ISC2 CC Practice Test 27 — 15 Questions

Question 1

A mid-sized financial services company has recently experienced a security incident where an attacker gained access to the internal network through a compromised VPN account. The account belonged to a remote employee who had been granted full network access. The company's security team is now reviewing their security principles to prevent a recurrence. The company has 500 employees, with 50 remote workers. They use a traditional perimeter-based firewall and VPN for remote access. The incident revealed that the compromised account had access to the entire internal network, including sensitive financial databases. The security team is considering implementing a new access control model. They have identified the following requirements: (1) Remote workers should only access specific applications necessary for their roles, (2) Access should be granted based on identity and device posture, (3) Network segmentation should be enforced regardless of location. Which of the following approaches BEST addresses these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Adopt a Zero Trust Architecture (ZTA) that uses an identity-aware proxy and micro-segmentation.. A Zero Trust Architecture (ZTA) with an identity-aware proxy and micro-segmentation directly addresses all three requirements: it grants access based on identity and device posture, limits remote workers to specific applications, and enforces segmentation regardless of location. ZTA assumes no implicit trust based on network location, which prevents a compromised VPN account from accessing the entire internal network. This is the most comprehensive and aligned solution.

Answer

Implement multi-factor authentication on the existing VPN and enforce stricter password policies.

Answer

Create separate VLANs for each department and restrict inter-VLAN routing with ACLs.

Answer

Apply the principle of least privilege by reducing user permissions on the network and servers.

Question 2

An e-commerce company notices that its product reviews are being scraped by automated bots far more aggressively than expected, and the resulting traffic is degrading checkout performance for real customers. The security team wants a control that slows automated abuse without challenging legitimate buyers. Which security principle does this control primarily support?

Accepted Answer

Availability. The scenario centers on keeping the storefront usable for legitimate customers despite aggressive automated traffic. Rate limiting and similar anti-automation controls protect the ability of authorized users to reach and use the system, which is the definition of availability. Confidentiality, integrity, and non-repudiation address disclosure, modification, and proof of action respectively, none of which describes degraded checkout performance caused by resource consumption.

Answer

Non-repudiation

Answer

Confidentiality

Answer

Integrity

Question 3

A security officer at a healthcare provider is reviewing the organization's risk management program. The officer must distinguish between threats and vulnerabilities when documenting risks. Which two of the following are examples of vulnerabilities rather than threats? (Choose two.)

Accepted Answer

An unpatched web server that is missing a critical security update. Vulnerabilities are weaknesses or gaps in protection that can be exploited, such as an unpatched web server and an unencrypted database. Threats are potential causes of harm, including ransomware groups, phishing campaigns, and natural disasters. The two correct choices describe internal weaknesses, while the other options describe threat actors or events that could exploit those weaknesses.

Answer

A ransomware group that is actively targeting healthcare organizations

Answer

A natural disaster such as a hurricane that could damage a data center

Answer

A phishing campaign that delivers malicious attachments to employees

Question 4

A security administrator is reviewing the organization's authentication controls and wants to strengthen them by adding factors from different categories. Which TWO of the following represent distinct authentication factor categories that can be combined to achieve multi-factor authentication? (Choose two.)

Accepted Answer

Something you possess, such as a smart card or hardware token. Multi-factor authentication requires two or more factors drawn from different categories: something you know, something you have, and something you are. A password or PIN represents knowledge, while a smart card or hardware token represents possession, so combining them satisfies the requirement. Usernames are identifiers rather than factors, two passwords remain knowledge-based, and a one-time passcode sent to the requesting device does not introduce a distinct factor category.

Answer

Two different passwords for the same account

Answer

A one-time passcode sent to the same device that is requesting access

Answer

A username and a password entered together

Question 5

A hospital's compliance officer is mapping controls for a new patient portal. The legal team wants documented assurance that a clinician cannot later deny having approved a medication order submitted through the portal. Which security principle is the legal team most directly requesting?

Accepted Answer

Non-repudiation. The legal team needs proof of who performed an action so it cannot be denied later. That is non-repudiation, usually achieved with digital signatures, strong authentication, and tamper-evident audit logging tied to individual identities. Integrity protects against unauthorized changes, confidentiality protects against disclosure, and availability protects against loss of access; none of these establishes undeniable authorship of the medication order.

Answer

Integrity

Answer

Availability

Answer

Confidentiality

Question 6

An organization is reviewing its security governance framework. Which TWO of the following are primary objectives of security governance? (Choose two.)

Accepted Answer

Aligning security strategy with business objectives. Security governance is the set of responsibilities and practices exercised by the board and executive management to provide strategic direction, ensure objectives are achieved, manage risks appropriately, and verify that resources are used responsibly. Aligning security strategy with business objectives and ensuring accountability for security decisions are core governance objectives. Technical controls, penetration testing, and awareness training are operational activities that support governance but are not primary objectives of governance itself.

Answer

Developing security awareness training

Answer

Implementing technical security controls

Answer

Conducting penetration testing

Question 7

A financial services firm wants to ensure that a single employee cannot initiate and approve a large wire transfer alone. The firm implements a process where one employee creates the transfer and a different employee must approve it. Which security principle is being applied?

Accepted Answer

Separation of duties. Separation of duties ensures that a critical task requires more than one person to complete, preventing a single individual from abusing the process. By having one employee create the wire transfer and another approve it, the firm applies this principle directly. Least privilege, job rotation, and mandatory vacation serve different purposes and do not enforce dual control over a single transaction.

Answer

Least privilege

Answer

Mandatory vacation

Answer

Job rotation

Question 8

A hospital's radiology department issues each technologist a smart card that must be inserted into a workstation reader before the technologist types a username and password. The smart card stores a digital certificate that the workstation validates. Which statement best describes how this arrangement maps to the identity and access control concepts?

Accepted Answer

The username provides identification, while the smart card and password together provide authentication.. Identification is the act of claiming an identity, and authentication is the act of proving that claim. Typing a username claims an identity, while the smart card and password independently verify it using possession and knowledge factors. Because two distinct factor types are required, the workflow is multi-factor authentication, and authorization would only follow once verification succeeds.

Answer

The entire sequence is authorization, because the workstation validates a digital certificate.

Answer

The smart card performs identification, while the username and password perform authentication.

Answer

The smart card and password together perform identification, while the username performs authentication.

Question 9

A software development company wants to ensure that only authorized code changes are deployed to production. The security team proposes that developers should not have direct write access to the production environment, and that all code must be reviewed and approved by a different team member before deployment. Which security principle does this proposal primarily enforce?

Accepted Answer

Separation of duties. The proposal enforces separation of duties by requiring that code changes are reviewed and approved by someone other than the developer, and by preventing developers from directly writing to production. This ensures that no single person can both create and deploy code without oversight. Least privilege, defense in depth, and non-repudiation address different aspects of security and do not capture the dual-control requirement.

Answer

Defense in depth

Answer

Least privilege

Answer

Non-repudiation

Question 10

A new employee at a marketing firm receives a company laptop, a proximity badge, and a one-time password token on their first day. Before being allowed to log in, the employee must enter their employee ID, then a code from the token, then scan the badge. Which access control concept does the employee ID represent in this sequence?

Accepted Answer

Identification. Identification is the claim of an identity, such as typing a username or employee ID, while authentication verifies that claim with credentials. In this scenario the employee ID is asserted before the token code and badge scan, so it functions as the identification step. Authorization and accounting occur only after identity is verified.

Answer

Accounting

Answer

Authorization

Answer

Authentication

Question 11

A hospital's billing application assigns permissions based on each employee's job title, such as nurse, billing clerk, or department manager. When an employee changes roles, the administrator updates the job title and the application automatically adjusts the employee's access. Which access control model is being used?

Accepted Answer

Role-based access control (RBAC). Role-based access control assigns permissions to roles and then assigns users to those roles, so access changes automatically when a user's role changes. The hospital's job-title-driven permissions match this model. Discretionary control lets owners set permissions, mandatory control uses labels and clearances, and rule-based control evaluates conditions rather than job functions.

Answer

Mandatory access control (MAC)

Answer

Rule-based access control

Answer

Discretionary access control (DAC)

Question 12

A security manager is developing a disaster recovery plan for a critical database. The manager needs to determine the maximum tolerable downtime (MTD) for the database. Which of the following should the manager consider FIRST when establishing the MTD?

Accepted Answer

The business impact of the database being unavailable. The maximum tolerable downtime (MTD) is the longest time an organization can tolerate a system being unavailable before unacceptable consequences occur. To establish MTD, the manager must first conduct a business impact analysis to understand the consequences of downtime. This includes financial, operational, and reputational impacts. Once MTD is known, the recovery time objective (RTO) can be set to ensure recovery occurs within that window. Cost, RTO, and RPO are all important but are not the primary driver for MTD.

Answer

The cost of implementing redundant hardware

Answer

The recovery time objective (RTO) of the database

Answer

The recovery point objective (RPO) of the database

Question 13

A hospital's IT team is reviewing its access control model. Administrators currently assign permissions to each nurse individually, which has caused errors and delays when staff rotate between departments. The team wants to simplify administration by assigning permissions to a role such as 'Pediatric Nurse' and then assigning nurses to that role. Which access control model should they implement?

Accepted Answer

Role-Based Access Control (RBAC). The hospital needs permissions tied to job functions rather than to individual accounts. Role-Based Access Control creates roles, assigns permissions to those roles, and then assigns users to roles, so rotating staff only requires changing the role assignment. This reduces administrative errors, supports least privilege at the role level, and scales cleanly as departments and duties change.

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Answer

Rule-Based Access Control

Question 14

A retail company's business continuity plan includes a requirement to test its disaster recovery capabilities annually. The IT team proposes conducting a tabletop exercise with key stakeholders. Which benefit does this type of test provide?

Accepted Answer

It evaluates the decision-making and communication processes without disrupting live operations.. A tabletop exercise is a discussion-based test that simulates an emergency scenario to evaluate plans, roles, and communication. It does not disrupt live operations and is relatively low-cost. It helps identify gaps in coordination and decision-making. It is not a technical test of recovery systems; instead, it focuses on the human and procedural elements of business continuity and disaster recovery.

Answer

It verifies that the recovery site can handle the production workload within the RTO.

Answer

It provides a full-scale simulation of a disaster to test all technical recovery procedures.

Answer

It automatically updates the disaster recovery plan based on identified gaps during the exercise.

Question 15

A financial services firm stores customer records in a database. A teller can read and update records for customers assigned to their branch but cannot view records belonging to other branches. A branch manager can view all records within their region. Which access control principle best explains why the teller's access is limited to their own branch's customers?

Accepted Answer

Need to know. Need to know restricts access to only the information a user requires for their job, which is why the teller sees only their branch's customers. Least privilege limits the types of permissions granted, separation of duties splits tasks among users, and defense in depth layers controls. The record-level restriction described maps to need to know.

Answer

Separation of duties

Answer

Least privilege

Answer

Defense in depth