ISC2 CC Practice Test 21 — 15 Questions

Question 1

A healthcare organization experiences a ransomware attack that encrypts all files on file servers and workstations. The incident response team has isolated the infected systems. The backup policy includes daily incremental backups and weekly full backups stored on a separate network segment. The most recent full backup is 5 days old. The incremental backups from the past 4 days are available but are stored on the same backup server that might be compromised. To restore data with minimal loss, what should the team do?

Accepted Answer

First verify the integrity of the backups by scanning them on an isolated system, then restore the full backup and apply the most recent clean incremental backups.. Option D is correct. First, verify backup integrity on an isolated system to ensure no ransomware remnants. Then restore the full backup and apply the most recent clean incremental backups. Option A could restore ransomware if backups are compromised. Option B uses only incremental, missing the full backup. Option C is too drastic if backups are clean.

Answer

Use the most recent incremental backup to restore files directly.

Answer

Assume all backups are compromised and rebuild systems from scratch.

Answer

Restore the weekly full backup and then apply all incremental backups from the past 5 days.

Question 2

A company uses a stateful firewall. A user reports that an application requiring multiple dynamic ports is not working. The firewall logs show that packets from the server are being dropped. What is the most likely cause?

Accepted Answer

The firewall is only allowing packets that match an established session, but the application's control channel is not being tracked correctly.. A stateful firewall tracks sessions by monitoring the control channel. For applications like FTP that use dynamic ports, the firewall must inspect the control channel to dynamically open pinholes for data channels. If the control channel is not tracked correctly, the firewall will not recognize the data channel packets as part of an established session and will drop them, even if the initial control session was allowed.

Answer

The firewall does not have a rule allowing inbound traffic for the application.

Answer

The firewall is not inspecting application-layer data.

Answer

The firewall's state table is full and cannot track new sessions.

Question 3

A company wants to allow remote employees to securely access internal resources over the internet. Which technology is most appropriate?

Accepted Answer

VPN. A VPN (Virtual Private Network) creates an encrypted tunnel over the internet, typically using protocols like IPsec or TLS, to securely connect remote users to internal resources. This ensures confidentiality, integrity, and authentication of data in transit, making it the standard solution for remote access security.

Answer

NAT

Answer

VLAN

Answer

DMZ

Question 4

A network administrator is configuring a DMZ for a company's web and email servers. Which firewall rule is most appropriate for traffic from the internet to the DMZ?

Accepted Answer

Allow inbound HTTP, HTTPS, SMTP, and DNS to DMZ. Option B is correct because a DMZ must selectively permit essential services from the internet to the public-facing servers while blocking all other inbound traffic. HTTP (80), HTTPS (443), SMTP (25), and DNS (53) are the standard protocols required for web and email servers to function. This rule implements the principle of least privilege by allowing only the necessary traffic to the DMZ.

Answer

Deny all inbound traffic to DMZ but allow outbound

Answer

Allow inbound only to the web server on ports 80 and 443

Answer

Allow all inbound traffic to DMZ

Question 5

Which TWO of the following are common methods to authenticate users on a wireless network? (Select TWO)

Accepted Answer

WPA3-SAE. WPA3-SAE (Simultaneous Authentication of Equals) is a common method to authenticate users on a wireless network because it replaces the pre-shared key (PSK) exchange with a secure password-based authentication protocol that is resistant to offline dictionary attacks. It uses a Diffie-Hellman key exchange combined with a shared password to derive a Pairwise Master Key (PMK), ensuring forward secrecy and mutual authentication.

Answer

WEP

Answer

WPA2-PSK

Answer

MAC address filtering

Question 6

A medium-sized enterprise uses a Cisco ASA firewall configured with multiple security zones (Inside, Outside, DMZ). The DMZ hosts a web server that must be accessible from the Internet on TCP 443. The Inside network (10.0.0.0/24) hosts internal clients. The web server has IP 172.16.0.10. The firewall's current rules: allow any from Outside to DMZ on TCP 443; allow any from Inside to Outside; deny all else. Recently, the security team noticed that an attacker compromised the web server and used it to launch an attack against an internal database server at 10.0.0.50. The attack was successful because the firewall allowed traffic from the DMZ to the Inside. The firewall's default behavior is to deny traffic from lower security zones to higher security zones (DMZ is lower than Inside). What is the MOST likely reason this traffic was allowed?

Accepted Answer

The firewall has an explicit permit rule for traffic from DMZ to Inside on any destination.. The correct answer is A because the firewall's default behavior is to deny traffic from a lower security zone (DMZ) to a higher security zone (Inside). For the attack to succeed, an explicit permit rule must have been configured to allow traffic from DMZ to Inside. The existing rules only permit Outside to DMZ on TCP 443 and Inside to Outside; without an explicit DMZ-to-Inside rule, the default deny would have blocked the attack. Thus, the most likely reason is that an administrator inadvertently or intentionally added such a permit rule.

Answer

The firewall was configured in transparent mode, allowing all traffic.

Answer

The attacker used a VPN connection that bypassed the firewall.

Answer

The firewall's default behavior permits traffic from lower security level to higher if the connection is initiated from the higher level.

Question 7

Which three of the following are best practices for securing a network switch? (Choose three.)

Accepted Answer

Disable unused ports.. Disabling unused ports on a network switch prevents unauthorized physical access and eliminates the risk of an attacker connecting to an open port to launch attacks such as ARP spoofing or DHCP starvation. This is a fundamental security best practice that reduces the attack surface by ensuring that only necessary ports are active and can be administratively controlled.

Answer

Enable Telnet for remote management.

Answer

Set all ports to trunk mode by default.

Question 8

A network administrator is configuring a wireless network for a small office. Security requirements include strong encryption and pre-shared key authentication. Which protocol should be used?

Accepted Answer

WPA2-PSK with AES. WPA2-PSK with AES is the correct choice because it provides strong encryption (AES-CCMP) and uses a pre-shared key for authentication, meeting the requirements for a small office without a RADIUS server. WPA2-PSK is widely supported and offers robust security against common attacks when a strong passphrase is used.

Answer

WPA3-Enterprise with 802.1X

Answer

Open with MAC address filtering

Answer

WEP with TKIP

Question 9

Which TWO of the following are recognized as benefits of network segmentation?

Accepted Answer

Reduced attack surface. Option A (Reduced attack surface) and Option D (Containment of breaches) are correct. Segmentation limits the scope of attacks and reduces exposure. Option B (Increased broadcast domains) is not a security benefit; it can cause performance issues. Option C (Simplified IP address management) is not directly related to security. Option E (Easier monitoring) is subjective and not a primary benefit.

Answer

Easier monitoring

Answer

Increased broadcast domains

Answer

Simplified IP address management

Question 10

A company wants to segment its network into separate broadcast domains to improve performance and security. Which device should be used to achieve this?

Accepted Answer

Router. A router is the correct device because it operates at Layer 3 (Network layer) of the OSI model and can segment a network into separate broadcast domains by forwarding packets based on IP addresses while blocking broadcast traffic (e.g., ARP requests) from crossing between interfaces. This isolation improves performance by reducing broadcast overhead and enhances security by controlling traffic flow between segments.

Answer

Switch

Answer

Hub

Answer

Repeater

Question 11

Refer to the exhibit. A network administrator configured the following firewall rules. After implementation, users from the internal network cannot browse the internet. Which element is causing the issue?

Accepted Answer

The rule order. The issue is that firewall rules are processed in sequential order from top to bottom, and the implicit deny-all rule at the end blocks any traffic that does not match an explicit permit rule. Since rule id=10 permits HTTP/HTTPS from internal to external, but rule id=20 blocks all traffic from the internal network, the deny rule (id=20) is evaluated before any later permit rule (id=30) and thus blocks all internet-bound traffic. The correct answer is D because the rule order causes the deny to override the intended permit.

Answer

Rule id=30

Answer

Rule id=10

Answer

Rule id=20

Question 12

A security operations center (SOC) analyst notices unusual outbound network traffic from a server that typically only receives connections. The traffic is encrypted and goes to an unknown external IP. Which step should the analyst perform FIRST?

Accepted Answer

Check the server's running processes and connections. Option D is correct because the analyst needs to gather more information before containing. Option A is too aggressive without confirmation. Option B is premature. Option C is reactive but less critical than investigation.

Answer

Power off the server

Answer

Block the outbound traffic at the firewall

Answer

Notify the system owner

Question 13

A company is implementing a data loss prevention (DLP) solution. Which strategy BEST balances security and productivity when monitoring outgoing email?

Accepted Answer

Alert on policy violations and allow user to override with manager approval. Option D is correct because it balances security and productivity by alerting on policy violations while allowing users to override the block with manager approval. This approach ensures that legitimate business communications are not disrupted, while still enforcing DLP policies through a secondary review process. In a DLP solution, this is often implemented via a 'justify and override' workflow, where the user must provide a reason and receive approval from a manager before the email is sent.

Answer

Log all emails without any alerts

Answer

Block all emails containing keywords like 'confidential'

Answer

Encrypt all outgoing emails automatically

Question 14

An organization wants to ensure that a critical database can be restored within 2 hours after a failure. Which metric should the organization define?

Accepted Answer

Recovery Time Objective (RTO). Option B is correct because RTO (Recovery Time Objective) defines the maximum acceptable downtime. Option A is about data loss. Option C is about recovery point. Option D is a testing metric.

Answer

Maximum Tolerable Downtime (MTD)

Answer

Service Level Agreement (SLA)

Answer

Recovery Point Objective (RPO)

Question 15

During a forensic investigation, the analyst needs to acquire a memory image from a live Windows system without altering evidence. Which tool is MOST appropriate?

Accepted Answer

FTK Imager. Option C is correct because FTK Imager can acquire memory with minimal impact. Option A is for disk imaging. Option B is a GUI tool but may alter memory. Option D is a volatility framework, not acquisition.

Answer

Volatility

Answer

EnCase

Answer

dd