ISC2 CC Practice Test 22 — 15 Questions

Question 1

A security analyst notices multiple failed login attempts from a single IP address within a short period. Which control would best mitigate this brute force attack?

Accepted Answer

Account lockout. Account lockout disables an account after a threshold of failed attempts, thwarting brute force attacks.

Answer

Session timeout

Answer

Password complexity

Answer

Least privilege

Question 2

Which access control principle restricts access to data based on the user's job role and tasks?

Accepted Answer

Need to know. Need-to-know restricts access to data only when necessary for job tasks, separate from least privilege which focuses on permissions.

Answer

Separation of duties

Answer

Defense in depth

Answer

Least privilege

Question 3

An employee is assigned a user account with read-only access to the sales database. However, the employee's job requires viewing only customer contact information, not sales figures. Which access control principle is being violated?

Accepted Answer

Need-to-know. Need-to-know restricts access to only the data necessary for job functions, separate from the permissions level (least privilege). Here, the employee has permissions to read data they do not need.

Answer

Defense in depth

Answer

Least privilege

Answer

Separation of duties

Question 4

Which of the following is an example of a logical access control?

Accepted Answer

Password complexity policy. Logical access controls are technology-based mechanisms like passwords, biometrics, and ACLs.

Answer

Security guard at entrance

Answer

Visitor logbook

Answer

Fence around building

Question 5

In the identification and authentication process, which step occurs first?

Accepted Answer

Identification. Identification is the claim of identity (e.g., username) before authentication proves it.

Answer

Accounting

Answer

Authentication

Answer

Authorization

Question 6

What is the process of claiming an identity called?

Accepted Answer

Identification. Identification is the act of claiming an identity, such as providing a username.

Answer

Authentication

Answer

Authorization

Answer

Accountability

Question 7

An organization is implementing a visitor management policy. Which THREE should be included? (Select THREE.)

Accepted Answer

Issuance of temporary visitor badges. Visitor management typically includes sign-in, escort policies, and visitor badges to track and control visitor access.

Answer

Background checks for all visitors

Answer

Biometric authentication for visitors

Question 8

A company requires that financial transactions be approved by two different managers before execution. This is an example of which access control principle?

Accepted Answer

Separation of duties. Separation of duties ensures no single individual can complete a high-risk action alone.

Answer

Need-to-know

Answer

Defense in depth

Answer

Least privilege

Question 9

Which of the following is a common mitigation technique for a SYN flood attack?

Accepted Answer

SYN cookies. SYN cookies allow the server to respond to SYN requests without maintaining state until the connection is verified, reducing the impact of SYN floods.

Answer

Use UDP instead of TCP

Answer

Disable TCP timestamps

Answer

Increase the TCP backlog queue

Question 10

Which TWO of the following correctly describe components of a directory service distinguished name (DN) in LDAP? (Select two.)

Accepted Answer

OU=Sales. In LDAP, a distinguished name uses CN (Common Name), OU (Organizational Unit), and DC (Domain Component). CN=John Smith and OU=Sales are valid components.

Answer

UID=jsmith

Answer

SN=Smith

Answer

GID=1234

Question 11

An LDAP distinguished name is written as: CN=John Smith,OU=Sales,DC=company,DC=com. What do the 'OU' and 'DC' components represent?

Accepted Answer

OU = Organizational Unit; DC = Domain Component. OU = Organizational Unit, DC = Domain Component.

Answer

OU = Organizational Unit; DC = Domain Controller

Answer

OU = Organizational Unit; DC = Distinguished Component

Answer

OU = Object Unit; DC = Domain Component

Question 12

Which of the following is an example of a logical access control?

Accepted Answer

Password policy requiring 8 characters. A password is a logical (software-based) control that authenticates users.

Answer

Biometric reader on a server room door

Answer

Fencing around a building

Answer

Security guards

Question 13

An organization uses a layered security approach: perimeter fencing, access badge readers at building entrances, biometric scanners in server rooms, and cable locks on laptops. This strategy best exemplifies which access control concept?

Accepted Answer

Defense in depth. Defense in depth employs multiple, overlapping layers of security controls to protect assets; if one layer fails, others still provide protection.

Answer

Need-to-know

Answer

Least privilege

Answer

Separation of duties

Question 14

Which TWO are examples of logical access controls? (Select TWO.)

Accepted Answer

Password complexity requirements. Logical controls are software-based. Passwords and account lockout are logical.

Answer

Fencing around the property

Answer

Guard at building entrance

Answer

Biometric door lock

Question 15

Which type of access control is implemented by a cable lock attached to a laptop?

Accepted Answer

Physical access control. Cable locks are physical security controls that prevent theft.

Answer

Administrative access control

Answer

Logical access control

Answer

Technical access control