ISC2 CC Practice Test 27 — 15 Questions

Question 1

A security analyst detects a large number of incomplete TCP connection requests (SYN segments) directed at a server. This is indicative of which type of attack?

Accepted Answer

SYN flood. SYN flood is a DoS attack that exhausts server resources by initiating many half-open connections.

Answer

ICMP flood

Answer

UDP flood

Answer

Smurf attack

Question 2

An employee receives an email from an unknown sender claiming to be from the IT department, asking for their password to perform an urgent system update. What type of social engineering attack is this?

Accepted Answer

Phishing. Phishing is a social engineering attack where attackers impersonate legitimate entities to trick victims into revealing sensitive information.

Answer

Tailgating

Answer

USB drop attack

Answer

Piggybacking

Question 3

An IT administrator wants to inspect HTTP traffic for malicious payloads such as SQL injection. Which network security device is most appropriate?

Accepted Answer

WAF. A Web Application Firewall (WAF) specializes in filtering and monitoring HTTP/HTTPS traffic, often using OWASP rules to detect attacks like SQL injection.

Answer

IDS

Answer

Honeypot

Answer

IPS

Question 4

Which of the following ports is used by HTTPS?

Accepted Answer

443. HTTPS uses port 443 by default for encrypted web traffic.

Answer

80

Answer

21

Answer

25

Question 5

Which of the following ports is commonly used for secure web traffic (HTTPS)?

Accepted Answer

443. HTTPS uses port 443 by default. HTTP uses port 80, and SSH uses port 22.

Answer

53

Answer

80

Answer

22

Question 6

An organization wants to segment its network so that public-facing servers are isolated from internal users. Which network design component should be used?

Accepted Answer

DMZ. A DMZ (demilitarized zone) is a separate network segment that hosts public-facing services, isolated from the internal LAN.

Answer

Honeypot

Answer

Subnet

Answer

VLAN

Question 7

An organization wants to allow external users to securely access internal web applications. Which network security device is specifically designed to inspect HTTP/HTTPS traffic and block malicious requests?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) is specialized for filtering HTTP/HTTPS traffic and protecting web applications.

Answer

Stateful firewall

Answer

Intrusion Detection System (IDS)

Answer

Packet filtering firewall

Question 8

During a security assessment, a penetration tester captures network traffic and notices that the source IP address in packets appears to be from a different network. Which technique is the attacker likely using?

Accepted Answer

IP spoofing. IP spoofing involves forging the source IP address in packets to impersonate another system or hide the true origin. This can be used in various attacks like DDoS or session hijacking.

Answer

DNS spoofing

Answer

ARP spoofing

Answer

MAC spoofing

Question 9

A company wants to protect its internal web server from common web application attacks. Which two security measures are most appropriate? (Choose TWO.)

Accepted Answer

Deploy a Web Application Firewall (WAF). A WAF specifically filters HTTP/HTTPS traffic, and HTTPS encryption protects data in transit. A firewall alone is not application-aware, and IDS/IPS are not specific to web applications.

Answer

Deploy an IDS in promiscuous mode

Answer

Use a stateful firewall only

Answer

Enable SNMP on the server

Question 10

Which tier in a Security Operations Center (SOC) is primarily responsible for triaging alerts and determining whether to escalate?

Accepted Answer

Tier 1. Tier 1 analysts monitor alerts and perform initial triage, escalating potential incidents to Tier 2 for deeper investigation.

Answer

SOC Manager

Answer

Tier 3

Answer

Tier 2

Question 11

Which protocol operates at the Transport layer of the OSI model and is connectionless and unreliable?

Accepted Answer

UDP. UDP is connectionless and does not guarantee delivery, making it fast but unreliable.

Answer

TCP

Answer

HTTP

Answer

IP

Question 12

A security team is investigating a potential man-in-the-middle attack. Which TWO of the following are common techniques used in MITM attacks? (Select TWO.)

Accepted Answer

ARP poisoning. ARP poisoning redirects traffic, and rogue Wi-Fi access points intercept communications.

Answer

SYN flood

Answer

DNS amplification

Answer

ICMP flood

Question 13

A network administrator is planning to segment the network. Which of the following are valid segmentation methods? (Choose TWO)

Accepted Answer

Subnetting. VLANs and subnetting are common segmentation techniques.

Answer

Firewalls

Answer

IDS

Answer

Honeypots

Question 14

Which two of the following are best practices to mitigate man-in-the-middle attacks? (Select TWO.)

Accepted Answer

Use HTTPS with proper certificate validation. HTTPS with certificate validation ensures secure communication, and VPNs encrypt traffic between endpoints. Disabling encryption increases risk, and using Telnet sends data in cleartext.

Answer

Disable SSL/TLS on web servers

Answer

Use ARP spoofing detection tools

Answer

Use Telnet for remote administration

Question 15

A network engineer wants to mitigate ARP spoofing attacks. Which of the following is the most effective technique?

Accepted Answer

Implement Dynamic ARP Inspection. Dynamic ARP Inspection (DAI) validates ARP packets to prevent spoofing.

Answer

Enable STP

Answer

Use static ARP entries

Answer

Disable ICMP