ISC2 CC Practice Exam 4 — 20 Questions

Question 1

During a DDoS attack, a company's web server is overwhelmed with a high volume of SYN packets from spoofed IP addresses, never completing the TCP handshake. Which type of attack is this?

Accepted Answer

SYN flood. A SYN flood sends many SYN packets to exhaust server resources by leaving half-open connections.

Answer

ICMP flood

Answer

UDP flood

Answer

Amplification attack

Question 2

A network administrator is troubleshooting a connectivity issue between two segments separated by a firewall. The firewall rule allows traffic from 10.1.1.0/24 to 10.2.2.0/24 on TCP 443. Users in 10.1.1.0/24 can access the web server at 10.2.2.10, but users in 10.2.2.0/24 cannot access a web server in 10.1.1.0/24. What is the most likely cause?

Accepted Answer

The firewall is not stateful and does not automatically allow return traffic; a separate rule is needed.. The firewall rule only permits traffic from 10.1.1.0/24 to 10.2.2.0/24 on TCP 443. When users in 10.2.2.0/24 initiate a connection to the web server in 10.1.1.0/24, the firewall sees a new session that does not match the existing rule (source/destination reversed). If the firewall is not stateful, it will not automatically allow the return traffic for the reverse direction, and no separate rule exists to permit that traffic, causing the connectivity failure.

Answer

The web server in 10.1.1.0 is blocking the IP range of 10.2.2.0/24.

Answer

The firewall rule is incorrectly applied to the wrong interface.

Answer

The subnet masks are misconfigured, causing routing issues.

Question 3

A security team discovers that an internal database server is sending large amounts of data to an unknown external IP address. The server is not supposed to communicate externally. Which security control should be implemented to prevent such data exfiltration?

Accepted Answer

Configure a firewall to deny all outbound traffic from the database server except to specific authorized destinations. A firewall with restrictive egress rules blocks unauthorized outbound traffic, preventing data exfiltration. Option A (VPN) would not stop the traffic; it could even encrypt and tunnel it. Option B (IDS) can detect but not block. Option D (DLP) monitors content but may not effectively block at the network level.

Answer

Implement a VPN for all external communications

Answer

Install an intrusion detection system (IDS) on the network segment

Answer

Deploy a data loss prevention (DLP) system on the server

Question 4

A security team implements a policy that requires all access to sensitive data to be logged and audited. Which principle is being enforced?

Accepted Answer

Accountability. Accountability is enforced because logging and auditing create a traceable record of who accessed sensitive data and what actions they performed. This allows security teams to hold individuals responsible for their actions by correlating log entries with specific user identities, typically via authentication systems like LDAP or SAML. The policy directly supports the principle that users must be answerable for their access to protected resources.

Answer

Non-repudiation

Answer

Integrity

Answer

Least privilege

Question 5

An administrator reviews the exhibit. Which security principle is being violated?

Accepted Answer

Least privilege. The user has write access to HR documents, which may not be necessary for their role, violating least privilege.

Answer

Non-repudiation

Answer

Separation of duties

Answer

Accountability

Question 6

A company's security policy requires that all privileged access to critical servers be logged and monitored. The IT team has implemented a jump server (bastion host) for administrators to connect to critical servers. All SSH connections to the jump server are logged, and from there, administrators connect to target servers. The security team notices that some administrators are bypassing the jump server and connecting directly to critical servers from their workstations. The direct connections are not logged. The security team needs to enforce the policy without disrupting operations. Which of the following is the BEST solution?

Accepted Answer

Implement a host-based firewall on each critical server to block direct connections.. A host-based firewall on each critical server can enforce the security policy by blocking direct SSH connections (TCP port 22) from any source other than the jump server's IP address. This ensures that all administrative access must go through the jump server, where logging is already in place, without disrupting legitimate operations through the authorized path.

Answer

Send a warning email to all administrators reminding them of the policy.

Answer

Disable direct SSH access to critical servers at the network firewall level.

Answer

Revoke local administrator rights on workstations.

Question 7

According to modern password guidance from NIST SP 800-63, which of the following is the most important factor when setting password requirements?

Accepted Answer

Enforcing a minimum length of at least 8 characters. NIST SP 800-63 recommends favoring password length over complexity, with a minimum of 8 characters (or 15+ for high assurance) and avoiding frequent forced changes unless compromised.

Answer

Requiring a mix of uppercase, lowercase, numbers, and special characters

Answer

Using randomly generated passwords

Answer

Changing passwords every 30 days

Question 8

Which THREE elements are essential components of a business continuity plan (BCP)?

Accepted Answer

Data backup schedules and procedures. Data backup schedules and procedures are essential because they ensure that critical data can be restored after a disruption. A BCP must specify the frequency of backups (e.g., daily incremental, weekly full), the retention policy, and the recovery point objective (RPO) to meet business requirements. Without defined schedules and procedures, data loss or corruption could render the recovery process ineffective.

Answer

Incident response team roster

Answer

Detailed network topology diagrams

Question 9

Which metric is used to define the maximum amount of data loss an organization can tolerate during a disaster?

Accepted Answer

RPO. RPO (Recovery Point Objective) defines the maximum acceptable amount of data loss measured in time, such as seconds, minutes, or hours. It determines the age of the backup or replication data that must be restored to resume normal operations after a disaster. For example, an RPO of 1 hour means the organization can tolerate losing up to 1 hour's worth of data.

Answer

RTO

Answer

SLA

Answer

MTBF

Question 10

A security team is analyzing network segmentation strategies. Which THREE of the following are benefits of using VLANs for network segmentation?

Accepted Answer

They allow logical grouping of users regardless of physical location. VLANs provide logical separation, improve security, reduce broadcast domain size, and allow flexible grouping without physical rewiring.

Answer

They eliminate the need for IP addressing

Answer

They increase the collision domain size

Question 11

During a disaster recovery test, backup tapes fail to restore data due to format incompatibility. Which element of the Business Continuity Plan should be updated?

Accepted Answer

Plan testing and maintenance. The failure of backup tapes to restore data due to format incompatibility indicates that the recovery procedures and tools were not validated during testing. This directly points to a deficiency in the 'Plan testing and maintenance' element, which ensures that backup media formats, restoration tools, and procedures are regularly verified and updated to match the current production environment. Without scheduled testing and maintenance, format drift between backup software versions or hardware changes can render tapes unreadable.

Answer

Business Impact Analysis (BIA)

Answer

Recovery strategies

Answer

Communication plan

Question 12

An organization wants to ensure that critical security events are not missed during off-hours. What is the best practice?

Accepted Answer

Configure a central SIEM with 24/7 monitoring. A central SIEM with 24/7 monitoring ensures that security events are continuously analyzed and alerted upon, even during off-hours. This is the best practice because it provides real-time correlation and escalation of critical events, preventing them from being missed. Relying on automatic responses or periodic scans lacks the human oversight needed for complex threat validation.

Answer

Rely on automatic responses

Answer

Assign on-call duties only to senior analysts

Answer

Schedule nightly scans

Question 13

A help desk technician receives a report that a user cannot access a shared network drive. The technician checks the file server and sees that the disk is full. What is the most immediate action the technician should take?

Accepted Answer

Free up space by deleting unnecessary files or moving data. Freeing up space restores access. The other options are either not immediate or do not directly address the disk full issue.

Answer

Reboot the file server

Answer

Run antivirus scan

Answer

Increase disk quota

Question 14

A company's security operations center (SOC) receives an alert about suspicious outbound traffic from a server in the DMZ to an external IP address known for command-and-control activity. The SOC analyst reviews the logs and sees that the source port is 443 and the destination port is 8080. Which of the following actions should the analyst take FIRST?

Accepted Answer

Isolate the server from the network and investigate further. The SOC analyst should first isolate the server from the network because the outbound traffic from a DMZ server to a known C2 IP address, using source port 443 (HTTPS) to destination port 8080 (HTTP alternate), indicates a potential compromise. Isolating the server stops the data exfiltration and prevents further C2 communication, allowing for a controlled forensic investigation without alerting the attacker. This aligns with the NIST SP 800-61 incident response process, where containment is prioritized before eradication or recovery.

Answer

Notify the incident response team and management immediately

Answer

Block the external IP address at the firewall

Answer

Modify the firewall rule to deny all outbound traffic from the DMZ

Question 15

Which THREE security mechanisms should be implemented to secure a network against ARP spoofing attacks? (Choose three.)

Accepted Answer

IP Source Guard. IP Source Guard (A) is correct because it uses DHCP snooping binding table entries to filter traffic on a per-port basis, dropping packets where the source IP address does not match the binding. This prevents an attacker from spoofing a legitimate host's IP address in ARP spoofing attacks by ensuring only valid IP-to-MAC mappings are allowed on the port.

Answer

Port security

Answer

MAC address filtering

Question 16

A security analyst is configuring an intrusion detection system (IDS) to detect SQL injection attacks. Which method is most effective?

Accepted Answer

Examine HTTP request parameters for SQL commands. Examining HTTP request parameters for SQL commands directly detects SQL injection attempts. The other options are unrelated or less effective.

Answer

Analyze DNS query patterns

Answer

Detect port scans from external IPs

Answer

Monitor bandwidth usage for spikes

Question 17

A security administrator notices that a user's account has been used to access sensitive files at unusual hours. Which security principle would most effectively help detect this type of activity?

Accepted Answer

Accountability. Accountability enables tracking of user actions through logs and monitoring. Option A (Non-repudiation) prevents denial of actions but does not focus on detection. Option B (Availability) ensures data is accessible. Option C (Integrity) ensures data accuracy.

Answer

Non-repudiation

Answer

Availability

Answer

Integrity

Question 18

A company deploys a firewall that inspects packet headers and maintains a state table to track active connections. It drops any incoming packets that do not match an established connection. What type of firewall is this?

Accepted Answer

Stateful inspection firewall. A stateful inspection firewall tracks connections and blocks unsolicited inbound traffic.

Answer

Application proxy firewall

Answer

Next-generation firewall

Answer

Packet filtering firewall

Question 19

Which of the following is considered sensitive Personally Identifiable Information (PII)?

Accepted Answer

Medical records. Medical records are sensitive PII because they can cause significant harm if disclosed.

Answer

Email address

Answer

Date of birth

Answer

Phone number

Question 20

A medium-sized enterprise uses a Cisco ASA firewall configured with multiple security zones (Inside, Outside, DMZ). The DMZ hosts a web server that must be accessible from the Internet on TCP 443. The Inside network (10.0.0.0/24) hosts internal clients. The web server has IP 172.16.0.10. The firewall's current rules: allow any from Outside to DMZ on TCP 443; allow any from Inside to Outside; deny all else. Recently, the security team noticed that an attacker compromised the web server and used it to launch an attack against an internal database server at 10.0.0.50. The attack was successful because the firewall allowed traffic from the DMZ to the Inside. The firewall's default behavior is to deny traffic from lower security zones to higher security zones (DMZ is lower than Inside). What is the MOST likely reason this traffic was allowed?

Accepted Answer

The firewall has an explicit permit rule for traffic from DMZ to Inside on any destination.. The firewall's default behavior is to deny traffic from a lower security zone (DMZ) to a higher security zone (Inside). For the attack to succeed, an explicit permit rule must have been configured to allow traffic from DMZ to Inside. The existing rules only permit Outside to DMZ on TCP 443 and Inside to Outside; without an explicit DMZ-to-Inside rule, the default deny would have blocked the attack. Thus, the most likely reason is that an administrator inadvertently or intentionally added such a permit rule.

Answer

The firewall was configured in transparent mode, allowing all traffic.

Answer

The attacker used a VPN connection that bypassed the firewall.

Answer

The firewall's default behavior permits traffic from lower security level to higher if the connection is initiated from the higher level.