ISC2 CC Practice Test 2 — 10 Questions

Question 1

An organization encrypts all sensitive data at rest and in transit. Which principle of the CIA triad is primarily being addressed?

Accepted Answer

Confidentiality. Encryption protects data from unauthorized disclosure, directly supporting confidentiality.

Answer

Availability

Answer

Non-repudiation

Answer

Integrity

Question 2

A company requires all visitors to sign in, wear a visible badge, and be escorted while on premises. This is an example of:

Accepted Answer

Visitor management. Visitor management procedures help control physical access of non-employees.

Answer

Separation of duties

Answer

Logical access control

Answer

Defense in depth

Question 3

A security administrator is implementing controls to protect a server room. Which TWO physical security layers should be included as part of a defense-in-depth strategy? (Select TWO.)

Accepted Answer

Fencing around the building. Defense in depth uses multiple layers. External perimeter (fencing) and internal server room (biometric) are distinct layers.

Answer

Complex password policy

Answer

Cable locks on individual servers

Answer

Session timeout settings

Question 4

A company is implementing a data loss prevention (DLP) solution. Which strategy BEST balances security and productivity when monitoring outgoing email?

Accepted Answer

Alert on policy violations and allow user to override with manager approval. It balances security and productivity by alerting on policy violations while allowing users to override the block with manager approval. This approach ensures that legitimate business communications are not disrupted, while still enforcing DLP policies through a secondary review process. In a DLP solution, this is often implemented via a 'justify and override' workflow, where the user must provide a reason and receive approval from a manager before the email is sent.

Answer

Log all emails without any alerts

Answer

Block all emails containing keywords like 'confidential'

Answer

Encrypt all outgoing emails automatically

Question 5

An organization implements a policy where no single employee can approve a financial transaction over $10,000; a second manager must also approve. This is an example of which access control principle?

Accepted Answer

Separation of duties. Separation of duties requires multiple people to complete a critical task, reducing fraud risk.

Answer

Least privilege

Answer

Need-to-know

Answer

Defense in depth

Question 6

Which THREE are differences between a hot site and a cold site? (Select three.)

Accepted Answer

Hot site is more expensive to maintain. A hot site is a fully operational, mirrored environment with real-time data synchronization, pre-installed hardware, and active network connectivity, making it significantly more expensive to maintain due to ongoing costs for power, cooling, bandwidth, and dedicated staff. In contrast, a cold site is a bare facility with no active infrastructure, requiring manual setup and provisioning before recovery can begin. The higher cost of a hot site is justified by its near-zero Recovery Time Objective (RTO), whereas a cold site's lower cost reflects its much longer RTO.

Answer

Cold site has pre-installed software and applications

Answer

Both have the same recovery time objective (RTO)

Question 7

Which TWO of the following are best practices for password management in a corporate environment?

Accepted Answer

Enforce password complexity requirements.. Enforcing password complexity requirements (e.g., minimum length, character types) reduces the risk of brute-force and dictionary attacks by increasing the effective keyspace. Option E is correct because multi-factor authentication (MFA) adds an additional layer of security beyond the password, mitigating credential theft or reuse. Together, they form a defense-in-depth approach to authentication security.

Answer

Store passwords in plaintext in a shared document.

Answer

Prohibit password changes more than once per year.

Answer

Share passwords among team members for shared accounts.

Question 8

A company's security policy requires that all sensitive data be encrypted at rest and in transit. However, a recent breach occurred because an attacker exploited a misconfigured web server that exposed a database directly. Which principle was most lacking in this scenario?

Accepted Answer

Defense in depth. Efense in depth because it emphasizes multiple layers of security controls. A single misconfiguration exposed the database directly, indicating a lack of layered defenses. The other principles: Least privilege (A) is about limiting permissions, Fail securely (B) is about ensuring secure states on failure, and Complete mediation (C) is about checking every access. Therefore, defense in depth was most lacking.

Answer

Least privilege

Answer

Fail securely

Answer

Complete mediation

Question 9

A security operations center (SOC) analyst is investigating a potential data exfiltration. Which two indicators are most likely signs of data exfiltration?

Accepted Answer

Unexpected large file transfers via FTP. Unexpected large file transfers via FTP are a classic indicator of data exfiltration because FTP is a clear-text protocol often used to move bulk data out of a network. A sudden spike in outbound FTP traffic, especially to an unfamiliar external IP, suggests an attacker is compressing and uploading stolen files. This behavior directly matches the exfiltration phase of the Cyber Kill Chain.

Answer

Large number of failed login attempts

Answer

Frequent DNS queries to known malicious domains

Answer

Multiple antivirus alerts

Question 10

A company has implemented a role-based access control (RBAC) system. A new employee in the finance department is granted the 'Finance User' role, which allows them to view invoices but not create payments. However, after a system upgrade, it is discovered that the 'Finance User' role now includes the ability to create payments due to a misconfiguration. The employee did not request this additional privilege and has not exploited it. The security team is notified. Which principle has been violated, and what is the most appropriate immediate action?

Accepted Answer

Least privilege; correct the role permissions to only what is necessary. Correct: Least privilege is violated because the employee has more permissions than needed. The immediate action is to correct the role permissions to only what is necessary (option D). Option A is wrong because separation of duties is not the violated principle; the employee did not misuse the privilege, so disabling the account is too extreme. Option B is wrong because accountability is not the issue, and removing the role from all employees is overly broad. Option C is wrong because revoking the employee's access permanently is too harsh and does not address the root cause.

Answer

Separation of duties; disable the employee's account until an investigation is complete

Answer

Accountability; remove the 'Finance User' role from all employees

Answer

Least privilege; revoke the employee's access permanently