ISC2 CC Practice Test 1 — 30 Questions

Question 1

A small e-commerce company hosts its web application on a single server with a public IP address. The server runs a Linux OS with Apache, MySQL, and PHP. The company recently experienced a data breach where an attacker gained access to the customer database. The investigation reveals that the attacker exploited a vulnerability in the PHP application to execute arbitrary commands. The server logs show that the attacker used an unauthenticated HTTP POST request to a legacy script that should have been removed. Additionally, the server had default firewall rules allowing all inbound traffic on ports 80 and 443. The company wants to prevent future breaches without redesigning the entire application. Which course of action is the most effective?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement a web application firewall (WAF) with virtual patching for the vulnerability.. The most effective because it provides immediate protection against the exploited vulnerability without requiring application redesign. A WAF with virtual patching can inspect HTTP POST requests to the legacy script and block malicious payloads, even if the underlying code remains vulnerable. This approach addresses the root cause (the unauthenticated exploit) while allowing the company to maintain operations and plan a permanent fix.

Answer

Move the database to a separate internal server and require VPN access for administration.

Answer

Upgrade the PHP version to the latest release and enable SELinux.

Answer

Remove the legacy script and update the firewall to block all traffic except necessary IPs.

Question 2

A financial institution requires that no single employee can both initiate and approve a wire transfer. This policy enforces which security principle?

Accepted Answer

Separation of duties. Separation of duties prevents fraud by dividing critical tasks. Least privilege limits access, but here it's about task division.

Answer

Defense in depth

Answer

Least privilege

Answer

Need to know

Question 3

An organization wants to implement defense in depth for its web application. Which combination of controls best illustrates this principle?

Accepted Answer

A firewall, intrusion detection system, and regular security awareness training.

Answer

A strict perimeter firewall without internal controls.

Answer

Encryption at rest only.

Answer

A single strong password policy.

Question 4

A security incident report indicates that an employee used their access to view confidential records unrelated to their job. Which security principle was most likely violated?

Accepted Answer

Least privilege

Answer

Separation of duties

Answer

Availability

Answer

Non-repudiation

Question 5

A security analyst notices that a user has been granted access to files beyond their job function. Which principle is violated?

Accepted Answer

Least privilege. Least privilege requires that users be granted only the minimum permissions necessary to perform their duties. The scenario shows excessive access, directly violating this principle.

Answer

Authentication

Answer

Non-repudiation

Answer

Accountability

Question 6

A company experiences a ransomware attack that encrypts all files on a server. Which security control would MOST effectively allow recovery without paying the ransom?

Accepted Answer

Regular backups. Regular backups enable restoration of encrypted data from a clean copy, bypassing the need to pay the ransom. Other controls help prevent or detect but do not directly facilitate recovery.

Answer

Firewall

Answer

Intrusion detection system

Answer

Antivirus software

Question 7

A company is deploying a security device that inspects HTTP and HTTPS traffic, applies OWASP rules, and can block malicious requests before they reach the web server. Which device best fits this description?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) is specifically designed to protect web applications by inspecting HTTP/HTTPS traffic and applying rules like OWASP.

Answer

Honeypot

Answer

Intrusion Prevention System (IPS)

Answer

Stateful firewall

Question 8

During a vulnerability scan, the security team discovers a critical vulnerability on a public-facing server. According to best practices, what should the team do next?

Accepted Answer

Schedule a maintenance window. According to vulnerability management best practices, the first step after discovering a critical vulnerability is to schedule a maintenance window to apply a patch or mitigation in a controlled manner. This minimizes service disruption and allows for testing, ensuring the fix does not introduce new issues. Immediate remediation during business hours (Option B) could cause downtime or impact users, while disabling the server (Option A) is an extreme measure reserved for active exploitation with no available patch.

Answer

Disable the server

Answer

Remediate immediately during business hours

Answer

Inform all users

Question 9

A helpdesk technician receives a report that a user in the finance department cannot access a shared folder on the server. The same server is accessible from other departments. What is the most likely cause?

Accepted Answer

A firewall rule is blocking traffic from the finance VLAN to the server. The scenario describes a user in the finance department unable to access a shared folder on a server that is reachable from other departments. This points to a segmentation or access control issue specific to the finance VLAN. A firewall rule blocking traffic from the finance VLAN to the server is the most likely cause because it would selectively prevent access for that subnet while allowing other VLANs to reach the server, matching the symptom of partial connectivity.

Answer

The server is down

Answer

The network cable is unplugged

Answer

The user's account is disabled

Question 10

Which TWO are true about a differential backup? (Select two.)

Accepted Answer

It requires a full backup to be restored first. A differential backup copies all files that have changed since the last full backup. Because it does not contain the complete data set, you must first restore the most recent full backup and then apply the differential backup on top of it to recover the system. This makes option B correct.

Answer

It copies files changed since the last backup of any type

Answer

It resets the archive bit on backed-up files

Answer

It is faster to restore than a full backup

Question 11

An organization encrypts all sensitive data at rest and in transit. Which principle of the CIA triad is primarily being addressed?

Accepted Answer

Confidentiality. Encryption protects data from unauthorized disclosure, directly supporting confidentiality.

Answer

Availability

Answer

Non-repudiation

Answer

Integrity

Question 12

A company requires all visitors to sign in, wear a visible badge, and be escorted while on premises. This is an example of:

Accepted Answer

Visitor management. Visitor management procedures help control physical access of non-employees.

Answer

Separation of duties

Answer

Logical access control

Answer

Defense in depth

Question 13

A security administrator is implementing controls to protect a server room. Which TWO physical security layers should be included as part of a defense-in-depth strategy? (Select TWO.)

Accepted Answer

Fencing around the building. Defense in depth uses multiple layers. External perimeter (fencing) and internal server room (biometric) are distinct layers.

Answer

Complex password policy

Answer

Cable locks on individual servers

Answer

Session timeout settings

Question 14

A company is implementing a data loss prevention (DLP) solution. Which strategy BEST balances security and productivity when monitoring outgoing email?

Accepted Answer

Alert on policy violations and allow user to override with manager approval. It balances security and productivity by alerting on policy violations while allowing users to override the block with manager approval. This approach ensures that legitimate business communications are not disrupted, while still enforcing DLP policies through a secondary review process. In a DLP solution, this is often implemented via a 'justify and override' workflow, where the user must provide a reason and receive approval from a manager before the email is sent.

Answer

Log all emails without any alerts

Answer

Block all emails containing keywords like 'confidential'

Answer

Encrypt all outgoing emails automatically

Question 15

An organization implements a policy where no single employee can approve a financial transaction over $10,000; a second manager must also approve. This is an example of which access control principle?

Accepted Answer

Separation of duties. Separation of duties requires multiple people to complete a critical task, reducing fraud risk.

Answer

Least privilege

Answer

Need-to-know

Answer

Defense in depth

Question 16

Which THREE are differences between a hot site and a cold site? (Select three.)

Accepted Answer

Hot site is more expensive to maintain. A hot site is a fully operational, mirrored environment with real-time data synchronization, pre-installed hardware, and active network connectivity, making it significantly more expensive to maintain due to ongoing costs for power, cooling, bandwidth, and dedicated staff. In contrast, a cold site is a bare facility with no active infrastructure, requiring manual setup and provisioning before recovery can begin. The higher cost of a hot site is justified by its near-zero Recovery Time Objective (RTO), whereas a cold site's lower cost reflects its much longer RTO.

Answer

Cold site has pre-installed software and applications

Answer

Both have the same recovery time objective (RTO)

Question 17

Which TWO of the following are best practices for password management in a corporate environment?

Accepted Answer

Enforce password complexity requirements.. Enforcing password complexity requirements (e.g., minimum length, character types) reduces the risk of brute-force and dictionary attacks by increasing the effective keyspace. Option E is correct because multi-factor authentication (MFA) adds an additional layer of security beyond the password, mitigating credential theft or reuse. Together, they form a defense-in-depth approach to authentication security.

Answer

Store passwords in plaintext in a shared document.

Answer

Prohibit password changes more than once per year.

Answer

Share passwords among team members for shared accounts.

Question 18

A company's security policy requires that all sensitive data be encrypted at rest and in transit. However, a recent breach occurred because an attacker exploited a misconfigured web server that exposed a database directly. Which principle was most lacking in this scenario?

Accepted Answer

Defense in depth. Efense in depth because it emphasizes multiple layers of security controls. A single misconfiguration exposed the database directly, indicating a lack of layered defenses. The other principles: Least privilege (A) is about limiting permissions, Fail securely (B) is about ensuring secure states on failure, and Complete mediation (C) is about checking every access. Therefore, defense in depth was most lacking.

Answer

Least privilege

Answer

Fail securely

Answer

Complete mediation

Question 19

A security operations center (SOC) analyst is investigating a potential data exfiltration. Which two indicators are most likely signs of data exfiltration?

Accepted Answer

Unexpected large file transfers via FTP. Unexpected large file transfers via FTP are a classic indicator of data exfiltration because FTP is a clear-text protocol often used to move bulk data out of a network. A sudden spike in outbound FTP traffic, especially to an unfamiliar external IP, suggests an attacker is compressing and uploading stolen files. This behavior directly matches the exfiltration phase of the Cyber Kill Chain.

Answer

Large number of failed login attempts

Answer

Frequent DNS queries to known malicious domains

Answer

Multiple antivirus alerts

Question 20

A company has implemented a role-based access control (RBAC) system. A new employee in the finance department is granted the 'Finance User' role, which allows them to view invoices but not create payments. However, after a system upgrade, it is discovered that the 'Finance User' role now includes the ability to create payments due to a misconfiguration. The employee did not request this additional privilege and has not exploited it. The security team is notified. Which principle has been violated, and what is the most appropriate immediate action?

Accepted Answer

Least privilege; correct the role permissions to only what is necessary. Correct: Least privilege is violated because the employee has more permissions than needed. The immediate action is to correct the role permissions to only what is necessary (option D). Option A is wrong because separation of duties is not the violated principle; the employee did not misuse the privilege, so disabling the account is too extreme. Option B is wrong because accountability is not the issue, and removing the role from all employees is overly broad. Option C is wrong because revoking the employee's access permanently is too harsh and does not address the root cause.

Answer

Separation of duties; disable the employee's account until an investigation is complete

Answer

Accountability; remove the 'Finance User' role from all employees

Answer

Least privilege; revoke the employee's access permanently