ISC2 CC Practice Test 23 — 15 Questions

Question 1

According to the NIST 800-61 incident response lifecycle, after containment and eradication have been performed, what is the next phase?

Accepted Answer

Recovery. According to the NIST 800-61 incident response lifecycle, the phases are Preparation, Detection & Analysis, Containment/Eradication, and Recovery. After containment (isolating the threat) and eradication (removing malware, patching vulnerabilities), the next phase is Recovery, where systems are carefully restored to normal operations, often using clean backups and verifying system integrity before reconnecting to the network.

Answer

Post-incident activity

Answer

Detection and analysis

Answer

Preparation

Question 2

A financial services company is conducting a Business Impact Analysis (BIA) for its online banking platform. Which THREE of the following are correctly defined metrics used in BIA?

Accepted Answer

Recovery Time Objective (RTO) – the maximum amount of time to restore a business function after a disruption.. Option B is correct because the Recovery Time Objective (RTO) is a core BIA metric defining the maximum acceptable time to restore a business function or process after a disruption before unacceptable consequences occur. Option C is correct because the Maximum Tolerable Downtime (MTD), also called Maximum Acceptable Outage (MAO), defines the total time a business function can be unavailable before causing irreparable harm to the organization, and it typically bounds the RTO. Option E is correct because the Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time, determining the required backup or replication frequency. Option A is not a BIA metric but a contractual service commitment, and Option D is a risk-analysis quantitative value (SLE × ARO) rather than a BIA recovery metric.

Answer

Service Level Agreement (SLA) – the contractual uptime percentage guaranteed to customers.

Answer

Annualized Loss Expectancy (ALE) – the expected monetary loss per year from a risk.

Question 3

During a tabletop exercise for a data center outage, the IT manager realizes that the disaster recovery plan does not specify how to failover the database cluster. The primary data center fails completely. The standby site has a replica of the database, but the application team cannot promote it because they lack the necessary privileges. What is the most likely cause of this gap?

Accepted Answer

The DR plan did not include role-based access for failover operations. The scenario explicitly states that the application team lacks the necessary privileges to promote the standby database. This indicates that the disaster recovery plan did not define role-based access controls (RBAC) or assign failover permissions to specific personnel or groups. Without documented roles and privileges, even a fully replicated standby database cannot be promoted, causing a failover gap.

Answer

The standby site's network connectivity was not tested

Answer

The database replication configuration was incorrect

Answer

The database failover procedure was not documented

Question 4

During a security audit, a penetration tester captures network traffic and finds that some packets have the IP ID field set to 0 and the DF (Don't Fragment) flag set. What is this technique attempting to do?

Accepted Answer

Perform a stealth scan using a zombie host to hide the attacker's identity. Setting the IP ID field to 0 and the DF flag in packets is characteristic of an idle scan (also known as a stealth scan). This technique uses a zombie host (with an incremental IP ID) to probe a target; by sending packets with DF set and IP ID 0 to the zombie, the attacker can observe changes in the zombie's IP ID to infer open ports on the target, thereby hiding the attacker's true IP address.

Answer

Spoof the source IP address of the attacker's machine

Answer

Launch a denial-of-service attack against the target

Answer

Evade a firewall by fragmenting packets

Question 5

During a security assessment, a penetration tester captures unencrypted credentials over the network. Which protocol is most likely being used?

Accepted Answer

FTP. FTP (File Transfer Protocol) transmits data, including credentials, in cleartext over the network. When a penetration tester captures unencrypted credentials, FTP is a likely candidate because it does not encrypt the authentication process, making it vulnerable to packet sniffing attacks.

Answer

SMTPS

Answer

SSH

Answer

HTTPS

Question 6

During a routine security audit, an analyst finds that several critical servers have misconfigured firewall rules allowing inbound SSH access from the entire internet. Which immediate action should the analyst take?

Accepted Answer

Modify the firewall rules to allow SSH only from specific management IPs. The immediate priority is to eliminate the critical vulnerability by restricting inbound SSH access to only authorized management IPs. This aligns with the principle of least privilege and the immediate remediation steps in security incident response, as leaving the misconfiguration active even briefly exposes the servers to potential compromise.

Answer

Disable SSH on all servers

Answer

Notify the server owners and wait for their response

Answer

Document the finding and include it in the audit report

Question 7

A network administrator notices unusual traffic from an internal workstation to an external IP address on port 443. The workstation has no business reason for such communication. Which action should the administrator take first?

Accepted Answer

Investigate the workstation for possible malware.. The first priority when encountering unexpected outbound traffic to an external IP on port 443 (HTTPS) is to investigate the workstation for possible malware. This traffic could indicate a command-and-control (C2) beacon or data exfiltration, and immediate investigation allows the administrator to gather forensic evidence before taking disruptive actions. Disabling the port or blocking traffic without investigation could destroy evidence or alert an attacker, while allowing the traffic would be negligent.

Answer

Disable the workstation's network port.

Answer

Block all outbound traffic from that workstation immediately.

Answer

Configure a firewall rule to allow the traffic and log it.

Question 8

A security analyst is reviewing logs and finds that a user accessed files outside of their department. The user claims it was necessary for a project. Which principle should the analyst use to assess whether this was appropriate?

Accepted Answer

Need to know. The 'need to know' principle restricts access to information based on the specific requirements of a user's role or project. In this scenario, the analyst must verify if the user's project actually required access to those specific files, not just if the user had the technical ability to access them. This principle is a subset of least privilege, focusing on data access rather than system permissions.

Answer

Accountability

Answer

Separation of duties

Answer

Least privilege

Question 9

A company implements redundant servers to ensure that if one server fails, another can take over immediately. Which security principle is primarily being addressed?

Accepted Answer

Availability. Redundant servers ensure that if one fails, another takes over immediately, maintaining uptime and continuous access to resources. This directly addresses the security principle of availability, which ensures systems and data are accessible when needed.

Answer

Authentication

Answer

Integrity

Answer

Confidentiality

Question 10

An organization uses fencing, bollards, and lighting around the perimeter, guards at the main entrance, and biometric readers on server room doors. This approach is an example of:

Accepted Answer

Defense in depth. Defense in depth is a layered security strategy where multiple overlapping controls are deployed so that if one fails, others still protect the asset. The scenario shows physical perimeter controls (fencing, bollards, lighting), personnel controls (guards), and logical/physical access controls (biometric readers) — clearly multiple layers. This matches the core definition of defense in depth.

Answer

Separation of duties

Answer

Least privilege

Answer

Need-to-know

Question 11

A security team identifies a vulnerability in a web application that could allow attackers to steal customer data. The team decides to accept the risk because the cost to fix exceeds the potential loss. This is an example of:

Accepted Answer

Risk acceptance. Risk acceptance means acknowledging the risk and choosing not to mitigate it, often due to cost-benefit analysis.

Answer

Risk transfer

Answer

Risk avoidance

Answer

Risk mitigation

Question 12

A company uses a proxy server for internet access. Employees can browse websites (HTTP/HTTPS), but they cannot connect to external FTP servers using FTP client software (e.g., FileZilla). The proxy is configured to allow HTTP and HTTPS only. The security team wants to allow FTP while maintaining security (e.g., logging and filtering). The FTP traffic is used for occasional file transfers with partners. Which of the following is the BEST solution to meet both requirements?

Accepted Answer

Install a separate FTP proxy in the DMZ and adjust firewall rules to allow FTP traffic to that proxy.. Deploying a dedicated FTP proxy in the DMZ allows the security team to inspect, log, and filter FTP traffic while keeping the existing HTTP/HTTPS proxy unchanged. Firewall rules can be tightened to permit FTP only to that proxy, which then forwards connections to external FTP servers, maintaining a secure, auditable chokepoint without exposing internal clients directly to FTP.

Answer

Use SSH tunneling to encapsulate FTP traffic over SSH to a jump server.

Answer

Configure the proxy to allow FTP traffic by adding FTP as an allowed protocol.

Answer

Enable FTP passive mode on the proxy.

Question 13

An organization labels its financial reports as "Confidential" and requires encryption at rest and in transit. This is an example of:

Accepted Answer

Data classification. Labeling data as 'Confidential' and applying handling requirements like encryption at rest and in transit is data classification — the process of categorizing data by sensitivity to determine appropriate protection. The label drives the controls, which is the essence of classification.

Answer

Data retention

Answer

Data obfuscation

Answer

Data masking

Question 14

A company requires all visitors to sign in, wear a visible badge, and be escorted while on premises. This is an example of:

Accepted Answer

Visitor management. Visitor management encompasses the administrative and physical controls used to register, badge, and escort non-employees on premises — exactly the sign-in, badge, and escort requirements described. It is a physical security control category focused on controlling and tracking visitors.

Answer

Separation of duties

Answer

Logical access control

Answer

Defense in depth

Question 15

During a data breach incident, the incident response team discovers that personally identifiable information (PII) of European Union residents was compromised. According to GDPR, what is the maximum time frame for notifying the supervisory authority?

Accepted Answer

72 hours. GDPR Article 33 mandates that a controller notify the competent supervisory authority of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to natural persons' rights and freedoms. This is the maximum allowable window under the regulation.

Answer

48 hours

Answer

7 days

Answer

24 hours