ISC2 CC Practice Exam 4 — 20 Questions

Question 1

Refer to the exhibit. A security engineer applies this storage access policy to restrict access. Users outside the 10.0.0.0/16 network report being denied access, which is expected. However, users inside that network also report access denied. What is the likely issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The policy only allows read access; users likely need list or other actions.. The storage policy only grants the read action, but users inside the 10.0.0.0/16 network are likely performing other actions such as list or write. Even though the source IP condition allows access from the trusted network, the explicit Allow statement is scoped solely to read. Any request for a different action (like list) will be implicitly denied by default, as IAM and storage policies are deny-by-default unless an explicit Allow exists for that specific action.

Answer

The condition syntax is incorrect and causes all requests to be evaluated incorrectly.

Answer

The Deny statement overrides the Allow statement for all requests.

Answer

The resource identifier includes a wildcard, causing a mismatch.

Question 2

An attacker sends forged ARP messages to associate their MAC address with the IP address of a legitimate server. This allows the attacker to intercept traffic intended for that server. What is this attack?

Accepted Answer

ARP spoofing. ARP spoofing (or ARP poisoning) involves sending fake ARP replies to associate the attacker's MAC with a victim's IP, enabling man-in-the-middle attacks.

Answer

DNS poisoning

Answer

MAC flooding

Answer

IP spoofing

Question 3

Match each security control type to its description.

Accepted Answer

Preventive: Controls that prevent security incidents from occurring. Security controls are categorized by their primary function. Preventive controls stop incidents, detective controls identify them, and corrective controls restore operations. Common confusions involve swapping preventive and detective roles.

Answer

Preventive: Controls that identify security incidents

Answer

Detective: Controls that prevent security incidents

Question 4

Match each risk management term to its meaning.

Accepted Answer

Risk: The potential for loss or harm when a threat exploits a vulnerability.. Risk is the potential for loss when a threat exploits a vulnerability. A threat is a potential cause of harm. A vulnerability is a weakness. Controls are measures to reduce risk.

Answer

Risk: A weakness in a system or its design.

Answer

Threat: The potential for loss or harm.

Answer

Vulnerability: A measure that modifies or reduces risk.

Question 5

A security analyst receives an alert indicating multiple failed login attempts from a single IP address targeting a user account. Which action should the analyst take FIRST?

Accepted Answer

Verify the alert and check if the account is compromised. The first step in incident response is to validate the alert. The analyst must verify that the failed login attempts are not a false positive (e.g., a user mistyping their password) and then check if the account has been compromised by reviewing logs for successful logins from the same IP or anomalous behavior. Prematurely disabling the account or blocking the IP could disrupt legitimate access or alert an attacker, while escalation to law enforcement is premature without confirmation of a breach.

Answer

Disable the user account immediately

Answer

Escalate the alert to law enforcement

Answer

Block the IP address at the firewall

Question 6

A security analyst recommends implementing digital signatures to ensure that a software update has not been altered during distribution. Which aspect of the CIA triad is primarily being addressed?

Accepted Answer

Integrity. Digital signatures use cryptographic hashing and asymmetric encryption to verify that data has not been altered in transit or at rest, which directly addresses the Integrity pillar of the CIA triad. If even a single bit of the software update changes, the signature verification fails, proving tampering. While signatures also provide authentication and non-repudiation, the question specifically asks which CIA triad aspect is primarily addressed, and integrity is the correct mapping.

Answer

Availability

Answer

Confidentiality

Answer

Non-repudiation

Question 7

During a security incident, the incident response team needs to preserve evidence for potential legal action. Which of the following is the most important action to take when collecting volatile data from a compromised server?

Accepted Answer

Capture the contents of RAM.. Volatile data in RAM is lost when power is removed. Capturing RAM preserves evidence that might contain running processes, network connections, and encryption keys. Disk images are non-volatile and can be collected later.

Answer

Make a bit-for-bit copy of all storage.

Answer

Create a forensic image of the hard drive.

Answer

Review system logs.

Question 8

What is the primary purpose of a digital signature?

Accepted Answer

Provide data integrity and non-repudiation. Digital signatures provide integrity (detect tampering) and non-repudiation (proof of origin).

Answer

Ensure data confidentiality

Answer

Control access to resources

Answer

Encrypt data at rest

Question 9

A security operations center (SOC) analyst notices unusual outbound network traffic from a server that typically only receives connections. The traffic is encrypted and goes to an unknown external IP. Which step should the analyst perform FIRST?

Accepted Answer

Check the server's running processes and connections. The first step in incident response is to gather evidence and understand the scope without altering the system. Checking the server's running processes and connections (A) allows the analyst to identify the malicious process, its parent, and the remote endpoint, which informs containment and eradication. This aligns with the 'identification' phase of incident response.

Answer

Power off the server

Answer

Block the outbound traffic at the firewall

Answer

Notify the system owner

Question 10

An attacker intercepts communications between a client and server by establishing independent connections with each. The client believes it is talking to the server, but the attacker relays messages. What is this attack?

Accepted Answer

Man-in-the-middle. A man-in-the-middle (MITM) attack occurs when an adversary positions themselves between two communicating parties, establishing separate connections with each and relaying (or altering) traffic while both sides believe they are communicating directly. The scenario describes exactly this relay behavior. The attacker can eavesdrop, modify, or inject data because neither endpoint detects the intermediary.

Answer

Phishing

Answer

Replay attack

Answer

DoS

Question 11

An organization experiences intermittent network outages. The security team notices that the ARP cache on several switches has entries pointing to an unknown MAC address for the default gateway. Which attack is most likely occurring?

Accepted Answer

ARP spoofing. ARP spoofing (ARP poisoning) occurs when an attacker sends forged ARP replies to associate their MAC address with the IP of the default gateway. Switches then populate their ARP caches with the attacker's MAC for the gateway IP, causing traffic to be redirected to the attacker. This matches the symptom of ARP cache entries pointing to an unknown MAC for the gateway.

Answer

DNS poisoning

Answer

IP spoofing

Answer

MAC flooding

Question 12

A company is designing a new application that processes credit card payments. They want to ensure that no single administrator can bypass security controls to approve a fraudulent transaction. Which principle should be implemented?

Accepted Answer

Separation of duties. Separation of duties ensures that no single administrator has the authority to both initiate and approve a credit card transaction. By dividing critical functions among multiple individuals, the company prevents a single compromised account from authorizing fraudulent payments. This principle directly addresses the risk of insider threats or credential misuse in payment processing systems.

Answer

Defense in depth

Answer

Least privilege

Answer

Need to know

Question 13

Drag and drop the steps to perform a password reset on a Windows user account into the correct order.

Accepted Answer

Open Computer Management, expand Local Users and Groups, select the Users folder, right-click the user account, choose Set Password, enter and confirm the new password. Password reset requires admin rights and is done via Local Users and Groups in Computer Management.

Answer

Right-click the user account, choose Set Password, open Computer Management, expand Local Users and Groups, select the Users folder, enter and confirm the new password

Answer

Open Computer Management, expand Local Users and Groups, right-click the user account, select the Users folder, choose Set Password, enter and confirm the new password

Answer

Open Computer Management, select the Users folder, expand Local Users and Groups, right-click the user account, choose Set Password, enter and confirm the new password

Question 14

An organization's recovery time objective (RTO) for its customer database is 4 hours. During a disaster, the backup restore process takes 2 hours, but reconfigure and test tasks add another 3 hours. Which action best addresses this gap?

Accepted Answer

Automate the configuration and validation steps after restore.. The RTO is 4 hours, but the actual recovery time is 2 hours (restore) + 3 hours (reconfigure and test) = 5 hours, exceeding the RTO by 1 hour. Automating the configuration and validation steps (option D) reduces the post-restore manual effort, bringing the total recovery time closer to or within the 4-hour RTO. This directly addresses the gap without altering the RTO or neglecting testing.

Answer

Conduct the restore test only during annual disaster recovery drills.

Answer

Reduce the recovery point objective (RPO) to minimize data loss.

Answer

Increase the RTO to 6 hours.

Question 15

A security team is developing an incident response plan. Which THREE of the following are essential components of crisis communications during a data breach? (Choose three.)

Accepted Answer

Notifying affected customers. Option A (Notifying affected customers) is correct because crisis communications during a data breach must include timely, clear notification to the individuals whose personal data was compromised, enabling them to take protective steps such as changing passwords or monitoring accounts. Option C (Complying with regulatory notification requirements) is correct because laws and regulations such as GDPR, HIPAA, and state breach-notification statutes mandate specific disclosures to regulators and affected parties within defined timeframes, making compliance a core communications obligation. Option D (Informing the organization's executive management) is correct because executives need accurate, prompt situational awareness to authorize response actions, allocate resources, and serve as the organization's authoritative voice internally and externally. Option B is not correct because publicly revealing technical attack details can expose unpatched vulnerabilities, aid attackers, and jeopardize ongoing forensic investigations. Option E is not correct because deleting logs destroys evidence, violates legal hold and retention obligations, and would obstruct incident response and regulatory compliance.

Answer

Revealing technical details of the attack to the public

Answer

Deleting all logs to prevent evidence leakage

Question 16

Which of the following are core principles of information security?

Accepted Answer

Integrity. The CIA triad is the foundational model of information security, and its three core principles are Confidentiality, Integrity, and Availability. Option C (Confidentiality) is correct because it ensures data is disclosed only to authorized parties, typically enforced through encryption, access controls, and classification. Option B (Integrity) is correct because it guarantees data remains accurate, complete, and unaltered, protected via hashing, checksums, and digital signatures. Option E (Availability) is correct because it ensures systems and data are accessible to authorized users when needed, supported by redundancy, backups, and DDoS mitigation. Options A (Authentication) and D (Non-repudiation) are not core principles of the CIA triad; authentication is an access-control mechanism that verifies identity, and non-repudiation is a security service that prevents denial of an action, often achieved with digital signatures.

Answer

Authentication

Answer

Non-repudiation

Question 17

A security analyst is implementing a solution to ensure that data transmitted between two servers cannot be read by unauthorized parties. Which security principle is the analyst primarily addressing?

Accepted Answer

Confidentiality. Confidentiality ensures that data is accessible only to authorized parties and is not disclosed to unauthorized individuals. Encrypting data in transit between two servers directly addresses confidentiality by rendering the data unreadable to eavesdroppers. This is the core goal of protocols like TLS, IPsec, and SSH, which the analyst would likely implement to satisfy this requirement.

Answer

Integrity

Answer

Availability

Answer

Authentication

Question 18

A company's security policy states that employees should only have access to the data necessary to perform their job functions. This is an example of which principle?

Accepted Answer

Least privilege. The principle of least privilege dictates that users and systems should be granted only the minimum permissions necessary to perform their tasks. By restricting data access to job-required information, the company directly implements this security control, reducing the attack surface and limiting potential damage from compromised accounts.

Answer

Defense in depth

Answer

Separation of duties

Answer

Fail-safe

Question 19

A security professional is asked to ensure that a document has not been altered since it was signed. Which technology best supports this requirement?

Accepted Answer

Digital signature. A digital signature uses asymmetric cryptography to sign a document's hash with the signer's private key, allowing anyone with the public key to verify both the signer's identity and that the document has not been altered. This provides integrity and non-repudiation, directly satisfying the requirement.

Answer

Symmetric encryption

Answer

Access control list

Answer

Hashing

Question 20

A security incident report indicates that an employee used their access to view confidential records unrelated to their job. Which security principle was most likely violated?

Accepted Answer

Least privilege. Least privilege means users should have only the minimum access necessary to perform their job. Viewing confidential records unrelated to their job violates this principle because the user had access beyond what was required.

Answer

Separation of duties

Answer

Availability

Answer

Non-repudiation