ISC2 CC Practice Test 4 — 25 Questions

Question 1

Which of the following are core principles of information security?

Accepted Answer

Integrity. The CIA triad is the foundational model of information security, and its three core principles are Confidentiality, Integrity, and Availability. Option C (Confidentiality) is correct because it ensures data is disclosed only to authorized parties, typically enforced through encryption, access controls, and classification. Option B (Integrity) is correct because it guarantees data remains accurate, complete, and unaltered, protected via hashing, checksums, and digital signatures. Option E (Availability) is correct because it ensures systems and data are accessible to authorized users when needed, supported by redundancy, backups, and DDoS mitigation. Options A (Authentication) and D (Non-repudiation) are not core principles of the CIA triad; authentication is an access-control mechanism that verifies identity, and non-repudiation is a security service that prevents denial of an action, often achieved with digital signatures.

Answer

Authentication

Answer

Non-repudiation

Question 2

A security analyst is implementing a solution to ensure that data transmitted between two servers cannot be read by unauthorized parties. Which security principle is the analyst primarily addressing?

Accepted Answer

Confidentiality. Confidentiality ensures that data is accessible only to authorized parties and is not disclosed to unauthorized individuals. Encrypting data in transit between two servers directly addresses confidentiality by rendering the data unreadable to eavesdroppers. This is the core goal of protocols like TLS, IPsec, and SSH, which the analyst would likely implement to satisfy this requirement.

Answer

Integrity

Answer

Availability

Answer

Authentication

Question 3

A company's security policy states that employees should only have access to the data necessary to perform their job functions. This is an example of which principle?

Accepted Answer

Least privilege. The principle of least privilege dictates that users and systems should be granted only the minimum permissions necessary to perform their tasks. By restricting data access to job-required information, the company directly implements this security control, reducing the attack surface and limiting potential damage from compromised accounts.

Answer

Defense in depth

Answer

Separation of duties

Answer

Fail-safe

Question 4

A security professional is asked to ensure that a document has not been altered since it was signed. Which technology best supports this requirement?

Accepted Answer

Digital signature. A digital signature uses asymmetric cryptography to sign a document's hash with the signer's private key, allowing anyone with the public key to verify both the signer's identity and that the document has not been altered. This provides integrity and non-repudiation, directly satisfying the requirement.

Answer

Symmetric encryption

Answer

Access control list

Answer

Hashing

Question 5

A security incident report indicates that an employee used their access to view confidential records unrelated to their job. Which security principle was most likely violated?

Accepted Answer

Least privilege. Least privilege means users should have only the minimum access necessary to perform their job. Viewing confidential records unrelated to their job violates this principle because the user had access beyond what was required.

Answer

Separation of duties

Answer

Availability

Answer

Non-repudiation

Question 6

An organization wants to implement defense in depth for its web application. Which combination of controls best illustrates this principle?

Accepted Answer

A firewall, intrusion detection system, and regular security awareness training.. Defense in depth involves multiple layers of security controls so that if one fails, others still protect the asset. A firewall, IDS, and security awareness training represent network, host, and human layers, respectively, illustrating the principle.

Answer

A strict perimeter firewall without internal controls.

Answer

Encryption at rest only.

Answer

A single strong password policy.

Question 7

A security team identifies that a server has a known vulnerability. A threat actor could exploit it to gain unauthorized access. The combination of these factors represents:

Accepted Answer

Risk. Risk is the combination of a threat exploiting a vulnerability, potentially leading to harm. Here, a threat actor could exploit a known vulnerability to gain unauthorized access, which represents a risk.

Answer

Threat

Answer

Control

Answer

Vulnerability

Question 8

Which of the following is the most effective way to prevent tailgating in a secured facility?

Accepted Answer

Training employees to not hold doors open for unknown individuals.. Tailgating exploits social trust — an attacker follows an authorized person through a door. Training employees to challenge and not hold doors for unknown individuals directly addresses the human behavior that enables tailgating, making it the most effective preventive control. Technical controls alone cannot stop a person who is willingly allowed through.

Answer

Installing security cameras at all entrances.

Answer

Using keycard access for all doors.

Answer

Hiring security guards to monitor entrances.

Question 9

A small accounting firm's staff connect to the corporate wireless network using a shared passphrase that every employee knows, and the same passphrase has not been changed in two years. A security consultant recommends moving to a deployment where each user authenticates with their own domain credentials and a RADIUS server validates the logon before network access is granted. Which technology should the consultant recommend?

Accepted Answer

WPA2-Enterprise with 802.1X authentication. Enterprise-mode wireless security couples the 802.1X framework with a RADIUS server so each user presents unique credentials, commonly their domain logon, before access is granted. This eliminates the shared-secret weakness, enables per-user revocation, and produces authentication logs tied to individuals, which is exactly what the consultant was asked to deliver for the accounting firm.

Answer

A captive portal that displays an acceptable-use policy before granting access

Answer

WPA2-Personal with a longer and more complex pre-shared key

Answer

MAC address filtering on the wireless access points

Question 10

The exhibit shows recent authentication logs. What type of attack is most likely indicated?

Accepted Answer

Brute-force attack. The exhibit shows repeated authentication attempts with different passwords for the same username, which is the hallmark of a brute-force attack. In authentication logs, a high frequency of failed login attempts (e.g., multiple 'Failed password' entries in quick succession) indicates an attacker systematically guessing credentials. This aligns with the CC domain of Access Controls, where brute-force attacks target weak password policies.

Answer

Man-in-the-middle attack

Answer

Phishing attack

Answer

Privilege escalation

Question 11

An IT administrator wants to inspect HTTP traffic for malicious payloads such as SQL injection. Which network security device is most appropriate?

Accepted Answer

WAF. A Web Application Firewall (WAF) is specifically designed to inspect HTTP/HTTPS traffic and block malicious payloads such as SQL injection, cross-site scripting (XSS), and other OWASP Top 10 attacks. It operates at the application layer (Layer 7) and can enforce custom rules based on HTTP request contents. An IDS or IPS may detect or block some attacks but is not purpose-built for web application protection.

Answer

IDS

Answer

Honeypot

Answer

IPS

Question 12

Which of the following ports is used by HTTPS?

Accepted Answer

443. HTTPS (Hypertext Transfer Protocol Secure) operates over TCP port 443 by default, using TLS to encrypt HTTP traffic between client and server. This is the IANA-assigned well-known port for HTTPS, so any browser request to https:// implicitly targets port 443 unless overridden. Port 80 is the counterpart for unencrypted HTTP, which is why the two are so often confused.

Answer

80

Answer

21

Answer

25

Question 13

A security analyst notices unusual traffic on the network. Using Wireshark, they capture packets and see that an attacker is reading all unencrypted data from the network segment. Which type of attack is most likely being performed?

Accepted Answer

Sniffing / Eavesdropping. Sniffing or eavesdropping involves capturing network traffic to read data. In this scenario, unencrypted data is being read, which is characteristic of sniffing.

Answer

Spoofing

Answer

DoS

Answer

Man-in-the-middle

Question 14

Which of the following ports is commonly used for secure web traffic (HTTPS)?

Accepted Answer

443. HTTPS uses TCP port 443 by default, wrapping HTTP inside a TLS tunnel so credentials, cookies, and page content are encrypted in transit. Port 443 is the IANA-registered well-known port for HTTPS and is what browsers assume when no port is specified in an https:// URL. This is why secure web traffic is universally associated with 443.

Answer

53

Answer

80

Answer

22

Question 15

An organization wants to segment its network so that public-facing servers are isolated from internal users. Which network design component should be used?

Accepted Answer

DMZ. A DMZ (demilitarized zone) is a perimeter subnetwork that hosts public-facing services such as web, mail, and DNS servers while keeping them separated from the internal trusted network. Traffic from the internet reaches the DMZ, but the DMZ is firewalled off from the internal LAN, so a compromised public server cannot pivot directly into internal systems. This is the standard architecture for isolating externally accessible servers.

Answer

Honeypot

Answer

Subnet

Answer

VLAN

Question 16

A company's security policy requires that all data at rest be encrypted. Which of the following is the BEST approach to ensure compliance while maintaining performance?

Accepted Answer

Deploy full disk encryption on all endpoints and servers.. Full disk encryption (FDE) encrypts the entire storage volume, including the operating system, applications, and all data at rest, ensuring compliance with a policy requiring all data at rest to be encrypted. FDE operates at the block level, typically using AES-256, with minimal performance overhead because encryption and decryption are handled by the disk controller or CPU with hardware acceleration (e.g., AES-NI), making it the best approach for maintaining performance while meeting the broad requirement.

Answer

Use database encryption to protect sensitive data.

Answer

Apply network encryption using TLS for all data transfers.

Answer

Implement file-level encryption for sensitive files only.

Question 17

Refer to the exhibit. A security analyst is reviewing firewall logs and notices repeated denied TCP packets from 192.0.2.10 to internal hosts. The packets are being denied by the access-group "OUTSIDE_IN". What is the most likely reason for these denials?

Accepted Answer

An external host is performing a port scan against internal systems.. The repeated denied TCP packets from 192.0.2.10 (an external IP) to multiple internal hosts indicate a port scan. The access-group 'OUTSIDE_IN' is applied to the outside interface, and the firewall is denying these packets because they match a deny ACE (access control entry) that blocks unsolicited inbound traffic. This pattern of multiple denied connections from a single external source to different internal destinations is characteristic of a reconnaissance scan, not a DoS attack or data exfiltration.

Answer

The firewall is misconfigured and blocking legitimate traffic.

Answer

An internal host has been compromised and is exfiltrating data.

Answer

An external host is launching a denial-of-service (DoS) attack.

Question 18

During an incident response, a forensics analyst captures a memory dump from a compromised server. The analyst needs to ensure the dump is not altered during analysis. Which practice best maintains integrity?

Accepted Answer

Generate a cryptographic hash of the dump before analysis. Generating a cryptographic hash of the memory dump before analysis creates a fixed-length digest that acts as a unique fingerprint of the data. Any subsequent modification, even a single bit flip, will produce a completely different hash value, allowing the analyst to verify the dump has not been altered. This is the standard method for proving integrity in forensic investigations, as required by evidence handling procedures.

Answer

Encrypt the memory dump file

Answer

Maintain a chain of custody log

Answer

Restrict access to the dump to authorized personnel only

Question 19

Refer to the exhibit. Which security principle is being supported by the logging of these events?

Accepted Answer

Accountability. Correct: D - Accountability. Logging provides a record of events that can be traced to specific sources, enabling accountability. Non-repudiation involves proof of actions by a user, but these logs do not prove user identity. Authentication and availability are not directly supported.

Answer

Availability

Answer

Authentication

Answer

Non-repudiation

Question 20

A security analyst needs to ensure that log data cannot be altered after it is written. Which of the following is the most effective method to protect log integrity?

Accepted Answer

Implementing write-once storage for log files. Write-once storage (WORM) physically prevents modification or deletion of log data after it is written, which is the strongest guarantee of log integrity. Because the media enforces immutability at the storage layer, even a compromised application or administrator cannot alter historical records.

Answer

Storing logs on the same server as the application

Answer

Using a separate log server with read-only access

Answer

Encrypting logs with a symmetric key