ISC2 CC Practice Test 20 — 15 Questions

Question 1

Which security control is most effective in preventing unauthorized physical access to a data center?

Accepted Answer

Mantraps.. Mantraps create a double-door system that prevents tailgating, making them highly effective. Other controls like video surveillance and guards are deterrents but less direct at preventing unauthorized entry.

Answer

Video surveillance.

Answer

Biometric door locks.

Answer

Security guards.

Question 2

After a ransomware attack, the company wants to ensure that critical data can be restored. Which principle is being addressed?

Accepted Answer

Availability. Availability ensures that data and systems are accessible to authorized users when needed. Ransomware typically encrypts data and holds it hostage, directly preventing access — so restoring critical data after an attack is fundamentally about restoring availability. Integrity concerns unauthorized modification, and confidentiality concerns unauthorized disclosure, neither of which is the primary concern when recovering from ransomware.

Answer

Integrity

Answer

Confidentiality

Answer

Non-repudiation

Question 3

A system administrator accidentally grants a user full administrative rights instead of read-only. Which control would best detect this error?

Accepted Answer

Detective control. A detective control is designed to identify and log events after they occur, such as reviewing access logs, SIEM alerts, or periodic access reviews that would reveal the accidental over-provisioning of admin rights. Because the error has already happened, only a detective control can surface it. Preventive controls would have stopped the grant, and corrective controls would fix it after detection.

Answer

Preventive control

Answer

Deterrent control

Answer

Corrective control

Question 4

Which TWO of the following are types of security controls used in defense in depth? (Select TWO.)

Accepted Answer

Detective controls. Detective controls are a core type of security control in a defense-in-depth strategy, designed to identify and alert on ongoing or past security incidents. Examples include intrusion detection systems (IDS) like Snort or Suricata, which analyze network traffic for malicious patterns, and security information and event management (SIEM) systems that correlate logs to detect anomalies. These controls provide visibility into the security posture, enabling timely response to threats that bypass preventive measures.

Answer

Corrective controls

Answer

Compensating controls

Answer

Administrative controls

Question 5

In a typical Windows environment, which access control model is used for managing file permissions?

Accepted Answer

Discretionary Access Control (DAC). In a typical Windows environment, file permissions are managed using Discretionary Access Control (DAC), where the owner of a resource (e.g., a file or folder) can grant or deny access to other users or groups. This is implemented via NTFS permissions, which allow the owner to set ACLs (Access Control Lists) on objects, giving them discretion over who can read, write, or execute. Windows does not enforce a system-wide policy beyond the owner's decisions, which is the hallmark of DAC.

Answer

Role-Based Access Control (RBAC)

Answer

Mandatory Access Control (MAC)

Answer

Attribute-Based Access Control (ABAC)

Question 6

An organization is implementing a new system that processes financial transactions. To reduce the risk of fraud, they ensure that no single individual can both initiate and approve a transaction. Which security principle is this?

Accepted Answer

Separation of duties. Separation of duties (SoD) is the security principle that prevents a single individual from having conflicting responsibilities, such as both initiating and approving a financial transaction. By splitting these tasks across different roles, the organization reduces the risk of fraud or error because collusion would be required to bypass controls. This is a core internal control mechanism in financial systems and aligns with the principle of dual control.

Answer

Need to know

Answer

Accountability

Answer

Least privilege

Question 7

What is the primary difference between an IDS and an IPS?

Accepted Answer

IDS only alerts, IPS can block traffic. The primary difference is that an IDS (Intrusion Detection System) is passive and only alerts on suspicious activity, while an IPS (Intrusion Prevention System) is inline and can actively block or drop malicious traffic. Both can monitor network or host activity, but the key distinction is the response capability: detect vs. detect and prevent.

Answer

IDS is faster than IPS

Answer

IDS is hardware, IPS is software

Answer

IDS monitors only hosts, IPS monitors network

Question 8

An organization is implementing a new logging policy. Which type of data should be excluded from logs to comply with privacy regulations?

Accepted Answer

Personal identifiable information (PII). Personal Identifiable Information (PII) should be excluded from logs to comply with privacy regulations like GDPR. Options A, B, and D are typically safe to log and important for security monitoring.

Answer

System performance metrics

Answer

User authentication attempts

Answer

Network traffic patterns

Question 9

A software developer is designing a web application that will store user credentials. What is the most secure method for storing passwords?

Accepted Answer

Hash passwords using a strong algorithm like bcrypt with a unique salt. Hashing with salt protects passwords even if database is compromised. Encryption is reversible, so less secure for passwords.

Answer

Use a tokenization service to replace passwords with tokens

Answer

Encrypt passwords using AES-256 and store the key separately

Answer

Store passwords in a secure database with access controls

Question 10

A security analyst receives an alert from the SIEM indicating a potential data exfiltration event. The alert shows a large volume of data being transferred to an external IP address during non-business hours. What is the MOST appropriate immediate action?

Accepted Answer

Verify whether the transfer is authorized.. The correct answer is to verify whether the transfer is authorized. In incident response, the first step is to validate the alert to determine if it represents a true positive or a false positive. Large data transfers during non-business hours could be legitimate activities such as backups, software updates, or authorized data sharing. Confirming authorization prevents unnecessary escalation and ensures that response efforts are focused on actual threats. This aligns with the 'Identification' phase of incident response, where the goal is to gather evidence and confirm the incident before taking disruptive actions.

Answer

Call the employee who owns the server.

Answer

Disconnect the affected server from the network.

Answer

Run an antivirus scan on the server.

Question 11

A company wants to allow remote employees to securely access internal resources over the internet. Which technology is most appropriate?

Accepted Answer

VPN. A VPN (Virtual Private Network) creates an encrypted tunnel over the internet, typically using protocols like IPsec or TLS, to securely connect remote users to internal resources. This ensures confidentiality, integrity, and authentication of data in transit, making it the standard solution for remote access security.

Answer

NAT

Answer

VLAN

Answer

DMZ

Question 12

A security team deploys a passive device that monitors network traffic and generates alerts when it detects suspicious patterns, but it does not take any action. This device is best described as a:

Accepted Answer

Intrusion Detection System (IDS). An Intrusion Detection System (IDS) passively monitors network traffic, analyzes it against signatures or behavioral baselines, and generates alerts on suspicious activity without blocking or modifying traffic. The question explicitly states the device 'does not take any action,' which is the defining characteristic of an IDS versus an IPS. A WAF and stateful firewall both enforce policy and can block traffic, so they do not fit the passive description.

Answer

Web Application Firewall (WAF)

Answer

Intrusion Prevention System (IPS)

Answer

Stateful firewall

Question 13

A security team is conducting a risk assessment for a new cloud application. They have identified a vulnerability in the application that could allow unauthorized access to sensitive data. Which three risk management strategies should they consider? (Choose three.)

Accepted Answer

Risk avoidance. Risk avoidance (B) is correct because it involves eliminating the vulnerability by not deploying the cloud application or removing the vulnerable component entirely, thus preventing any possibility of unauthorized access to sensitive data. This strategy is appropriate when the risk exceeds the organization's risk appetite and cannot be effectively reduced through other means.

Answer

Risk ignorance

Answer

Risk acceptance

Question 14

An organization requires that two different administrators approve changes to firewall rules. This is an example of which security principle?

Accepted Answer

Separation of duties. Requiring two different administrators to approve firewall changes is separation of duties, which splits a critical task among multiple people so no single individual can complete it alone. This prevents fraud, error, and unilateral abuse of privileged access.

Answer

Least privilege

Answer

Defense in depth

Answer

Need-to-know

Question 15

Which firewall type operates at Layer 3 and Layer 4, making decisions based solely on source/destination IP and port numbers?

Accepted Answer

Packet filtering firewall. A packet filtering firewall operates at Layer 3 (Network) and Layer 4 (Transport) of the OSI model, examining source and destination IP addresses and port numbers to allow or deny traffic. It is stateless and makes decisions per packet based on configured ACLs.

Answer

Stateful inspection firewall

Answer

Next-generation firewall (NGFW)

Answer

Application proxy firewall