ISC2 CC Practice Test 19 — 15 Questions

Question 1

An organization stores backup data on a tape drive (onsite) and also replicates critical data to a cloud storage service. This practice best exemplifies which backup rule?

Accepted Answer

3-2-1 backup rule. The 3-2-1 backup rule states that you should keep at least three copies of data, on two different media types, with one copy stored offsite. Storing backups on tape (onsite) plus replicating critical data to cloud storage satisfies the multiple-media and offsite requirements, making it the textbook example of the rule.

Answer

Incremental backup strategy

Answer

Differential backup strategy

Answer

Full backup strategy

Question 2

A security operations center (SOC) analyst receives an alert for a high volume of outbound traffic from an internal server to a known malicious IP address. Which step should the analyst take next?

Accepted Answer

Isolate the server from the network.. Isolating the server from the network is the correct next step because it contains the potential compromise while preserving volatile evidence (memory, running processes) for forensic analysis. It stops further command-and-control communication and lateral movement without destroying the system state. Shutting down or blocking all outbound traffic are either too destructive or insufficient.

Answer

Shut down the server.

Answer

Disregard the alert as a false positive.

Answer

Block all outbound traffic from the server.

Question 3

During a disaster recovery exercise, the team discovers that the backup site does not have the latest security patches applied. Which of the following steps should be taken FIRST?

Accepted Answer

Document the finding and assess risk. The first step in any incident or exercise finding is to document the issue and assess the risk it poses. Patching the backup site immediately (Option A) could introduce instability or conflicts with the current exercise, while shutting it down (Option B) would disrupt the DR test. By documenting and assessing risk first, the team can determine the appropriate remediation priority based on the backup site's role and the criticality of the missing patches.

Answer

Patch the backup site immediately

Answer

Shut down the backup site

Answer

Continue the exercise and note the issue

Question 4

Which of the following best describes the principle of confidentiality in the CIA triad?

Accepted Answer

Preventing unauthorized disclosure of information. Confidentiality ensures that information is not disclosed to unauthorized individuals, entities, or processes. Encryption and access controls are primary mechanisms to enforce confidentiality.

Answer

Ensuring data is accurate and complete

Answer

Verifying the identity of users

Answer

Ensuring systems and data are accessible when needed

Question 5

Which TWO actions are appropriate during the identification phase of incident response?

Accepted Answer

Correlate alerts from multiple sources.. During the identification phase, responders must determine whether an incident has actually occurred and scope it, so option B (correlate alerts from multiple sources) is correct because aggregating and cross-referencing alerts from SIEM, IDS/IPS, EDR, and other telemetry helps confirm a true positive and establish the incident's extent. Option C (review system logs for anomalies) is also correct because examining OS, application, and security logs for unusual events, timestamps, and indicators of compromise is a core identification activity that validates and characterizes the suspected incident. Option A (post-mortem analysis) belongs to the lessons-learned/ post-incident phase after containment, eradication, and recovery. Option D (restore data from backups) is a recovery-phase action, and option E (disconnect affected systems from the network) is a containment action, both of which occur after the incident has been identified.

Answer

Conduct a post-mortem analysis.

Answer

Restore data from backups.

Answer

Disconnect affected systems from the network.

Question 6

Which access control principle ensures that a user is granted only the minimum permissions necessary to perform their job functions?

Accepted Answer

Least privilege. The principle of least privilege dictates that users are granted only the minimum permissions necessary to perform their job functions. This reduces the attack surface and limits potential damage from accidental or malicious actions.

Answer

Need-to-know

Answer

Defense in depth

Answer

Separation of duties

Question 7

A system administrator must grant a help desk technician the ability to reset user passwords but not change user roles. Which security principle does this scenario enforce?

Accepted Answer

Principle of least privilege. The principle of least privilege dictates that users are granted only the minimum access rights necessary to perform their job functions — no more. Granting the help desk technician the ability to reset passwords but explicitly withholding the ability to change user roles is a textbook application of this principle, because role changes are a more privileged operation than password resets. This limits the blast radius if the technician's account is compromised.

Answer

Accountability

Answer

Need-to-know

Answer

Non-repudiation

Question 8

Which TWO are true about a differential backup? (Select two.)

Accepted Answer

It requires a full backup to be restored first. Option B is correct because a differential backup only contains data changed since the last full backup, so restoring requires the original full backup plus the most recent differential backup to reconstruct the complete data set. Option C is correct because a differential backup by definition copies all files that have changed since the last full backup, not since the last incremental or differential backup. Option A is incorrect because copying files changed since the last backup of any type describes an incremental backup, not a differential backup. Option D is incorrect because resetting the archive bit is characteristic of incremental backups (and some full backups), whereas differential backups do not reset the archive bit, which is why each successive differential grows larger. Option E is incorrect because a differential restore requires two restore operations (full plus differential) and is therefore not faster than restoring a single full backup.

Answer

It copies files changed since the last backup of any type

Answer

It resets the archive bit on backed-up files

Answer

It is faster to restore than a full backup

Question 9

During a disaster, an organization activates a reciprocal agreement with another company. What is a primary risk associated with this strategy?

Accepted Answer

Potential lack of capacity when both parties need resources simultaneously. A reciprocal agreement (also called a mutual aid pact) is a disaster recovery arrangement where two organizations agree to share each other's computing facilities in an emergency. The primary risk is that a disaster may affect both parties simultaneously—such as a regional event like a hurricane, earthquake, or widespread power outage—leaving neither with spare capacity to host the other's workloads. Because neither party maintains dedicated redundant resources for the other, resource contention during a shared crisis is the defining weakness of this strategy.

Answer

Long RTO due to data transfer

Answer

High cost of maintaining duplicate infrastructure

Answer

Incompatible hardware

Question 10

An organization's BIA determines that the payroll system has a Maximum Tolerable Downtime (MTD) of 4 hours. The current recovery plan has an RTO of 2 hours and an RPO of 1 hour. What is the maximum Work Recovery Time (WRT) allowed to meet the MTD?

Accepted Answer

2 hours. The Maximum Tolerable Downtime (MTD) is the total time a business process can be unavailable. It is composed of the Recovery Time Objective (RTO) plus the Work Recovery Time (WRT). Given MTD = 4 hours and RTO = 2 hours, WRT = MTD - RTO = 2 hours.

Answer

3 hours

Answer

4 hours

Answer

1 hour

Question 11

An organization implements redundant servers and failover mechanisms to ensure continuous operation during a power outage. Which goal of the CIA triad is primarily being addressed?

Accepted Answer

Availability. Availability ensures that systems and data are accessible to authorized users when needed, and redundant servers with failover mechanisms directly support continuous operation during outages. This is the core goal of the availability pillar of the CIA triad. Confidentiality and integrity address different concerns, so availability is the correct answer.

Answer

Confidentiality

Answer

Integrity

Answer

Authentication

Question 12

A security team implements a policy that requires all access to sensitive data to be logged and audited. Which principle is being enforced?

Accepted Answer

Accountability. Accountability is enforced because logging and auditing create a traceable record of who accessed sensitive data and what actions they performed. This allows security teams to hold individuals responsible for their actions by correlating log entries with specific user identities, typically via authentication systems like LDAP or SAML. The policy directly supports the principle that users must be answerable for their access to protected resources.

Answer

Non-repudiation

Answer

Integrity

Answer

Least privilege

Question 13

A security policy requires that data classified as 'Confidential' must be encrypted both at rest and in transit. Which TWO of the following are likely data handling requirements for 'Confidential' data? (Select TWO)

Accepted Answer

Access to data must be restricted to authorized personnel only. Option B is correct because Confidential data must be restricted to authorized personnel only, which is a fundamental access control requirement for this classification level. Option D is correct because the scenario explicitly states that Confidential data must be encrypted at rest, and encryption when stored on servers directly satisfies that at-rest requirement. Options A, C, and E do not belong: posting Confidential data on a public website would expose it to unauthorized disclosure, sharing it with any vendor without a contract violates third-party handling and confidentiality obligations, and deleting it after 30 days regardless of business need is an arbitrary retention rule not implied by the encryption or access-control requirements.

Answer

Data may be posted on the public website

Answer

Data can be shared with any vendor without a contract

Answer

Data must be deleted after 30 days regardless of business need

Question 14

Refer to the exhibit. An IDS generates this alert for traffic from an internal server (10.1.1.50) to an external IP on port 443. The security team investigates and finds that the server is a web application that normally uses TLS 1.2. What does this alert most likely indicate?

Accepted Answer

An attacker is performing an SSL stripping attack, downgrading the connection to SSLv3. The alert indicates a downgrade from TLS 1.2 to SSLv3, which is the hallmark of an SSL stripping attack. In this attack, an adversary intercepts the client's TLS handshake request and forces the connection to use the weaker SSLv3 protocol, often by manipulating the ClientHello message to remove TLS options. This allows the attacker to exploit known vulnerabilities in SSLv3, such as POODLE, to decrypt or hijack the session.

Answer

The server is experiencing a buffer overflow attack

Answer

The server's certificate has expired and the client is falling back to SSLv3

Answer

The server has been misconfigured to use SSLv3 instead of TLS

Question 15

Which THREE of the following are examples of implementing defense in depth? (Select THREE.)

Accepted Answer

Using a firewall to filter traffic. Defense in depth layers multiple independent security controls so that no single failure exposes the whole system. Option B is correct because a firewall filtering traffic enforces a network-perimeter control, inspecting and permitting or denying packets based on rules, which is a classic layered defense. Option D is correct because access control lists (ACLs) restrict which subjects can reach specific resources, adding an authorization layer that limits lateral movement even if perimeter defenses are bypassed. Option E is correct because encrypting data at rest protects confidentiality of stored data, so a breach of storage media or a database does not automatically expose plaintext, forming a data-level control. Option A does not belong: single sign-on centralizes authentication and can actually concentrate risk rather than add a defensive layer. Option C does not belong: allowing all traffic by default is a permissive posture that removes filtering, the opposite of defense in depth.

Answer

Enabling single sign-on for all applications

Answer

Allowing all traffic by default