ISC2 CC Practice Test 2 — 10 Questions

Question 1

Which two of the following are common methods to secure a virtual private network (VPN) connection? (Choose two.)

Accepted Answer

SSL/TLS. SSL/TLS is a common method to secure VPN connections, typically used in SSL VPNs. It operates at the transport layer (Layer 4) and provides encryption, authentication, and integrity for data transmitted over the internet, often using port 443 to bypass firewalls. This makes it ideal for remote access VPNs where clients connect via a web browser or a lightweight client.

Answer

ICMP

Answer

LDAP

Answer

SNMP

Question 2

A security team is investigating a potential ARP spoofing attack on the local network. Which two measures can effectively detect or prevent such attacks? (Choose two.)

Accepted Answer

Enable DHCP snooping with Dynamic ARP Inspection.. Option B is correct because Dynamic ARP Inspection (DAI), working together with DHCP snooping, validates ARP packets against the trusted DHCP snooping binding table and drops ARP packets with spoofed IP-to-MAC mappings, directly detecting and preventing ARP spoofing on the local network. Option E is correct because configuring static ARP entries on critical servers hard-codes the legitimate IP-to-MAC mappings, so the servers ignore forged ARP replies and cannot be poisoned by an attacker on the same segment. Option A does not belong because disabling ICMP redirects only prevents hosts from accepting forged redirect messages for routing manipulation, not ARP cache poisoning. Option C does not belong because MAC address filtering on switches only restricts which MAC addresses may appear on a port and does not validate ARP payloads, so an attacker can still spoof ARP for an allowed MAC. Option D does not belong because STP BPDU guard protects against rogue switches sending spanning-tree BPDUs and has no role in detecting or preventing ARP spoofing.

Answer

Disable ICMP redirects on hosts.

Answer

Use MAC address filtering on switches.

Answer

Enable STP BPDU guard.

Question 3

During a forensic investigation, it is crucial to preserve the original evidence. What is the first step the investigator should take when acquiring a hard drive?

Accepted Answer

Create a forensic image using a write blocker. Creating a bit-for-bit forensic image using a write blocker preserves the original evidence. Option D (calculate the hash) is done after imaging to verify integrity. Option A (booting the drive) would modify data and compromise the evidence. Option B (turning off the computer and removing the hard drive) may be necessary but is not the first step in acquisition; the first step is to create a forensic image with a write blocker.

Answer

Boot the drive to check for operating system errors

Answer

Turn off the computer and remove the hard drive

Answer

Calculate the hash of the original drive

Question 4

An organization requires that financial transactions over $10,000 be approved by two different managers. This is an example of which access control principle?

Accepted Answer

Separation of duties. Separation of duties ensures that no single individual has complete control over a critical action, reducing the risk of fraud or error.

Answer

Defense in depth

Answer

Need to know

Answer

Least privilege

Question 5

A network technician is setting up a remote access VPN for employees using IPsec. The company's firewall is configured to allow IPsec traffic. Employees report that they can successfully establish the VPN connection (tunnel appears up), but they cannot ping or access any internal resources (e.g., file servers). The firewall logs show that packets from the VPN client IP addresses are being dropped at the firewall interface. Which of the following is the MOST likely cause of this issue?

Accepted Answer

The firewall's access control list does not permit traffic from the VPN subnet to the internal network.. The VPN tunnel is established, meaning Phase 1 and Phase 2 of IPsec are complete and the client has a valid IP from the pool. However, packets from the VPN subnet are being dropped at the firewall interface, which indicates that the firewall's access control list (ACL) does not include a permit statement for traffic sourced from the VPN client subnet destined to the internal network. Without this ACL entry, the firewall will drop the traffic even though the tunnel is up.

Answer

The VPN client is not assigned a correct IP address from the pool.

Answer

The firewall's intrusion prevention system is blocking the traffic.

Answer

The IPsec encryption algorithm is incompatible between client and firewall.

Question 6

A company has a disaster recovery plan that includes a hot site. Which of the following is the PRIMARY advantage of a hot site over a cold site?

Accepted Answer

Faster recovery time. A hot site is a fully operational duplicate of the primary data center, complete with live servers, storage, networking, and synchronized data. This eliminates the need to procure and configure hardware after a disaster, enabling recovery in minutes or hours rather than days or weeks. The primary advantage is therefore a significantly faster recovery time objective (RTO) compared to a cold site, which has no pre-installed equipment.

Answer

Easier maintenance

Answer

Greater security

Answer

Lower cost

Question 7

A security professional is implementing a file integrity monitoring (FIM) system on critical servers. Which element of the CIA triad does this primarily address?

Accepted Answer

Integrity. File integrity monitoring detects unauthorized changes to files, ensuring data accuracy and completeness, which is the integrity element.

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 8

A company uses WPA2-Enterprise for wireless authentication. What additional security measure should be implemented to protect against rogue access points?

Accepted Answer

Deploy a wireless intrusion prevention system (WIPS). WPA2-Enterprise uses 802.1X for authentication, but it does not inherently detect or block rogue access points (APs) that mimic legitimate SSIDs. A Wireless Intrusion Prevention System (WIPS) continuously monitors the RF spectrum, identifies unauthorized APs by analyzing beacon frames, probe responses, and MAC addresses, and can automatically contain them by sending deauthentication frames or alerting administrators. This is the most direct and effective measure to protect against rogue APs in an enterprise WLAN.

Answer

Enable MAC filtering

Answer

Implement 802.1X with mutual authentication

Answer

Use WPA3

Question 9

Refer to the exhibit. A user with this policy tries to list objects in a container but gets an access denied error. What is the most likely reason?

Accepted Answer

The policy does not grant the List permission on the container.. The policy shown grants Read permission, which allows reading individual objects, but does not include the List permission on the container. Listing objects requires the List action on the container resource. Without this permission, the user receives an access denied error when attempting to list objects, even if they can read objects directly.

Answer

The resource identifier should include the container itself.

Answer

The effect should be Deny.

Answer

The user lacks encryption keys.

Question 10

During an incident, the IR team identifies that the root cause is a zero-day vulnerability. Which of the following is the best immediate action?

Accepted Answer

Implement compensating controls. When a zero-day vulnerability is the root cause, no vendor patch exists yet (option C is impossible). Rebuilding systems (option B) without addressing the vulnerability leaves them re-exposed. The best immediate action is to implement compensating controls—such as firewall rules, IDS/IPS signatures, or application-layer filtering—to mitigate the risk until a permanent fix is available. This aligns with incident response containment strategies that prioritize reducing impact while preserving forensic evidence.

Answer

Report to CERT/CC

Answer

Rebuild all affected systems

Answer

Apply a vendor patch