ISC2 CC Practice Test 29 — 15 Questions

Question 1

During an incident, a security analyst detects unusual network traffic from a workstation that is exfiltrating data to an external IP address. The analyst isolates the workstation. Which incident response phase does the isolation action belong to?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Containment. Isolation of an affected workstation is a containment action because it stops the spread of the incident and prevents further data exfiltration while the investigation continues. Containment is the phase in the NIST/SANS incident response lifecycle (Preparation, Detection & Analysis, Containment, Eradication, Recovery, Post-Incident) where the goal is to limit damage and prevent the incident from expanding. Detection and analysis involve identifying and validating the event; eradication removes the root cause.

Answer

Detection

Answer

Analysis

Answer

Eradication

Question 2

According to the (ISC)² Code of Ethics, which of the following has the highest priority?

Accepted Answer

Protect society, the common good, necessary public trust and confidence, and the infrastructure. The (ISC)² Code of Ethics canons are ordered by priority, and the first canon is to protect society, the common good, necessary public trust and confidence, and the infrastructure. This takes precedence over duties to principals, the profession, and self. The other canons follow in descending order.

Answer

Provide diligent and competent service to principals

Answer

Act honorably, honestly, justly, responsibly, and legally

Answer

Advance and protect the profession

Question 3

A security operations center (SOC) analyst is reviewing network traffic logs and notices a series of connections to an unfamiliar external IP address on port 443. The analyst suspects a command-and-control (C2) channel. Which TWO characteristics would most likely indicate that this traffic is malicious C2 activity? (Choose two.)

Accepted Answer

The traffic uses domain fronting to hide the true destination.. Beaconing behavior, such as regular intervals with consistent packet sizes, is a hallmark of automated C2 communication. Domain fronting, which disguises the true destination by manipulating SNI and Host headers, is another technique frequently used by malware to evade network defenses. Both are strong indicators of malicious C2 activity, whereas cloud-hosted IPs, service-initiated connections, and self-signed certificates can also be legitimate.

Answer

The connections are initiated by a server process running as a system service.

Answer

The traffic is encrypted and uses a self-signed certificate.

Answer

The external IP address is associated with a known cloud service provider.

Question 4

A hospital's network team needs to provide secure remote access for clinicians who work from home. The clinicians must be able to reach internal medical records systems as if they were on the hospital LAN, but the hospital's security policy requires that all remote traffic be encrypted and that remote devices be prevented from directly accessing the public internet through the hospital network. Which technology best meets these requirements?

Accepted Answer

A full-tunnel VPN. A full-tunnel VPN is the only option that both encrypts remote access and forces all client traffic through the hospital network, satisfying the policy that remote devices must not reach the public internet directly. Split tunneling, SSH port forwarding, and remote desktop gateways each leave internet-bound traffic outside the hospital's control.

Answer

Secure Shell (SSH) port forwarding

Answer

A remote desktop gateway

Answer

A split-tunnel VPN

Question 5

A mid-sized hospital experiences a ransomware outbreak that encrypts its electronic health record (EHR) servers on a Friday night. The incident response plan designates a severity classification of 'Critical'. According to established incident response practices, which action should the incident response team take FIRST?

Accepted Answer

Isolate the affected systems from the network to contain the spread while preserving evidence. The first priority in an active ransomware incident is to contain the spread while preserving evidence, so isolating affected systems from the network is the correct initial action. Containment prevents further encryption of shared resources and backup repositories. It also keeps the systems in a state suitable for forensic analysis, which is needed to determine scope and root cause before eradication and recovery efforts begin.

Answer

Restore the EHR servers from the most recent backup immediately so clinical operations can resume

Answer

Notify all hospital staff and patients about the breach before taking any technical action

Answer

Immediately power down all affected EHR servers to stop the encryption from spreading further

Question 6

A software company wants contractors to access an internal code repository only during their contracted hours and only from company-managed laptops. The repository administrator should implement which type of access control to meet these conditions?

Accepted Answer

Rule-based access control, by evaluating time-of-day and managed-device conditions. The requirements are conditions evaluated when access is requested: the clock must be inside contracted hours, and the device must be company-managed. Rule-based access control inspects exactly such attributes at decision time, enforcing both constraints together. Role, discretionary, and mandatory models govern who may access what, but none of them natively evaluate time-of-day or device posture.

Answer

Discretionary access control, by letting the repository owner approve each contractor

Answer

Role-based access control, by creating a Contractor role with read access

Answer

Mandatory access control, by labeling the repository as confidential and requiring clearance

Question 7

A security professional is asked to choose an authentication method for a high-security facility. The requirement is to use something the user 'is'. Which authentication type should be selected?

Accepted Answer

Type 3 – Inherence factor. Type 3 – Inherence factor refers to something the user 'is', i.e., a biometric characteristic such as fingerprint, retina, or iris. The requirement explicitly states 'something the user is', which directly maps to inherence. Therefore, Type 3 is the correct authentication type.

Answer

Multi-factor authentication

Answer

Type 2 – Possession factor

Answer

Type 1 – Knowledge factor

Question 8

A company deploys a network security device that can block malicious traffic in real-time by inspecting packet payloads and application data. However, the device occasionally blocks legitimate traffic. Which device is described?

Accepted Answer

IPS. An IPS (Intrusion Prevention System) inspects packet payloads and application data in real time and can actively block malicious traffic. The fact that it occasionally blocks legitimate traffic is a classic false-positive behavior of IPS devices, which is why tuning is required.

Answer

Firewall

Answer

WAF

Answer

IDS

Question 9

A small business wants to prevent employees from visiting known malicious websites. The owner asks a technician to implement a control that blocks requests to a maintained list of bad domains before any connection is made to those sites. Which solution should the technician deploy?

Accepted Answer

A DNS filtering service that refuses to resolve known malicious domains. DNS filtering is the only listed control that stops a malicious website visit at the name-resolution stage. By refusing to resolve the domain, it prevents the client from learning the destination IP address, so no connection can be initiated. Endpoint antivirus, application-aware firewalls, and intrusion prevention systems all operate later in the connection lifecycle.

Answer

A host-based antivirus scanner that quarantines downloaded files

Answer

An intrusion prevention system placed inline at the network edge

Answer

A next-generation firewall configured with application signatures

Question 10

Which risk management strategy involves implementing security controls to reduce the likelihood or impact of a risk?

Accepted Answer

Risk mitigation. Risk mitigation involves implementing security controls to reduce either the likelihood or the impact of a risk. This is the most common risk management strategy because it addresses the risk directly rather than shifting or avoiding it. Examples include patching vulnerabilities, deploying firewalls, or enforcing MFA to lower the probability of exploitation.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transfer

Question 11

A security analyst is reviewing logs from a Linux web server and notices the following entries: multiple failed SSH login attempts for user 'root' from various IP addresses, followed by a successful login from an IP address in a different country. Shortly after, a new user account 'backup' is created and added to the sudoers file. Which type of attack is MOST likely represented?

Accepted Answer

Brute force attack leading to privilege escalation. The sequence of multiple failed SSH logins followed by a successful login from a foreign IP and the creation of a sudo-enabled account strongly indicates a brute force attack that succeeded, leading to privilege escalation. This is a common attack chain where initial access is gained through weak credentials, and persistence is established via a new privileged user.

Answer

Distributed denial of service (DDoS)

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Question 12

A security administrator is configuring a firewall to protect an internal network. The administrator needs to allow only HTTP and HTTPS traffic from the internal network to the internet, while blocking all other outbound traffic. Which of the following should the administrator implement?

Accepted Answer

Explicit allow rules for HTTP and HTTPS, followed by an implicit deny. Firewall rule sets are processed in order. To allow only HTTP and HTTPS outbound, explicit allow rules for TCP 80 and 443 must be created first. Then, a final rule (often implicit) denies all other traffic. This ensures that only the desired traffic is permitted and everything else is blocked, meeting the requirement.

Answer

A deny rule for all traffic except HTTP and HTTPS

Answer

An implicit deny rule at the end of the rule set

Answer

A stateful inspection rule that allows all outbound traffic

Question 13

During an incident, a responder needs to capture the contents of volatile memory on a running Linux server before shutting it down, because encryption keys and running processes may only exist in RAM. Which action BEST preserves this volatile evidence?

Accepted Answer

Capture a memory image using a tool such as LiME or AVML before any shutdown. Order of volatility requires collecting the most perishable evidence first, and RAM contents disappear the moment a system loses power or restarts. Memory acquisition tools such as LiME or AVML capture encryption keys, active network connections, and running processes that disk images cannot recover. Capturing memory before shutdown or disk imaging preserves the ephemeral evidence needed to understand attacker activity and credentials in use.

Answer

Pull the power cord immediately, then remove and image the hard drive

Answer

Restart the server and enable verbose logging for future collection

Answer

Run the dd command to image the primary disk to an external drive

Question 14

According to the (ISC)² Code of Ethics, which canon has the highest priority?

Accepted Answer

Protect society, the common good, necessary public trust and confidence, and the infrastructure. The (ISC)² Code of Ethics Canons are ordered by priority, and the first canon — 'Protect society, the common good, necessary public trust and confidence, and the infrastructure' — takes precedence over all others. This reflects the profession's obligation to place the safety and welfare of society above client interests and professional advancement. When canons conflict, the higher-priority canon must guide the decision.

Answer

Provide diligent and competent service to principals

Answer

Advance and protect the profession

Answer

Act honorably, honestly, justly, responsibly, and legally

Question 15

An attacker sends an email to an employee that appears to come from the CEO, asking for sensitive data. This is an example of which type of threat?

Accepted Answer

Phishing. Phishing is a social engineering attack where an attacker impersonates a trusted entity (like the CEO) to trick the recipient into revealing sensitive information. The scenario describes an email that appears to come from the CEO, which is a classic phishing attempt. Spoofing (A) refers to falsifying the sender address, but the broader threat here is phishing because it involves deception to extract data. Man-in-the-middle (C) and sniffing (D) are network-level attacks, not email-based social engineering.

Answer

Spoofing

Answer

Man-in-the-middle

Answer

Sniffing