ISC2 CC Practice Test 24 — 15 Questions

Question 1

A security analyst receives an alert from the SIEM indicating a potential data exfiltration event. The alert shows a large volume of data being transferred to an external IP address during non-business hours. What is the MOST appropriate immediate action?

Accepted Answer

Verify whether the transfer is authorized.. Option D is correct because verifying the transfer's authorization prevents unnecessary disruption. Option A is too drastic without confirmation. Option B is not efficient and may tip off the user. Option C does not address exfiltration.

Answer

Call the employee who owns the server.

Answer

Disconnect the affected server from the network.

Answer

Run an antivirus scan on the server.

Question 2

A security analyst is reviewing event logs and notices multiple failed login attempts from a single IP address followed by a successful login. Which TWO actions should the analyst take next?

Accepted Answer

Escalate to the incident response team.. Options B and E are correct. Investigating the source IP and escalating to the incident response team are appropriate first steps. Disabling the account or resetting the password may be necessary later but should be done after investigation. Blocking the IP may be done but escalation is more critical.

Answer

Disable the user account immediately.

Answer

Block the IP address at the firewall.

Answer

Reset the password for the affected account.

Question 3

An employee reports receiving a suspicious email with an attachment from an unknown sender. What is the first action the employee should take?

Accepted Answer

Report the email to the security team.. Reporting the email to the security team allows professionals to analyze and respond appropriately. Deleting the email or opening the attachment can be dangerous; forwarding may spread the threat.

Answer

Open the attachment to check its content.

Answer

Forward the email to all employees as a warning.

Answer

Delete the email immediately.

Question 4

During a security incident, the incident response team needs to preserve evidence for potential legal action. Which of the following is the most important action to take when collecting volatile data from a compromised server?

Accepted Answer

Capture the contents of RAM.. Volatile data in RAM is lost when power is removed. Capturing RAM preserves evidence that might contain running processes, network connections, and encryption keys. Disk images are non-volatile and can be collected later.

Answer

Make a bit-for-bit copy of all storage.

Answer

Create a forensic image of the hard drive.

Answer

Review system logs.

Question 5

Which THREE of the following are important steps in the incident response process as defined by the NIST framework? (Choose three.)

Accepted Answer

Detection and Analysis. Preparation (B), Detection & Analysis (C), and Containment, Eradication & Recovery (D) are the core phases. Vulnerability scanning (A) is part of ongoing security, not incident response. Auditing (E) is a compliance activity.

Answer

Vulnerability scanning

Answer

Post-incident auditing

Question 6

Which of the following is an example of a detective control?

Accepted Answer

Intrusion Detection System (IDS). Option A is correct because an Intrusion Detection System (IDS) detects and alerts on suspicious activity. Option B is a preventive control. Option C is a preventive control. Option D is a directive control.

Answer

Security awareness training

Answer

Firewall

Answer

Encryption

Question 7

A security analyst is configuring an intrusion detection system (IDS) to detect SQL injection attacks. Which method is most effective?

Accepted Answer

Examine HTTP request parameters for SQL commands. Option D is correct because examining HTTP request parameters for SQL commands directly detects SQL injection attempts. The other options are unrelated or less effective.

Answer

Analyze DNS query patterns

Answer

Detect port scans from external IPs

Answer

Monitor bandwidth usage for spikes

Question 8

Which THREE of the following are best practices for securing a wireless network?

Accepted Answer

Disable SSID broadcast. WPA2 encryption, disabling SSID broadcast (though not strong, often considered best practice in older materials), and using a strong passphrase are commonly recommended. MAC filtering and captive portals are not primary security controls.

Answer

Enable MAC address filtering

Answer

Implement a captive portal

Question 9

An organization is implementing a patch management program. Which of the following is the BEST approach to minimize risk while maintaining operational stability?

Accepted Answer

Deploy patches to a test environment before production.. Option A is correct because testing patches in a staging environment reduces the chance of adverse impacts. Option B is risky without testing. Option C leaves many systems vulnerable. Option D ignores important security patches.

Answer

Skip patches that are not related to security.

Answer

Apply patches to all systems simultaneously.

Answer

Only patch systems that are internet-facing.

Question 10

Which THREE of the following are considered essential security principles according to ISC2?

Accepted Answer

Separation of duties. Correct: A, B, D. Least privilege, non-repudiation, and separation of duties are key security principles. Biometrics and encryption are mechanisms, not principles.

Answer

Encryption

Answer

Biometrics

Question 11

A company requires employees to use biometric authentication to access the data center. This is an example of which security principle?

Accepted Answer

Authentication. Correct: D - Authentication. Authentication is the process of verifying the identity of a user, and biometrics is one method. Option A is wrong because non-repudiation ensures actions cannot be denied, not identity verification. Option B is wrong because availability ensures systems are accessible. Option C is wrong because integrity ensures data accuracy.

Answer

Availability

Answer

Integrity

Answer

Non-repudiation

Question 12

Which TWO of the following are primary goals of the security principle of confidentiality?

Accepted Answer

Protect data in transit. Correct: A and C. Confidentiality ensures data is not disclosed to unauthorized parties, covering both storage and transmission. Data accuracy (integrity), system uptime (availability), and identity verification (authentication) are not confidentiality goals.

Answer

Ensure data accuracy

Answer

Maintain system uptime

Answer

Provide user authentication

Question 13

After a security breach, investigators find that an attacker exploited a vulnerability in a publicly accessible application to gain access to internal databases. Which security principle would have most effectively limited the impact?

Accepted Answer

Defense in depth

Answer

Accountability

Answer

Confidentiality

Answer

Non-repudiation

Question 14

A company implements a policy that requires two employees to approve any financial transaction over $10,000. Which security principle is being applied?

Accepted Answer

Separation of duties. Separation of duties ensures that no single individual has control over all critical functions, reducing the risk of fraud or error. In this scenario, requiring two approvals for large transactions institutionalizes the principle.

Answer

Need to know

Answer

Defense in depth

Answer

Least privilege

Question 15

Which TWO of the following are methods to ensure non-repudiation? (Select two).

Accepted Answer

Audit logs. Digital signatures provide cryptographic proof of origin, and audit logs provide a record of actions. Together they ensure that a party cannot deny involvement.

Answer

Biometric authentication

Answer

Access control lists

Answer

Encryption