ISC2 CC Practice Exam 3 — 20 Questions

Question 1

A company implements a new firewall and intrusion detection system to reduce the risk of network breaches. This is an example of:

Accepted Answer

Risk mitigation. Risk mitigation reduces the likelihood or impact of a threat by implementing controls; a firewall and IDS are detective and preventive controls that lower the probability and severity of a network breach without eliminating the risk entirely. This is the textbook definition of mitigation — the risk still exists but is reduced to an acceptable level.

Answer

Risk avoidance

Answer

Risk acceptance

Answer

Risk transfer

Question 2

An organization wants to implement network segmentation to improve security. Which three methods are commonly used for network segmentation? (Select THREE.)

Accepted Answer

Subnetting. Subnetting (A) is correct because dividing a larger IP network into smaller logical subnets using CIDR and subnet masks creates distinct broadcast domains and limits lateral movement between segments. DMZs (B) are correct because a demilitarized zone places internet-facing services such as web, mail, or DNS servers in a separate screened segment, isolating them from the internal trusted network. VLANs (D) are correct because IEEE 802.1Q VLANs logically segment a switched network at Layer 2, allowing departments or device groups to be separated without physical rewiring and enforcing traffic isolation via trunk and access port configuration. Firewalls (C) are not a segmentation method themselves; they are policy enforcement devices that control traffic between segments, so they are typically deployed to secure segmentation rather than create it. Intrusion Detection Systems (E) are monitoring tools that detect malicious activity and generate alerts, but they do not divide or isolate network segments.

Answer

Firewalls

Answer

Intrusion Detection Systems

Question 3

An organization is preparing its Business Continuity Plan (BCP). Which process identifies critical business functions and the impact of disruptions?

Accepted Answer

Business Impact Analysis (BIA). A Business Impact Analysis (BIA) identifies critical business functions, dependencies, and the impact of disruptions, providing metrics like MTD, RTO, and RPO.

Answer

Incident Response Plan (IRP)

Answer

Disaster Recovery Plan (DRP)

Answer

Risk Assessment

Question 4

Which THREE security mechanisms should be implemented to secure a network against ARP spoofing attacks? (Choose three.)

Accepted Answer

IP Source Guard. IP Source Guard (A) is correct because it uses DHCP snooping binding table entries to filter traffic on a per-port basis, dropping packets where the source IP address does not match the binding. This prevents an attacker from spoofing a legitimate host's IP address in ARP spoofing attacks by ensuring only valid IP-to-MAC mappings are allowed on the port.

Answer

Port security

Answer

MAC address filtering

Question 5

An organization requires that a financial transaction must be initiated by one employee and approved by a manager before processing. Which access control principle does this enforce?

Accepted Answer

Separation of duties. Separation of duties (SoD) is the principle that no single individual should have enough privileges to complete a sensitive transaction alone; it requires splitting critical tasks among multiple people. Here, one employee initiates and a different manager approves, which is the textbook definition of SoD. It prevents fraud and errors by ensuring collusion is needed to abuse the process.

Answer

Defense in depth

Answer

Least privilege

Answer

Need-to-know

Question 6

An organization wants to ensure that a critical database can be restored within 2 hours after a failure. Which metric should the organization define?

Accepted Answer

Recovery Time Objective (RTO). Recovery Time Objective (RTO) defines the maximum acceptable time to restore a system or service after a disruption. A requirement to restore a critical database within 2 hours is exactly an RTO. RTO drives backup, replication, and failover design decisions.

Answer

Maximum Tolerable Downtime (MTD)

Answer

Service Level Agreement (SLA)

Answer

Recovery Point Objective (RPO)

Question 7

During an incident, an organization needs to preserve volatile data. Which of the following should be collected FIRST?

Accepted Answer

Memory contents. Volatile data is lost when the system loses power. Memory content is the most volatile.

Answer

Backup tapes

Answer

Hard drive contents

Answer

Network logs

Question 8

Match each security policy type to its focus.

Accepted Answer

Acceptable Use Policy: Defines acceptable behavior for using organizational resources. The correct matches pair each policy type with its primary focus. Common confusions involve swapping definitions between similar policies, such as Acceptable Use with Access Control, or Incident Response with Data Retention.

Answer

Acceptable Use Policy: Defines rules for granting and revoking access to information systems

Answer

Incident Response Policy: Specifies how long data must be stored and when to dispose

Question 9

A security analyst is investigating a potential breach. The analyst discovers that an attacker gained access to a server by exploiting a known vulnerability that was not patched. The attacker then installed malware that encrypted critical files and demanded payment. Which of the following best describes the role of the unpatched vulnerability in this incident?

Accepted Answer

It is a weakness that was exploited by a threat.. The unpatched vulnerability is a weakness in the system that was exploited by a threat (the attacker). In risk management, a vulnerability is a flaw or gap that can be leveraged to compromise security. The threat is the actor or event that exploits the vulnerability, and the risk is the potential for loss. The impact is the resulting damage. Therefore, the vulnerability's role is that of a weakness exploited by a threat, making it the correct description.

Answer

It is the risk that materialized.

Answer

It is the impact of the security incident.

Answer

It is the threat that exploited the system.

Question 10

A security manager is advised to implement 'due care' in their organization. Which action best exemplifies due care?

Accepted Answer

Regularly updating antivirus software. Due care means taking reasonable steps to protect assets, such as implementing basic security controls like patch management.

Answer

Purchasing cyber insurance

Answer

Performing a background check on a new vendor

Answer

Accepting the risk of a legacy system

Question 11

A system administrator is configuring permissions for a new file server. To adhere to the principle of least privilege, which approach should the administrator take?

Accepted Answer

Grant each user only the permissions necessary to perform their job duties.. The principle of least privilege means granting each user only the minimum permissions required to perform their job functions — nothing more. Option C directly embodies this by tying permissions to actual job duties rather than broad group membership or department-wide access.

Answer

Grant permissions only to the IT department.

Answer

Grant permissions based on the user's department membership.

Answer

Grant all users full control to simplify management.

Question 12

Which of the following best describes the purpose of due care in information security?

Accepted Answer

Implementing reasonable security measures to protect data. Due care means exercising a minimum standard of care to protect information assets, such as implementing basic security controls.

Answer

Prioritizing security incidents based on impact

Answer

Transferring risk to a third party

Answer

Investigating a vendor's background before contracting

Question 13

A SOC analyst reviews a SIEM alert indicating a high volume of outbound traffic from a server to an external IP address known for command-and-control activity. The analyst has confirmed the alert is not a false positive. What is the most appropriate next step?

Accepted Answer

Conduct a deeper investigation to identify affected systems and data.. After confirming a SIEM alert is not a false positive, the most appropriate next step is to conduct a deeper investigation to identify affected systems and data. This aligns with the incident response process, where containment and eradication should be based on a thorough understanding of the scope and impact. Immediate blocking or rebooting without investigation could destroy evidence or disrupt business operations.

Answer

Escalate the alert to Tier 3 for advanced analysis.

Answer

Block the external IP address at the firewall immediately.

Answer

Reboot the server to terminate any malicious processes.

Question 14

A multinational corporation deploys redundant servers in geographically diverse data centers and uses a load balancer to distribute traffic. This setup primarily addresses which security concern?

Accepted Answer

Availability. Redundancy and load balancing ensure that systems remain accessible, supporting availability.

Answer

Confidentiality

Answer

Integrity

Answer

Non-repudiation

Question 15

Which security principle ensures that data cannot be accessed by unauthorized individuals?

Accepted Answer

Confidentiality. Confidentiality ensures that data is not disclosed to unauthorized individuals, systems, or processes.

Answer

Integrity

Answer

Non-repudiation

Answer

Availability

Question 16

Drag and drop the steps to configure a basic VPN (site-to-site) between two routers into the correct order.

Accepted Answer

Configure IKE policy and pre-shared key, then configure IPsec transform set, then define interesting traffic with crypto ACL, then create and apply crypto map to the interface, then verify the VPN tunnel.. Configuring a site-to-site VPN between two routers requires a specific sequence: first establish IKE policy and pre-shared keys for authentication, then define the IPsec transform set for encryption and integrity, then specify interesting traffic via a crypto ACL, then create and apply the crypto map to the outgoing interface, and finally verify the tunnel. This order ensures all security parameters are correctly bound and operational.

Answer

Define interesting traffic with crypto ACL, then configure IPsec transform set, then configure IKE policy and pre-shared key, then create and apply crypto map, then verify.

Answer

Configure IKE policy and pre-shared key, then define interesting traffic with crypto ACL, then configure IPsec transform set, then create and apply crypto map, then verify.

Answer

Verify the VPN tunnel, then configure IKE policy, then configure IPsec transform set, then define ACL, then create crypto map.

Question 17

Which data classification level typically requires the highest level of protection?

Accepted Answer

Top secret. Top secret is the highest classification and requires strict controls.

Answer

Internal

Answer

Confidential

Answer

Public

Question 18

A security administrator is configuring a network device that monitors traffic and generates alerts when suspicious patterns are detected. The device does not block traffic. Which type of system is being deployed?

Accepted Answer

Intrusion Detection System (IDS). An IDS (Intrusion Detection System) is passive and only alerts, while an IPS actively blocks.

Answer

Web Application Firewall (WAF)

Answer

Intrusion Prevention System (IPS)

Answer

Next-Generation Firewall (NGFW)

Question 19

Which of the following is a key function of a Security Information and Event Management (SIEM) system?

Accepted Answer

Correlating log data from multiple sources to identify security incidents. SIEM aggregates and correlates logs from various sources to detect patterns and generate alerts.

Answer

Blocking malicious network traffic

Answer

Enforcing password complexity requirements

Answer

Patching vulnerabilities in operating systems

Question 20

A security analyst implements a hashing algorithm to verify that a downloaded file has not been altered. Which security goal is being achieved?

Accepted Answer

Integrity. Hashing ensures data integrity by detecting changes.

Answer

Authentication

Answer

Availability

Answer

Confidentiality