ISC2 CC Practice Test 30 — 15 Questions

Question 1

Which access control model allows the owner of a resource to decide who can access it?

Accepted Answer

Discretionary Access Control (DAC). Discretionary Access Control (DAC) allows the owner of a resource to determine who can access it and with what permissions. In DAC, the resource creator or authorized owner can grant or revoke access rights to other subjects, typically through access control lists (ACLs) or file permissions. This model is commonly implemented in operating systems like Windows NTFS and Linux file systems, where the owner sets read, write, or execute permissions.

Answer

Mandatory Access Control (MAC)

Answer

Role-Based Access Control (RBAC)

Answer

Attribute-Based Access Control (ABAC)

Question 2

Which TWO are essential elements of a business impact analysis (BIA)?

Accepted Answer

Identification of critical business functions. Identifying critical business functions is a core element of a BIA. The BIA determines which systems and processes are essential for business operations, and without this identification, you cannot prioritize recovery efforts or allocate resources effectively during a disaster.

Answer

A network topology diagram

Answer

List of all employees

Answer

Assignment of IP addresses

Question 3

A security engineer is designing a DMZ for a web server that must be accessible from the internet. The web server needs to query an internal database server. Which network security approach best limits exposure?

Accepted Answer

Place the web server in the DMZ and the database server in the internal network, with a firewall allowing only specific traffic from the web server to the database.. It implements a true DMZ architecture: the web server resides in the DMZ (a semi-trusted zone) while the database server remains in the internal network, protected by a firewall that permits only specific traffic (e.g., TCP/3306 for MySQL or TCP/1433 for MSSQL) from the web server. This minimizes the attack surface by ensuring that even if the web server is compromised, the database server is not directly reachable from the internet, and the firewall enforces strict stateful inspection and access control.

Answer

Use a single firewall with rules that allow all traffic from the internet to the internal network.

Answer

Place both servers in the same subnet with a firewall allowing all traffic.

Answer

Place the database server in the DMZ with the web server.

Question 4

During a ransomware incident, the incident response team has completed the containment and eradication phases. According to the NIST incident response framework, which THREE of the following activities are part of the post-incident activity phase?

Accepted Answer

Conduct a lessons learned meeting to identify improvements.. The post-incident activity phase includes lessons learned, evidence retention, and updating incident response plans. System hardening is part of eradication, and customer notification may occur during recovery or communication, but not strictly part of the post-incident phase in the NIST framework.

Answer

Notify affected customers of the data breach.

Answer

Harden system configurations to prevent reinfection.

Question 5

An LDAP distinguished name (DN) is written as 'CN=John Smith,OU=Sales,DC=company,DC=com'. What does 'CN' represent?

Accepted Answer

Common Name. In LDAP, CN stands for Common Name, which is typically the user's name.

Answer

Domain Component

Answer

Organizational Unit

Answer

Country Name

Question 6

An organization uses a primary data center and a backup site 500 miles away. The backup site replicates data synchronously. Which risk is MOST likely introduced by this configuration?

Accepted Answer

Increased latency for write operations. Synchronous replication requires the primary site to wait for an acknowledgment from the backup site before completing each write operation. The 500-mile distance introduces a minimum round-trip latency of approximately 8-10 ms (based on fiber optic propagation at ~200 km/ms), which directly increases the time taken for write operations. This latency impact is the most likely risk introduced by this configuration.

Answer

High recovery point objective (RPO)

Answer

Data encryption overhead

Answer

Insufficient bandwidth between sites

Question 7

A company implements a policy where a financial transaction must be initiated by one employee and approved by a different employee. This is an example of which access control concept?

Accepted Answer

Separation of duties. Separation of duties (SoD) is an access control concept that requires a critical task, such as a financial transaction, to be split into multiple steps performed by different individuals. This prevents any single employee from having the authority to both initiate and approve a transaction, thereby reducing the risk of fraud or error. In this scenario, the policy directly enforces SoD by ensuring that no one person can complete the entire process alone.

Answer

Need-to-know

Answer

Least privilege

Answer

Job rotation

Question 8

Which access control model uses subject and object labels to enforce access based on a security policy?

Accepted Answer

Mandatory Access Control (MAC). Mandatory Access Control (MAC) enforces access decisions based on security labels assigned to subjects (users/processes) and objects (files/resources). The system, not the user, controls access by comparing these labels against a security policy, such as Bell-LaPadula or Biba. This is why MAC is the correct answer for label-based enforcement.

Answer

Discretionary Access Control (DAC)

Answer

Attribute-Based Access Control (ABAC)

Answer

Role-Based Access Control (RBAC)

Question 9

An organization uses a SIEM to correlate logs from multiple sources. A rule triggers when a user logs in from two geographically distant locations within a short time. What type of attack does this rule primarily detect?

Accepted Answer

Credential theft or session hijacking. The SIEM rule detects impossible travel — a user authenticating from two geographically distant locations within a time window too short for physical travel. This behavior strongly indicates that an attacker has stolen the user's credentials (credential theft) or taken over an active session (session hijacking) and is using them from a different location. The SIEM correlates authentication logs (e.g., from Active Directory, VPN, or web apps) with geolocation data (IP-to-location mapping) to flag this anomaly.

Answer

Denial of service attack

Answer

Brute-force attack

Answer

Man-in-the-middle attack

Question 10

A financial institution has a security operations center that monitors network traffic using a SIEM. The SIEM receives logs from all network devices, servers, and endpoints. One analyst notices an anomaly: a user account, 'jsmith', which is normally used during business hours (9 AM to 5 PM), has been logging in from a remote IP address at 2 AM every day for the past week. The logins are successful, and the user is accessing internal file shares. The user jsmith works in the accounting department and has access to sensitive financial reports. The analyst checks the user's workstation logs and finds that the workstation is powered off at the time of the remote logins. The company uses two-factor authentication, but the log entries show that only the password was used. Which of the following is the most likely explanation and the best immediate action?

Accepted Answer

The user's credentials have been stolen and are being used by an attacker; disable the account. The anomaly—successful logins at 2 AM from a remote IP while the user's workstation is powered off and only a password (bypassing 2FA) is used—strongly indicates credential theft and account takeover. The SIEM logs show authentication without the second factor, which means the attacker either obtained the password and bypassed 2FA (e.g., through a phishing attack that captured both factors or a session cookie) or the 2FA was not enforced for this specific remote login. Disabling the account immediately stops the unauthorized access to sensitive financial shares.

Answer

The user is working overtime from home; no action needed

Answer

The two-factor authentication system is malfunctioning; reconfigure the 2FA server

Answer

The user's workstation is infected with a remote access trojan; run antivirus

Question 11

Which TWO are phases of the NIST incident response life cycle? (Select exactly 2.)

Accepted Answer

Preparation. Preparation is the first phase of the NIST SP 800-61 incident response life cycle, focusing on establishing policies, tools, and training before an incident occurs. This phase ensures the organization is ready to detect and respond to security events effectively.

Answer

Documentation

Answer

Assessment

Answer

Authorization

Question 12

Drag and drop the steps for the TCP three-way handshake into the correct order.

Accepted Answer

SYN, then SYN-ACK, then ACK. The TCP three-way handshake is a three-step process used to establish a reliable connection. The client initiates by sending a SYN (synchronize) packet to the server. The server responds with a SYN-ACK (synchronize-acknowledge) packet, acknowledging the client's request and indicating its own synchronization. Finally, the client sends an ACK (acknowledge) packet to confirm the connection establishment. This sequence ensures both sides agree on initial sequence numbers and that the connection is ready for data transfer.

Answer

SYN, then ACK, then SYN-ACK

Answer

SYN-ACK, then SYN, then ACK

Answer

ACK, then SYN, then SYN-ACK

Question 13

An organization is implementing a patch management program. Which of the following is the BEST approach to minimize risk while maintaining operational stability?

Accepted Answer

Deploy patches to a test environment before production.. The best approach because deploying patches to a test environment before production allows the organization to identify potential issues, such as compatibility problems or stability regressions, without affecting live systems. This minimizes operational risk while still addressing security vulnerabilities. Option A is risky because non-security patches may fix critical stability issues; Option B ignores the need for testing and could cause widespread outages; Option C overlooks vulnerabilities on internal systems, which can be exploited as pivot points.

Answer

Skip patches that are not related to security.

Answer

Apply patches to all systems simultaneously.

Answer

Only patch systems that are internet-facing.

Question 14

A security analyst detects a large volume of small ICMP echo request packets from multiple external sources targeting a single internal server, causing the server to become unresponsive. Which type of attack is this?

Accepted Answer

ICMP flood (DDoS). A DDoS attack using ICMP flood overwhelms the target with echo requests, consuming bandwidth and resources.

Answer

ARP spoofing

Answer

Man-in-the-middle

Answer

SYN flood

Question 15

Which firewall type reads packet headers and also tracks the state of active connections to make filtering decisions?

Accepted Answer

Stateful inspection. Stateful inspection firewalls maintain a state table to track connections, allowing return traffic for permitted outbound connections.

Answer

Packet filtering

Answer

Application proxy

Answer

NGFW