ISC2 CC Practice Exam 2 — 20 Questions

Question 1

You are the IT security officer for a hospital that handles protected health information (PHI). The hospital uses an electronic health record (EHR) system. You receive a report that a nurse accessed the medical records of a celebrity patient without a legitimate medical reason. The access was logged. The hospital policy requires all employees to access only the minimum necessary information for their job duties. The nurse claims they were just curious. This is a violation of which security principle, and what is the best course of action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Least privilege; revoke the nurse's access to the EHR system and initiate disciplinary proceedings. The nurse's unauthorized access violates the principle of least privilege, which requires that users be granted only the minimum access necessary for their job duties. The best course of action is to revoke the nurse's access to the EHR system and initiate disciplinary proceedings, as outlined in option C. Option A (encryption) does not address unauthorized access by authorized users. Option B (disabling access for all nurses) is excessive and would disrupt operations. Option D (sending a warning) is insufficient given the severity of the violation.

Answer

Confidentiality; encrypt all patient records

Answer

Accountability; disable access for all nurses to the EHR

Answer

Least privilege; send a warning to the nurse

Question 2

A company wants to segment its network into separate broadcast domains to improve performance and security. Which device should be used to achieve this?

Accepted Answer

Router. A router is the correct device because it operates at Layer 3 (Network layer) of the OSI model and can segment a network into separate broadcast domains by forwarding packets based on IP addresses while blocking broadcast traffic (e.g., ARP requests) from crossing between interfaces. This isolation improves performance by reducing broadcast overhead and enhances security by controlling traffic flow between segments.

Answer

Switch

Answer

Hub

Answer

Repeater

Question 3

A security team is investigating a potential ARP spoofing attack on the local network. Which two measures can effectively detect or prevent such attacks? (Choose two.)

Accepted Answer

Enable DHCP snooping with Dynamic ARP Inspection.. Dynamic ARP Inspection (DAI) uses DHCP snooping binding tables to validate ARP packets, ensuring that only legitimate IP-to-MAC address mappings are accepted. This directly prevents ARP spoofing by dropping malicious ARP replies that do not match the binding table. Configuring static ARP entries on critical servers hardcodes the IP-to-MAC mapping, so the server will ignore any spoofed ARP replies attempting to redirect traffic.

Answer

Disable ICMP redirects on hosts.

Answer

Use MAC address filtering on switches.

Answer

Enable STP BPDU guard.

Question 4

Drag and drop the steps for the incident response process according to NIST into the correct order.

Accepted Answer

Preparation, then Detection and Analysis, then Containment/Eradication/Recovery, then Post-Incident Activity. NIST incident response lifecycle: Preparation, Detection and Analysis, Containment/Eradication/Recovery, Post-Incident Activity.

Answer

Detection and Analysis, then Containment/Eradication/Recovery, then Preparation, then Post-Incident Activity

Answer

Preparation, then Containment/Eradication/Recovery, then Detection and Analysis, then Post-Incident Activity

Answer

Post-Incident Activity, then Preparation, then Detection and Analysis, then Containment/Eradication/Recovery

Question 5

Which THREE of the following are essential components of an incident response plan? (Select THREE.)

Accepted Answer

Preparation. Preparation is the foundational phase of the NIST SP 800-61 incident response lifecycle, ensuring policies, tools, and trained personnel are in place before an incident occurs. Without preparation, subsequent phases like detection and containment cannot be executed effectively. The CC exam emphasizes that preparation includes establishing communication plans, acquiring forensic tools, and conducting tabletop exercises.

Answer

Business continuity plan activation

Answer

Vulnerability scanning schedule

Question 6

During a disaster recovery test, the IT team discovers that restoring all data from full backups takes 48 hours, exceeding the RTO. Which backup strategy would reduce restore time while maintaining a similar backup window?

Accepted Answer

Using differential backups instead of incremental. A differential backup backs up all changes since the last full backup, so restore requires only the full backup and the latest differential, reducing restore time compared to incremental.

Answer

Increasing backup frequency to hourly

Answer

Implementing the 3-2-1 backup rule

Answer

Switching from full to incremental backups only

Question 7

Which TWO of the following are examples of sensitive PII? (Select TWO.)

Accepted Answer

Medical records. Sensitive PII includes medical records and biometrics. Name and email are general PII; IP address is not PII alone.

Answer

Name

Answer

Email address

Answer

IP address

Question 8

Which recovery site strategy provides the shortest recovery time objective (RTO), typically measured in hours, by maintaining a fully mirrored environment that can be activated immediately?

Accepted Answer

Hot site. A hot site is fully configured with hardware, software, and real-time data replication, enabling recovery within hours.

Answer

Warm site

Answer

Reciprocal agreement

Answer

Cold site

Question 9

What is the primary purpose of a digital signature?

Accepted Answer

Provide data integrity and non-repudiation. Digital signatures provide integrity (detect tampering) and non-repudiation (proof of origin).

Answer

Ensure data confidentiality

Answer

Control access to resources

Answer

Encrypt data at rest

Question 10

A critical vulnerability is discovered in a widely used VPN appliance that is actively being exploited in the wild. The vendor has released an emergency patch. However, the organization's patch management policy requires testing in a staging environment before production deployment. What should the security team do?

Accepted Answer

Deploy the patch immediately without testing to all devices. For critical vulnerabilities under active exploitation, emergency patching should bypass normal testing to reduce risk, but compensating controls can be applied if immediate patching is not possible.

Answer

Apply a workaround from the vendor and skip patching

Answer

Wait for the scheduled patch cycle to test thoroughly

Answer

Disconnect the VPN appliance until the next patch cycle

Question 11

A company's SIEM solution aggregates logs from various sources and generates an alert when multiple failed logins occur within a short timeframe. Which log source is most likely to provide the data for this alert?

Accepted Answer

Authentication logs. Authentication logs record login attempts, including failures, and are the primary source for detecting brute-force attacks.

Answer

System logs

Answer

Firewall logs

Answer

Application logs

Question 12

During a forensic investigation, it is crucial to preserve the original evidence. What is the first step the investigator should take when acquiring a hard drive?

Accepted Answer

Create a forensic image using a write blocker. Creating a bit-for-bit forensic image using a write blocker preserves the original evidence. Option D (calculate the hash) is done after imaging to verify integrity. Option A (booting the drive) would modify data and compromise the evidence. Option B (turning off the computer and removing the hard drive) may be necessary but is not the first step in acquisition; the first step is to create a forensic image with a write blocker.

Answer

Boot the drive to check for operating system errors

Answer

Turn off the computer and remove the hard drive

Answer

Calculate the hash of the original drive

Question 13

A company's security policy requires that all sensitive data be encrypted both at rest and in transit. This is an example of applying which security principle?

Accepted Answer

Defense in depth

Answer

Separation of duties

Answer

Need to know

Answer

Least privilege

Question 14

An organization's BIA determines that the payroll system has a Maximum Tolerable Downtime (MTD) of 4 hours. The current recovery plan has an RTO of 2 hours and an RPO of 1 hour. What is the maximum Work Recovery Time (WRT) allowed to meet the MTD?

Accepted Answer

2 hours. MTD = RTO + WRT. Given MTD=4, RTO=2, so WRT ≤ 2 hours.

Answer

3 hours

Answer

4 hours

Answer

1 hour

Question 15

During an incident, the incident response team discovers that an attacker has exfiltrated sensitive customer data. According to incident response best practices, whose approval is REQUIRED before contacting law enforcement?

Accepted Answer

Legal counsel. Legal counsel approval is required before contacting law enforcement because they ensure that the disclosure complies with data privacy laws (e.g., GDPR, CCPA) and does not violate chain-of-custody requirements or expose the organization to liability. The incident response team must coordinate with legal to determine the appropriate timing and scope of law enforcement involvement, as premature contact can compromise ongoing forensic investigations or breach legal agreements.

Answer

CISO

Answer

CEO

Answer

Public relations

Question 16

A multinational corporation has a policy that all sensitive emails must be digitally signed and encrypted. However, during a recent internal audit, it was discovered that many employees were not using digital signatures because the process was cumbersome. As a result, the company could not prove that certain emails were actually sent by the claimed sender. The security team needs to improve compliance without sacrificing security. Which of the following is the best approach?

Accepted Answer

Integrate the signing process seamlessly into the email client to reduce friction.. Integrating the signing process seamlessly into the email client reduces friction and increases compliance while maintaining security. Training alone does not address the cumbersome process, reducing encryption strength weakens security, and allowing personal certificates complicates management.

Answer

Implement a mandatory training program emphasizing the importance of digital signatures.

Answer

Reduce the encryption strength to speed up the signing process.

Answer

Allow employees to use personal signing certificates.

Question 17

A small business has a single server that hosts critical applications. The server's hard drive fails, and the most recent backup is 3 days old. The backup is stored on an external drive that is kept in the same room as the server. The server is also the domain controller and file server. After replacing the drive and restoring from backup, the IT administrator discovers that some user files are missing because they were created after the backup. The administrator needs to minimize data loss in the future. Which of the following should be implemented?

Accepted Answer

Use a cloud-based backup solution.. A cloud-based backup solution automatically stores backups offsite, ensuring that even if the local site is compromised or the backup drive fails, recent data is recoverable. This minimizes data loss by enabling more frequent backups (e.g., hourly or continuous) without relying on manual intervention or physical media rotation, directly addressing the 3-day gap in the scenario.

Answer

Perform daily backups and store them offsite.

Answer

Implement RAID 1 for disk redundancy.

Answer

Enable versioning on the file server.

Question 18

In a directory service like Active Directory, which component is used to organize users, groups, and computers into a hierarchical structure for applying policies?

Accepted Answer

Organizational Units (OUs). Organizational Units (OUs) are containers in Active Directory that allow hierarchical organization and Group Policy application.

Answer

Group Policy Objects (GPOs)

Answer

Domain controllers

Answer

LDAP

Question 19

A company experiences a data breach where customer PII was exfiltrated. The incident response team contains the breach and restores systems. Which step in the risk management process should the company prioritize next to prevent recurrence?

Accepted Answer

Risk mitigation. After an incident, risk treatment involves implementing controls to reduce risk. Risk identification already occurred.

Answer

Risk communication

Answer

Risk assessment

Answer

Risk identification

Question 20

Based on the exhibit, what is the most likely result of the client's HTTP request?

Accepted Answer

The HTTP request is blocked, but other traffic from the client is allowed.. The exhibit shows an extended ACL applied inbound on the client's interface that denies TCP traffic from the client to the server on port 80 (HTTP) but permits all other IP traffic. Therefore, the HTTP request is blocked, but any other traffic from the client (e.g., DNS, ICMP) is allowed. Option D correctly states that the HTTP request is blocked but other traffic is allowed.

Answer

The HTTP request is permitted because the ACL is applied to the wrong interface.

Answer

The HTTP request is permitted because the ACL only blocks traffic from the router's own IP.

Answer

The HTTP request is blocked, and all other traffic from the client is also blocked.