ISC2 CC Practice Test 22 — 15 Questions

Question 1

Which access control model uses subject and object labels to enforce access based on a security policy?

Accepted Answer

Mandatory Access Control (MAC). Mandatory Access Control (MAC) enforces access decisions based on security labels assigned to subjects (users/processes) and objects (files/resources). The system, not the user, controls access by comparing these labels against a security policy, such as Bell-LaPadula or Biba. This is why MAC is the correct answer for label-based enforcement.

Answer

Discretionary Access Control (DAC)

Answer

Attribute-Based Access Control (ABAC)

Answer

Role-Based Access Control (RBAC)

Question 2

Which OSI layer is responsible for logical addressing, routing, and forwarding of packets, and where does an IP address operate?

Accepted Answer

Layer 3 – Network. Layer 3 (Network) handles IP addresses, routing, and packet forwarding.

Answer

Layer 2 – Data Link

Answer

Layer 1 – Physical

Answer

Layer 4 – Transport

Question 3

A company decides to accept the risk of using a legacy system because the cost of replacing it exceeds potential losses. This is an example of:

Accepted Answer

Risk acceptance. Risk acceptance means acknowledging the risk and not taking further action.

Answer

Risk avoidance

Answer

Risk transfer

Answer

Risk mitigation

Question 4

An organization must comply with PCI DSS log retention requirements. What is the minimum retention period for logs, and how long must they be immediately available for analysis?

Accepted Answer

12 months retention, 3 months immediately available. PCI DSS requires logs to be retained for at least 12 months, with the most recent 3 months immediately available for review.

Answer

24 months retention, 12 months immediately available

Answer

6 months retention, 1 month immediately available

Answer

12 months retention, 6 months immediately available

Question 5

Which of the following is the PRIMARY purpose of a business impact analysis (BIA)?

Accepted Answer

Identify critical business processes and their recovery priorities. The primary purpose of a business impact analysis (BIA) is to identify critical business processes and quantify the impact of their disruption, which directly determines recovery priorities and objectives (RTO/RPO). This output drives the business continuity and disaster recovery strategy, not asset inventory or cost estimation.

Answer

Determine the cost of implementing security controls

Answer

List all IT assets

Answer

Assign incident response roles

Question 6

An organization wants to ensure that its backup strategy can recover data within 2 hours after a system failure. Which metric should be defined in the disaster recovery plan?

Accepted Answer

Recovery Time Objective (RTO). The Recovery Time Objective (RTO) defines the maximum acceptable time to restore systems and data after a disaster, directly addressing the 2-hour recovery requirement. In the context of backup strategy, RTO drives decisions on failover mechanisms, replication speed, and restoration procedures to meet the specified downtime limit.

Answer

Mean Time Between Failures (MTBF)

Answer

Recovery Point Objective (RPO)

Answer

Service Level Agreement (SLA)

Question 7

A security analyst reviews firewall logs and sees a series of outbound connections from an internal server to a known command-and-control (C2) IP address at regular intervals. Which step should the analyst take first according to incident response best practices?

Accepted Answer

Check if the IP address is associated with known malware or threats.. According to incident response best practices, the first step after detecting a potential incident is to verify and validate the alert by checking if the IP is associated with known threats. This confirms whether it is a true positive before taking disruptive actions. Isolation, quarantine, and blocking are subsequent steps.

Answer

Isolate the server from the network immediately.

Answer

Quarantine the server and begin forensic analysis.

Answer

Terminate the outbound connections by blocking the IP.

Question 8

You are implementing a security control to prevent unauthorized devices from connecting to the corporate wired network. Which network access control method should be used?

Accepted Answer

802.1X authentication. 802.1X is the IEEE standard for port-based network access control that authenticates devices and/or users before granting access to a wired or wireless LAN port. It uses EAP over LAN (EAPOL) between the supplicant and authenticator, and RADIUS between the authenticator and authentication server, providing strong, credential-based admission control. This directly addresses preventing unauthorized devices from connecting to the wired network.

Answer

VLAN segmentation

Answer

MAC address filtering

Answer

Network Access Control (NAC) only

Question 9

Which transport layer protocol is used by voice over IP (VoIP) applications that require low latency and can tolerate some packet loss?

Accepted Answer

UDP. UDP is connectionless and has no retransmission, ordering, or congestion-control overhead, which minimizes latency—exactly what VoIP needs. It tolerates some packet loss because voice codecs can interpolate or conceal minor gaps, and retransmitting lost voice packets would arrive too late to be useful anyway.

Answer

ICMP

Answer

SCTP

Answer

TCP

Question 10

An organization must retain authentication logs for compliance with PCI DSS. What is the minimum retention period and the requirement for immediate availability?

Accepted Answer

12 months retention with 3 months immediately available. PCI DSS Requirement 10.7 mandates retaining audit logs for at least 12 months, with a minimum of the most recent 3 months immediately available for analysis. This ensures organizations can investigate recent incidents quickly while still preserving a full year of history for forensic and compliance review.

Answer

6 months retention with 1 month immediately available

Answer

24 months retention with 12 months immediately available

Answer

18 months retention with 6 months immediately available

Question 11

Refer to the exhibit. What type of event is this?

Accepted Answer

Failed network login. The event shows a failed network logon (Logon Type 3) with a failure status code. Option A is incorrect because an account lockout event would have a different event ID (e.g., 4740), not a Logon Type 3 failure. Option B is incorrect because the event indicates a failure (e.g., status 0xC000006D), not a successful login. Option D is incorrect because Logon Type 3 indicates a network logon, whereas a local logon would be Type 2 or 10.

Answer

Account lockout

Answer

Successful remote login

Answer

Failed local login

Question 12

A company is implementing risk management for a new project. Which THREE of the following are valid risk treatment options? (Select THREE.)

Accepted Answer

Risk acceptance. Risk acceptance (A) is a valid risk treatment option because the organization consciously decides to tolerate the risk without taking action, often when the cost of mitigation exceeds the potential impact. Risk transfer (B) is valid because the organization shifts the financial impact of a risk to a third party, typically through insurance, outsourcing, or contracts. Risk mitigation (D) is valid because it involves taking actions to reduce the probability or impact of a risk, such as implementing controls or safeguards. Risk communication (C) is not a treatment option; it is an ongoing activity for sharing risk information among stakeholders. Risk analysis (E) is not a treatment option either; it is part of risk assessment, used to identify and evaluate risks before treatment decisions are made.

Answer

Risk communication

Answer

Risk analysis

Question 13

During a security audit, you discover that a financial application stores passwords using MD5 hashing without salt. What is the primary security concern with this practice?

Accepted Answer

Without salting, the hashes are vulnerable to precomputed rainbow table attacks. MD5 is a fast hash, making it susceptible to brute-force and rainbow table attacks. Without salting, identical passwords produce identical hashes, allowing precomputed rainbow tables to quickly reverse them. Hashing is one-way, so MD5 is not reversible in the true sense. Speed is a vulnerability, not a benefit. Compliance is secondary but not the primary security concern.

Answer

MD5 is reversible, allowing attackers to recover plaintext passwords

Answer

MD5 is too slow, causing performance issues during authentication

Answer

Storing hashes violates PCI DSS compliance, but does not affect security

Question 14

A security analyst observes these SSH logs. What is the MOST likely attack?

Accepted Answer

Brute force attack on SSH service. The SSH logs show repeated failed authentication attempts from the same or multiple source IPs against common accounts (root, admin), which is the signature of a brute force attack. Automated tools like Hydra or Medusa cycle through username/password combinations, generating a high volume of 'Failed password' entries in a short time window. This pattern distinguishes brute force from other SSH-related attacks.

Answer

Session hijacking via SSH

Answer

Phishing attack targeting root and admin accounts

Answer

Denial of service attack on port 22

Question 15

A security analyst discovers that a user's account has been used to access sensitive data outside of normal business hours from an unfamiliar IP address. The user claims they were not logged in at that time. Which security operations process should be initiated first?

Accepted Answer

Initiate the incident response process. The scenario describes a potential security incident—unauthorized access to sensitive data from an unfamiliar IP address outside business hours—which requires immediate activation of the incident response process. The first step in any security operations workflow is to follow the organization's incident response plan (NIST SP 800-61) to contain, analyze, and remediate the threat. Jumping to forensic analysis, password resets, or account disabling without a coordinated incident response can destroy evidence or fail to address the root cause.

Answer

Perform a forensic analysis of the user's workstation

Answer

Reset the user's password and enforce multi-factor authentication

Answer

Disable the user account immediately