ISC2 CC Practice Test 2 — 25 Questions

Question 1

A company’s disaster recovery plan specifies an RTO of 4 hours and an RPO of 1 hour for its critical database. The database is backed up every hour using incremental backups. After a catastrophic failure, restoration takes 3 hours, but the database must be rolled forward using transaction logs. The total time to make the database fully operational is 5 hours. Which statement is correct?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

RTO is exceeded but RPO is likely met. The RTO is 4 hours, but the total time to make the database fully operational is 5 hours, so RTO is exceeded. The RPO is 1 hour, and backups are taken every hour; the data loss is at most 1 hour of transactions, so RPO is likely met. Therefore, RTO is exceeded but RPO is likely met.

Answer

Both RTO and RPO are exceeded

Answer

RPO is exceeded but RTO is met

Answer

Both RTO and RPO are met

Question 2

Which TWO of the following are common indicators of a phishing email? (Select TWO.)

Accepted Answer

The email contains a sense of urgency, such as 'Your account will be closed.'. Phishing emails commonly exploit urgency to bypass rational decision-making. Attackers use phrases like 'Your account will be closed' to pressure recipients into clicking malicious links or providing credentials without verifying the source. This social engineering tactic is a hallmark of phishing campaigns.

Answer

The email contains an attachment with a .txt extension

Answer

The email has a high-importance flag set by the sender

Answer

The email is sent to multiple recipients in the 'To' field

Question 3

A security operations center (SOC) analyst receives an alert for a potential malware infection on a workstation. Which of the following is the first action the analyst should take?

Accepted Answer

Isolate the workstation from the network to prevent spread. When a potential malware infection is detected, the immediate priority is containment to prevent lateral movement and further compromise. Isolating the workstation from the network (e.g., disabling the network interface or disconnecting the cable) stops the malware from communicating with command-and-control servers or spreading to other hosts. This aligns with the NIST incident response framework's containment phase, which precedes eradication and recovery actions.

Answer

Reimage the workstation

Answer

Run a full antivirus scan

Answer

Notify law enforcement

Question 4

In the context of identification and authentication, which of the following is an example of authentication?

Accepted Answer

Providing a fingerprint scan. Authentication is the process of verifying a claimed identity, typically through something the user knows, has, or is. Providing a fingerprint scan is an example of authentication because it uses a biometric factor to verify the user's identity. The other options are related to identification, not authentication.

Answer

Entering a username

Answer

Being assigned a user ID

Answer

Swiping an access badge

Question 5

Drag and drop the steps to configure a wireless access point with WPA2-PSK security into the correct order.

Accepted Answer

Set SSID, then select WPA2 security mode, then set PSK passphrase, then apply settings.. Configuring a wireless access point with WPA2-PSK requires a logical sequence: first set the SSID to identify the network, then choose WPA2 as the security mode, then define the pre-shared key (PSK) passphrase, and finally apply the settings. This order ensures all necessary parameters are in place before the configuration is activated, preventing the AP from broadcasting with incomplete security settings.

Answer

Set SSID, then set PSK passphrase, then select WPA2 security mode, then apply settings.

Answer

Select WPA2 security mode, then set SSID, then set PSK passphrase, then apply settings.

Answer

Set SSID, then select WPA2 security mode, then apply settings, then set PSK passphrase.

Question 6

A SOC analyst is investigating an incident where an employee's workstation was compromised via a phishing email. The analyst has captured the following indicators: the email originated from a known malicious domain, the attachment was a macro-enabled document, and the macro executed a PowerShell command that downloaded a payload from a remote server. Which TWO actions should the analyst take immediately as part of the incident response process? (Choose two.)

Accepted Answer

Isolate the workstation from the network.. Option B is correct because isolating the compromised workstation from the network immediately contains the incident, preventing the PowerShell-downloaded payload from establishing C2 communication or lateral movement to other hosts. Option D is correct because blocking the known malicious domain at the email gateway stops further phishing emails from that domain reaching other employees, addressing the initial infection vector. Option A is not an immediate containment step; law enforcement notification typically occurs later per legal/organizational policy. Option C, sandboxing the macro, is useful for deeper analysis but is not an immediate containment action and can be done after isolation. Option E, deleting the email from all mailboxes, is a remediation step that may follow, but blocking the domain at the gateway is the more immediate preventive action.

Answer

Contact law enforcement immediately.

Answer

Analyze the macro code in a sandbox.

Answer

Delete the phishing email from all mailboxes.

Question 7

A multinational financial services organization operates three data centers in different geographic regions. Each data center runs a mix of critical and non-critical applications. The DR plan specifies Recovery Time Objectives (RTOs) ranging from 4 hours for critical applications to 72 hours for non-critical. During a scheduled DR test, the team attempts to fail over the primary customer database to the secondary site. The failover fails because the replication link between sites was saturated due to a large data synchronization job running concurrently. The test is declared a failure, and senior management is concerned about the DR plan's reliability. The IT director suggests increasing bandwidth between sites. The security architect proposes implementing network prioritization for replication traffic. The business continuity manager recommends revising the RTOs to be more realistic based on current bandwidth. The system administrator thinks the issue will resolve if the test is repeated during off-peak hours. Which of the following is the BEST course of action to address the root cause of the failure?

Accepted Answer

Implement Quality of Service (QoS) policies to prioritize database replication traffic over other data transfers.. The root cause is that the replication link was saturated by a large data synchronization job, which delayed the critical database replication traffic needed to meet the 4-hour RTO. Implementing Quality of Service (QoS) policies directly addresses this by prioritizing database replication traffic over other data transfers, ensuring that critical replication gets the necessary bandwidth even during concurrent large jobs. This is the most effective solution because it resolves the contention without requiring additional bandwidth or changing RTOs.

Answer

Increase the bandwidth on the replication link by ordering a faster circuit from the ISP.

Answer

Reschedule the next DR test to occur during a scheduled maintenance window with no other replication activity.

Answer

Revise the RTO for the customer database from 4 hours to 8 hours to account for current bandwidth limitations.

Question 8

A security analyst notices an unusually high number of incomplete TCP connection requests. Which type of attack is most likely occurring?

Accepted Answer

SYN flood. SYN flood attacks exploit the TCP three-way handshake by sending many SYN packets without completing the handshake, exhausting server resources.

Answer

Smurf attack

Answer

ARP spoofing

Answer

DNS amplification

Question 9

A system administrator implements version control for all configuration files. Which principle is being strengthened?

Accepted Answer

Integrity. Version control helps ensure data accuracy and prevents unauthorized changes, supporting integrity.

Answer

Availability

Answer

Confidentiality

Answer

Accountability

Question 10

An attacker used stolen credentials from a phishing campaign to authenticate to a cloud email account. The organization's incident response team wants to immediately stop the attacker from continuing to access the mailbox while preserving evidence for investigation. Which action best meets both goals?

Accepted Answer

Disable the account in the identity provider, then export the mailbox audit log and sign-in logs to a secure evidence repository.. The most effective containment combines immediate revocation of access with preservation of forensic data. Disabling the account in the identity provider stops the attacker from authenticating again, while exporting audit and sign-in logs captures evidence before it rotates or is lost. Destructive actions like deleting the mailbox, or partial measures like a password change or IP block, either harm the investigation or fail to reliably stop the attacker.

Answer

Delete the mailbox and recreate it for the legitimate user, then reset the user's password.

Answer

Change the user's password and enable self-service password reset so the user can regain access quickly.

Answer

Add the attacker's IP address to the firewall block list and continue monitoring the mailbox for suspicious activity.

Question 11

A company wants to isolate its public web server from internal networks to reduce risk. The server must be accessible from the internet. Which network architecture should be used?

Accepted Answer

Implement a DMZ. A DMZ (demilitarized zone) is a segmented network that sits between the untrusted internet and the trusted internal LAN, hosting public-facing services like web servers. It allows inbound internet access to the server while firewalls restrict traffic from the DMZ into the internal network, minimizing risk if the server is compromised. This directly satisfies the requirement to isolate the public server from internal networks.

Answer

Place the server on the internal LAN with a strong firewall rule

Answer

Use a VLAN to logically separate the server

Answer

Connect the server directly to the internet without firewall

Question 12

Which of the following is an example of a physical control that supports the availability principle of the CIA triad?

Accepted Answer

Redundant servers. Availability ensures systems are accessible when needed. Redundant servers provide failover capability, minimizing downtime.

Answer

Data encryption

Answer

Biometric authentication

Answer

Digital signatures

Question 13

An employee receives an email from an unknown sender claiming to be from the IT department, asking for their password to perform an urgent system update. What type of social engineering attack is this?

Accepted Answer

Phishing. Phishing is a social engineering attack where an attacker sends a fraudulent email, often impersonating a trusted entity like the IT department, to trick the recipient into revealing sensitive information such as passwords. The scenario describes an email from an unknown sender claiming to be from IT and requesting a password, which is a classic phishing attempt. The other options involve physical or direct access tactics.

Answer

Tailgating

Answer

USB drop attack

Answer

Piggybacking

Question 14

A company's network uses 802.1X authentication for wired and wireless access. Which component authenticates the user credentials against an identity store?

Accepted Answer

Authentication server (RADIUS). In 802.1X, the authentication server (typically a RADIUS server) is the component that validates user credentials against an identity store such as LDAP, Active Directory, or a local database. The supplicant (client) provides credentials, the authenticator (switch or access point) relays EAP frames, but only the RADIUS server performs the actual authentication decision.

Answer

Supplicant

Answer

Authenticator

Answer

Access point

Question 15

A company's security operations center (SOC) receives an alert about suspicious outbound traffic from a server in the DMZ to an external IP address known for command-and-control activity. The SOC analyst reviews the logs and sees that the source port is 443 and the destination port is 8080. Which of the following actions should the analyst take FIRST?

Accepted Answer

Isolate the server from the network and investigate further. The SOC analyst should first isolate the server from the network because the outbound traffic from a DMZ server to a known C2 IP address, using source port 443 (HTTPS) to destination port 8080 (HTTP alternate), indicates a potential compromise. Isolating the server stops the data exfiltration and prevents further C2 communication, allowing for a controlled forensic investigation without alerting the attacker. This aligns with the NIST SP 800-61 incident response process, where containment is prioritized before eradication or recovery.

Answer

Notify the incident response team and management immediately

Answer

Block the external IP address at the firewall

Answer

Modify the firewall rule to deny all outbound traffic from the DMZ

Question 16

A company implements a new firewall and intrusion detection system to reduce the risk of network breaches. This is an example of:

Accepted Answer

Risk mitigation. Risk mitigation reduces the likelihood or impact of a threat by implementing controls; a firewall and IDS are detective and preventive controls that lower the probability and severity of a network breach without eliminating the risk entirely. This is the textbook definition of mitigation — the risk still exists but is reduced to an acceptable level.

Answer

Risk avoidance

Answer

Risk acceptance

Answer

Risk transfer

Question 17

An organization wants to implement network segmentation to improve security. Which three methods are commonly used for network segmentation? (Select THREE.)

Accepted Answer

Subnetting. Subnetting (A) is correct because dividing a larger IP network into smaller logical subnets using CIDR and subnet masks creates distinct broadcast domains and limits lateral movement between segments. DMZs (B) are correct because a demilitarized zone places internet-facing services such as web, mail, or DNS servers in a separate screened segment, isolating them from the internal trusted network. VLANs (D) are correct because IEEE 802.1Q VLANs logically segment a switched network at Layer 2, allowing departments or device groups to be separated without physical rewiring and enforcing traffic isolation via trunk and access port configuration. Firewalls (C) are not a segmentation method themselves; they are policy enforcement devices that control traffic between segments, so they are typically deployed to secure segmentation rather than create it. Intrusion Detection Systems (E) are monitoring tools that detect malicious activity and generate alerts, but they do not divide or isolate network segments.

Answer

Firewalls

Answer

Intrusion Detection Systems

Question 18

An organization is preparing its Business Continuity Plan (BCP). Which process identifies critical business functions and the impact of disruptions?

Accepted Answer

Business Impact Analysis (BIA). A Business Impact Analysis (BIA) identifies critical business functions, dependencies, and the impact of disruptions, providing metrics like MTD, RTO, and RPO.

Answer

Incident Response Plan (IRP)

Answer

Disaster Recovery Plan (DRP)

Answer

Risk Assessment

Question 19

Which THREE security mechanisms should be implemented to secure a network against ARP spoofing attacks? (Choose three.)

Accepted Answer

IP Source Guard. IP Source Guard (A) is correct because it uses DHCP snooping binding table entries to filter traffic on a per-port basis, dropping packets where the source IP address does not match the binding. This prevents an attacker from spoofing a legitimate host's IP address in ARP spoofing attacks by ensuring only valid IP-to-MAC mappings are allowed on the port.

Answer

Port security

Answer

MAC address filtering

Question 20

An organization requires that a financial transaction must be initiated by one employee and approved by a manager before processing. Which access control principle does this enforce?

Accepted Answer

Separation of duties. Separation of duties (SoD) is the principle that no single individual should have enough privileges to complete a sensitive transaction alone; it requires splitting critical tasks among multiple people. Here, one employee initiates and a different manager approves, which is the textbook definition of SoD. It prevents fraud and errors by ensuring collusion is needed to abuse the process.

Answer

Defense in depth

Answer

Least privilege

Answer

Need-to-know