ISC2 CC Practice Test 3 — 10 Questions

Question 1

An analyst reviews the exhibit. Which security principle is being violated by allowing root login via SSH?

Accepted Answer

Least privilege. Allowing root login via SSH violates the principle of least privilege because it grants unrestricted administrative access to the system, bypassing any need for privilege escalation. In a properly secured SSH configuration, root login should be disabled (e.g., `PermitRootLogin no` in `/etc/ssh/sshd_config`), forcing administrators to log in as a regular user and then use `sudo` or `su` to elevate privileges only when necessary. This minimizes the attack surface and ensures that actions are auditable and tied to a specific user account.

Answer

Fail-safe

Answer

Defense in depth

Answer

Separation of duties

Question 2

Which protocol is used to resolve IP addresses to MAC addresses on a local network?

Accepted Answer

ARP. ARP (Address Resolution Protocol) resolves a known IPv4 address to its corresponding MAC address on a local network segment by broadcasting an ARP request and receiving a unicast ARP reply. It is the standard Layer 2/Layer 3 glue protocol for Ethernet and IPv4 communication.

Answer

DHCP

Answer

DNS

Answer

ICMP

Question 3

Which security control would best mitigate the risk of network sniffing on a wired LAN segment?

Accepted Answer

Using encryption protocols (e.g., IPsec, TLS). Encrypting traffic (e.g., using HTTPS, VPN) makes sniffed data unreadable.

Answer

Implementing VLANs

Answer

Disabling unused ports on the switch

Answer

Deploying an intrusion detection system

Question 4

An organization is creating a Business Continuity Plan (BCP). Which analysis should be performed first to identify critical business functions and their dependencies?

Accepted Answer

Business Impact Analysis. The Business Impact Analysis (BIA) is the foundational step in BCP development because it systematically identifies critical business functions, their dependencies, and the impact of their disruption over time. It quantifies the consequences of downtime, helping prioritize recovery objectives like RTO and RPO. Without a BIA, subsequent risk assessment and recovery strategies lack a business-driven focus.

Answer

Risk Assessment

Answer

Vulnerability Assessment

Answer

Gap Analysis

Question 5

A network administrator is configuring a switch to logically separate the Accounting and HR departments on the same physical switch. Which technology should be used?

Accepted Answer

VLAN. A VLAN (Virtual LAN, IEEE 802.1Q) logically segments a single physical switch into multiple isolated broadcast domains, allowing the Accounting and HR departments to share hardware while remaining logically separated at Layer 2. This is the standard technology for departmental segmentation on a common switch. Subnetting operates at Layer 3 and does not by itself isolate traffic on the same switch without VLANs or ACLs.

Answer

Subnetting

Answer

DMZ

Answer

Honeypot

Question 6

A company’s disaster recovery plan specifies an RTO of 4 hours and an RPO of 1 hour for its critical database. The database is backed up every hour using incremental backups. After a catastrophic failure, restoration takes 3 hours, but the database must be rolled forward using transaction logs. The total time to make the database fully operational is 5 hours. Which statement is correct?

Accepted Answer

RTO is exceeded but RPO is likely met. The RTO is 4 hours, but the total time to make the database fully operational is 5 hours, so RTO is exceeded. The RPO is 1 hour, and backups are taken every hour; the data loss is at most 1 hour of transactions, so RPO is likely met. Therefore, RTO is exceeded but RPO is likely met.

Answer

Both RTO and RPO are exceeded

Answer

RPO is exceeded but RTO is met

Answer

Both RTO and RPO are met

Question 7

Which TWO of the following are common indicators of a phishing email? (Select TWO.)

Accepted Answer

The email contains a sense of urgency, such as 'Your account will be closed.'. Phishing emails commonly exploit urgency to bypass rational decision-making. Attackers use phrases like 'Your account will be closed' to pressure recipients into clicking malicious links or providing credentials without verifying the source. This social engineering tactic is a hallmark of phishing campaigns.

Answer

The email contains an attachment with a .txt extension

Answer

The email has a high-importance flag set by the sender

Answer

The email is sent to multiple recipients in the 'To' field

Question 8

A security operations center (SOC) analyst receives an alert for a potential malware infection on a workstation. Which of the following is the first action the analyst should take?

Accepted Answer

Isolate the workstation from the network to prevent spread. When a potential malware infection is detected, the immediate priority is containment to prevent lateral movement and further compromise. Isolating the workstation from the network (e.g., disabling the network interface or disconnecting the cable) stops the malware from communicating with command-and-control servers or spreading to other hosts. This aligns with the NIST incident response framework's containment phase, which precedes eradication and recovery actions.

Answer

Reimage the workstation

Answer

Run a full antivirus scan

Answer

Notify law enforcement

Question 9

In the context of identification and authentication, which of the following is an example of authentication?

Accepted Answer

Providing a fingerprint scan. Authentication is the process of verifying a claimed identity, typically through something the user knows, has, or is. Providing a fingerprint scan is an example of authentication because it uses a biometric factor to verify the user's identity. The other options are related to identification, not authentication.

Answer

Entering a username

Answer

Being assigned a user ID

Answer

Swiping an access badge

Question 10

Drag and drop the steps to configure a wireless access point with WPA2-PSK security into the correct order.

Accepted Answer

Set SSID, then select WPA2 security mode, then set PSK passphrase, then apply settings.. Configuring a wireless access point with WPA2-PSK requires a logical sequence: first set the SSID to identify the network, then choose WPA2 as the security mode, then define the pre-shared key (PSK) passphrase, and finally apply the settings. This order ensures all necessary parameters are in place before the configuration is activated, preventing the AP from broadcasting with incomplete security settings.

Answer

Set SSID, then set PSK passphrase, then select WPA2 security mode, then apply settings.

Answer

Select WPA2 security mode, then set SSID, then set PSK passphrase, then apply settings.

Answer

Set SSID, then select WPA2 security mode, then apply settings, then set PSK passphrase.