ISC2 CC Practice Test 5 — 25 Questions

Question 1

During a security incident, the incident response team needs to preserve evidence. Which of the following actions should be performed first?

Accepted Answer

Capture a memory dump. Capturing a memory dump (volatile data) is the first priority because it contains critical evidence such as running processes, network connections, and encryption keys that will be lost when the system is powered off. The order of volatility dictates that volatile data must be collected before any non-volatile data, and before any actions that could alter system state.

Answer

Notify law enforcement

Answer

Power off the system

Answer

Run antivirus scan

Question 2

Which tier in a Security Operations Center (SOC) is primarily responsible for triaging alerts and determining whether to escalate?

Accepted Answer

Tier 1. Tier 1 analysts are the first line of defense in a SOC, responsible for monitoring incoming alerts, performing initial triage, and deciding whether to escalate to Tier 2. They follow predefined playbooks to filter false positives and validate true positives. This role is explicitly designed for rapid alert assessment, not deep investigation or management.

Answer

SOC Manager

Answer

Tier 3

Answer

Tier 2

Question 3

A network administrator is implementing a defense-in-depth strategy. Which THREE of the following are considered network security controls? (Select THREE)

Accepted Answer

Virtual Private Network (VPN). A Virtual Private Network (VPN) is a network security control because it creates an encrypted tunnel (using protocols such as IPsec or TLS) between a remote user and the corporate network, ensuring data confidentiality and integrity over untrusted networks like the internet. This protects data in transit and authenticates endpoints, which is a core network-layer security function.

Answer

Full disk encryption

Answer

Antivirus software

Question 4

During a data breach investigation, the incident response team discovers that personally identifiable information (PII) of EU residents was exfiltrated. Under GDPR, what is the maximum time frame for notifying the supervisory authority?

Accepted Answer

72 hours. GDPR requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.

Answer

7 days

Answer

48 hours

Answer

24 hours

Question 5

A security analyst notices that a user has been granted access to files beyond their job function. Which principle is violated?

Accepted Answer

Least privilege. The principle of least privilege states that users should be granted only the minimum access rights necessary to perform their job functions. Granting access to files beyond that scope directly violates this principle. This is a foundational access control concept in security frameworks like ISO 27001 and NIST.

Answer

Authentication

Answer

Non-repudiation

Answer

Accountability

Question 6

Which protocol operates at the Transport layer of the OSI model and is connectionless and unreliable?

Accepted Answer

UDP. UDP (User Datagram Protocol) is a Transport layer (Layer 4) protocol that is connectionless and unreliable. It does not establish a connection before sending data, and it does not guarantee delivery, ordering, or error recovery. This makes it suitable for applications that prioritize speed over reliability, such as streaming or DNS.

Answer

TCP

Answer

HTTP

Answer

IP

Question 7

An organization uses hashing to ensure that data has not been altered during transmission. Which security principle is being implemented?

Accepted Answer

Integrity. Hashing produces a fixed-length digest that acts as a fingerprint of the data. If even a single bit changes during transmission, the resulting hash will differ, allowing the receiver to detect any alteration. This directly enforces the security principle of integrity, which ensures data is not modified in an unauthorized or accidental manner.

Answer

Availability

Answer

Authentication

Answer

Confidentiality

Question 8

Which TCP segment is sent to initiate the three-way handshake?

Accepted Answer

SYN. The TCP three-way handshake begins with the client sending a SYN segment to the server to request a connection and synchronize sequence numbers. The server responds with SYN-ACK, and the client completes with ACK. Therefore, the segment that initiates the handshake is SYN.

Answer

ACK

Answer

SYN-ACK

Answer

FIN

Question 9

During a ransomware incident, the incident response team needs to communicate with stakeholders. According to best practices, which TWO groups should be notified immediately? (Select TWO.)

Accepted Answer

Legal and public relations. Option B (Legal and public relations) is correct because during a ransomware incident, legal counsel must be engaged immediately to assess regulatory notification obligations (e.g., GDPR, HIPAA, SEC disclosure rules) and preserve attorney-client privilege, while public relations manages external messaging to protect the organization's reputation and prevent misinformation. Option E (Internal management) is correct because executive leadership and management must be notified right away to authorize incident response actions, allocate resources, make critical business decisions, and fulfill their governance and oversight responsibilities. Option A (Affected customers) is not an immediate notification group; customer notification typically occurs after the scope of the breach is determined and legal/regulatory guidance is obtained, often with a defined timeline. Option C (All employees) is too broad for immediate notification, as mass communication can cause panic or leaks; only those with a need to know are informed initially. Option D (Competitors) has no legitimate role in incident response notification and would only expose the organization to further risk.

Answer

Affected customers

Answer

All employees

Answer

Competitors

Question 10

A company's BCP requires that critical systems be restored within 2 hours of disruption. Which metric defines this?

Accepted Answer

Recovery Time Objective (RTO). The Recovery Time Objective (RTO) defines the maximum acceptable time that a system or application can be unavailable after a disruption. In this scenario, the requirement to restore critical systems within 2 hours directly specifies the RTO. It is a key metric in business continuity planning that drives the design of failover and recovery strategies.

Answer

Mean Time to Repair (MTTR)

Answer

Service Level Agreement (SLA)

Answer

Recovery Point Objective (RPO)

Question 11

According to the (ISC)² Code of Ethics, which of the following obligations takes the highest priority?

Accepted Answer

Protect society. The (ISC)² Code of Ethics Canons are ordered by priority, and the first canon — 'Protect society, the common good, necessary public trust and confidence, and the infrastructure' — takes precedence over all others. This means that when obligations conflict, the safety and welfare of society outweigh duties to employers, clients, or the profession. The remaining canons (act honorably, provide diligent service, advance the profession) are subordinate to this top-level obligation.

Answer

Advance the profession

Answer

Act honourably

Answer

Provide diligent service

Question 12

A company uses encryption to protect data at rest and in transit. This primarily addresses which aspect of the CIA triad?

Accepted Answer

Confidentiality. Encryption protects data confidentiality by ensuring that only authorized parties can read the data. Whether at rest (stored on disk) or in transit (moving across networks), encryption renders data unreadable to unauthorized users, directly addressing the confidentiality aspect of the CIA triad. Integrity, authentication, and availability are separate concerns not primarily addressed by encryption alone.

Answer

Integrity

Answer

Authentication

Answer

Availability

Question 13

Which access control principle restricts access to data based on the user's job role and tasks?

Accepted Answer

Need to know. Need to know restricts access based on the specific data a user requires to perform their job tasks, which is exactly what the question describes. It is narrower than least privilege: least privilege limits the level of access (e.g., read vs. write), while need to know limits which specific data the user can see.

Answer

Separation of duties

Answer

Defense in depth

Answer

Least privilege

Question 14

An employee uses their username to claim an identity and then enters a password to prove it. What is the term for the process of proving the claimed identity?

Accepted Answer

Authentication. Authentication is the process of verifying a claimed identity, typically by validating one or more factors such as something you know (password), something you have (token), or something you are (biometric). When the employee enters a password to prove the username they claimed, that verification step is authentication. Identification is the act of claiming the identity; authentication proves it.

Answer

Authorization

Answer

Accounting

Answer

Identification

Question 15

Which common port is used by DNS and which transport layer protocol does it primarily use?

Accepted Answer

Port 53, both UDP and TCP. DNS uses port 53 for both UDP and TCP: UDP is used for standard queries and responses because it is fast and low-overhead, while TCP is used for zone transfers, DNSSEC responses, and queries with responses larger than 512 bytes (or EDNS0-negotiated sizes). This dual-protocol design is why the correct answer must include both.

Answer

Port 53, UDP only

Answer

Port 161, UDP

Answer

Port 53, TCP only

Question 16

Which incident category involves an attacker tricking an employee into revealing credentials?

Accepted Answer

Social engineering. Social engineering is the incident category that involves manipulating people into divulging confidential information, such as credentials. Attackers use psychological tactics like phishing, pretexting, or baiting to trick employees into revealing passwords or other sensitive data.

Answer

Data breach

Answer

Malware

Answer

Denial of service

Question 17

A company is implementing a data classification policy. According to best practices, which THREE of the following should be classified as 'restricted' or 'top secret'? (Select THREE).

Accepted Answer

Classified government intelligence. Option B (classified government intelligence) is correctly marked restricted/top secret because it is information whose unauthorized disclosure would cause exceptional damage to national security and is legally protected at the highest classification levels. Option D (trade secrets) is correct because trade secrets are proprietary intellectual property whose disclosure would cause severe competitive and financial harm, so best-practice data classification places them in the highest sensitivity tier. Option E (biometric data of employees) is correct because biometric identifiers are sensitive personal data (often special-category data under regimes like GDPR) that cannot be changed if compromised, warranting restricted handling. The unmarked options do not belong: A (company cafeteria menu) and C (marketing brochures) are intended for public or internal distribution and carry negligible confidentiality impact, so they would be classified as public or internal, not restricted.

Answer

Company cafeteria menu

Answer

Marketing brochures

Question 18

Which backup strategy requires the least amount of time to perform a daily backup but the most time to perform a full restore?

Accepted Answer

Incremental backup. An incremental backup only captures data changed since the last backup of any type, so each daily run is very fast and small. However, a full restore requires the last full backup plus every incremental since then, applied in sequence—making restore the slowest of all strategies.

Answer

Differential backup

Answer

Full backup

Answer

Synthetic full backup

Question 19

Which TWO of the following are fundamental principles of information security that form the CIA triad?

Accepted Answer

Confidentiality. Confidentiality (A) is a core CIA triad principle because it ensures information is not disclosed to unauthorized individuals, systems, or processes, typically enforced through encryption, access controls, and classification. Integrity (B) is also a core CIA triad principle because it ensures data and systems remain accurate, complete, and protected from unauthorized modification, whether in storage or transit, using mechanisms like hashing, checksums, and digital signatures. Together with Availability, these three form the CIA triad, the foundational model for information security. Privacy (C) is a related concept concerning the appropriate handling of personal data, but it is not one of the three CIA triad principles. Non-repudiation (D) is a security property that prevents a party from denying an action, often achieved with digital signatures, but it is not part of the CIA triad. Accountability (E) supports security through auditing and traceability, but it is likewise not one of the three CIA triad pillars.

Answer

Privacy

Answer

Non-repudiation

Answer

Accountability

Question 20

A company is deploying a security device that inspects HTTP and HTTPS traffic, applies OWASP rules, and can block malicious requests before they reach the web server. Which device best fits this description?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) is specifically designed to inspect HTTP and HTTPS traffic at Layer 7, apply rule sets such as the OWASP ModSecurity Core Rule Set, and block malicious requests like SQL injection, XSS, and CSRF before they reach the web server. It understands web protocols and can enforce positive/negative security models based on HTTP headers, cookies, and payloads. This matches the described requirement exactly.

Answer

Honeypot

Answer

Intrusion Prevention System (IPS)

Answer

Stateful firewall