ISC2 CC Practice Test 3 — 25 Questions

Question 1

A system administrator is configuring permissions for a new file server. To adhere to the principle of least privilege, which approach should the administrator take?

Accepted Answer

Grant each user only the permissions necessary to perform their job duties.. The principle of least privilege means granting each user only the minimum permissions required to perform their job functions — nothing more. Option C directly embodies this by tying permissions to actual job duties rather than broad group membership or department-wide access.

Answer

Grant permissions only to the IT department.

Answer

Grant permissions based on the user's department membership.

Answer

Grant all users full control to simplify management.

Question 2

Which of the following best describes the purpose of due care in information security?

Accepted Answer

Implementing reasonable security measures to protect data. Due care means exercising a minimum standard of care to protect information assets, such as implementing basic security controls.

Answer

Prioritizing security incidents based on impact

Answer

Transferring risk to a third party

Answer

Investigating a vendor's background before contracting

Question 3

A SOC analyst reviews a SIEM alert indicating a high volume of outbound traffic from a server to an external IP address known for command-and-control activity. The analyst has confirmed the alert is not a false positive. What is the most appropriate next step?

Accepted Answer

Conduct a deeper investigation to identify affected systems and data.. After confirming a SIEM alert is not a false positive, the most appropriate next step is to conduct a deeper investigation to identify affected systems and data. This aligns with the incident response process, where containment and eradication should be based on a thorough understanding of the scope and impact. Immediate blocking or rebooting without investigation could destroy evidence or disrupt business operations.

Answer

Escalate the alert to Tier 3 for advanced analysis.

Answer

Block the external IP address at the firewall immediately.

Answer

Reboot the server to terminate any malicious processes.

Question 4

A multinational corporation deploys redundant servers in geographically diverse data centers and uses a load balancer to distribute traffic. This setup primarily addresses which security concern?

Accepted Answer

Availability. Redundancy and load balancing ensure that systems remain accessible, supporting availability.

Answer

Confidentiality

Answer

Integrity

Answer

Non-repudiation

Question 5

Which security principle ensures that data cannot be accessed by unauthorized individuals?

Accepted Answer

Confidentiality. Confidentiality ensures that data is not disclosed to unauthorized individuals, systems, or processes.

Answer

Integrity

Answer

Non-repudiation

Answer

Availability

Question 6

Drag and drop the steps to configure a basic VPN (site-to-site) between two routers into the correct order.

Accepted Answer

Configure IKE policy and pre-shared key, then configure IPsec transform set, then define interesting traffic with crypto ACL, then create and apply crypto map to the interface, then verify the VPN tunnel.. Configuring a site-to-site VPN between two routers requires a specific sequence: first establish IKE policy and pre-shared keys for authentication, then define the IPsec transform set for encryption and integrity, then specify interesting traffic via a crypto ACL, then create and apply the crypto map to the outgoing interface, and finally verify the tunnel. This order ensures all security parameters are correctly bound and operational.

Answer

Define interesting traffic with crypto ACL, then configure IPsec transform set, then configure IKE policy and pre-shared key, then create and apply crypto map, then verify.

Answer

Configure IKE policy and pre-shared key, then define interesting traffic with crypto ACL, then configure IPsec transform set, then create and apply crypto map, then verify.

Answer

Verify the VPN tunnel, then configure IKE policy, then configure IPsec transform set, then define ACL, then create crypto map.

Question 7

Which data classification level typically requires the highest level of protection?

Accepted Answer

Top secret. Top secret is the highest classification and requires strict controls.

Answer

Internal

Answer

Confidential

Answer

Public

Question 8

A security administrator is configuring a network device that monitors traffic and generates alerts when suspicious patterns are detected. The device does not block traffic. Which type of system is being deployed?

Accepted Answer

Intrusion Detection System (IDS). An IDS (Intrusion Detection System) is passive and only alerts, while an IPS actively blocks.

Answer

Web Application Firewall (WAF)

Answer

Intrusion Prevention System (IPS)

Answer

Next-Generation Firewall (NGFW)

Question 9

Which of the following is a key function of a Security Information and Event Management (SIEM) system?

Accepted Answer

Correlating log data from multiple sources to identify security incidents. SIEM aggregates and correlates logs from various sources to detect patterns and generate alerts.

Answer

Blocking malicious network traffic

Answer

Enforcing password complexity requirements

Answer

Patching vulnerabilities in operating systems

Question 10

A security analyst implements a hashing algorithm to verify that a downloaded file has not been altered. Which security goal is being achieved?

Accepted Answer

Integrity. Hashing ensures data integrity by detecting changes.

Answer

Authentication

Answer

Availability

Answer

Confidentiality

Question 11

Refer to the exhibit. A security engineer applies this storage access policy to restrict access. Users outside the 10.0.0.0/16 network report being denied access, which is expected. However, users inside that network also report access denied. What is the likely issue?

Accepted Answer

The policy only allows read access; users likely need list or other actions.. The storage policy only grants the read action, but users inside the 10.0.0.0/16 network are likely performing other actions such as list or write. Even though the source IP condition allows access from the trusted network, the explicit Allow statement is scoped solely to read. Any request for a different action (like list) will be implicitly denied by default, as IAM and storage policies are deny-by-default unless an explicit Allow exists for that specific action.

Answer

The condition syntax is incorrect and causes all requests to be evaluated incorrectly.

Answer

The Deny statement overrides the Allow statement for all requests.

Answer

The resource identifier includes a wildcard, causing a mismatch.

Question 12

An attacker sends forged ARP messages to associate their MAC address with the IP address of a legitimate server. This allows the attacker to intercept traffic intended for that server. What is this attack?

Accepted Answer

ARP spoofing. ARP spoofing (or ARP poisoning) involves sending fake ARP replies to associate the attacker's MAC with a victim's IP, enabling man-in-the-middle attacks.

Answer

DNS poisoning

Answer

MAC flooding

Answer

IP spoofing

Question 13

Match each security control type to its description.

Accepted Answer

Preventive: Controls that prevent security incidents from occurring. Security controls are categorized by their primary function. Preventive controls stop incidents, detective controls identify them, and corrective controls restore operations. Common confusions involve swapping preventive and detective roles.

Answer

Preventive: Controls that identify security incidents

Answer

Detective: Controls that prevent security incidents

Question 14

Match each risk management term to its meaning.

Accepted Answer

Risk: The potential for loss or harm when a threat exploits a vulnerability.. Risk is the potential for loss when a threat exploits a vulnerability. A threat is a potential cause of harm. A vulnerability is a weakness. Controls are measures to reduce risk.

Answer

Risk: A weakness in a system or its design.

Answer

Threat: The potential for loss or harm.

Answer

Vulnerability: A measure that modifies or reduces risk.

Question 15

A security analyst receives an alert indicating multiple failed login attempts from a single IP address targeting a user account. Which action should the analyst take FIRST?

Accepted Answer

Verify the alert and check if the account is compromised. The first step in incident response is to validate the alert. The analyst must verify that the failed login attempts are not a false positive (e.g., a user mistyping their password) and then check if the account has been compromised by reviewing logs for successful logins from the same IP or anomalous behavior. Prematurely disabling the account or blocking the IP could disrupt legitimate access or alert an attacker, while escalation to law enforcement is premature without confirmation of a breach.

Answer

Disable the user account immediately

Answer

Escalate the alert to law enforcement

Answer

Block the IP address at the firewall

Question 16

A security analyst recommends implementing digital signatures to ensure that a software update has not been altered during distribution. Which aspect of the CIA triad is primarily being addressed?

Accepted Answer

Integrity. Digital signatures use cryptographic hashing and asymmetric encryption to verify that data has not been altered in transit or at rest, which directly addresses the Integrity pillar of the CIA triad. If even a single bit of the software update changes, the signature verification fails, proving tampering. While signatures also provide authentication and non-repudiation, the question specifically asks which CIA triad aspect is primarily addressed, and integrity is the correct mapping.

Answer

Availability

Answer

Confidentiality

Answer

Non-repudiation

Question 17

During a security incident, the incident response team needs to preserve evidence for potential legal action. Which of the following is the most important action to take when collecting volatile data from a compromised server?

Accepted Answer

Capture the contents of RAM.. Volatile data in RAM is lost when power is removed. Capturing RAM preserves evidence that might contain running processes, network connections, and encryption keys. Disk images are non-volatile and can be collected later.

Answer

Make a bit-for-bit copy of all storage.

Answer

Create a forensic image of the hard drive.

Answer

Review system logs.

Question 18

What is the primary purpose of a digital signature?

Accepted Answer

Provide data integrity and non-repudiation. Digital signatures provide integrity (detect tampering) and non-repudiation (proof of origin).

Answer

Ensure data confidentiality

Answer

Control access to resources

Answer

Encrypt data at rest

Question 19

A security operations center (SOC) analyst notices unusual outbound network traffic from a server that typically only receives connections. The traffic is encrypted and goes to an unknown external IP. Which step should the analyst perform FIRST?

Accepted Answer

Check the server's running processes and connections. The first step in incident response is to gather evidence and understand the scope without altering the system. Checking the server's running processes and connections (A) allows the analyst to identify the malicious process, its parent, and the remote endpoint, which informs containment and eradication. This aligns with the 'identification' phase of incident response.

Answer

Power off the server

Answer

Block the outbound traffic at the firewall

Answer

Notify the system owner

Question 20

An attacker intercepts communications between a client and server by establishing independent connections with each. The client believes it is talking to the server, but the attacker relays messages. What is this attack?

Accepted Answer

Man-in-the-middle. A man-in-the-middle (MITM) attack occurs when an adversary positions themselves between two communicating parties, establishing separate connections with each and relaying (or altering) traffic while both sides believe they are communicating directly. The scenario describes exactly this relay behavior. The attacker can eavesdrop, modify, or inject data because neither endpoint detects the intermediary.

Answer

Phishing

Answer

Replay attack

Answer

DoS