ISC2 CC Practice Test 28 — 15 Questions

Question 1

A security analyst notices unusual traffic from an internal workstation to an external IP address on port 25. Which protocol is most likely being used?

Accepted Answer

SMTP. Port 25 is the default port for SMTP (Simple Mail Transfer Protocol).

Answer

FTP

Answer

DNS

Answer

HTTP

Question 2

Which of the following is a security concern associated with the Telnet protocol?

Accepted Answer

It transmits data in cleartext.. Telnet transmits data, including credentials, in cleartext, making it susceptible to sniffing. SSH is the secure alternative.

Answer

It requires certificate management.

Answer

It is vulnerable to DNS poisoning.

Answer

It uses encryption that is too weak.

Question 3

An organization wants to securely manage network devices from remote locations. Which of the following protocols should be used for command-line access?

Accepted Answer

SSH. SSH (port 22) encrypts all traffic, including passwords and commands, making it secure for remote administration. Telnet transmits data in cleartext and should be avoided.

Answer

HTTP

Answer

Telnet

Answer

FTP

Question 4

A security administrator is implementing measures to protect log integrity. Which of the following is the most effective method to prevent tampering with logs after they are generated?

Accepted Answer

Using write-once storage. Write-once storage (e.g., WORM) ensures logs cannot be altered or deleted, preserving integrity.

Answer

Rotating logs daily

Answer

Encrypting logs with a symmetric key

Answer

Storing logs on the local system drive

Question 5

Which firewall type is capable of inspecting the contents of application-layer traffic, such as HTTP requests, to detect malicious patterns?

Accepted Answer

Application proxy firewall. An application proxy firewall (also known as an application-level gateway) performs deep packet inspection at the application layer, allowing it to filter based on content like URLs or SQL commands.

Answer

Next-generation firewall

Answer

Stateful inspection firewall

Answer

Packet filtering firewall

Question 6

Which common port is used by DNS and which transport layer protocol does it primarily use?

Accepted Answer

Port 53, both UDP and TCP. DNS uses port 53 and primarily uses UDP for queries, though TCP is used for zone transfers.

Answer

Port 53, UDP only

Answer

Port 161, UDP

Answer

Port 53, TCP only

Question 7

Which transport layer protocol is used by voice over IP (VoIP) applications that require low latency and can tolerate some packet loss?

Accepted Answer

UDP. UDP is connectionless and faster, making it suitable for real-time applications like VoIP where occasional packet loss is acceptable.

Answer

ICMP

Answer

SCTP

Answer

TCP

Question 8

Which protocol is used to resolve IP addresses to MAC addresses on a local network?

Accepted Answer

ARP. ARP (Address Resolution Protocol) maps IP addresses to MAC addresses, operating at Layer 2/3 boundary.

Answer

DHCP

Answer

DNS

Answer

ICMP

Question 9

Which port number is associated with HTTPS, and what protocol encrypts the communication?

Accepted Answer

Port 443, SSL/TLS. HTTPS uses port 443 and is encrypted using SSL/TLS.

Answer

Port 80, SSL/TLS

Answer

Port 8080, SSL/TLS

Answer

Port 443, SSH

Question 10

An attacker captures network traffic using Wireshark and reads unencrypted emails. Which security goal is most directly compromised?

Accepted Answer

Confidentiality. Sniffing captures sensitive data, violating confidentiality.

Answer

Integrity

Answer

Availability

Answer

Non-repudiation

Question 11

A security analyst is reviewing network traffic and needs to identify which of the following protocols are inherently insecure because they transmit data in cleartext. (Select TWO.)

Accepted Answer

FTP. Telnet and FTP transmit data, including credentials, in cleartext. SSH and HTTPS encrypt all traffic.

Answer

DNS

Answer

HTTPS

Answer

SSH

Question 12

An organization wants to implement a network security device that can block malicious traffic in real-time and must be placed inline. Which device should be chosen?

Accepted Answer

Intrusion Prevention System (IPS). An Intrusion Prevention System (IPS) is inline and can actively block threats, unlike an IDS which only alerts.

Answer

Vulnerability scanner

Answer

Packet sniffer

Answer

Intrusion Detection System (IDS)

Question 13

A security engineer is evaluating different firewall architectures. Which firewall type can decrypt SSL/TLS traffic, inspect the contents, and then re-encrypt it?

Accepted Answer

Next-generation firewall (NGFW). NGFWs often include SSL inspection capabilities to examine encrypted traffic for threats.

Answer

Application proxy firewall

Answer

Packet filtering firewall

Answer

Stateful inspection firewall

Question 14

Which layer of the OSI model is responsible for routing packets across networks?

Accepted Answer

Network layer. The Network layer (Layer 3) handles routing and logical addressing (IP addresses).

Answer

Physical layer

Answer

Transport layer

Answer

Data Link layer

Question 15

An organization must comply with PCI DSS log retention requirements. What is the minimum retention period for logs, and how long must they be immediately available for analysis?

Accepted Answer

12 months retention, 3 months immediately available. PCI DSS requires logs to be retained for at least 12 months, with the most recent 3 months immediately available for review.

Answer

24 months retention, 12 months immediately available

Answer

6 months retention, 1 month immediately available

Answer

12 months retention, 6 months immediately available