ISC2 CC Practice Test 25 — 15 Questions

Question 1

A security analyst is reviewing physical security controls. Which TWO are examples of perimeter physical controls? (Select TWO.)

Accepted Answer

Fencing around the property. Perimeter controls secure the outer boundary. Fencing and lighting are common perimeter controls; badges and biometrics are interior or point-of-entry controls.

Answer

Access badges at building entrance

Answer

Biometric reader on server room door

Answer

Cable locks on laptops

Question 2

An organization wants to implement layered physical security for its data center. Which THREE of the following controls would be considered part of a defense-in-depth physical security strategy?

Accepted Answer

Cable locks on laptop computers. Defense in depth for physical security involves multiple layers: external perimeter controls (fencing, bollards, lighting), building entrance controls (guards, access badges, mantraps), and internal controls (server room biometric readers, equipment locks). Together they create overlapping barriers.

Answer

Password complexity requirements

Answer

Visitor sign-in log

Question 3

A security engineer is configuring a network security device that can block malicious HTTP requests based on application-layer inspection. Which device type is most suitable?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) specifically inspects HTTP/HTTPS traffic and can block attacks like SQL injection and XSS.

Answer

Intrusion Prevention System (IPS)

Answer

Network-based Intrusion Detection System (NIDS)

Answer

Stateful firewall

Question 4

Which protocol is used to resolve IP addresses to MAC addresses on a local network?

Accepted Answer

ARP. ARP (Address Resolution Protocol) maps IP addresses to MAC addresses within the same network.

Answer

DHCP

Answer

DNS

Answer

ICMP

Question 5

Which of the following is an indicator of a phishing email?

Accepted Answer

The email includes a link that directs to a website with a domain similar to, but not exactly, the company's official domain. Phishing emails often contain suspicious links that lead to malicious websites. Unexpected senders and urgency are also common indicators.

Answer

The email has a professional signature with contact information

Answer

The email comes from a known colleague and contains a file attachment they mentioned earlier

Answer

The email is sent during regular business hours

Question 6

A security analyst notices unusual traffic on the network and wants to capture packets for analysis without altering traffic. Which device should they use?

Accepted Answer

Network tap. A network tap (or port mirror) creates a copy of traffic for passive monitoring. A firewall blocks/allows traffic, an IPS blocks malicious traffic, and a proxy modifies requests.

Answer

Firewall

Answer

Intrusion Prevention System (IPS)

Answer

Proxy server

Question 7

Which OSI layer is responsible for logical addressing and routing?

Accepted Answer

Network layer. The Network layer (Layer 3) handles IP addressing and routing decisions.

Answer

Data Link layer

Answer

Transport layer

Answer

Physical layer

Question 8

Which three of the following are benefits of using VLANs in a network? (Choose three.)

Accepted Answer

Enhanced security through network segmentation. VLANs improve security through segmentation, reduce broadcast traffic, and simplify network changes. They do not increase collision domains (switches eliminate collisions) and do not replace routing.

Answer

Eliminates the need for routing

Answer

Increased collision domains

Question 9

What is the primary difference between an IDS and an IPS?

Accepted Answer

IDS only alerts, IPS can block traffic. IDS is passive (alerts), IPS is inline (can block).

Answer

IDS is faster than IPS

Answer

IDS is hardware, IPS is software

Answer

IDS monitors only hosts, IPS monitors network

Question 10

A company deploys a device that inspects HTTP and HTTPS traffic to block SQL injection and cross-site scripting attacks. This device is best described as a:

Accepted Answer

Web application firewall (WAF). A Web Application Firewall (WAF) is specifically designed to protect web applications by filtering and monitoring HTTP/HTTPS traffic, often using rules like OWASP to block common attacks.

Answer

Stateful firewall

Answer

Honeypot

Answer

Network-based IPS

Question 11

A firewall that filters traffic based solely on source and destination IP addresses and ports without considering the state of connections is known as a:

Accepted Answer

Stateless firewall. A stateless (packet-filtering) firewall examines each packet independently and does not track connection state.

Answer

Application proxy

Answer

Stateful firewall

Answer

Next-generation firewall

Question 12

A company's public web server is placed in a separate network segment that is accessible from the internet but isolated from the internal LAN. What is this network architecture called?

Accepted Answer

DMZ. A DMZ (demilitarized zone) is a buffer network for public-facing services.

Answer

Subnet

Answer

Honeypot

Answer

VLAN

Question 13

Which protocol is considered insecure because it transmits data in cleartext, including passwords?

Accepted Answer

Telnet. Telnet (port 23) sends all data, including credentials, in plaintext.

Answer

SFTP

Answer

SSH

Answer

HTTPS

Question 14

A legacy system cannot be patched due to vendor unavailability. Which compensating control would be most effective in reducing the risk of exploitation?

Accepted Answer

Deploy a web application firewall (WAF) in front of the system.. Network isolation prevents attackers from reaching the vulnerable system, while a WAF adds an additional layer of defense for web-based vulnerabilities.

Answer

Increase logging and monitoring of the system.

Answer

Perform weekly vulnerability scans on the system.

Answer

Apply a virtual patch using an intrusion prevention system (IPS).

Question 15

A company places a web server and an email server in a separate network segment that is accessible from the internet but isolated from the internal LAN. What is this segment called?

Accepted Answer

DMZ. A DMZ (demilitarized zone) hosts public-facing services with controlled access to internal network.

Answer

VLAN

Answer

Honeypot

Answer

Subnet