ISC2 CC Practice Test 28 — 15 Questions

Question 1

Refer to the exhibit. Which security principle is being supported by the logging of these events?

Accepted Answer

Accountability. Correct: A - Accountability. Logging provides a record of events that can be traced to specific sources, enabling accountability. Non-repudiation involves proof of actions by a user, but these logs do not prove user identity. Authentication and availability are not directly supported.

Answer

Availability

Answer

Authentication

Answer

Non-repudiation

Question 2

Which TWO of the following are examples of administrative security controls? (Choose two.)

Accepted Answer

Security awareness training

Answer

Intrusion detection system

Answer

Firewall

Answer

Encryption

Question 3

A company experiences a ransomware attack that encrypts all files on a server. Which security control would MOST effectively allow recovery without paying the ransom?

Accepted Answer

Regular backups. Regular backups enable restoration of encrypted data from a clean copy, bypassing the need to pay the ransom. Other controls help prevent or detect but do not directly facilitate recovery.

Answer

Firewall

Answer

Intrusion detection system

Answer

Antivirus software

Question 4

Refer to the exhibit. A user from IP 10.0.1.5 attempts to download an object from example-bucket. What will happen?

Accepted Answer

Denied because the deny statement overrides. The policy includes both an allow for the 10.0.0.0/16 range and a more specific deny for the 10.0.1.0/24 subnet. Since 10.0.1.5 falls within the deny condition, the explicit deny overrides the allow, resulting in denied access.

Answer

Access denied due to implicit deny

Answer

Allowed because the allow statement matches

Answer

Allowed because the deny statement is invalid

Question 5

Which TWO of the following are core components of the CIA triad?

Accepted Answer

Confidentiality. Confidentiality, Integrity, and Availability are the three core principles. Authentication and Non-repudiation are additional security goals.

Answer

Authentication

Answer

Non-repudiation

Answer

Authorization

Question 6

A system administrator configured the sudoers file as shown. What is the primary security risk of this configuration?

Accepted Answer

It removes the password requirement for sudo, weakening authentication for privileged access. Option D is correct because '!authenticate' removes the password requirement for the admin group, which violates the principle of least privilege and authentication. It does not grant passwordless sudo for all users (A) — only the admin group. (B) is a risk, but not as severe as no password. (C) is not implied by the config. The main risk is bypassing authentication.

Answer

It enables privilege escalation for all users on the system

Answer

It logs all commands run by admin users, creating a privacy risk

Answer

It allows any user in the admin group to run commands as any user without a password

Question 7

A security team discovers that an internal database server is sending large amounts of data to an unknown external IP address. The server is not supposed to communicate externally. Which security control should be implemented to prevent such data exfiltration?

Accepted Answer

Configure a firewall to deny all outbound traffic from the database server except to specific authorized destinations. Option A is correct because a restrictive firewall egress rule blocks unauthorized outbound traffic. IDS (C) only detects, not prevent. DLP (B) monitors content but may not block at network level. VPN (D) would not stop exfiltration; it could even facilitate it.

Answer

Implement a VPN for all external communications

Answer

Install an intrusion detection system (IDS) on the network segment

Answer

Deploy a data loss prevention (DLP) system on the server

Question 8

Which TWO of the following are core principles of the CIA triad?

Accepted Answer

Integrity. The CIA triad consists of Confidentiality, Integrity, and Availability. Options A and C are correct. Option B (Non-repudiation) is separate. Option D (Authentication) is separate. Option E (Authorization) is separate.

Answer

Non-repudiation

Answer

Authorization

Answer

Authentication

Question 9

A company's security policy requires that all sensitive data be encrypted at rest and in transit. However, a recent breach occurred because an attacker exploited a misconfigured web server that exposed a database directly. Which principle was most lacking in this scenario?

Accepted Answer

Defense in depth. Defense in depth would have added additional controls such as network segmentation and access controls to prevent a single misconfiguration from compromising data. Option A (Fail securely) ensures secure state on failure. Option B (Complete mediation) checks every access. Option D (Least privilege) is about permissions.

Answer

Least privilege

Answer

Fail securely

Answer

Complete mediation

Question 10

Refer to the exhibit.
```
-rw-r-x--- 1 user1 developers 1024 Apr 12 10:00 config.cfg
```
The security policy states that only the file owner (user1) and members of the developers group should be able to read the file. Which change is necessary to align with the principle of least privilege?

Accepted Answer

Change the file mode to 640.

Answer

Add world read permission.

Answer

Change group permissions to rw-r--.

Answer

Change the owner to user2.

Question 11

An organization wants to implement a policy where employees must use a smart card and a PIN to access sensitive data. This is an example of:

Accepted Answer

Multi-factor authentication (two factors). Multi-factor authentication (MFA) requires two or more different types of authentication factors. Here, the smart card (something you have) and PIN (something you know) constitute two factors, making it MFA.

Answer

Single factor authentication

Answer

Two-factor authentication

Answer

Biometric authentication

Question 12

A security analyst discovers that an employee shared their password with a colleague to complete a task. Which security principle has been violated?

Accepted Answer

Accountability. Accountability relies on unique identification. Password sharing breaks this link.

Answer

Availability

Answer

Confidentiality

Answer

Integrity

Question 13

An AWS administrator attached this IAM policy to a user. What is the effect of this policy?

Accepted Answer

The user cannot delete the bucket critical-data.. The policy explicitly denies the s3:DeleteBucket action on the critical-data bucket, overriding any allow.

Answer

The user can delete the bucket if allowed by another policy.

Answer

The user can still delete objects inside the bucket.

Answer

The user can delete any bucket except critical-data.

Question 14

A security analyst observes the log entries on an SSH server as shown. What is the most likely type of attack in progress?

Accepted Answer

Brute-force attack. Option B is correct because repeated failed password attempts for the same account (root) from the same IP in rapid succession is characteristic of a brute-force attack. Dictionary attack (A) uses a list of common passwords, but the log does not show different passwords; it could be either, but brute-force is more general. (C) is wrong because it's not a DoS (though it might degrade performance). (D) is wrong because there is no indication of privilege escalation beyond root attempts.

Answer

Dictionary attack

Answer

Privilege escalation

Answer

Denial-of-service (DoS) attack

Question 15

A security analyst discovers that an organization's firewall rule set allows all inbound traffic on TCP port 443 from any source to a single web server. Additionally, the server has a known critical vulnerability in its TLS implementation. Which principle of security architecture is most directly violated by this configuration?

Accepted Answer

Least privilege. Least privilege requires restricting access to only what is necessary. Allowing inbound from any source (0.0.0.0/0) violates least privilege because it is broader than necessary. Option B is correct. Option A (defense in depth) would be violated if no other controls exist, but the question asks the most direct violation. Option C (separation of duties) is about task division. Option D (fail-safe) is about default deny.

Answer

Defense in depth

Answer

Separation of duties

Answer

Fail-safe defaults

ISC2 CC Practice Test 28 — 15 Questions

Exhibit

ISC2 CC Practice Test 28 — 15 Questions

Exhibit