ISC2 CC Practice Test 4 — 25 Questions

Question 1

A security analyst is configuring an intrusion detection system (IDS) to detect SQL injection attacks. Which method is most effective?

Accepted Answer

Examine HTTP request parameters for SQL commands. Examining HTTP request parameters for SQL commands directly detects SQL injection attempts. The other options are unrelated or less effective.

Answer

Analyze DNS query patterns

Answer

Detect port scans from external IPs

Answer

Monitor bandwidth usage for spikes

Question 2

A security administrator notices that a user's account has been used to access sensitive files at unusual hours. Which security principle would most effectively help detect this type of activity?

Accepted Answer

Accountability. Accountability enables tracking of user actions through logs and monitoring. Option A (Non-repudiation) prevents denial of actions but does not focus on detection. Option B (Availability) ensures data is accessible. Option C (Integrity) ensures data accuracy.

Answer

Non-repudiation

Answer

Availability

Answer

Integrity

Question 3

A company deploys a firewall that inspects packet headers and maintains a state table to track active connections. It drops any incoming packets that do not match an established connection. What type of firewall is this?

Accepted Answer

Stateful inspection firewall. A stateful inspection firewall tracks connections and blocks unsolicited inbound traffic.

Answer

Application proxy firewall

Answer

Next-generation firewall

Answer

Packet filtering firewall

Question 4

Which of the following is considered sensitive Personally Identifiable Information (PII)?

Accepted Answer

Medical records. Medical records are sensitive PII because they can cause significant harm if disclosed.

Answer

Email address

Answer

Date of birth

Answer

Phone number

Question 5

A medium-sized enterprise uses a Cisco ASA firewall configured with multiple security zones (Inside, Outside, DMZ). The DMZ hosts a web server that must be accessible from the Internet on TCP 443. The Inside network (10.0.0.0/24) hosts internal clients. The web server has IP 172.16.0.10. The firewall's current rules: allow any from Outside to DMZ on TCP 443; allow any from Inside to Outside; deny all else. Recently, the security team noticed that an attacker compromised the web server and used it to launch an attack against an internal database server at 10.0.0.50. The attack was successful because the firewall allowed traffic from the DMZ to the Inside. The firewall's default behavior is to deny traffic from lower security zones to higher security zones (DMZ is lower than Inside). What is the MOST likely reason this traffic was allowed?

Accepted Answer

The firewall has an explicit permit rule for traffic from DMZ to Inside on any destination.. The firewall's default behavior is to deny traffic from a lower security zone (DMZ) to a higher security zone (Inside). For the attack to succeed, an explicit permit rule must have been configured to allow traffic from DMZ to Inside. The existing rules only permit Outside to DMZ on TCP 443 and Inside to Outside; without an explicit DMZ-to-Inside rule, the default deny would have blocked the attack. Thus, the most likely reason is that an administrator inadvertently or intentionally added such a permit rule.

Answer

The firewall was configured in transparent mode, allowing all traffic.

Answer

The attacker used a VPN connection that bypassed the firewall.

Answer

The firewall's default behavior permits traffic from lower security level to higher if the connection is initiated from the higher level.

Question 6

Which of the following is the primary purpose of a security information and event management (SIEM) system?

Accepted Answer

Correlate and analyze log data to detect incidents.. The primary purpose of a SIEM system is to aggregate, correlate, and analyze log data from multiple sources (e.g., firewalls, servers, IDS/IPS) in real time to detect security incidents. By applying correlation rules and analytics, SIEM identifies patterns or anomalies that indicate malicious activity, enabling security teams to respond promptly.

Answer

Enforce access control policies.

Answer

Replace the need for manual log review.

Answer

Prevent malware infections.

Question 7

A security consultant is evaluating a vendor's security practices before signing a contract. The consultant reviews the vendor's security policies, incident response plans, and conducts background checks on key personnel. This activity is an example of:

Accepted Answer

Due diligence. Due diligence involves investigating and verifying security practices before making a decision, such as vendor risk assessment.

Answer

Risk avoidance

Answer

Due care

Answer

Risk mitigation

Question 8

Which of the following is a key function of a Security Information and Event Management (SIEM) system?

Accepted Answer

Correlating log data from multiple sources to identify security incidents. SIEM aggregates and correlates logs from various sources to detect patterns and generate alerts.

Answer

Blocking malicious network traffic

Answer

Enforcing password complexity requirements

Answer

Patching vulnerabilities in operating systems

Question 9

Which TWO of the following are commonly used techniques to detect phishing emails? (Choose two.)

Accepted Answer

Sandboxing email attachments in a secure environment.. Sandboxing email attachments in a secure environment (Option C) is a common technique to detect phishing emails because it allows suspicious attachments to be executed and analyzed in an isolated virtual machine. This process observes the attachment's behavior for malicious activities, such as attempting to connect to a command-and-control server or dropping malware, without risking the actual endpoint. It is a core technology used in advanced email security gateways and threat intelligence platforms.

Answer

Scanning for specific file extensions.

Answer

Disabling automatic image loading.

Answer

Implementing DKIM and DMARC records.

Question 10

Which TWO of the following are examples of integrity controls? (Select TWO)

Accepted Answer

Digital signatures. Hashing and digital signatures are integrity controls that verify data has not been altered.

Answer

Redundancy

Answer

Firewalls

Answer

Encryption

Question 11

A security manager is advised to implement 'due care' in their organization. Which action best exemplifies due care?

Accepted Answer

Regularly updating antivirus software. Due care means taking reasonable steps to protect assets, such as implementing basic security controls like patch management.

Answer

Purchasing cyber insurance

Answer

Performing a background check on a new vendor

Answer

Accepting the risk of a legacy system

Question 12

Which of the following best describes the purpose of due care in information security?

Accepted Answer

Implementing reasonable security measures to protect data. Due care means exercising a minimum standard of care to protect information assets, such as implementing basic security controls.

Answer

Prioritizing security incidents based on impact

Answer

Transferring risk to a third party

Answer

Investigating a vendor's background before contracting

Question 13

After a security breach, the organization conducts a background check on a new vendor before signing a contract. This practice is known as:

Accepted Answer

Due diligence. Due diligence involves investigating and verifying before acting.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Due care

Question 14

A multinational corporation deploys redundant servers in geographically diverse data centers and uses a load balancer to distribute traffic. This setup primarily addresses which security concern?

Accepted Answer

Availability. Redundancy and load balancing ensure that systems remain accessible, supporting availability.

Answer

Confidentiality

Answer

Integrity

Answer

Non-repudiation

Question 15

Which of the following is an example of a physical control that supports the availability principle of the CIA triad?

Accepted Answer

Redundant servers. Availability ensures systems are accessible when needed. Redundant servers provide failover capability, minimizing downtime.

Answer

Data encryption

Answer

Biometric authentication

Answer

Digital signatures

Question 16

Which security principle ensures that data cannot be accessed by unauthorized individuals?

Accepted Answer

Confidentiality. Confidentiality ensures that data is not disclosed to unauthorized individuals, systems, or processes.

Answer

Integrity

Answer

Non-repudiation

Answer

Availability

Question 17

Which of the following is a benefit of using VLANs in a network?

Accepted Answer

Logical segmentation without additional hardware. VLANs allow logical segmentation of a network at Layer 2, improving security and reducing broadcast traffic without requiring additional physical switches.

Answer

Elimination of all broadcast traffic

Answer

Faster data transfer speeds

Answer

Increased physical security

Question 18

A security analyst receives an alert of unusual network traffic from an internal host to an external IP known for command-and-control. After isolating the host, what should be the next step?

Accepted Answer

Preserve forensic evidence and analyze. Preserving forensic evidence and analyzing the host is the correct next step because incident response methodology (e.g., NIST SP 800-61) requires containment followed by evidence collection and analysis to determine the scope of compromise, identify indicators of compromise (IOCs), and understand the attack vector. Wiping or reimaging destroys volatile data (e.g., memory, running processes, network connections) and artifacts (e.g., registry keys, prefetch files, event logs) that are critical for attribution and remediation. Analysis may involve memory forensics (using tools like Volatility) and disk forensics to extract malware samples, C2 communication logs, and lateral movement traces.

Answer

Wipe the host and reinstall OS

Answer

Reimage the host from backup

Answer

Notify law enforcement

Question 19

Which data classification level typically requires the highest level of protection?

Accepted Answer

Top secret. Top secret is the highest classification and requires strict controls.

Answer

Internal

Answer

Confidential

Answer

Public

Question 20

Which two protocols operate at the Transport layer of the OSI model? (Choose TWO.)

Accepted Answer

TCP. TCP and UDP are the primary Transport layer protocols. IP is Network layer, Ethernet is Data Link, and HTTP is Application layer.

Answer

HTTP

Answer

IP

Answer

Ethernet