ISC2 CC Practice Test 24 — 15 Questions

Question 1

Which TWO of the following are types of security controls?

Accepted Answer

Corrective. The question asks for types of security controls, and the standard control categories by function are preventive, detective, corrective, deterrent, compensating, and physical/administrative/technical. Option B (Corrective) is correct because corrective controls are a recognized functional category that acts after an incident to restore systems and reduce impact, such as backups, patches, or disaster recovery procedures. Option D (Preventive) is correct because preventive controls are a recognized functional category designed to stop incidents before they occur, such as firewalls, encryption, access controls, and security awareness training. Option A (Network) is not a control type but rather a domain or scope where controls can be applied, so it does not fit the question. Option C (All of the above) is wrong because it would include the incorrect Network option, and Option E (None of the above) is wrong because two valid control types are listed.

Answer

Network

Answer

All of the above

Answer

None of the above

Question 2

A security analyst notices unusual traffic on the network and wants to capture packets for analysis without altering traffic. Which device should they use?

Accepted Answer

Network tap. A network tap is a passive hardware device inserted inline (or via a mirror port) that copies traffic to a monitoring port without altering or delaying the original traffic. This makes it ideal for packet capture and analysis because it provides a true copy of the wire traffic and does not introduce a point of failure or modify packets. Firewalls, IPS, and proxies are all inline devices that can alter or block traffic.

Answer

Firewall

Answer

Intrusion Prevention System (IPS)

Answer

Proxy server

Question 3

Which THREE of the following are characteristics of a stateful firewall? (Select exactly three.)

Accepted Answer

It can automatically allow return traffic for outbound connections. Option A is correct because a stateful firewall tracks the connection state and can automatically permit return traffic for sessions initiated from inside the trusted network, rather than requiring a separate inbound rule. Option B is correct because the core mechanism of a stateful firewall is a state table (connection table) that records active sessions, including source/destination IPs, ports, sequence numbers, and TCP flags. Option E is correct because stateful firewalls make filtering decisions based on the context of the traffic flow, such as whether a packet belongs to an established, related, or new connection, rather than evaluating each packet in isolation. Option C is not correct here because application-layer payload inspection is characteristic of an application-layer firewall or next-generation firewall (NGFW) with deep packet inspection, not a defining feature of a basic stateful firewall. Option D is not correct because filtering solely on source/destination IP and port describes a stateless packet-filtering firewall, which does not maintain connection state.

Answer

It inspects application-layer payloads

Answer

It filters packets based solely on source/destination IP and port

Question 4

Which of the following ports is used by HTTPS for secure web traffic?

Accepted Answer

443. HTTPS uses port 443 by default.

Answer

80

Answer

22

Answer

53

Question 5

An account lockout policy is designed to mitigate which type of attack?

Accepted Answer

Brute force. An account lockout policy locks a user account after a specified number of failed login attempts, which mitigates brute force attacks by preventing attackers from making unlimited password guesses. Brute force attacks rely on trying many combinations; lockout stops this after a few attempts.

Answer

SQL injection

Answer

Man-in-the-middle

Answer

Phishing

Question 6

An organization wants to ensure that even if an attacker compromises a user's account, the damage is limited. Which principle is most directly applied?

Accepted Answer

Least privilege. Least privilege is the principle of granting users only the minimum access rights necessary to perform their job functions. If an attacker compromises a user's account, the damage is limited because the account has restricted permissions. This directly addresses limiting damage from a compromised account.

Answer

Separation of duties

Answer

Defense in depth

Answer

Need-to-know

Question 7

An LDAP distinguished name (DN) is formatted as: CN=John Smith,OU=Sales,DC=company,DC=com. Which component represents the organizational unit?

Accepted Answer

OU=Sales. In an LDAP distinguished name (DN), each component is identified by its attribute type. The organizational unit (OU) is represented by the 'OU=' attribute. In the given DN, 'OU=Sales' explicitly designates the organizational unit named 'Sales'.

Answer

DC=com

Answer

CN=John Smith

Answer

DC=company

Question 8

An organization's password policy requires passwords to be at least 8 characters long and prohibits common passwords found in breach databases. This policy aligns with which guideline?

Accepted Answer

NIST SP 800-63. NIST SP 800-63 (Digital Identity Guidelines) explicitly addresses authenticator and memorized-secret requirements, including minimum length and screening against breached-password lists (e.g., in SP 800-63B, section 5.1.1.2). The described policy — 8-character minimum plus blocklist of common/breached passwords — mirrors NIST's guidance almost verbatim.

Answer

COBIT

Answer

ISO 27001

Answer

PCI DSS

Question 9

An organization encrypts all sensitive data at rest and in transit. Which principle of the CIA triad is primarily being addressed?

Accepted Answer

Confidentiality. Encryption of data at rest and in transit directly protects data from unauthorized disclosure, which is the definition of confidentiality in the CIA triad. Encryption ensures that even if data is intercepted or accessed without authorization, it remains unreadable without the proper decryption key. This is the textbook control for the confidentiality principle.

Answer

Availability

Answer

Non-repudiation

Answer

Integrity

Question 10

A company deploys a web application that stores user passwords using a salted hash. During a security review, an auditor recommends switching from SHA-1 to SHA-256. What is the primary security benefit of this change?

Accepted Answer

It increases collision resistance. SHA-256 produces a 256-bit digest versus SHA-1's 160-bit digest, dramatically increasing the computational effort required to find two different inputs that hash to the same value. SHA-1 has known practical collision attacks (e.g., SHAttered in 2017), so migrating to SHA-256 strengthens the integrity of the stored password hashes against collision-based attacks. The salting still protects against rainbow tables, but the hash algorithm upgrade specifically addresses collision resistance.

Answer

It improves system availability

Answer

It provides encryption of the passwords at rest

Answer

It enhances non-repudiation

Question 11

A security analyst detects a large number of half-open TCP connections targeting a web server. This is most likely indicative of what type of attack?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending numerous SYN packets with spoofed source addresses, causing the server to allocate resources for half-open connections that never complete. The server's connection table fills up, exhausting resources and preventing legitimate connections. This matches the symptom of many half-open TCP connections observed by the analyst.

Answer

Smurf attack

Answer

ARP spoofing

Answer

DNS amplification

Question 12

An organization wants to ensure that all workstations are configured according to a hardened baseline. Which process detects when a workstation deviates from this baseline?

Accepted Answer

Automated configuration scanning. Automated configuration scanning continuously compares each workstation's settings against a defined hardened baseline and flags deviations. It is the only option that provides ongoing detection of drift from the security configuration standard.

Answer

Patch management

Answer

Change control

Answer

Security awareness training

Question 13

Which layer of the OSI model is responsible for routing packets based on IP addresses?

Accepted Answer

Network layer. The Network layer (Layer 3) is responsible for logical addressing and routing packets based on IP addresses. It determines the best path for data to travel across multiple networks, using routers to forward packets hop-by-hop. This layer encapsulates data into packets and handles fragmentation and reassembly when necessary.

Answer

Data Link layer

Answer

Transport layer

Answer

Physical layer

Question 14

An LDAP distinguished name (DN) is written as 'CN=John Smith,OU=Sales,DC=company,DC=com'. What does 'CN' represent?

Accepted Answer

Common Name. In an LDAP distinguished name (DN), 'CN' stands for Common Name. It is used to represent the name of an object, such as a user or a group. In the example 'CN=John Smith,OU=Sales,DC=company,DC=com', 'CN=John Smith' indicates the common name of the entry, which is typically the user's full name.

Answer

Domain Component

Answer

Organizational Unit

Answer

Country Name

Question 15

A security administrator needs to ensure that only authorized personnel can access the server room. Which physical control is most appropriate?

Accepted Answer

Biometric access control system. A biometric access control system verifies identity based on a unique physical characteristic (fingerprint, retina, iris), which cannot be shared, lost, or guessed like a code or card. This provides the strongest assurance that only specifically enrolled authorized personnel gain entry, satisfying the requirement more directly than any shared-secret or observational control.

Answer

Mantrap with card reader

Answer

Keypad lock with a shared code

Answer

Video surveillance cameras