ISC2 CC Practice Test 26 — 15 Questions

Question 1

An organization uses a network segmentation strategy that creates separate broadcast domains on a single switch. Which technology is being used?

Accepted Answer

VLAN. A VLAN (Virtual Local Area Network) logically partitions a single physical switch into multiple separate broadcast domains. Each VLAN operates as its own Layer 2 network, and broadcast traffic from one VLAN is not forwarded to another without a Layer 3 device. This is the standard technology for network segmentation at Layer 2.

Answer

DMZ

Answer

Honeypot

Answer

Subnetting

Question 2

Which of the following is the best practice for managing cryptographic keys in a large organization?

Accepted Answer

Store keys in a centralized hardware security module (HSM) with strict access controls.. A centralized Hardware Security Module (HSM) provides tamper-resistant, dedicated hardware for secure key generation, storage, and cryptographic operations. Strict access controls (e.g., role-based access, multi-factor authentication) ensure that only authorized personnel can manage keys, while the HSM prevents key extraction even if the host system is compromised. This aligns with NIST SP 800-57 guidelines for key management in large organizations.

Answer

Embed keys in application code to ensure availability.

Answer

Distribute keys to administrators via email for convenience.

Answer

Use a single key for all encryption to simplify management.

Question 3

After a security audit, a company discovers that several employees have access to financial systems that are not required for their job roles. Which access control model would best prevent this issue in the future?

Accepted Answer

Role-based access control (RBAC). RBAC assigns permissions to roles rather than individuals, so access is granted only when a user's job role requires it. This directly enforces least privilege and prevents the audit finding where employees held unnecessary financial-system access. When roles are defined from job functions and reviewed periodically, orphaned or excessive entitlements are far easier to detect and remove.

Answer

Mandatory access control (MAC)

Answer

Discretionary access control (DAC)

Answer

Attribute-based access control (ABAC)

Question 4

An organization is implementing a risk management strategy for a new system. Which THREE actions are examples of risk mitigation?

Accepted Answer

Patching known vulnerabilities. Patching known vulnerabilities (A) is a risk mitigation action because it reduces the likelihood that an attacker can exploit a known weakness, directly lowering the probability of a successful compromise. Installing a firewall (B) mitigates risk by filtering and controlling network traffic, thereby reducing exposure to unauthorized access and certain network-based attacks. Conducting security awareness training (D) mitigates risk by reducing the likelihood that users will fall for phishing, social engineering, or unsafe practices, which addresses the human factor in security incidents. Purchasing cyber insurance (C) is risk transference, not mitigation, because it shifts financial impact to an insurer rather than reducing the likelihood or impact of the event itself. Discontinuing a business process (E) is risk avoidance, since it eliminates the activity that creates the risk instead of reducing it.

Answer

Purchasing cyber insurance

Answer

Discontinuing a business process

Question 5

Which THREE of the following are important steps in the incident response process as defined by the NIST framework? (Choose three.)

Accepted Answer

Detection and Analysis. The NIST SP 800-61 incident response lifecycle defines four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. Option D (Preparation) is correct because it is the first phase, covering establishing an IR capability, tools, communications, and training before incidents occur. Option A (Detection and Analysis) is correct because it is the phase where events are validated as incidents and their scope, impact, and root cause are analyzed. Option C (Containment, Eradication, and Recovery) is correct because it is the phase where the incident is limited, the threat removed, and systems restored to normal operation. Option B (Vulnerability scanning) is not a distinct NIST IR phase; it is a proactive security control that may feed Preparation or Detection but is not one of the defined steps. Option E (Post-incident auditing) is not the NIST phase name; the correct fourth phase is Post-Incident Activity, which includes lessons learned and evidence retention rather than a standalone 'auditing' step.

Answer

Vulnerability scanning

Answer

Post-incident auditing

Question 6

In Active Directory, a GPO is used to enforce a policy that automatically locks user sessions after 15 minutes of inactivity. This is an example of which type of access control?

Accepted Answer

Logical access control. A GPO-enforced session lock is a logical access control because it is implemented in software/OS policy and governs how users interact with system resources after authentication. Logical controls include passwords, permissions, encryption, and session policies, all enforced by the operating system or applications rather than physical barriers or administrative procedures.

Answer

Detective access control

Answer

Physical access control

Answer

Administrative access control

Question 7

Which TWO of the following are core components of the ISC2 Code of Ethics? (Choose two.)

Accepted Answer

Advance and protect the profession.. The ISC2 Code of Ethics explicitly requires members to 'advance and protect the profession' as one of its four mandatory canons. This means acting honorably, maintaining competence, and not engaging in conduct that brings discredit upon the profession. It is a core ethical duty for all certified professionals.

Answer

Disclose all confidential information to law enforcement.

Answer

Ensure maximum profitability for the organization.

Answer

Always follow orders from management.

Question 8

A security engineer is evaluating different firewall architectures. Which firewall type can decrypt SSL/TLS traffic, inspect the contents, and then re-encrypt it?

Accepted Answer

Next-generation firewall (NGFW). A Next-Generation Firewall (NGFW) includes SSL/TLS decryption and inspection capabilities, allowing it to decrypt encrypted traffic, inspect the plaintext for threats or policy violations, and then re-encrypt it before forwarding. This is a defining feature that separates NGFWs from traditional firewalls. The other firewall types lack the deep packet inspection and decryption engine required.

Answer

Application proxy firewall

Answer

Packet filtering firewall

Answer

Stateful inspection firewall

Question 9

Which of the following is considered Sensitive PII?

Accepted Answer

Social Security Number. Sensitive PII is defined as personally identifiable information that, if disclosed, could cause harm or enable identity theft, and it typically includes data elements like Social Security Numbers, financial account numbers, and medical records. A Social Security Number is the canonical example because it is a unique government-issued identifier that can be used to open credit lines, file fraudulent tax returns, or impersonate the individual. Email addresses, phone numbers, and names are generally classified as non-sensitive PII because they are often publicly available and cannot alone be used to commit identity theft.

Answer

Email address

Answer

Phone number

Answer

Name

Question 10

A healthcare provider must ensure that patient records remain unaltered during storage and transmission between clinics. Which security principle is being addressed when the organization implements hashing and digital signatures on those records?

Accepted Answer

Integrity. The scenario centers on preventing and detecting unauthorized modification of patient records while they are stored and moved between clinics. Integrity controls such as hashing and digital signatures make any change detectable and bind the data to its source. Confidentiality hides contents, availability keeps data reachable, and non-repudiation proves who did something; none of those directly satisfies the requirement that the records stay unaltered.

Answer

Non-repudiation

Answer

Confidentiality

Answer

Availability

Question 11

A security analyst is assessing the risk associated with a new web application. The analyst identifies that the application has a SQL injection vulnerability, and there is a known exploit available that could allow an attacker to extract sensitive data. The application is exposed to the internet and is used by customers. Which two factors are most directly involved in determining the level of risk? (Choose two.)

Accepted Answer

The likelihood of the vulnerability being exploited. Risk is typically defined as the combination of the likelihood of a threat exploiting a vulnerability and the impact of that exploitation. In this scenario, the known exploit and internet exposure increase likelihood, while potential sensitive data extraction increases impact. These two factors are directly involved in determining the risk level, making them the correct choices.

Answer

The color scheme of the user interface

Answer

The number of lines of code in the application

Answer

The programming language used to develop the application

Question 12

A hospital's IT department wants to ensure that only authorized clinicians can view patient records, while also guaranteeing that those records have not been tampered with. Which security principle is primarily concerned with preventing unauthorized disclosure of the records?

Accepted Answer

Confidentiality. Confidentiality is the security principle that ensures information is not made available or disclosed to unauthorized individuals, entities, or processes. In the hospital scenario, the goal is to restrict patient record access to authorized clinicians, which is a classic confidentiality objective. Integrity addresses unauthorized modification, availability addresses timely access, and non-repudiation addresses proof of actions.

Answer

Non-repudiation

Answer

Integrity

Answer

Availability

Question 13

A software development team is designing a new application that will process credit card payments. The security architect recommends that the application should not store the card verification value (CVV) after the transaction is authorized. Which principle is the architect applying?

Accepted Answer

Data minimization. The architect recommends not retaining the CVV after the transaction, which reduces the amount of sensitive data the application holds. This is data minimization, the practice of limiting collection and retention to what is necessary. Least privilege is about access rights, separation of duties is about dividing tasks, and defense in depth is about layered controls, so data minimization is the correct principle.

Answer

Least privilege

Answer

Separation of duties

Answer

Defense in depth

Question 14

A financial services company wants to ensure that a terminated employee cannot continue to use an active badge to enter the building after their last day. The security manager reviews physical access control procedures. Which control type is being applied when the badge is deactivated in the access control system?

Accepted Answer

Preventive control. Deactivating a badge stops the terminated employee from entering the facility, which is the definition of a preventive control. Preventive controls aim to stop unauthorized actions before they happen. Detective controls identify events after the fact, corrective controls address incidents after they occur, and compensating controls substitute for missing controls. Since the action blocks access in advance, preventive is correct.

Answer

Detective control

Answer

Corrective control

Answer

Compensating control

Question 15

A security manager is documenting how the organization decides which safeguards to apply to a new customer database. The team identifies the value of the data, the threats that could exploit weaknesses, and the potential business impact, then selects controls that reduce risk to an acceptable level. Which concept best describes this activity?

Accepted Answer

Risk management. The manager is following a structured process: identify and value the asset, determine threats and vulnerabilities, assess potential business impact, and choose safeguards that bring risk to an acceptable level. That end-to-end process is risk management, which includes risk identification, analysis, evaluation, and treatment. Business continuity planning addresses disruptions, awareness training changes user behavior, and vulnerability assessment only finds weaknesses; none of those encompasses the full decision cycle described.

Answer

Vulnerability assessment

Answer

Business continuity planning

Answer

Security awareness training