ISC2 CC Practice Test 4 — 25 Questions

Question 1

Refer to the exhibit. The network administrator configured NAT as shown. Internal hosts can access the internet, but no external hosts can access the company's web server (192.168.1.10). What is the issue?

Accepted Answer

The pool includes the static IP causing conflict. The correct answer is D because the dynamic NAT pool includes the IP address 192.168.1.10, which is also used for the static NAT mapping to the web server. When a packet arrives from the internet destined for the static NAT address, the router first checks dynamic NAT entries and may assign that address from the pool to an internal host, causing a conflict and preventing the static translation from being applied. This is a classic IP address overlap issue where the pool should exclude the static NAT address.

Answer

The static NAT is being overridden by the dynamic NAT

Answer

The outside interface should be the inside interface

Answer

The web server is not in the access-list

Question 2

A security analyst reviews firewall logs and notices a large number of outbound connections from a single internal IP to a known malicious IP on port 445. The analyst quarantines the workstation and runs an antivirus scan, which finds no malware. What should the analyst do next?

Accepted Answer

Analyze network traffic to identify the process responsible for the connections.. Option D is correct because the absence of malware detection does not rule out malicious activity; the connections could be caused by a legitimate process that has been abused (e.g., a vulnerable service or script) or by fileless malware that evades signature-based scans. Analyzing network traffic with tools like Wireshark or NetFlow can identify the source process (e.g., via Windows Event Logs or Sysmon), the exact data being sent, and whether the traffic is encrypted or uses SMB protocol specifics on port 445. This forensic step is essential before taking irreversible actions like reimaging or broad blocking.

Answer

Conclude that the scan is clean and remove the quarantine.

Answer

Reimage the workstation immediately.

Answer

Block all outbound traffic on port 445 from the internal network.

Question 3

A company's network uses 802.1X authentication for wired and wireless access. Which component authenticates the user credentials against an identity store?

Accepted Answer

Authentication server (RADIUS). In 802.1X, the authentication server (typically a RADIUS server) is the component that validates user credentials against an identity store such as LDAP, Active Directory, or a local database. The supplicant (client) provides credentials, the authenticator (switch or access point) relays EAP frames, but only the RADIUS server performs the actual authentication decision.

Answer

Supplicant

Answer

Authenticator

Answer

Access point

Question 4

Which of the following is an example of a detective control in a security operations context?

Accepted Answer

Reviewing audit logs for suspicious activity.. Detective controls are designed to identify and alert on security incidents after they have occurred. Reviewing audit logs for suspicious activity is a classic detective control because it involves examining historical records to detect unauthorized access or anomalies. In contrast, preventive controls like patching, MFA, and firewall rules aim to stop incidents before they happen.

Answer

Installing a security patch to fix a vulnerability.

Answer

Requiring multi-factor authentication for remote access.

Answer

Firewall rules blocking unauthorized traffic.

Question 5

A security engineer is designing a network for a small business that needs to segregate guest Wi-Fi from the internal corporate network. The guest network should have internet access only, with no access to internal resources. Which of the following is the BEST design approach?

Accepted Answer

Place the guest Wi-Fi on a separate VLAN with a firewall rule blocking traffic to internal subnets.. Option D is the best approach because placing the guest Wi-Fi on a separate VLAN and applying a firewall rule to block traffic to internal subnets provides both logical segmentation and access control. This ensures that guest traffic is isolated at Layer 2 (VLAN) and Layer 3/4 (firewall), preventing any unauthorized access to the corporate network while still allowing internet connectivity through a default route.

Answer

Implement MAC address filtering on the access point to allow only known devices.

Answer

Connect the guest Wi-Fi to the internet through a separate router that does not have routes to the internal network.

Answer

Use a single VLAN with a DHCP server that assigns different IP ranges to guests and employees.

Question 6

Which TWO are key components of an effective incident response plan? (Select TWO.)

Accepted Answer

Communication plan for stakeholders. Option D is correct because an incident response plan must include a communication plan for stakeholders to ensure timely and accurate information sharing during a security incident. This includes predefined escalation paths, contact lists, and communication channels (e.g., email, phone, secure messaging) to coordinate response efforts and manage external notifications (e.g., legal, PR, customers). Without a communication plan, response teams risk confusion, delays, and inconsistent messaging, which can exacerbate the incident's impact.

Answer

Business continuity procedures

Answer

List of forensic tools

Answer

Backup verification schedule

Question 7

An organization implements a bring-your-own-device (BYOD) policy. Which security control is most important to enforce in the BYOD policy?

Accepted Answer

Implement mobile device management (MDM) for remote wipe and policy enforcement. Mobile device management (MDM) is the most important control for a BYOD policy because it provides centralized policy enforcement, remote wipe capabilities, and device compliance monitoring. Unlike isolated controls like passwords or encryption, MDM allows the organization to enforce security policies dynamically and revoke access or wipe corporate data if a device is lost, stolen, or non-compliant.

Answer

Require complex passwords

Answer

Install a firewall on each device

Answer

Enable full disk encryption

Question 8

A security analyst investigates a possible data exfiltration. The analyst sees a large amount of data being sent to an external IP address at regular intervals. Which of the following is the most likely technique being used?

Accepted Answer

DNS tunneling. DNS tunneling encodes data within DNS queries and responses, allowing attackers to bypass network security controls by exfiltrating data through UDP port 53, which is often allowed through firewalls. The regular intervals of large data transfers to an external IP address are characteristic of a DNS tunnel, as the attacker segments data into multiple DNS queries to avoid detection.

Answer

SQL injection

Answer

Phishing

Answer

Man-in-the-middle

Question 9

An organization has a policy that all servers must have security patches applied within 30 days of release. Which of the following is the best practice for patching?

Accepted Answer

Test patches in a non-production environment before deploying to production. Option C is correct because testing patches in a non-production environment first allows the organization to identify compatibility issues, performance regressions, or conflicts with existing software before risking production systems. This aligns with the change management principle of validating changes in a controlled setting, ensuring that the 30-day patching deadline can be met without introducing instability. Skipping testing (A) or applying patches simultaneously (B) could lead to widespread outages, while only applying critical patches (D) would leave the organization exposed to non-critical vulnerabilities that could be chained in an attack.

Answer

Skip patches that have not been widely tested

Answer

Apply patches to all servers simultaneously

Answer

Only apply critical patches

Question 10

Which is a key benefit of a cold site as a recovery location?

Accepted Answer

Low cost. A cold site is a backup facility that provides only the physical infrastructure (power, cooling, and space) but no pre-installed hardware or live data. Because it lacks equipment and requires manual setup before recovery can begin, it has the lowest capital and operational costs among recovery site options, making low cost its key benefit.

Answer

Real-time data synchronization

Answer

Reduced need for testing

Answer

Fast recovery time

Question 11

A company has a disaster recovery plan that includes a hot site. Which of the following is the PRIMARY advantage of a hot site over a cold site?

Accepted Answer

Faster recovery time. A hot site is a fully operational duplicate of the primary data center, complete with live servers, storage, networking, and synchronized data. This eliminates the need to procure and configure hardware after a disaster, enabling recovery in minutes or hours rather than days or weeks. The primary advantage is therefore a significantly faster recovery time objective (RTO) compared to a cold site, which has no pre-installed equipment.

Answer

Easier maintenance

Answer

Greater security

Answer

Lower cost

Question 12

Refer to the exhibit. An administrator needs to restore a database file from two weeks ago, but the backup log shows success. What is the most likely reason the file cannot be restored?

Accepted Answer

The backup source did not include that file. Option C is correct because the backup log only records the success or failure of the backup job as a whole, not the inclusion of every individual file. If the database file was not selected in the backup source configuration (e.g., a file-level backup job that excluded the database directory or a volume shadow copy that did not include the file), the backup would complete successfully without backing up that file. When the administrator attempts to restore, the file is missing from the backup set, even though the job log shows success.

Answer

The retention policy deleted it

Answer

The schedule was incorrect

Answer

The encryption key changed

Question 13

In incident response, which TWO are considered volatile data that should be collected first? (Select exactly 2.)

Accepted Answer

Network connections. Network connections (option B) are volatile because they represent active communication channels that disappear when the system is powered off or disconnected. In incident response, collecting network connection data (e.g., using netstat -an) first preserves evidence of ongoing malicious activity, such as command-and-control (C2) traffic or lateral movement, before it is lost.

Answer

Hard drive contents

Answer

Backup tapes

Answer

System logs

Question 14

Which THREE are commonly defined in a disaster recovery plan? (Select exactly 3.)

Accepted Answer

Recovery point objective. Recovery point objective (RPO) is a core metric defined in a disaster recovery plan because it specifies the maximum acceptable amount of data loss measured in time. For example, an RPO of 1 hour means backups must be taken at least every hour to ensure no more than 60 minutes of data is lost. This directly drives backup frequency and replication technology choices, such as synchronous vs. asynchronous replication.

Answer

Cost-benefit analysis

Answer

Annual loss expectancy

Question 15

Which statement best describes a warm site in disaster recovery?

Accepted Answer

It has hardware and network equipment but requires data restoration from backups. A warm site is a middle-ground disaster recovery option that has hardware and network infrastructure pre-installed but does not have live, synchronized data. Instead, data must be restored from backups (e.g., tape or disk snapshots) before operations can resume. This contrasts with a hot site, which maintains real-time data replication and fully active systems.

Answer

It has replicated data but no active systems

Answer

It is fully operational with real-time data synchronization

Answer

It has no hardware or infrastructure installed

Question 16

Which TWO of the following are best practices for securing a wireless network? (Select exactly two.)

Accepted Answer

Implement MAC address filtering. Option C is correct because MAC address filtering restricts network access to devices with pre-approved MAC addresses, adding a layer of access control. While not foolproof (MACs can be spoofed), it is a recognized best practice for reducing the attack surface in small or home networks.

Answer

Use WEP encryption for compatibility

Answer

Disable SSID broadcast

Answer

Disable DHCP and use static IP addressing

Question 17

Which metric defines the maximum acceptable amount of data loss measured in time?

Accepted Answer

Recovery Point Objective (RPO). The Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time, typically expressed in seconds, minutes, or hours. It represents the age of the most recent backup or replicated data that must be available to resume operations after a disaster, directly determining the frequency of backups or replication intervals.

Answer

Mean Time Between Failures (MTBF)

Answer

Mean Time to Repair (MTTR)

Answer

Recovery Time Objective (RTO)

Question 18

Which concept ensures that a user cannot deny having performed a specific action?

Accepted Answer

Non-repudiation. Non-repudiation ensures that a user cannot deny having performed a specific action, typically by using cryptographic mechanisms such as digital signatures or audit logs. In the context of the CC exam, this is most commonly achieved through public key infrastructure (PKI) where a private key signs an action, and the corresponding public key verifies the signature, providing irrefutable proof of origin. This prevents a user from later claiming they did not send a message or perform a transaction.

Answer

Availability

Answer

Integrity

Answer

Authorization

Question 19

Refer to the exhibit.
```
C:\> netstat -an | find "LISTENING"
  TCP    0.0.0.0:80     0.0.0.0:0    LISTENING
  TCP    0.0.0.0:443    0.0.0.0:0    LISTENING
  TCP    192.168.1.10:3389  0.0.0.0:0    LISTENING
```
A server administrator runs this command and sees the output. Which service is listening on a port that should typically be disabled to reduce the attack surface?

Accepted Answer

Remote Desktop (port 3389). Remote Desktop Protocol (RDP) on port 3389 is a high-risk service that should typically be disabled on servers unless absolutely necessary, as it provides a direct graphical interface for remote administration and is a common target for brute-force attacks. The output shows RDP listening on a specific internal IP (192.168.1.10), indicating it is bound to a routable interface, which increases exposure. In contrast, HTTP (port 80) and HTTPS (port 443) are standard web services that are often required for a server's function, so they are not typically disabled for attack surface reduction.

Answer

HTTP (port 80)

Answer

All of the above

Answer

HTTPS (port 443)

Question 20

Which TWO are essential elements of a business impact analysis (BIA)?

Accepted Answer

Identification of critical business functions. Option C is correct because identifying critical business functions is a core element of a BIA. The BIA determines which systems and processes are essential for business operations, and without this identification, you cannot prioritize recovery efforts or allocate resources effectively during a disaster.

Answer

A network topology diagram

Answer

List of all employees

Answer

Assignment of IP addresses

ISC2 CC Practice Test 4 — 25 Questions

Exhibit

ISC2 CC Practice Test 4 — 25 Questions

Exhibit