ISC2 CC Practice Test 30 — 15 Questions

Question 1

An organization implements a policy requiring employees to use a smart card and a PIN to access the data center. This is an example of which type of authentication?

Accepted Answer

Multi-factor authentication. Multi-factor authentication (MFA) requires two or more different authentication factors: something you have (smart card), something you know (PIN), and optionally something you are (biometric). Here, the smart card is a possession factor and the PIN is a knowledge factor, so combining them satisfies MFA. This is the correct classification because the two factors are of different types, not just two instances of the same type.

Answer

Type 3 authentication

Answer

Single-factor authentication

Answer

Type 2 authentication only

Question 2

An organization is building a log management capability so its security team can detect and investigate incidents across many systems. Which TWO practices BEST support effective centralized log collection and analysis? (Choose two.)

Accepted Answer

Forward logs to a central repository with integrity protection and controlled access. Effective centralized logging depends on trustworthy, correlated data. Synchronized clocks make cross-source timelines reliable, while forwarding logs to a protected central repository preserves evidence even if a source host is compromised. Together these practices enable detection and investigation. Local-only storage, disabled logging, and ungoverned configuration changes all create blind spots or permit tampering, defeating the purpose of centralization.

Answer

Disable logging on high-traffic servers to reduce storage costs

Answer

Store all logs only on the local systems that generate them

Answer

Allow every administrator to modify log settings without change control

Question 3

A company wants to reduce the risk of malware spreading from employee workstations to critical servers. The security team proposes placing firewalls between network segments and restricting traffic to only required ports and protocols. Which security control category does this approach primarily represent?

Accepted Answer

Technical control. Network segmentation enforced by firewalls and port restrictions is implemented through technology, making it a technical control. It limits how malware can move laterally from workstations to critical servers by permitting only required traffic. Unlike administrative controls that depend on policies and training, or physical controls that restrict access to facilities, this approach enforces boundaries automatically. Segmenting systems and minimizing allowed protocols reduces the attack surface and contains incidents.

Answer

Administrative control

Answer

Physical control

Answer

Compensating control

Question 4

A company wants to host a public-facing web server and an email server while protecting the internal network. Which network architecture is best suited for this purpose?

Accepted Answer

DMZ. A DMZ (demilitarized zone) is a segmented network that sits between the internet and the internal network, hosting public-facing servers while allowing controlled access from both sides.

Answer

Subnetting

Answer

Full mesh topology

Answer

Virtual LAN (VLAN)

Question 5

A security operations center receives an alert that a workstation is communicating with a known command-and-control IP address over HTTPS on port 443. The endpoint agent shows no malware signature match. Which containment action should the analyst take first to limit damage while preserving the ability to investigate?

Accepted Answer

Isolate the workstation from the network using the endpoint agent's network containment feature.. When an endpoint shows beaconing to known command-and-control infrastructure but no signature match, the priority is to sever the attacker's channel without destroying evidence. Endpoint network containment isolates the host while keeping memory and running processes available for forensic capture. Powering off, deleting files, or blocking a single external IP either destroys evidence or leaves the compromised host free to communicate and move laterally.

Answer

Immediately power off the workstation to stop any malicious activity.

Answer

Block the destination IP address at the perimeter firewall and continue monitoring the workstation.

Answer

Delete the suspicious files identified by the endpoint agent and run a full antivirus scan.

Question 6

A company is building an incident response capability and wants to ensure the containment phase is effective. Which TWO activities are appropriate during containment? (Choose two.)

Accepted Answer

Applying temporary firewall or access-control rules to block the attacker's known infrastructure. Containment stops the spread and limits damage while keeping evidence intact for analysis. Isolating affected hosts and blocking the attacker's known infrastructure both reduce ongoing impact and are reversible, temporary measures. Rebuilding everything, closing the incident, or deleting logs are recovery or destructive actions that either destroy evidence or prematurely end the response, so they do not belong in containment.

Answer

Deleting all logs from affected systems to prevent the attacker from covering their tracks

Answer

Closing the incident ticket and notifying customers that service has resumed

Answer

Rebuilding every server in the data center from scratch immediately

Question 7

A security analyst receives an alert that a user account successfully authenticated to the corporate VPN from two geographically distant countries within a five-minute window. The user is currently traveling and confirms only one login. Which conclusion is MOST appropriate for the analyst to draw at this stage?

Accepted Answer

The account is likely compromised and the impossible-travel indicator warrants immediate investigation. Successful authentications from two distant countries within five minutes, combined with the user confirming a single session, form a classic impossible-travel indicator of credential compromise. The analyst should treat the account as potentially compromised and act quickly to contain it, rather than dismissing the alert, assuming benign credential sharing, or blaming infrastructure. Prompt investigation limits any attacker's access.

Answer

The VPN concentrator has failed and the logs are unreliable, so the account is safe

Answer

The alert is a false positive caused by NTP drift and should be closed immediately

Answer

The user must be sharing credentials with a colleague and should only be reminded of policy

Question 8

A small accounting firm has a single flat network. During a risk review, the consultant recommends placing all wireless guest users on a separate logical network so they cannot reach the internal file server, even though both networks share the same physical switches and access points. Which technology best accomplishes this?

Accepted Answer

VLAN. VLANs let one physical switch infrastructure carry multiple isolated logical networks, which is exactly what is needed to separate guest wireless users from internal resources. Access control lists or firewall rules between the VLANs enforce the policy. NAT, DHCP, and DNS are addressing or naming services and do not by themselves prevent one group of users from reaching another group's systems.

Answer

DNS

Answer

DHCP

Answer

NAT

Question 9

A security administrator is reviewing physical access controls. Which control is considered an external perimeter security measure?

Accepted Answer

Fencing around the property. Fencing around the property is an external perimeter security measure because it establishes the outermost physical boundary of the facility, deterring and delaying unauthorized entry before an attacker reaches the building. Perimeter controls focus on the site's outer edge, while the other options protect interior assets or personnel behavior. Fencing, bollards, lighting, and gates are classic examples of external perimeter defenses.

Answer

Biometric reader on server room door

Answer

Cable locks on laptops

Answer

Visitor badge policy

Question 10

A financial services firm must protect a legacy trading application that uses a proprietary protocol on TCP port 7000. The security team wants to block all traffic to this port except from a small set of approved internal subnets, and they must ensure that fragmented packets cannot bypass the rule. Which control most directly achieves this?

Accepted Answer

A packet-filtering firewall that reassembles fragments before applying rules.. The requirement is deterministic network-layer access control on a specific port combined with protection against fragmentation evasion. A packet-filtering firewall that reassembles fragments before applying rules does exactly that, whereas application gateways, stateful inspection, and intrusion prevention systems address different concerns and do not guarantee both the source restriction and the anti-fragmentation behavior in this scenario.

Answer

A stateful inspection firewall that tracks established TCP sessions.

Answer

A network intrusion prevention system tuned to the trading protocol.

Answer

An application-layer gateway that decodes the proprietary protocol.

Question 11

During an incident, an analyst needs to determine whether a compromised account was used to access a sensitive file share. The file server runs Windows and the organization uses centralized authentication. Which log source should the analyst review first to identify the account's access to the share?

Accepted Answer

Windows Security event logs on the file server, filtered for object access auditing events.. To establish whether a specific account accessed a sensitive file share on Windows, the file server's Security log with object access auditing enabled is the authoritative source. Event 4663 and related object access events capture the account, object path, and access type. Domain controller Kerberos events, firewall SMB logs, and antivirus logs provide authentication or network context but cannot prove file-level access by the compromised account.

Answer

Antivirus console logs showing scan results on the file server.

Answer

Domain controller Security logs filtered for Kerberos ticket-granting service events.

Answer

Firewall logs showing SMB traffic between the workstation and the file server.

Question 12

A network administrator is configuring a new wireless network for a small office. The office manager wants to ensure that only authorized employees can connect and that traffic between wireless clients is encrypted. Which security protocol should the administrator implement?

Accepted Answer

Wi-Fi Protected Access 2 (WPA2) with Advanced Encryption Standard (AES) and a pre-shared key. WPA2 with AES and a pre-shared key provides both authentication (via the key) and strong encryption for wireless traffic. It is the standard for securing small office wireless networks. Other options either lack encryption or use weak, outdated methods that do not meet the security requirements.

Answer

Media Access Control (MAC) address filtering with a whitelist

Answer

Open authentication with a captive portal for user login

Answer

Wired Equivalent Privacy (WEP) with a 128-bit key

Question 13

A hospital's biomedical team connects a new MRI workstation to the clinical VLAN. The workstation must reach a PACS archive on a different subnet, but the team reports that no traffic leaves the workstation. A technician confirms the workstation has an IP address of 10.20.30.44/24 and the PACS archive is 10.20.40.10/24. Which device should the workstation be configured to use as its default gateway?

Accepted Answer

A router interface on the 10.20.30.0/24 subnet. The workstation needs a next-hop address inside its own subnet so it can ARP for that device and hand off traffic destined for 10.20.40.0/24. Only a router interface on 10.20.30.0/24 provides a reachable Layer 2 next hop that can also route to the PACS subnet. The other candidates either sit outside the local subnet or cannot perform IP routing.

Answer

The PACS archive server itself at 10.20.40.10

Answer

The DNS server address assigned by DHCP

Answer

A Layer 2 switch's management IP address on the 10.20.30.0/24 subnet

Question 14

A hospital's security team wants to give remote clinicians access to internal patient systems without exposing those systems directly to the internet. The team requires strong encryption, per-user authentication, and the ability to log every session. Which solution best fits these requirements?

Accepted Answer

A remote access VPN terminating on a VPN concentrator with user authentication and session logging. A remote access VPN provides the encrypted tunnel, individual user authentication, and auditable session records that the hospital requires, while keeping internal systems unreachable from the public internet. It scales to a distributed clinical workforce far better than fixed site-to-site links and gives the security team the visibility it needs.

Answer

A remote desktop gateway that publishes the internal applications over HTTPS

Answer

A site-to-site IPsec tunnel between the hospital and each clinician's home router

Answer

Publishing the patient systems through a reverse proxy with TLS

Question 15

A financial services company is designing a demilitarized zone (DMZ) for its public web and email relay servers. The security architect wants to reduce the attack surface and limit what an attacker can reach if a DMZ host is compromised. Which two design practices should be implemented? (Choose two.)

Accepted Answer

Permit only the specific inbound ports required for the public services into the DMZ.. A DMZ should expose only the ports required for public services and should enforce strict, default-deny rules on the internal firewall so that a compromised DMZ host cannot freely reach internal systems. These two practices reduce attack surface and contain lateral movement. Opening management paths or sharing VLANs and rule sets with internal networks removes the separation that makes the DMZ valuable.

Answer

Allow the DMZ hosts to initiate connections to any internal server for management convenience.

Answer

Place the DMZ servers on the same VLAN as internal user workstations to simplify routing.

Answer

Use the same firewall rule set for both the external and internal firewalls to reduce administrative effort.