ISC2 CC Practice Test 20 — 15 Questions

Question 1

A user reports that they are unable to access a shared network drive that they previously could access. The administrator checks permissions and finds the user's account is still a member of the correct group. What should the administrator check next?

Accepted Answer

Check for explicit deny permissions on the folder. Even if group membership is correct, explicit deny permissions can override allow permissions. Checking for deny entries on the folder is a logical next step. User lockout would affect all accesses. Effective permissions would show the combined result but checking for denies is more direct. Password expiration is a login issue, not a permissions issue.

Answer

Group membership inheritance

Answer

User account lockout status

Answer

Effective permissions

Question 2

An organization is implementing a new access control system based on the principle of least privilege. Which two of the following practices are essential to achieving least privilege? (Select TWO)

Accepted Answer

Review permissions regularly. Option A is correct because regular permission reviews are essential to maintaining least privilege over time. Users' roles and responsibilities change, and without periodic audits, excessive permissions can accumulate, violating the principle. This aligns with the NIST SP 800-53 AC-6 control for least privilege, which requires organizations to review user access rights at defined intervals.

Answer

Grant users default full access and restrict later

Answer

Enable accounts after use

Answer

Provide write access to all users

Question 3

A small business uses a cloud file storage service that allows sharing links. An employee mistakenly shared a folder containing customer data via a public link. The business wants to prevent such incidents in the future without blocking legitimate sharing. Which access control method should they implement?

Accepted Answer

Require authentication for shared links. Requiring authentication for shared links ensures that only intended recipients can access the data, reducing the risk of public exposure. Disabling all sharing is too restrictive. Watermarking and encryption do not prevent sharing to unauthorized users.

Answer

Disable all external sharing

Answer

Use watermarking on documents

Answer

Encrypt all files

Question 4

Which component of the AAA framework determines what resources an authenticated user can access?

Accepted Answer

Authorization. Authorization is the component of the AAA (Authentication, Authorization, Accounting) framework that determines what resources an authenticated user can access. After authentication verifies the user's identity, authorization enforces policies—such as those defined in a local database or via RADIUS/TACACS+—to permit or deny access to specific network services, commands, or resources.

Answer

Auditing

Answer

Accounting

Answer

Authentication

Question 5

After a security audit, a company discovers that several employees have access to financial systems that are not required for their job roles. Which access control model would best prevent this issue in the future?

Accepted Answer

Role-based access control (RBAC). Role-based access control (RBAC) assigns permissions based on job roles, ensuring users have only the access needed for their role. DAC allows owners to give access arbitrarily, which could lead to over-provisioning. MAC is rigid and label-based, not ideal for dynamic business needs. ABAC is flexible but more complex to implement than RBAC for this scenario.

Answer

Mandatory access control (MAC)

Answer

Discretionary access control (DAC)

Answer

Attribute-based access control (ABAC)

Question 6

A company uses a mandatory access control (MAC) system where all files are labeled 'Confidential', 'Secret', or 'Top Secret'. A user with 'Secret' clearance tries to read a 'Top Secret' file. What is the outcome?

Accepted Answer

Access is denied because the user's clearance is lower than the file's classification. In a mandatory access control (MAC) system, access decisions are based on comparing the user's clearance level with the file's classification label. Since the user has 'Secret' clearance and the file is labeled 'Top Secret', the clearance is lower than the file's classification, so access is denied. This follows the fundamental MAC principle of 'no read up' (simple security property) in Bell-LaPadula model.

Answer

Access is allowed because the user has a legitimate need

Answer

Access is denied only if the file also has a category

Answer

Access is allowed because the user has Secret clearance

Question 7

During a disaster recovery exercise, the team discovers that the backup site does not have the latest security patches applied. Which of the following steps should be taken FIRST?

Accepted Answer

Document the finding and assess risk. The first step in any incident or exercise finding is to document the issue and assess the risk it poses. Patching the backup site immediately (Option A) could introduce instability or conflicts with the current exercise, while shutting it down (Option B) would disrupt the DR test. By documenting and assessing risk first, the team can determine the appropriate remediation priority based on the backup site's role and the criticality of the missing patches.

Answer

Patch the backup site immediately

Answer

Shut down the backup site

Answer

Continue the exercise and note the issue

Question 8

Refer to the exhibit. A DBA is investigating a replication issue. What should be the FIRST action?

Accepted Answer

Verify data integrity on primary. Checksum mismatch indicates data corruption on one side. The first step is to verify data integrity on the primary to determine which copy is correct.

Answer

Restore table from backup

Answer

Reseed replication

Answer

Fail over to standby

Question 9

Which TWO are best practices for managing backup media?

Accepted Answer

Encrypt backup data. Encrypting backup data ensures confidentiality and integrity during transit and at rest, protecting against unauthorized access if media is lost or stolen. This is a critical best practice for compliance with standards like GDPR or HIPAA, and aligns with the principle of defense in depth. Without encryption, backup media becomes a significant security vulnerability.

Answer

Keep backups on the same server for easy access

Answer

Use only tape media

Answer

Test backups annually

Question 10

During a disaster recovery test, backup tapes fail to restore data due to format incompatibility. Which element of the Business Continuity Plan should be updated?

Accepted Answer

Plan testing and maintenance. The failure of backup tapes to restore data due to format incompatibility indicates that the recovery procedures and tools were not validated during testing. This directly points to a deficiency in the 'Plan testing and maintenance' element, which ensures that backup media formats, restoration tools, and procedures are regularly verified and updated to match the current production environment. Without scheduled testing and maintenance, format drift between backup software versions or hardware changes can render tapes unreadable.

Answer

Business Impact Analysis (BIA)

Answer

Recovery strategies

Answer

Communication plan

Question 11

Refer to the exhibit. Based on the report, which improvement is most appropriate?

Accepted Answer

Switch to synchronous replication. Asynchronous replication can lead to data inconsistency during failover. Switching to synchronous replication ensures data consistency at the cost of some latency.

Answer

Increase backup frequency

Answer

Reduce network failover time

Answer

Implement load balancing

Question 12

During an incident, an organization needs to preserve volatile data. Which of the following should be collected FIRST?

Accepted Answer

Memory contents. Volatile data is lost when the system loses power. Memory content is the most volatile.

Answer

Backup tapes

Answer

Hard drive contents

Answer

Network logs

Question 13

An organization's backup strategy includes daily full backups. However, recovery tests show that restoring from tape takes 6 hours longer than expected. What is the most likely cause?

Accepted Answer

Improperly documented recovery procedures. Improperly documented recovery procedures can lead to incorrect steps or delays during restoration, which is a common cause of extended recovery times.

Answer

Tape drive failure

Answer

Inadequate storage capacity

Answer

Insufficient bandwidth

Question 14

Refer to the exhibit. A security analyst observes repeated outbound connection attempts from an internal server to external IP addresses on a non-standard port. What is the MOST likely interpretation?

Accepted Answer

The server is infected with malware. Repeated outbound connection attempts from an internal server to external IP addresses on a non-standard port are a classic indicator of malware command-and-control (C2) activity. Malware often uses non-standard ports to evade detection and establish outbound communication with an external attacker. This behavior is not typical of legitimate services, which use well-known ports and protocols.

Answer

The server is being used for remote desktop access

Answer

The server is performing a port scan

Answer

The server is a legitimate mail server

Question 15

A small business with limited budget wants to ensure critical business functions can resume within 24 hours of a disaster. Their data changes infrequently. Which recovery solution is MOST cost-effective?

Accepted Answer

Cloud backup with instant restore. Cloud backup with instant restore (Option B) is the most cost-effective solution because the business has a limited budget, data changes infrequently, and the RTO is 24 hours. Cloud backup eliminates the need for maintaining physical infrastructure, and instant restore from cloud snapshots can meet the 24-hour RTO without the high costs of a warm or hot site.

Answer

Warm site with daily backups

Answer

Cold site with monthly backups

Answer

Hot site with real-time replication