ISC2 CC Practice Exam 4 — 20 Questions

Question 1

During a routine security audit, an analyst finds that several critical servers have misconfigured firewall rules allowing inbound SSH access from the entire internet. Which immediate action should the analyst take?

Accepted Answer

Modify the firewall rules to allow SSH only from specific management IPs. Option D is correct because the immediate priority is to eliminate the critical vulnerability by restricting inbound SSH access to only authorized management IPs. This aligns with the principle of least privilege and the immediate remediation steps in security incident response, as leaving the misconfiguration active even briefly exposes the servers to potential compromise.

Answer

Disable SSH on all servers

Answer

Notify the server owners and wait for their response

Answer

Document the finding and include it in the audit report

Question 2

Refer to the exhibit. A security analyst reviews this log entry. What type of attack is most likely occurring?

Accepted Answer

Brute-force attack. The log entry shows repeated failed authentication attempts from a single source IP (10.10.10.10) against multiple usernames (admin, root, test) in a short time window. This pattern of systematically trying different credentials against a target system is characteristic of a brute-force attack, where an attacker iterates through possible username/password combinations to gain unauthorized access.

Answer

Pass-the-hash attack

Answer

Password spraying attack

Answer

Kerberos ticket attack

Question 3

Drag and drop the steps for the TCP three-way handshake into the correct order.

Question 4

Which TWO of the following are common indicators of a phishing email? (Select TWO.)

Accepted Answer

The email contains a sense of urgency, such as 'Your account will be closed.'. Option B is correct because phishing emails commonly exploit urgency to bypass rational decision-making. Attackers use phrases like 'Your account will be closed' to pressure recipients into clicking malicious links or providing credentials without verifying the source. This social engineering tactic is a hallmark of phishing campaigns.

Answer

The email contains an attachment with a .txt extension

Answer

The email has a high-importance flag set by the sender

Answer

The email is sent to multiple recipients in the 'To' field

Question 5

A security architect is designing access controls for a new application. The requirement is that only managers can approve expense reports above $10,000. Which control model best fits this requirement?

Accepted Answer

Rule-based access control (RuBAC). Rule-based access control (RuBAC) uses a set of rules or conditions to determine access decisions, such as the expense report amount exceeding $10,000. In this scenario, the access control decision depends on a dynamic attribute (the expense amount) rather than a static role or identity, making RuBAC the best fit. RuBAC is often implemented using access control lists (ACLs) or policy-based engines that evaluate conditions like 'if amount > 10000 then require manager approval'.

Answer

Role-based access control (RBAC)

Answer

Discretionary access control (DAC)

Answer

Mandatory access control (MAC)

Question 6

A security analyst notices that a user's account has been used to access sensitive files outside of normal working hours from an unknown IP address. Which security principle is most directly violated?

Accepted Answer

Confidentiality. The scenario describes unauthorized access to sensitive files from an unknown IP address outside normal hours, which directly violates the principle of confidentiality. Confidentiality ensures that data is accessible only to authorized users and systems, and this breach indicates that sensitive information may have been exposed to an unauthorized party.

Answer

Availability

Answer

Non-repudiation

Answer

Integrity

Question 7

Refer to the exhibit. A security analyst notices that a user with the Finance role is able to write to /finance/data from a macOS device at 10:00 AM. The policy shown is the only policy affecting this resource. What is the most likely reason for this behavior?

Accepted Answer

The user's device attribute is incorrectly set to Windows.. Option D is correct because the policy likely includes a device attribute condition (e.g., device.os == 'Windows') that must be satisfied for the Deny effect to apply. Since the user is on a macOS device, the condition evaluates to false, so the Deny is not enforced, and the default Allow (or a broader Allow rule) permits write access. This is a common misconfiguration where the device attribute is set incorrectly, causing unintended access.

Answer

The condition is evaluated as OR instead of AND.

Answer

The time condition is evaluated as BETWEEN 09:00 and 17:00 exclusive.

Answer

The policy is misconfigured with effect Deny.

Question 8

Drag and drop the steps to perform a password reset on a Windows user account into the correct order.

Question 9

Drag and drop the steps for the proper disposal of a hard drive containing sensitive data into the correct order.

Question 10

Drag and drop the steps to recover a system from a verified backup after a ransomware attack into the correct order.

Question 11

Drag and drop the steps for the incident response process according to NIST into the correct order.

Question 12

Drag and drop the steps to create a new VLAN on a managed switch into the correct order.

Question 13

An organization wants to implement the principle of least privilege for its database administrators. Which approach best achieves this goal?

Accepted Answer

Use role-based access control (RBAC) to grant permissions specific to each administrator's duties.. Role-based access control (RBAC) directly enforces the principle of least privilege by granting database administrators only the permissions required for their specific job functions. Unlike MAC, which focuses on data classification labels, RBAC maps roles (e.g., backup admin, security admin) to precise sets of privileges, ensuring no user has unnecessary access.

Answer

Implement mandatory access control (MAC) with labels for all data.

Answer

Allow administrators to self-assign permissions as needed.

Answer

Assign each administrator full database admin rights for simplicity.

Question 14

A security engineer is configuring a network intrusion detection system (NIDS) to monitor traffic on a critical subnet. To minimize false positives, which of the following should the engineer baseline first?

Accepted Answer

The normal traffic patterns during peak business hours. Baselining normal traffic patterns during peak business hours establishes a reference of legitimate network behavior, which is essential for a NIDS to distinguish benign anomalies from actual threats. Without this baseline, the NIDS may generate false positives by flagging legitimate peak-hour traffic spikes as malicious. This aligns with the principle that anomaly-based detection relies on a statistical model of normal activity to reduce noise.

Answer

The results of a recent vulnerability scan

Answer

The latest attack signatures from the vendor

Answer

The firewall logs from the past 24 hours

Question 15

In a defense-in-depth strategy, which access control mechanism provides the most granular control over user permissions?

Accepted Answer

Access control lists (ACLs) on files. Access control lists (ACLs) on files provide the most granular control because they allow permissions to be set at the individual file or object level, specifying exactly which users or groups can read, write, execute, or modify that specific resource. This is in contrast to broader mechanisms like network segmentation or firewall rules, which operate at the network or subnet level and cannot distinguish between individual files within a system. ACLs are a fundamental component of discretionary access control (DAC) and are implemented in file systems such as NTFS, ext4, and ZFS.

Answer

Network segmentation

Answer

Physical security controls

Answer

Firewall rules

Question 16

Which TWO scenarios best illustrate the principle of least privilege?

Accepted Answer

An administrator uses a separate standard account for daily work and an admin account only when needed. Option C is correct because it demonstrates the principle of least privilege by using a separate standard user account for daily tasks and elevating to an administrative account only when necessary. This minimizes the attack surface by ensuring that administrative privileges are not active during routine activities, reducing the risk of accidental system changes or malware execution with elevated rights. In Windows environments, this is commonly implemented via User Account Control (UAC) and the use of a standard vs. administrator account.

Answer

Regular employees can install software on their workstations

Answer

The CEO has root access to all servers

Answer

All users have full control over shared folders

Question 17

A system administrator needs to grant a contractor temporary access to a server for patching. The contractor should only have access during the patching window. Which access control implementation method is most appropriate?

Accepted Answer

Time-based ACL (rule-based access control). Time-based ACLs (rule-based access control) allow the administrator to define a specific time range during which the contractor's access is permitted. This directly matches the requirement for temporary access only during the patching window, as the ACL can be configured with a time-range object that automatically enables and disables the permit statement without manual intervention.

Answer

Group-based permissions with a recurring schedule

Answer

Discretionary access control (DAC)

Answer

Mandatory access control (MAC)

Question 18

An organization wants to implement a system that enforces access decisions based on a user's attributes (e.g., department, clearance, time) and environmental conditions. Which model is best?

Accepted Answer

Attribute-based access control (ABAC). Attribute-based access control (ABAC) is the correct model because it evaluates access decisions based on a combination of user attributes (e.g., department, clearance), resource attributes, and environmental conditions (e.g., time of day, location). Unlike RBAC, which relies solely on predefined roles, ABAC uses policies that can incorporate dynamic factors like current time or threat level, making it ideal for fine-grained, context-aware enforcement.

Answer

Role-based access control (RBAC)

Answer

Discretionary access control (DAC)

Answer

Mandatory access control (MAC)

Question 19

A company's backup strategy involves daily full backups only. What is the primary risk associated with this approach?

Accepted Answer

Recovery Time Objective (RTO) may be exceeded due to long restore. With daily full backups only, the Recovery Point Objective (RPO) is effectively 24 hours, which may be acceptable depending on business requirements. However, the primary risk is that restoring from a single full backup can take a very long time, especially for large datasets, potentially exceeding the Recovery Time Objective (RTO). This is because full backups contain all data and must be restored entirely, unlike incremental or differential backups that allow faster recovery by restoring only changed blocks.

Answer

Recovery Point Objective (RPO) may be too long

Answer

High cost of backup storage

Answer

Data corruption could spread across backups

Question 20

Which TWO are true about a differential backup? (Select two.)

Accepted Answer

It requires a full backup to be restored first. A differential backup copies all files that have changed since the last full backup. Because it does not contain the complete data set, you must first restore the most recent full backup and then apply the differential backup on top of it to recover the system. This makes option B correct.

Answer

It copies files changed since the last backup of any type

Answer

It resets the archive bit on backed-up files

Answer

It is faster to restore than a full backup