ISC2 CC Practice Test 25 — 15 Questions

Question 1

A large organization has implemented a Security Operations Center (SOC) with a tiered incident response model. Tier 1 analysts triage alerts and escalate confirmed incidents to Tier 2 for deeper analysis. Recently, the SOC has been overwhelmed by a high volume of low-severity alerts from endpoint detection and response (EDR) tools, causing delays in handling true positive incidents. The SOC manager wants to reduce alert fatigue without missing critical threats. Which of the following strategies would be MOST effective?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement automated playbooks for low-severity alerts to perform initial investigation and closure if benign.. Automated playbooks (SOAR-style) let the SOC enrich, correlate, and close low-severity alerts without human intervention, freeing Tier 1 and Tier 2 analysts to focus on genuine threats. This directly reduces alert fatigue while preserving detection coverage, because the rules remain enabled and only the triage step is automated. It is the only option that scales without degrading detection or analyst workload.

Answer

Require Tier 2 analysts to review all alerts before Tier 1.

Answer

Increase the number of Tier 1 analysts to handle the volume.

Answer

Disable all low-severity alert rules in the EDR.

Question 2

An organization configures account lockout after 5 failed login attempts within 15 minutes. This control is designed to mitigate which type of attack?

Accepted Answer

Brute-force attack. Account lockout after 5 failed attempts within 15 minutes is a classic defense against brute-force attacks, which rely on rapidly submitting many password guesses until one succeeds. By locking the account after a small number of failures, the control drastically reduces the number of attempts an attacker can make in a given time window, making automated guessing impractical. This is a standard mitigation recommended by frameworks like NIST and CIS.

Answer

Phishing

Answer

Social engineering

Answer

Man-in-the-middle attack

Question 3

A healthcare organization experiences a data breach involving protected health information (PHI). Under GDPR, within how many hours must the organization notify the relevant supervisory authority?

Accepted Answer

72 hours. Under GDPR Article 33, a controller must notify the relevant supervisory authority of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to data subjects' rights and freedoms. PHI constitutes personal data under GDPR, so the 72-hour clock applies. This deadline is a maximum; notification should occur as soon as possible within that window.

Answer

24 hours

Answer

48 hours

Answer

7 days

Question 4

A company uses redundant servers and automated failover to ensure that its website remains accessible during a server outage. Which principle of the CIA triad is being addressed?

Accepted Answer

Availability. Availability ensures that systems and data are accessible to authorized users when needed. Redundant servers and automated failover directly address availability by eliminating single points of failure and enabling continuous service during outages. Integrity concerns data accuracy, confidentiality concerns unauthorized disclosure, and non-repudiation concerns proving an action occurred — none of which are addressed by redundancy.

Answer

Non-repudiation

Answer

Integrity

Answer

Confidentiality

Question 5

An organization deploys firewalls at the network perimeter, antivirus on endpoints, and encryption for data at rest. This approach best exemplifies which security principle?

Accepted Answer

Defense in depth. Defense in depth layers multiple independent controls — perimeter firewalls, endpoint antivirus, and encryption at rest — so that if one fails, others still protect the asset. This layered approach is the defining characteristic of defense in depth. The scenario explicitly describes multiple control types at different layers, which matches this principle.

Answer

Separation of duties

Answer

Diversity of defense

Answer

Least privilege

Question 6

Which three of the following are best practices for securing a network switch? (Choose three.)

Accepted Answer

Disable unused ports.. Disabling unused ports on a network switch prevents unauthorized physical access and eliminates the risk of an attacker connecting to an open port to launch attacks such as ARP spoofing or DHCP starvation. This is a fundamental security best practice that reduces the attack surface by ensuring that only necessary ports are active and can be administratively controlled.

Answer

Enable Telnet for remote management.

Answer

Set all ports to trunk mode by default.

Question 7

Which protocol is considered insecure because it transmits data, including credentials, in cleartext?

Accepted Answer

Telnet. Telnet transmits all data, including usernames and passwords, in cleartext over the network, making it trivial to intercept with packet sniffing. It lacks encryption and is considered insecure for any authentication or sensitive data. This is why Telnet has been replaced by SSH for remote administration.

Answer

SFTP

Answer

SSH

Answer

HTTPS

Question 8

A visitor signs in at a company's reception, receives a badge, and is escorted throughout the building. This process is part of which type of access control?

Accepted Answer

Physical access control. The scenario describes a visitor signing in, receiving a badge, and being escorted, which are all physical measures to control access to the building. Physical access control encompasses mechanisms like badges, locks, guards, and escorts that restrict physical entry to facilities. Therefore, this process is part of physical access control.

Answer

Technical access control

Answer

Administrative access control

Answer

Logical access control

Question 9

A security analyst is reviewing physical security controls. Which TWO are examples of perimeter physical controls? (Select TWO.)

Accepted Answer

Fencing around the property. Option D (fencing around the property) is correct because fencing is a classic perimeter control that establishes a physical boundary and deters or delays unauthorized entry to the site. Option E (lighting in the parking lot) is correct because exterior lighting is a perimeter control that illuminates the outer grounds, deterring intruders and enabling surveillance of approaches to the facility. Option A (access badges at building entrance) is not a perimeter control but an access control at a building entry point, which is a more interior layer of defense. Option B (biometric reader on server room door) is an interior access control protecting a high-value asset, not the site perimeter. Option C (cable locks on laptops) is an asset-level physical control for portable devices, not a perimeter control.

Answer

Access badges at building entrance

Answer

Biometric reader on server room door

Answer

Cable locks on laptops

Question 10

A company's business continuity plan requires a maximum tolerable downtime of 2 hours for the ERP system. The current backup process takes 3 hours to restore. Which of the following is the BEST corrective action?

Accepted Answer

Implement synchronous replication. The maximum tolerable downtime (MTD) is 2 hours, but the current restore process takes 3 hours, which exceeds the MTD. Synchronous replication writes data to both primary and secondary storage simultaneously, ensuring that the secondary copy is always current and can be failed over to in seconds or minutes, not hours. This reduces the recovery time objective (RTO) to well under the required 2 hours, directly addressing the gap.

Answer

Reduce RTO to 1 hour

Answer

Increase backup frequency

Answer

Perform restoration testing quarterly

Question 11

An employee reports receiving a suspicious email with an attachment from an unknown sender. What is the first action the employee should take?

Accepted Answer

Report the email to the security team.. Reporting the email to the security team allows professionals to analyze and respond appropriately. Deleting the email or opening the attachment can be dangerous; forwarding may spread the threat.

Answer

Open the attachment to check its content.

Answer

Forward the email to all employees as a warning.

Answer

Delete the email immediately.

Question 12

A system administrator notices that a user has been granted read and write permissions to a folder but should only have read access. Which type of access control issue does this represent?

Accepted Answer

Excessive permissions. Excessive permissions occur when a user or group is granted more privileges than necessary for their role. In this scenario, the user has read and write access to a folder but should only have read access, meaning the write permission is unnecessary and violates the principle of least privilege. This is a classic example of excessive permissions, as the user has been over-provisioned beyond their job requirements.

Answer

Segregation of duties conflict

Answer

Authorization creep

Answer

Incomplete revocation

Question 13

A company requires employees to use biometric authentication to access the data center. This is an example of which security principle?

Accepted Answer

Authentication. Biometric authentication (fingerprint, retina, facial recognition) verifies a claimed identity by matching a unique physical trait against a stored template, which is the definition of authentication — proving you are who you say you are. It falls under the 'something you are' authentication factor. The other options describe different security goals (availability, integrity, non-repudiation) rather than the act of verifying identity.

Answer

Availability

Answer

Integrity

Answer

Non-repudiation

Question 14

An organization is implementing a new identity management system. They want to ensure that users can only access resources necessary for their job roles. Which principle should guide the access control design?

Accepted Answer

Least privilege. The principle of least privilege dictates that users should be granted only the permissions necessary to perform their job functions and nothing more. In an identity management system, this is implemented by assigning minimal access rights to resources, reducing the attack surface and limiting potential damage from compromised accounts. This directly aligns with the scenario of ensuring users can only access resources essential for their roles.

Answer

Separation of duties

Answer

Need to know

Answer

Defense in depth

Question 15

A SOC analyst reviews an alert indicating a high number of failed login attempts from a single external IP address targeting multiple user accounts. Which security control is most effective at preventing this type of attack?

Accepted Answer

Implementing account lockout policies. Account lockout policies directly mitigate brute-force attacks by temporarily disabling an account after a defined number of failed login attempts (e.g., 5 failures within 15 minutes). This prevents the attacker from continuing to guess passwords for multiple user accounts from a single external IP, without affecting legitimate users who can be unlocked after a lockout duration or via an administrative reset.

Answer

Deploying a web application firewall

Answer

Enabling verbose logging for authentication events

Answer

Increasing password complexity requirements