ISC2 CC Practice Test 21 — 15 Questions

Question 1

Refer to the exhibit. What is the effect of this ACL?

Accepted Answer

Allows HTTP and HTTPS traffic to server 10.0.1.100, denies all other traffic. The ACL permits HTTP (port 80) and HTTPS (port 443) traffic from any source to host 10.0.1.100, and explicitly denies all other traffic.

Answer

Allows only HTTPS to 10.0.1.100

Answer

Denies HTTP and HTTPS to 10.0.1.100

Answer

Allows all traffic to 10.0.1.100

Question 2

During a disaster recovery test, an organization uses a warm site. The site has partially configured servers and network infrastructure but lacks recent data. The recovery team expects to have the system operational within 2 days. Which recovery metric is most directly addressed by the warm site's capabilities?

Accepted Answer

Recovery Time Objective (RTO). A warm site typically has hardware and partial configuration, allowing recovery in days. This directly impacts the recovery time objective (RTO), which is the target time for restoring systems and data.

Answer

Recovery Point Objective (RPO)

Answer

Maximum Tolerable Downtime (MTD)

Answer

Work Recovery Time (WRT)

Question 3

An organization experiences a data breach involving personally identifiable information (PII) of European Union residents. According to GDPR, which THREE of the following are required actions?

Accepted Answer

Document the breach, its effects, and the remedial actions taken.. GDPR requires notification to the supervisory authority within 72 hours, communication to affected data subjects without undue delay, and documentation of the breach. Conducting a BIA is not a GDPR breach notification requirement, and restoring systems is part of recovery but not a specific GDPR requirement.

Answer

Restore all affected systems from the latest full backup.

Answer

Conduct a Business Impact Analysis (BIA) to determine the financial impact.

Question 4

An incident response team is analyzing a data breach. Which THREE actions are part of the 'Lessons Learned' phase? (Select THREE)

Accepted Answer

Documenting the timeline of events and actions taken. Lessons Learned involves reviewing the incident, updating plans, and conducting post-mortems to improve future response. Identifying the root cause is part of analysis/eradication.

Answer

Identifying the root cause of the breach

Answer

Isolating affected systems to prevent further damage

Question 5

A company is selecting a recovery site strategy. Which TWO factors should be considered when choosing between a hot site and a warm site? (Select TWO.)

Accepted Answer

Cost. RTO and cost are primary differentiators: hot sites have shorter RTO but higher cost.

Answer

Number of employees

Answer

Color of the server racks

Answer

Type of operating system

Question 6

An organization is evaluating recovery site options. Which TWO factors are most critical when selecting between a hot site and a warm site? (Select TWO.)

Accepted Answer

Cost. The primary factors are recovery time objective (RTO) and cost. Hot sites provide fast RTO but are expensive; warm sites are cheaper but have longer RTO.

Answer

Geographic diversity

Answer

Number of employees

Answer

Regulatory compliance

Question 7

During an incident, a security analyst detects unusual network traffic from a workstation that is exfiltrating data to an external IP address. The analyst isolates the workstation. Which incident response phase does the isolation action belong to?

Accepted Answer

Containment. Containment is the phase where actions are taken to stop the incident from spreading or causing further damage, such as isolating affected systems.

Answer

Detection

Answer

Analysis

Answer

Eradication

Question 8

Which backup method copies all data that has changed since the last full backup, regardless of subsequent incremental or differential backups?

Accepted Answer

Differential backup. A differential backup copies all changes since the last full backup, making it distinct from incremental which copies changes since the last backup of any type.

Answer

Full backup

Answer

Synthetic full backup

Answer

Incremental backup

Question 9

A healthcare organization suffers a data breach involving protected health information (PHI). The incident occurred on Monday, and the organization discovers it on Wednesday. Under GDPR, if the breach affects EU residents, what is the deadline for notifying the supervisory authority?

Accepted Answer

Saturday. GDPR requires notification within 72 hours of becoming aware of the breach.

Answer

Wednesday (day of discovery)

Answer

Thursday

Answer

Monday (day of breach)

Question 10

Which type of recovery site is pre-configured with hardware and software, but does not have live data, typically requiring days to become operational?

Accepted Answer

Warm site. A warm site has partially configured infrastructure but no current data, leading to RTO of days.

Answer

Cloud-based recovery

Answer

Cold site

Answer

Hot site

Question 11

Which recovery site strategy provides the fastest recovery time, typically within hours, and is a fully mirrored environment ready to take over operations immediately?

Accepted Answer

Hot site. A hot site is fully configured with current data and systems, allowing recovery within hours.

Answer

Reciprocal agreement

Answer

Warm site

Answer

Cold site

Question 12

During a disaster, an organization activates a reciprocal agreement with another company. What is a primary risk associated with this strategy?

Accepted Answer

Potential lack of capacity when both parties need resources simultaneously. Reciprocal agreements often fail because one party may lack capacity or resources when needed.

Answer

Long RTO due to data transfer

Answer

High cost of maintaining duplicate infrastructure

Answer

Incompatible hardware

Question 13

Which backup strategy requires the least amount of time to perform a daily backup but the most time to perform a full restore?

Accepted Answer

Incremental backup. Incremental backups only back up changes since the last backup (any type), making them fastest to perform but slowest to restore because all increments since the last full must be applied.

Answer

Differential backup

Answer

Full backup

Answer

Synthetic full backup

Question 14

According to NIST SP 800-63, which password policy is most recommended?

Accepted Answer

Enforce a minimum length of 8 characters and check against breached password lists. NIST SP 800-63 emphasizes password length over complexity and discourages frequent mandatory changes.

Answer

Allow short passwords but require numbers and symbols

Answer

Use complex passwords with special characters and minimal length

Answer

Require frequent password changes every 30 days

Question 15

In Active Directory, a GPO is used to enforce a policy that automatically locks user sessions after 15 minutes of inactivity. This is an example of which type of access control?

Accepted Answer

Logical access control. Session timeouts are logical access controls that reduce risk of unauthorized access from unattended workstations.

Answer

Detective access control

Answer

Physical access control

Answer

Administrative access control