ISC2 CC Practice Test 1 — 30 Questions

Question 1

A security analyst discovers that a user's account has been used to access sensitive data outside of normal business hours from an unfamiliar IP address. The user claims they were not logged in at that time. Which security operations process should be initiated first?

Accepted Answer

Initiate the incident response process. Option D is correct because the scenario describes a potential security incident—unauthorized access to sensitive data from an unfamiliar IP address outside business hours—which requires immediate activation of the incident response process. The first step in any security operations workflow is to follow the organization's incident response plan (NIST SP 800-61) to contain, analyze, and remediate the threat. Jumping to forensic analysis, password resets, or account disabling without a coordinated incident response can destroy evidence or fail to address the root cause.

Answer

Perform a forensic analysis of the user's workstation

Answer

Reset the user's password and enforce multi-factor authentication

Answer

Disable the user account immediately

Question 2

An organization wants to ensure that data remains unaltered during transmission over the internet. Which security goal is being addressed?

Accepted Answer

Integrity. Integrity ensures that data is not altered during transmission, typically verified through cryptographic hash functions (e.g., SHA-256) or message authentication codes (MACs) such as HMAC. Protocols like TLS use integrity checks to detect any unauthorized modification of packets in transit, directly addressing the requirement that data remains unaltered.

Answer

Non-repudiation

Answer

Availability

Answer

Confidentiality

Question 3

A security auditor discovers that a user has been granted read and write access to a sensitive file, but the user's job only requires read access. Which access control principle has been violated?

Accepted Answer

Least privilege. The principle of least privilege dictates that users should be granted only the minimum permissions necessary to perform their job functions. Granting write access when only read access is required violates this principle by providing unnecessary and potentially harmful capabilities. This is a core access control concept in the CC exam.

Answer

Job rotation

Answer

Need-to-know

Answer

Separation of duties

Question 4

A company's network uses 802.1X authentication with PEAP-MSCHAPv2 on wired ports. Users report that after a recent switch firmware update, some workstations fail to authenticate intermittently, while others work fine. The authentication server logs show 'Authentication failed: Unknown CA certificate' for affected workstations. What is the most likely cause?

Accepted Answer

The switch is now using a different certificate that is not trusted by the clients. The error 'Unknown CA certificate' indicates that the client does not trust the certificate presented by the RADIUS server during PEAP-MSCHAPv2 authentication. After a switch firmware update, the switch may have been reconfigured to use a different server certificate (e.g., a self-signed or internally issued certificate) that is not in the trusted root store of the affected workstations. Since PEAP requires the client to validate the server certificate, a mismatch causes intermittent authentication failures.

Answer

The switch is not forwarding EAP packets properly due to a firmware bug

Answer

The RADIUS shared secret was changed during the firmware update

Answer

The authentication server (NPS) is overloaded and dropping requests

Question 5

During a security audit, a penetration tester captures network traffic and finds that some packets have the IP ID field set to 0 and the DF (Don't Fragment) flag set. What is this technique attempting to do?

Accepted Answer

Perform a stealth scan using a zombie host to hide the attacker's identity. Setting the IP ID field to 0 and the DF flag in packets is characteristic of an idle scan (also known as a stealth scan). This technique uses a zombie host (with an incremental IP ID) to probe a target; by sending packets with DF set and IP ID 0 to the zombie, the attacker can observe changes in the zombie's IP ID to infer open ports on the target, thereby hiding the attacker's true IP address.

Answer

Spoof the source IP address of the attacker's machine

Answer

Launch a denial-of-service attack against the target

Answer

Evade a firewall by fragmenting packets

Question 6

A security operations team is implementing a new SIEM solution. They want to ensure that logs from all critical systems are collected and analyzed in real time. Which of the following is the MOST important consideration when designing the log collection architecture?

Accepted Answer

Ensure sufficient network bandwidth and storage capacity. The most critical factor in real-time log collection is ensuring that the network can handle the volume of log data without congestion and that storage can ingest and retain the data without dropping events. Without sufficient bandwidth, logs will be delayed or lost, defeating the purpose of real-time analysis. Storage capacity directly impacts the ability to retain and query logs for immediate and historical investigation.

Answer

Use a standardized log format for all systems

Answer

Encrypt all log transmissions in transit

Answer

Define a log retention policy of at least one year

Question 7

A company's security operations center (SOC) receives an alert about suspicious outbound traffic from a server in the DMZ to an external IP address known for command-and-control activity. The SOC analyst reviews the logs and sees that the source port is 443 and the destination port is 8080. Which of the following actions should the analyst take FIRST?

Accepted Answer

Isolate the server from the network and investigate further. The SOC analyst should first isolate the server from the network because the outbound traffic from a DMZ server to a known C2 IP address, using source port 443 (HTTPS) to destination port 8080 (HTTP alternate), indicates a potential compromise. Isolating the server stops the data exfiltration and prevents further C2 communication, allowing for a controlled forensic investigation without alerting the attacker. This aligns with the NIST SP 800-61 incident response process, where containment is prioritized before eradication or recovery.

Answer

Notify the incident response team and management immediately

Answer

Block the external IP address at the firewall

Answer

Modify the firewall rule to deny all outbound traffic from the DMZ

Question 8

A SOC analyst is investigating a potential data exfiltration incident. The logs show that an internal user transferred a large volume of data to a cloud storage service using HTTPS. The analyst finds that the user's workstation has BitLocker Drive Encryption enabled, and the user has administrative privileges. Which of the following best describes the PRIMARY challenge in investigating this incident?

Accepted Answer

The user has administrative privileges, which could allow them to cover their tracks. The primary challenge is that administrative privileges allow the user to tamper with logs, disable security monitoring, or use tools to cover their tracks, making forensic reconstruction difficult. Even with BitLocker and HTTPS, the SOC can still analyze network logs and endpoint telemetry, but admin rights directly undermine the integrity of evidence on the workstation.

Answer

The volume of data transferred makes it difficult to determine what was exfiltrated

Answer

The data was transferred over HTTPS, which cannot be decrypted by the SOC

Answer

BitLocker encryption prevents access to the hard drive for forensic analysis

Question 9

A company is implementing an access control system to protect sensitive data. Employees in the finance department must access financial records, but only during business hours and from company-issued devices. Which access control model best supports these requirements?

Accepted Answer

Rule-Based Access Control (RuBAC). Rule-Based Access Control (RuBAC) is the correct choice because it enforces access decisions based on a set of predefined rules, such as time-of-day restrictions and device compliance. In this scenario, the rules 'business hours only' and 'company-issued devices only' are static conditions that can be implemented as access control rules (e.g., using a firewall ACL or a policy engine) without requiring user attributes or labels. RuBAC is ideal when access is governed by operational policies that are not tied to user identity or data classification.

Answer

Attribute-Based Access Control (ABAC)

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Question 10

A security administrator is reviewing the principles of access control. Which TWO of the following are core components of the AAA framework? (Select TWO.)

Accepted Answer

Authorization. The AAA framework consists of Authentication, Authorization, and Accounting. Authentication verifies the identity of a user or device (e.g., via RADIUS or TACACS+). Authorization determines what resources or actions the authenticated entity is permitted to access (e.g., via privilege levels or ACLs). Accounting tracks and logs user activities for auditing and billing purposes. Therefore, Authorization (A) and Authentication (D) are two of the three core components of AAA.

Answer

Identification

Answer

Non-repudiation

Answer

Auditing

Question 11

Refer to the exhibit. What action did the firewall take on the traffic from 10.0.1.15 to 10.0.2.10?

Accepted Answer

Denied the traffic. The firewall denied the traffic from 10.0.1.15 to 10.0.2.10 because the access control list (ACL) or security policy explicitly denies the source IP 10.0.1.15, as shown in the exhibit. The firewall processes rules sequentially, and the first matching rule for this traffic is a deny entry, so the packet is dropped without further inspection or logging unless specified.

Answer

Logged and permitted

Answer

Permitted the traffic

Answer

Translated the source address

Question 12

A security administrator notices that a user with standard privileges was able to modify a system file. Which security principle has been violated?

Accepted Answer

Least privilege. The principle of least privilege requires that users be granted only the permissions necessary to perform their job functions. A standard user modifying a system file indicates they have been assigned unnecessary administrative rights, violating this principle. This could occur if the user is a member of a group like Administrators or has been granted explicit write access to protected directories such as %SystemRoot%\System32.

Answer

Need to know

Answer

Defense in depth

Answer

Separation of duties

Question 13

An organization uses a primary data center and a backup site 500 miles away. The backup site replicates data synchronously. Which risk is MOST likely introduced by this configuration?

Accepted Answer

Increased latency for write operations. Synchronous replication requires the primary site to wait for an acknowledgment from the backup site before completing each write operation. The 500-mile distance introduces a minimum round-trip latency of approximately 8-10 ms (based on fiber optic propagation at ~200 km/ms), which directly increases the time taken for write operations. This latency impact is the most likely risk introduced by this configuration.

Answer

High recovery point objective (RPO)

Answer

Data encryption overhead

Answer

Insufficient bandwidth between sites

Question 14

Based on the exhibit, what is the most likely result of the client's HTTP request?

Accepted Answer

The HTTP request is blocked, but other traffic from the client is allowed.. The exhibit shows an extended ACL applied inbound on the client's interface that permits TCP traffic from the client to the server on port 80 (HTTP) but denies all other IP traffic from the client. Therefore, the HTTP request is permitted, but any other traffic from the client (e.g., DNS, ICMP) is blocked. Option D correctly states that the HTTP request is blocked, but other traffic is allowed, which matches the ACL behavior.

Answer

The HTTP request is permitted because the ACL is applied to the wrong interface.

Answer

The HTTP request is permitted because the ACL only blocks traffic from the router's own IP.

Answer

The HTTP request is blocked, and all other traffic from the client is also blocked.

Question 15

Refer to the exhibit. A security engineer reviews this firewall ACL. Which of the following best describes the security posture?

Accepted Answer

The ACL is misconfigured because the deny for SSH is never reached. Option A is correct because the ACL is evaluated top-down, and the first matching rule is applied. Since the 'permit tcp any any eq 443' rule appears before the 'deny tcp any any eq 22' rule, SSH traffic (TCP/22) is actually permitted by the implicit 'permit ip any any' that follows the explicit permit for HTTPS, or more accurately, the SSH deny is never reached because the permit for HTTPS matches all TCP traffic to port 443, but SSH traffic on port 22 is not matched by that rule; however, the key point is that the ACL lacks an explicit deny at the end, so any traffic not matching the first two rules (including SSH) is implicitly permitted by the default 'permit ip any any' at the end of the ACL, making the SSH deny rule ineffective.

Answer

The ACL is properly ordered with most specific rules first

Answer

The ACL should have a deny any any at the end to be secure

Answer

The ACL correctly allows HTTPS and denies SSH, blocking other traffic

Question 16

A SOC analyst reviews an alert indicating a high number of failed login attempts from a single external IP address targeting multiple user accounts. Which security control is most effective at preventing this type of attack?

Accepted Answer

Implementing account lockout policies. Option D is correct because account lockout policies directly mitigate brute-force attacks by temporarily disabling an account after a defined number of failed login attempts (e.g., 5 failures within 15 minutes). This prevents the attacker from continuing to guess passwords for multiple user accounts from a single external IP, without affecting legitimate users who can be unlocked after a lockout duration or via an administrative reset.

Answer

Deploying a web application firewall

Answer

Enabling verbose logging for authentication events

Answer

Increasing password complexity requirements

Question 17

A SOC analyst notices that a large volume of outbound traffic is occurring from a single workstation to an external IP address known to be associated with a command-and-control server. What is the most likely conclusion?

Accepted Answer

The workstation is infected with malware that is beaconing to the attacker. The large volume of outbound traffic from a single workstation to a known command-and-control (C2) server is a classic indicator of malware beaconing. Beaconing involves the infected host periodically sending small packets or HTTP/HTTPS requests to the C2 server to receive instructions or exfiltrate data, which matches the observed behavior. This is distinct from legitimate traffic patterns because the destination IP is specifically associated with malicious activity.

Answer

The network is experiencing a denial of service attack

Answer

The user is streaming video from a blocked site

Answer

The workstation is performing a legitimate software update

Question 18

Which TWO of the following are primary objectives of an incident response plan? (Choose two.)

Accepted Answer

Return affected systems to normal operation. Option B is correct because a primary objective of an incident response plan is to return affected systems to normal operation. This involves containment, eradication, and recovery steps to restore business functions after a security incident, ensuring the organization can resume operations securely.

Answer

Ensure business continuity during the incident

Answer

Collect evidence for legal proceedings

Answer

Identify the root cause of the incident

Question 19

A company's primary data center experiences a complete power failure, and operations are shifted to a secondary site. The failover process takes 4 hours, but the recovery point objective (RPO) is set to 1 hour. Which of the following is the most likely consequence of this incident?

Accepted Answer

Data loss of up to 3 hours occurred.. The RPO of 1 hour means the company can tolerate losing up to 1 hour of data. Since the failover took 4 hours, any data written in the 3 hours before the power failure that had not yet been replicated to the secondary site would be lost. This results in a data loss window of up to 3 hours, exceeding the RPO.

Answer

The failover process was unsuccessful.

Answer

No data loss occurred because the secondary site was available.

Answer

The recovery time objective (RTO) was not met.

Question 20

Refer to the exhibit. A security analyst observes that users from the 192.168.1.0/24 network cannot access HTTPS websites, but HTTP access works fine. What is the most likely cause?

Accepted Answer

The ACL is applied to the wrong interface or direction.. The exhibit shows an ACL that permits HTTP (TCP 80) but does not explicitly permit HTTPS (TCP 443). However, the question states that HTTP works and HTTPS does not, which suggests the ACL is correctly filtering inbound traffic on the outside interface. The most likely cause is that the ACL is applied to the wrong interface or direction, because if it were applied inbound on the inside interface, it would block outbound HTTPS traffic from the 192.168.1.0/24 network. The implicit deny at the end of the ACL would block any traffic not explicitly permitted, but since HTTP works, the issue is not the implicit deny itself but rather the placement of the ACL.

Answer

The implicit deny at the end of the ACL blocks HTTPS traffic.

Answer

The ACL is missing a permit statement for TCP port 443 return traffic.

Answer

The ACL explicitly denies TCP port 443.