ISC2 CC Practice Test 29 — 15 Questions

Question 1

A company discovers a critical vulnerability in a widely used software application. The vendor has released a patch, but the company's patch management policy requires testing before deployment. What is the best course of action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply the patch using emergency change control to critical systems first, then test and deploy to others. For critical vulnerabilities being actively exploited, emergency patching should bypass normal testing cycles to reduce risk quickly.

Answer

Wait for the next scheduled maintenance window to apply the patch

Answer

Deploy the patch immediately without testing to all systems

Answer

Test the patch in a staging environment and then deploy to production

Question 2

A SOC analyst is investigating a potential data exfiltration incident. Which TWO log sources would be most useful for identifying outbound data transfers? (Select TWO)

Accepted Answer

Firewall logs. Firewall logs show allowed outbound connections, and proxy logs can reveal web traffic and file uploads, both critical for detecting exfiltration.

Answer

Patch management logs

Answer

System logs

Answer

Authentication logs

Question 3

A Security Operations Center (SOC) Tier 1 analyst notices an alert for a failed login attempt from an unusual geographic location. What is the primary responsibility of a Tier 1 analyst in this scenario?

Accepted Answer

Escalate the alert to Tier 2 for further investigation.. Tier 1 analysts monitor alerts, triage them, and escalate potential incidents to higher tiers for deeper investigation.

Answer

Perform advanced forensic analysis on the affected system.

Answer

Conduct threat hunting to identify similar patterns.

Answer

Implement a firewall rule to block all traffic from that location.

Question 4

An organization is implementing a security awareness program. Which THREE topics should be included to address common social engineering attacks? (Select THREE)

Accepted Answer

Tailgating awareness. Phishing, tailgating, and USB drop attacks are common social engineering vectors. Password security, while important, is more about authentication hygiene.

Answer

Secure coding practices

Answer

Password complexity requirements

Question 5

A SOC analyst notices a large spike in outbound traffic from a workstation that is not scheduled for any data transfers. Upon checking the SIEM, the analyst sees that the workstation's antivirus was disabled 30 minutes ago. What type of logs should the analyst examine first to understand the sequence of events?

Accepted Answer

System logs. System logs record service start/stop events, including antivirus disabling. Authentication logs may show who logged in, but system logs are more direct for service changes.

Answer

Application logs

Answer

Firewall logs

Answer

Authentication logs

Question 6

During a patch management cycle, a new vulnerability is disclosed in a widely used web server software. What is the first step an organization should take in the patch lifecycle?

Accepted Answer

Wait for the vendor to release a patch.. The patch lifecycle begins with disclosure of the vulnerability, which prompts the vendor to develop and release a patch.

Answer

Apply compensating controls if the patch cannot be installed.

Answer

Deploy the patch immediately to all production servers.

Answer

Test the patch in a staging environment.

Question 7

A critical zero-day vulnerability is actively being exploited in the wild, affecting an organization's internet-facing application. Which patching approach should be taken?

Accepted Answer

Deploy an emergency patch without testing.. Emergency patching is used for vulnerabilities that are actively exploited or have high severity, bypassing normal testing cycles to reduce risk quickly.

Answer

Isolate the application from the network and wait for a vendor patch.

Answer

Implement a web application firewall (WAF) as a permanent solution.

Answer

Follow the standard patch lifecycle with testing.

Question 8

An organization has a legacy system that cannot be patched due to vendor end-of-life. Which compensating control is most effective at reducing the risk of exploitation via network-based attacks?

Accepted Answer

Deploying a Web Application Firewall (WAF) in front of the system. A Web Application Firewall (WAF) can block malicious traffic targeting known vulnerabilities, providing a layer of defense for unpatched systems.

Answer

Increasing log retention for the system

Answer

Implementing strict password policies

Answer

Conducting regular security awareness training

Question 9

A security awareness trainer is developing material on USB drop attacks. Which TWO messages should be included in the training? (Choose two.)

Accepted Answer

Never plug in a USB drive that you found lying around.. Users should not plug in unknown USB drives as they may contain malware, and they should report found drives to security for safe handling.

Answer

Use the USB drive only on a non-networked computer.

Answer

Always scan a found USB drive with antivirus before using.

Answer

Format the USB drive before using it.

Question 10

A security engineer is designing a patch management process. Which TWO steps are part of the standard patch lifecycle? (Select TWO)

Accepted Answer

Testing the patch in a staging environment. The patch lifecycle includes testing in a staging environment and deploying to production after approval.

Answer

Vulnerability disclosure by researcher

Answer

Decommissioning the vulnerable system

Answer

Immediately deploying patches to all systems

Question 11

Which TWO of the following are common indicators of a phishing email?

Accepted Answer

Unexpected sender or email address. Unexpected sender and urgent language are classic phishing indicators. File attachments can be malicious, but presence alone is not always phishing; legitimate emails have attachments too. The other options are not typical phishing indicators.

Answer

Professional formatting with correct grammar

Answer

Presence of a file attachment

Answer

Use of the recipient's full name in the greeting

Question 12

A security analyst notices repeated failed login attempts from an internal IP address to a domain controller, followed by a successful login. Which log type is most likely to provide detailed evidence of this activity?

Accepted Answer

Authentication logs. Authentication logs record login attempts, including failures and successes, making them ideal for detecting brute-force attacks.

Answer

Application logs

Answer

Firewall logs

Answer

System logs

Question 13

Which type of log should be monitored to detect a user account that has been granted administrative privileges unexpectedly?

Accepted Answer

Authentication logs. Authentication logs typically record privilege escalation events, such as when a user is added to an admin group or granted elevated rights.

Answer

Application logs

Answer

System logs

Answer

Firewall logs

Question 14

After a security incident, an investigator needs to analyze logs to determine the timeline of events. Which TWO types of logs are most likely to provide evidence of lateral movement within the network?

Accepted Answer

Authentication logs. Authentication logs show user logins to different systems (lateral movement), and firewall logs show connections between internal hosts. System logs may show service creation but are not as direct.

Answer

DNS logs

Answer

System logs

Answer

Application logs

Question 15

Which THREE are essential elements of a disaster recovery plan? (Select THREE.)

Accepted Answer

Recovery time objectives (RTOs). Recovery time objectives (RTOs) define the maximum acceptable downtime for a system or application after a disaster. They are essential because they directly drive the design of the recovery strategy, including resource allocation and technology choices, ensuring that critical services are restored within the business's tolerance for interruption.

Answer

Communication plan for employees

Answer

Business impact analysis results