ISC2 CC Practice Test 2 — 25 Questions

Question 1

During a disaster recovery test, the IT team discovers that restoring all data from full backups takes 48 hours, exceeding the RTO. Which backup strategy would reduce restore time while maintaining a similar backup window?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Using differential backups instead of incremental. A differential backup backs up all changes since the last full backup, so restore requires only the full backup and the latest differential, reducing restore time compared to incremental.

Answer

Increasing backup frequency to hourly

Answer

Implementing the 3-2-1 backup rule

Answer

Switching from full to incremental backups only

Question 2

Which TWO of the following are examples of sensitive PII? (Select TWO.)

Accepted Answer

Medical records. Sensitive PII includes medical records and biometrics. Name and email are general PII; IP address is not PII alone.

Answer

Name

Answer

Email address

Answer

IP address

Question 3

Which recovery site strategy provides the shortest recovery time objective (RTO), typically measured in hours, by maintaining a fully mirrored environment that can be activated immediately?

Accepted Answer

Hot site. A hot site is fully configured with hardware, software, and real-time data replication, enabling recovery within hours.

Answer

Warm site

Answer

Reciprocal agreement

Answer

Cold site

Question 4

What is the primary purpose of a digital signature?

Accepted Answer

Provide data integrity and non-repudiation. Digital signatures provide integrity (detect tampering) and non-repudiation (proof of origin).

Answer

Ensure data confidentiality

Answer

Control access to resources

Answer

Encrypt data at rest

Question 5

A critical vulnerability is discovered in a widely used VPN appliance that is actively being exploited in the wild. The vendor has released an emergency patch. However, the organization's patch management policy requires testing in a staging environment before production deployment. What should the security team do?

Accepted Answer

Deploy the patch immediately without testing to all devices. For critical vulnerabilities under active exploitation, emergency patching should bypass normal testing to reduce risk, but compensating controls can be applied if immediate patching is not possible.

Answer

Apply a workaround from the vendor and skip patching

Answer

Wait for the scheduled patch cycle to test thoroughly

Answer

Disconnect the VPN appliance until the next patch cycle

Question 6

A company's SIEM solution aggregates logs from various sources and generates an alert when multiple failed logins occur within a short timeframe. Which log source is most likely to provide the data for this alert?

Accepted Answer

Authentication logs. Authentication logs record login attempts, including failures, and are the primary source for detecting brute-force attacks.

Answer

System logs

Answer

Firewall logs

Answer

Application logs

Question 7

During a forensic investigation, it is crucial to preserve the original evidence. What is the first step the investigator should take when acquiring a hard drive?

Accepted Answer

Create a forensic image using a write blocker. Creating a bit-for-bit forensic image using a write blocker preserves the original evidence. Option D (calculate the hash) is done after imaging to verify integrity. Option A (booting the drive) would modify data and compromise the evidence. Option B (turning off the computer and removing the hard drive) may be necessary but is not the first step in acquisition; the first step is to create a forensic image with a write blocker.

Answer

Boot the drive to check for operating system errors

Answer

Turn off the computer and remove the hard drive

Answer

Calculate the hash of the original drive

Question 8

A company's security policy requires that all sensitive data be encrypted both at rest and in transit. This is an example of applying which security principle?

Accepted Answer

Defense in depth

Answer

Separation of duties

Answer

Need to know

Answer

Least privilege

Question 9

An organization's BIA determines that the payroll system has a Maximum Tolerable Downtime (MTD) of 4 hours. The current recovery plan has an RTO of 2 hours and an RPO of 1 hour. What is the maximum Work Recovery Time (WRT) allowed to meet the MTD?

Accepted Answer

2 hours. MTD = RTO + WRT. Given MTD=4, RTO=2, so WRT ≤ 2 hours.

Answer

3 hours

Answer

4 hours

Answer

1 hour

Question 10

During an incident, the incident response team discovers that an attacker has exfiltrated sensitive customer data. According to incident response best practices, whose approval is REQUIRED before contacting law enforcement?

Accepted Answer

Legal counsel. Legal counsel approval is required before contacting law enforcement because they ensure that the disclosure complies with data privacy laws (e.g., GDPR, CCPA) and does not violate chain-of-custody requirements or expose the organization to liability. The incident response team must coordinate with legal to determine the appropriate timing and scope of law enforcement involvement, as premature contact can compromise ongoing forensic investigations or breach legal agreements.

Answer

CISO

Answer

CEO

Answer

Public relations

Question 11

A multinational corporation has a policy that all sensitive emails must be digitally signed and encrypted. However, during a recent internal audit, it was discovered that many employees were not using digital signatures because the process was cumbersome. As a result, the company could not prove that certain emails were actually sent by the claimed sender. The security team needs to improve compliance without sacrificing security. Which of the following is the best approach?

Accepted Answer

Integrate the signing process seamlessly into the email client to reduce friction.. Integrating the signing process seamlessly into the email client reduces friction and increases compliance while maintaining security. Training alone does not address the cumbersome process, reducing encryption strength weakens security, and allowing personal certificates complicates management.

Answer

Implement a mandatory training program emphasizing the importance of digital signatures.

Answer

Reduce the encryption strength to speed up the signing process.

Answer

Allow employees to use personal signing certificates.

Question 12

A small business has a single server that hosts critical applications. The server's hard drive fails, and the most recent backup is 3 days old. The backup is stored on an external drive that is kept in the same room as the server. The server is also the domain controller and file server. After replacing the drive and restoring from backup, the IT administrator discovers that some user files are missing because they were created after the backup. The administrator needs to minimize data loss in the future. Which of the following should be implemented?

Accepted Answer

Use a cloud-based backup solution.. A cloud-based backup solution automatically stores backups offsite, ensuring that even if the local site is compromised or the backup drive fails, recent data is recoverable. This minimizes data loss by enabling more frequent backups (e.g., hourly or continuous) without relying on manual intervention or physical media rotation, directly addressing the 3-day gap in the scenario.

Answer

Perform daily backups and store them offsite.

Answer

Implement RAID 1 for disk redundancy.

Answer

Enable versioning on the file server.

Question 13

In a directory service like Active Directory, which component is used to organize users, groups, and computers into a hierarchical structure for applying policies?

Accepted Answer

Organizational Units (OUs). Organizational Units (OUs) are containers in Active Directory that allow hierarchical organization and Group Policy application.

Answer

Group Policy Objects (GPOs)

Answer

Domain controllers

Answer

LDAP

Question 14

A company experiences a data breach where customer PII was exfiltrated. The incident response team contains the breach and restores systems. Which step in the risk management process should the company prioritize next to prevent recurrence?

Accepted Answer

Risk mitigation. After an incident, risk treatment involves implementing controls to reduce risk. Risk identification already occurred.

Answer

Risk communication

Answer

Risk assessment

Answer

Risk identification

Question 15

Based on the exhibit, what is the most likely result of the client's HTTP request?

Accepted Answer

The HTTP request is blocked, but other traffic from the client is allowed.. The exhibit shows an extended ACL applied inbound on the client's interface that denies TCP traffic from the client to the server on port 80 (HTTP) but permits all other IP traffic. Therefore, the HTTP request is blocked, but any other traffic from the client (e.g., DNS, ICMP) is allowed. Option D correctly states that the HTTP request is blocked but other traffic is allowed.

Answer

The HTTP request is permitted because the ACL is applied to the wrong interface.

Answer

The HTTP request is permitted because the ACL only blocks traffic from the router's own IP.

Answer

The HTTP request is blocked, and all other traffic from the client is also blocked.

Question 16

A company's critical database must be recovered within 4 hours after a disaster, and they can tolerate losing up to 1 hour of data. During a disaster, after the systems are restored, it takes an additional 30 minutes to verify data integrity and resume normal operations. Which metric is represented by the 4-hour requirement?

Accepted Answer

Recovery Time Objective (RTO). Recovery Time Objective (RTO) is the maximum acceptable time to restore systems and data after a disaster.

Answer

Maximum Tolerable Downtime (MTD)

Answer

Recovery Point Objective (RPO)

Answer

Work Recovery Time (WRT)

Question 17

A financial services company is conducting a Business Impact Analysis (BIA) for its online banking platform. Which THREE of the following are correctly defined metrics used in BIA?

Accepted Answer

Recovery Time Objective (RTO) – the maximum amount of time to restore a business function after a disruption.. In BIA, Recovery Time Objective (RTO) is the maximum time allowed to recover systems after a disaster, Maximum Tolerable Downtime (MTD) is the total time a business function can be unavailable before causing irreparable harm, and Recovery Point Objective (RPO) is the maximum acceptable data loss measured in time. All three are correctly defined BIA metrics. Service Level Agreement (SLA) is a contractual term, not a BIA metric. Annualized Loss Expectancy (ALE) is a risk assessment metric, not specifically part of BIA.

Answer

Service Level Agreement (SLA) – the contractual uptime percentage guaranteed to customers.

Answer

Annualized Loss Expectancy (ALE) – the expected monetary loss per year from a risk.

Question 18

A hospital uses role-based access control (RBAC) for its electronic health records. Nurses can view patient records; doctors can view and edit; administrators can only view administrative data. Recently, a nurse was able to edit a patient's record, which should only be allowed for doctors. The investigation finds that the nurse's role was incorrectly assigned a 'doctor' role due to a misconfiguration. To prevent recurrence, the access control system should be reviewed. Which is the best long-term solution?

Accepted Answer

Conduct quarterly role reviews and recertification. The root cause is a role misconfiguration, and the best long-term solution is to implement a process of periodic role reviews and recertification. This ensures that role assignments are regularly audited and validated against current job responsibilities, preventing role creep and unauthorized privilege accumulation. In RBAC, the principle of least privilege is maintained through ongoing governance, not through a one-time fix.

Answer

Implement mandatory access control (MAC) with security labels

Answer

Remove the nurse's ability to edit records

Answer

Implement user behavior analytics to detect anomalies

Question 19

Which of the following is the best practice for managing cryptographic keys in a large organization?

Accepted Answer

Store keys in a centralized hardware security module (HSM) with strict access controls.. A centralized Hardware Security Module (HSM) provides tamper-resistant, dedicated hardware for secure key generation, storage, and cryptographic operations. Strict access controls (e.g., role-based access, multi-factor authentication) ensure that only authorized personnel can manage keys, while the HSM prevents key extraction even if the host system is compromised. This aligns with NIST SP 800-57 guidelines for key management in large organizations.

Answer

Embed keys in application code to ensure availability.

Answer

Distribute keys to administrators via email for convenience.

Answer

Use a single key for all encryption to simplify management.

Question 20

Refer to the exhibit.
```
-rw-r-x--- 1 user1 developers 1024 Apr 12 10:00 config.cfg
```
The security policy states that only the file owner (user1) and members of the developers group should be able to read the file. Which change is necessary to align with the principle of least privilege?

Accepted Answer

Change the file mode to 640.

Answer

Add world read permission.

Answer

Change group permissions to rw-r--.

Answer

Change the owner to user2.