ISC2 CC Practice Test 27 — 15 Questions

Question 1

Refer to the exhibit. Which security control is MOST likely triggered?

Accepted Answer

Account lockout policy. The log shows an account lockout after multiple failed authentication attempts, indicating an account lockout policy is in effect.

Answer

Intrusion prevention system

Answer

Antivirus software

Answer

Firewall rule

Question 2

An organization is designing a security architecture for a cloud-based application. They implement firewalls, intrusion detection systems, and encryption, and also conduct regular security awareness training. This approach demonstrates which security principle?

Accepted Answer

Defense in depth. Defense in depth uses multiple layered controls. The combination of technical and administrative controls is key.

Answer

Security through obscurity

Answer

Least privilege

Answer

Separation of duties

Question 3

During a security audit, you discover that a financial application stores passwords using MD5 hashing without salt. What is the primary security concern with this practice?

Accepted Answer

Without salting, the hashes are vulnerable to precomputed rainbow table attacks. Option B is correct because MD5 is vulnerable to rainbow table attacks, and lack of salting makes it easy for attackers to precompute hashes. Reversibility is not the primary concern (hashing is one-way). Speed is actually a vulnerability, not a strength. Compliance violation is a secondary issue.

Answer

MD5 is reversible, allowing attackers to recover plaintext passwords

Answer

MD5 is too slow, causing performance issues during authentication

Answer

Storing hashes violates PCI DSS compliance, but does not affect security

Question 4

A cloud security engineer reviews the following S3 bucket policy. What is the primary security risk?

Accepted Answer

The bucket is publicly readable, allowing anyone to access its contents. Option A is correct because the policy allows any anonymous user to read any object in the bucket (Principal: * without condition). Option B is wrong because write access is not granted. Option C is wrong because the risk is unauthorized read, not deletion. Option D is wrong; encryption is not addressed here.

Answer

The bucket does not have encryption enabled

Answer

The bucket policy permits deletion of objects by anyone

Answer

The bucket allows unauthorized users to write objects

Question 5

A company's security policy states that all sensitive data must be encrypted both at rest and in transit. Which threat model does this control primarily address?

Accepted Answer

Unauthorized disclosure. Encryption at rest and in transit primarily protects confidentiality against unauthorized access. Option B is correct. Option A (availability) is about uptime. Option C (integrity) is about accuracy, though encryption can help, but primary is confidentiality. Option D (non-repudiation) is about proof of origin.

Answer

Data tampering

Answer

Denial of service

Answer

Repudiation

Question 6

A company implements two-factor authentication (2FA) for all remote access. Which primary security goal is this enhancing?

Accepted Answer

Confidentiality. 2FA strengthens authentication, ensuring only authorized users access data, thereby protecting confidentiality. Option B (Integrity) is about data accuracy. Option C (Availability) is about uptime. Option D (Non-repudiation) is about proof of actions.

Answer

Availability

Answer

Integrity

Answer

Non-repudiation

Question 7

Refer to the exhibit. Which security principle is this policy primarily enforcing?

Accepted Answer

Least privilege. Correct: B - Least privilege. The policy allows only get access to a specific bucket from a specific IP range, granting the minimum necessary access. Confidentiality is addressed indirectly, but the design emphasizes least privilege. Defense in depth and non-repudiation are not shown.

Answer

Non-repudiation

Answer

Defense in depth

Answer

Confidentiality

Question 8

An organization implements a role-based access control (RBAC) system. To maintain the principle of least privilege, what should the administrator do when a user changes roles?

Accepted Answer

Remove the previous role's access and assign the new role's access.

Answer

Keep all access and let the manager manually remove as needed.

Answer

Use a single role for all users to simplify management.

Answer

Add the new role's access while keeping the previous role's access.

Question 9

During a security audit, it is discovered that a single administrator can create user accounts, assign privileges, and review audit logs. Which principle is most likely being violated?

Accepted Answer

Separation of duties. Separation of duties requires that conflicting critical tasks be performed by different individuals to prevent fraud or error. The administrator has both operational and oversight roles, violating this principle.

Answer

Least privilege

Answer

Need to know

Answer

Defense in depth

Question 10

Refer to the exhibit. What is the effect of this ACL?

Accepted Answer

Allows HTTP and HTTPS traffic to server 10.0.1.100, denies all other traffic. The ACL permits HTTP (port 80) and HTTPS (port 443) traffic from any source to host 10.0.1.100, and explicitly denies all other traffic.

Answer

Allows only HTTPS to 10.0.1.100

Answer

Denies HTTP and HTTPS to 10.0.1.100

Answer

Allows all traffic to 10.0.1.100

Question 11

A software developer is designing a web application that will store user credentials. What is the most secure method for storing passwords?

Accepted Answer

Hash passwords using a strong algorithm like bcrypt with a unique salt. Hashing with salt protects passwords even if database is compromised. Encryption is reversible, so less secure for passwords.

Answer

Use a tokenization service to replace passwords with tokens

Answer

Encrypt passwords using AES-256 and store the key separately

Answer

Store passwords in a secure database with access controls

Question 12

You are designing a backup strategy for a critical database. The business requires that in the event of a failure, data loss must not exceed 15 minutes. Which metric primarily addresses this requirement?

Accepted Answer

Recovery Point Objective (RPO). Option A is correct because Recovery Point Objective (RPO) defines the maximum acceptable data loss in terms of time. Recovery Time Objective (RTO) is about downtime duration. MTBF relates to reliability, and SLA is a service agreement. RPO directly addresses data loss tolerance.

Answer

Service Level Agreement (SLA)

Answer

Mean Time Between Failures (MTBF)

Answer

Recovery Time Objective (RTO)

Question 13

A network administrator configures the ACL on a router as shown. What is the effect of this access list?

Accepted Answer

Blocks Telnet traffic entering the interface, but allows all other traffic. Option A is correct because the ACL denies TCP traffic to port 23 (Telnet) and permits all other IP traffic. Option B is wrong because SSH is port 22. Option C is wrong because the ACL is applied inbound on Gig0/1, so it filters incoming traffic only, not outgoing. Option D is wrong because it applies to all TCP traffic, not just Telnet.

Answer

Blocks SSH traffic (port 22) from entering the interface

Answer

Blocks Telnet traffic leaving the interface, but allows all other traffic

Answer

Blocks all TCP traffic except Telnet

Question 14

A security architect is evaluating a biometric authentication system. The system's false positive rate is 0.1%, and the false negative rate is 2%. Which security principle is most compromised if the organization prioritizes user convenience over security?

Accepted Answer

Availability. A low false positive rate means few unauthorized users are authenticated, but a high false negative rate can lock out legitimate users, affecting availability. If convenience is prioritized, the false negative rate might be reduced by lowering thresholds, increasing false positives and compromising security (confidentiality/integrity). However, the immediate principle affected by a high false negative rate is availability because legitimate users cannot access systems. Option C is correct. Option A (confidentiality) is more related to false positives. Option B (integrity) is not direct. Option D (non-repudiation) is about accountability.

Answer

Confidentiality

Answer

Non-repudiation

Answer

Integrity

Question 15

During a security audit, it is discovered that a single employee can approve purchase orders and also receive the goods. Which security principle is being violated?

Accepted Answer

Separation of duties. Separation of duties requires that conflicting tasks be divided among different individuals to prevent fraud. Option A (Least privilege) is about access levels. Option B (Need-to-know) restricts data access. Option C (Defense in depth) is about layered controls.

Answer

Defense in depth

Answer

Least privilege

Answer

Need-to-know

ISC2 CC Practice Test 27 — 15 Questions

Exhibit

ISC2 CC Practice Test 27 — 15 Questions

Exhibit