ISC2 CC Practice Test 2 — 30 Questions

Question 1

An organization is implementing a new identity management system. They want to ensure that users can only access resources necessary for their job roles. Which principle should guide the access control design?

Accepted Answer

Least privilege. The principle of least privilege dictates that users should be granted only the permissions necessary to perform their job functions and nothing more. In an identity management system, this is implemented by assigning minimal access rights to resources, reducing the attack surface and limiting potential damage from compromised accounts. This directly aligns with the scenario of ensuring users can only access resources essential for their roles.

Answer

Separation of duties

Answer

Need to know

Answer

Defense in depth

Question 2

An organization experiences a ransomware attack that encrypts critical file servers. The backups are stored on a separate network segment but are also encrypted. The incident response team suspects the attacker compromised the backup system using stored credentials. Which best practice should have been implemented to prevent this?

Accepted Answer

Enable multi-factor authentication (MFA) on backup system access. Option B is correct because enabling multi-factor authentication (MFA) on backup system access would have prevented the attacker from using stored credentials to compromise the backup system. MFA requires an additional authentication factor beyond just a password or stored token, making credential theft or reuse insufficient for access. This directly addresses the attack vector described—stolen credentials—rather than relying solely on network segmentation or encryption.

Answer

Implement air-gapped backups stored offline

Answer

Encrypt backup data at rest and in transit

Answer

Use a separate VLAN for backup traffic

Question 3

A company is designing a new application that processes credit card payments. They want to ensure that no single administrator can bypass security controls to approve a fraudulent transaction. Which principle should be implemented?

Accepted Answer

Separation of duties. Separation of duties ensures that no single administrator has the authority to both initiate and approve a credit card transaction. By dividing critical functions among multiple individuals, the company prevents a single compromised account from authorizing fraudulent payments. This principle directly addresses the risk of insider threats or credential misuse in payment processing systems.

Answer

Defense in depth

Answer

Least privilege

Answer

Need to know

Question 4

Which TWO of the following are core components of the ISC2 Code of Ethics? (Choose two.)

Accepted Answer

Advance and protect the profession.. Option A is correct because the ISC2 Code of Ethics explicitly requires members to 'advance and protect the profession' as one of its four mandatory canons. This means acting honorably, maintaining competence, and not engaging in conduct that brings discredit upon the profession. It is a core ethical duty for all certified professionals.

Answer

Disclose all confidential information to law enforcement.

Answer

Ensure maximum profitability for the organization.

Answer

Always follow orders from management.

Question 5

Which THREE of the following are recognized security control types according to ISC2? (Choose three.)

Accepted Answer

Technical. Option B (Technical) is correct because ISC2 recognizes technical controls as a primary security control type, encompassing mechanisms like firewalls, encryption, and intrusion detection systems that enforce security policies through technology. These controls operate at the system or network level to protect assets directly.

Answer

Deterrent

Answer

Operational

Question 6

Refer to the exhibit. An administrator configures the above ACLs on a router. The goal is to allow internal users (192.168.1.0/24) to browse the web, and to allow SSH management from the internet to a server at 10.0.0.10. However, users report that they cannot browse external websites. What is the most likely reason?

Accepted Answer

ACL 100 is applied outbound on the internal interface, so it does not filter outbound traffic from internal users. ACL 100 is applied outbound on the internal interface (e.g., GigabitEthernet0/0). Outbound ACLs filter traffic leaving the interface, but internal users' web traffic originates from the internal network and must be allowed inbound on the internal interface (or outbound on the external interface). Since ACL 100 is applied outbound on the internal interface, it only filters traffic that has already been routed out of that interface, which is not the path for internal users' outbound web requests. The correct approach is to apply the ACL inbound on the internal interface or outbound on the external interface.

Answer

ACL 100 does not permit DNS traffic, so users cannot resolve domain names

Answer

ACL 110 blocks the return traffic from the internet

Answer

The implicit deny at the end of ACL 100 blocks established connections

Question 7

Refer to the exhibit. An IDS generates this alert for traffic from an internal server (10.1.1.50) to an external IP on port 443. The security team investigates and finds that the server is a web application that normally uses TLS 1.2. What does this alert most likely indicate?

Accepted Answer

An attacker is performing an SSL stripping attack, downgrading the connection to SSLv3. The alert indicates a downgrade from TLS 1.2 to SSLv3, which is the hallmark of an SSL stripping attack. In this attack, an adversary intercepts the client's TLS handshake request and forces the connection to use the weaker SSLv3 protocol, often by manipulating the ClientHello message to remove TLS options. This allows the attacker to exploit known vulnerabilities in SSLv3, such as POODLE, to decrypt or hijack the session.

Answer

The server is experiencing a buffer overflow attack

Answer

The server's certificate has expired and the client is falling back to SSLv3

Answer

The server has been misconfigured to use SSLv3 instead of TLS

Question 8

Which THREE are valid methods for authenticating a user in an access control system?

Accepted Answer

Fingerprint scan. A fingerprint scan is a valid authentication method because it falls under 'something you are' (biometric authentication). In access control systems, biometrics like fingerprint scans provide a high level of assurance by verifying a unique physical characteristic of the user, making it a strong factor for authentication.

Answer

User ID

Answer

Access control list

Question 9

Which THREE of the following are characteristics of a stateful firewall? (Select exactly three.)

Accepted Answer

It can automatically allow return traffic for outbound connections. A stateful firewall automatically allows return traffic for outbound connections because it tracks the state of each connection in a state table. When a packet from an internal host initiates an outbound TCP connection (e.g., SYN), the firewall creates an entry in the state table. When the corresponding return packet (e.g., SYN-ACK) arrives, the firewall checks the state table and permits it without needing an explicit inbound rule, as it recognizes the packet as part of an established session.

Answer

It inspects application-layer payloads

Answer

It filters packets based solely on source/destination IP and port

Question 10

A security analyst notices that an internal web server is receiving a high volume of TCP SYN packets from a single external IP address, but the server is not sending SYN-ACK replies. The server's CPU and memory usage are normal. What is the most likely cause?

Accepted Answer

The server is under a SYN flood attack, filling the connection queue. The correct answer is B because a SYN flood attack works by sending a high volume of TCP SYN packets to a server, filling its half-open connection queue (the backlog) and preventing it from completing the three-way handshake. Since the server's CPU and memory are normal, the issue is not resource exhaustion but rather the queue being saturated, causing the server to stop sending SYN-ACK replies to new connection requests.

Answer

A firewall rule is blocking inbound SYN-ACK packets

Answer

The server's TCP/IP stack has crashed

Answer

The server is experiencing a distributed denial-of-service (DDoS) attack

Question 11

An organization uses Active Directory and wants to grant a group of temporary interns access to a shared folder for exactly 30 days. Which access control approach is most efficient?

Accepted Answer

Create a security group with a time-based membership that expires automatically after 30 days.. Option B is correct because Active Directory supports time-based group membership via the `memberTimeToLive` attribute (introduced in Windows Server 2016 and later), which allows a security group to be configured so that members are automatically removed after a specified duration. This eliminates manual intervention and ensures the interns lose access exactly after 30 days without requiring password changes or calendar reminders.

Answer

Use a group managed service account with a 30-day password expiration.

Answer

Assign each intern directly to the folder permissions and set a calendar reminder to revoke.

Answer

Create a security group, add interns, and manually remove them after 30 days.

Question 12

A company is designing a new authentication system for remote employees. They want to ensure that if one authentication factor is compromised, the system remains secure. Which security principle should they apply?

Accepted Answer

Defense in depth. Defense in depth is the correct principle because it involves implementing multiple layers of security controls so that if one authentication factor is compromised, other layers still protect the system. In this scenario, requiring multiple authentication factors (e.g., password plus biometric or token) ensures that a single compromised factor does not grant full access, maintaining overall system security.

Answer

Fail-safe

Answer

Least privilege

Answer

Need to know

Question 13

After a security breach, it was discovered that an attacker used a stolen certificate to sign malicious code. Which security principle was compromised?

Accepted Answer

Non-repudiation. Non-repudiation ensures that an entity cannot deny having performed an action, such as signing code. When an attacker uses a stolen certificate to sign malicious code, the legitimate owner of the certificate cannot deny the signature, because the cryptographic proof (the digital signature) is bound to the certificate. This compromises the principle of non-repudiation, as the signature can no longer be reliably attributed to the intended signer.

Answer

Integrity

Answer

Confidentiality

Answer

Availability

Question 14

A company has implemented a security information and event management (SIEM) system. The SOC team notices that the SIEM is generating a high volume of false positive alerts from a specific web application firewall (WAF). The WAF logs show many requests with SQL injection patterns, but the application is not vulnerable. Which of the following actions would BEST reduce false positives without compromising security?

Accepted Answer

Tune the WAF's detection rules based on the application's normal traffic profile. Option C is correct because tuning the WAF's detection rules to match the application's normal traffic profile reduces false positives by filtering out benign requests that resemble SQL injection patterns. This approach maintains security by still detecting actual attacks, unlike simply suppressing alerts or disabling detection. The SIEM should correlate WAF alerts with application context, but the root cause is the WAF's overly broad rules, which need refinement.

Answer

Create a SIEM rule to suppress alerts from that WAF

Answer

Increase the alert threshold in the WAF to reduce sensitivity

Answer

Disable SQL injection detection in the WAF for that application

Question 15

During a security audit, it is found that a database administrator can access payroll data. The company policy states that administrators should not have access to sensitive HR data. Which security principle is being violated?

Accepted Answer

Separation of duties. The scenario describes a single database administrator having both the ability to access and modify payroll data, which combines operational and oversight roles. Separation of duties (SoD) is the principle that requires splitting critical tasks and privileges among multiple individuals to prevent fraud or error. Here, the administrator's access violates SoD because they can both manage the database and view sensitive HR data, which should require separate authorization.

Answer

Accountability

Answer

Least privilege

Answer

Privacy

Question 16

A security engineer is configuring a firewall to allow web traffic but block all other inbound connections. The firewall is set to deny all traffic by default and only allow specific ports. Which security principle is being applied?

Accepted Answer

Default deny. The correct answer is A, Default deny. The scenario describes a firewall configured to deny all traffic by default and then explicitly allow only specific ports (e.g., TCP 80/443 for web traffic). This directly implements the default deny security principle, where any traffic not explicitly permitted is blocked. This contrasts with a default allow posture, which would permit all traffic unless explicitly denied.

Answer

Defense in depth

Answer

Fail-safe

Answer

Least privilege

Question 17

An organization is implementing a new system that processes financial transactions. To reduce the risk of fraud, they ensure that no single individual can both initiate and approve a transaction. Which security principle is this?

Accepted Answer

Separation of duties. Separation of duties (SoD) is the security principle that prevents a single individual from having conflicting responsibilities, such as both initiating and approving a financial transaction. By splitting these tasks across different roles, the organization reduces the risk of fraud or error because collusion would be required to bypass controls. This is a core internal control mechanism in financial systems and aligns with the principle of dual control.

Answer

Need to know

Answer

Accountability

Answer

Least privilege

Question 18

Which THREE of the following are examples of the principle of least privilege? (Select THREE.)

Accepted Answer

Granting a user only the permissions needed to perform their job. Option A is correct because the principle of least privilege dictates that a user should be granted only the permissions necessary to perform their job functions. This minimizes the attack surface and limits potential damage from accidental or malicious actions. In practice, this means assigning specific roles or access control lists (ACLs) rather than broad permissions.

Answer

Giving all employees full access to the file server

Answer

Assigning administrator rights to all employees by default

Question 19

During a ransomware incident, the incident response team isolates affected systems. Which of the following is the NEXT best step?

Accepted Answer

Preserve forensic evidence from the isolated systems.. After isolating affected systems during a ransomware incident, the next best step is to preserve forensic evidence from those systems. This ensures that data such as memory dumps, logs, and encrypted files are captured intact for analysis, which is critical for understanding the attack vector, identifying the ransomware variant, and potentially recovering data without paying the ransom. Forensic preservation must occur before any remediation steps like wiping or rebuilding, as those actions would destroy the evidence needed for investigation and legal proceedings.

Answer

Wipe and rebuild all affected systems.

Answer

Notify law enforcement immediately.

Answer

Pay the ransom to restore operations quickly.

Question 20

An organization's recovery time objective (RTO) for its customer database is 4 hours. During a disaster, the backup restore process takes 2 hours, but reconfigure and test tasks add another 3 hours. Which action best addresses this gap?

Accepted Answer

Automate the configuration and validation steps after restore.. The RTO is 4 hours, but the actual recovery time is 2 hours (restore) + 3 hours (reconfigure and test) = 5 hours, exceeding the RTO by 1 hour. Automating the configuration and validation steps (option D) reduces the post-restore manual effort, bringing the total recovery time closer to or within the 4-hour RTO. This directly addresses the gap without altering the RTO or neglecting testing.

Answer

Conduct the restore test only during annual disaster recovery drills.

Answer

Reduce the recovery point objective (RPO) to minimize data loss.

Answer

Increase the RTO to 6 hours.