ISC2 CC Practice Test 2 — 30 Questions

Question 1

A SOC analyst is investigating an incident where an employee's workstation was compromised via a phishing email. The analyst has captured the following indicators: the email originated from a known malicious domain, the attachment was a macro-enabled document, and the macro executed a PowerShell command that downloaded a payload from a remote server. Which TWO actions should the analyst take immediately as part of the incident response process? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Isolate the workstation from the network.. Option B is correct because isolating the compromised workstation from the network immediately contains the incident, preventing the PowerShell-downloaded payload from establishing C2 communication or lateral movement to other hosts. Option D is correct because blocking the known malicious domain at the email gateway stops further phishing emails from that domain reaching other employees, addressing the initial infection vector. Option A is not an immediate containment step; law enforcement notification typically occurs later per legal/organizational policy. Option C, sandboxing the macro, is useful for deeper analysis but is not an immediate containment action and can be done after isolation. Option E, deleting the email from all mailboxes, is a remediation step that may follow, but blocking the domain at the gateway is the more immediate preventive action.

Answer

Contact law enforcement immediately.

Answer

Analyze the macro code in a sandbox.

Answer

Delete the phishing email from all mailboxes.

Question 2

A multinational financial services organization operates three data centers in different geographic regions. Each data center runs a mix of critical and non-critical applications. The DR plan specifies Recovery Time Objectives (RTOs) ranging from 4 hours for critical applications to 72 hours for non-critical. During a scheduled DR test, the team attempts to fail over the primary customer database to the secondary site. The failover fails because the replication link between sites was saturated due to a large data synchronization job running concurrently. The test is declared a failure, and senior management is concerned about the DR plan's reliability. The IT director suggests increasing bandwidth between sites. The security architect proposes implementing network prioritization for replication traffic. The business continuity manager recommends revising the RTOs to be more realistic based on current bandwidth. The system administrator thinks the issue will resolve if the test is repeated during off-peak hours. Which of the following is the BEST course of action to address the root cause of the failure?

Accepted Answer

Implement Quality of Service (QoS) policies to prioritize database replication traffic over other data transfers.. The root cause is that the replication link was saturated by a large data synchronization job, which delayed the critical database replication traffic needed to meet the 4-hour RTO. Implementing Quality of Service (QoS) policies directly addresses this by prioritizing database replication traffic over other data transfers, ensuring that critical replication gets the necessary bandwidth even during concurrent large jobs. This is the most effective solution because it resolves the contention without requiring additional bandwidth or changing RTOs.

Answer

Increase the bandwidth on the replication link by ordering a faster circuit from the ISP.

Answer

Reschedule the next DR test to occur during a scheduled maintenance window with no other replication activity.

Answer

Revise the RTO for the customer database from 4 hours to 8 hours to account for current bandwidth limitations.

Question 3

A security analyst notices an unusually high number of incomplete TCP connection requests. Which type of attack is most likely occurring?

Accepted Answer

SYN flood. SYN flood attacks exploit the TCP three-way handshake by sending many SYN packets without completing the handshake, exhausting server resources.

Answer

Smurf attack

Answer

ARP spoofing

Answer

DNS amplification

Question 4

A system administrator implements version control for all configuration files. Which principle is being strengthened?

Accepted Answer

Integrity. Version control helps ensure data accuracy and prevents unauthorized changes, supporting integrity.

Answer

Availability

Answer

Confidentiality

Answer

Accountability

Question 5

An attacker used stolen credentials from a phishing campaign to authenticate to a cloud email account. The organization's incident response team wants to immediately stop the attacker from continuing to access the mailbox while preserving evidence for investigation. Which action best meets both goals?

Accepted Answer

Disable the account in the identity provider, then export the mailbox audit log and sign-in logs to a secure evidence repository.. The most effective containment combines immediate revocation of access with preservation of forensic data. Disabling the account in the identity provider stops the attacker from authenticating again, while exporting audit and sign-in logs captures evidence before it rotates or is lost. Destructive actions like deleting the mailbox, or partial measures like a password change or IP block, either harm the investigation or fail to reliably stop the attacker.

Answer

Delete the mailbox and recreate it for the legitimate user, then reset the user's password.

Answer

Change the user's password and enable self-service password reset so the user can regain access quickly.

Answer

Add the attacker's IP address to the firewall block list and continue monitoring the mailbox for suspicious activity.

Question 6

A company wants to isolate its public web server from internal networks to reduce risk. The server must be accessible from the internet. Which network architecture should be used?

Accepted Answer

Implement a DMZ. A DMZ (demilitarized zone) is a segmented network that sits between the untrusted internet and the trusted internal LAN, hosting public-facing services like web servers. It allows inbound internet access to the server while firewalls restrict traffic from the DMZ into the internal network, minimizing risk if the server is compromised. This directly satisfies the requirement to isolate the public server from internal networks.

Answer

Place the server on the internal LAN with a strong firewall rule

Answer

Use a VLAN to logically separate the server

Answer

Connect the server directly to the internet without firewall

Question 7

Which of the following is an example of a physical control that supports the availability principle of the CIA triad?

Accepted Answer

Redundant servers. Availability ensures systems are accessible when needed. Redundant servers provide failover capability, minimizing downtime.

Answer

Data encryption

Answer

Biometric authentication

Answer

Digital signatures

Question 8

An employee receives an email from an unknown sender claiming to be from the IT department, asking for their password to perform an urgent system update. What type of social engineering attack is this?

Accepted Answer

Phishing. Phishing is a social engineering attack where an attacker sends a fraudulent email, often impersonating a trusted entity like the IT department, to trick the recipient into revealing sensitive information such as passwords. The scenario describes an email from an unknown sender claiming to be from IT and requesting a password, which is a classic phishing attempt. The other options involve physical or direct access tactics.

Answer

Tailgating

Answer

USB drop attack

Answer

Piggybacking

Question 9

A company's network uses 802.1X authentication for wired and wireless access. Which component authenticates the user credentials against an identity store?

Accepted Answer

Authentication server (RADIUS). In 802.1X, the authentication server (typically a RADIUS server) is the component that validates user credentials against an identity store such as LDAP, Active Directory, or a local database. The supplicant (client) provides credentials, the authenticator (switch or access point) relays EAP frames, but only the RADIUS server performs the actual authentication decision.

Answer

Supplicant

Answer

Authenticator

Answer

Access point

Question 10

A company's security operations center (SOC) receives an alert about suspicious outbound traffic from a server in the DMZ to an external IP address known for command-and-control activity. The SOC analyst reviews the logs and sees that the source port is 443 and the destination port is 8080. Which of the following actions should the analyst take FIRST?

Accepted Answer

Isolate the server from the network and investigate further. The SOC analyst should first isolate the server from the network because the outbound traffic from a DMZ server to a known C2 IP address, using source port 443 (HTTPS) to destination port 8080 (HTTP alternate), indicates a potential compromise. Isolating the server stops the data exfiltration and prevents further C2 communication, allowing for a controlled forensic investigation without alerting the attacker. This aligns with the NIST SP 800-61 incident response process, where containment is prioritized before eradication or recovery.

Answer

Notify the incident response team and management immediately

Answer

Block the external IP address at the firewall

Answer

Modify the firewall rule to deny all outbound traffic from the DMZ

Question 11

A company implements a new firewall and intrusion detection system to reduce the risk of network breaches. This is an example of:

Accepted Answer

Risk mitigation. Risk mitigation reduces the likelihood or impact of a threat by implementing controls; a firewall and IDS are detective and preventive controls that lower the probability and severity of a network breach without eliminating the risk entirely. This is the textbook definition of mitigation — the risk still exists but is reduced to an acceptable level.

Answer

Risk avoidance

Answer

Risk acceptance

Answer

Risk transfer

Question 12

An organization wants to implement network segmentation to improve security. Which three methods are commonly used for network segmentation? (Select THREE.)

Accepted Answer

Subnetting. Subnetting (A) is correct because dividing a larger IP network into smaller logical subnets using CIDR and subnet masks creates distinct broadcast domains and limits lateral movement between segments. DMZs (B) are correct because a demilitarized zone places internet-facing services such as web, mail, or DNS servers in a separate screened segment, isolating them from the internal trusted network. VLANs (D) are correct because IEEE 802.1Q VLANs logically segment a switched network at Layer 2, allowing departments or device groups to be separated without physical rewiring and enforcing traffic isolation via trunk and access port configuration. Firewalls (C) are not a segmentation method themselves; they are policy enforcement devices that control traffic between segments, so they are typically deployed to secure segmentation rather than create it. Intrusion Detection Systems (E) are monitoring tools that detect malicious activity and generate alerts, but they do not divide or isolate network segments.

Answer

Firewalls

Answer

Intrusion Detection Systems

Question 13

An organization is preparing its Business Continuity Plan (BCP). Which process identifies critical business functions and the impact of disruptions?

Accepted Answer

Business Impact Analysis (BIA). A Business Impact Analysis (BIA) identifies critical business functions, dependencies, and the impact of disruptions, providing metrics like MTD, RTO, and RPO.

Answer

Incident Response Plan (IRP)

Answer

Disaster Recovery Plan (DRP)

Answer

Risk Assessment

Question 14

Which THREE security mechanisms should be implemented to secure a network against ARP spoofing attacks? (Choose three.)

Accepted Answer

IP Source Guard. IP Source Guard (A) is correct because it uses DHCP snooping binding table entries to filter traffic on a per-port basis, dropping packets where the source IP address does not match the binding. This prevents an attacker from spoofing a legitimate host's IP address in ARP spoofing attacks by ensuring only valid IP-to-MAC mappings are allowed on the port.

Answer

Port security

Answer

MAC address filtering

Question 15

An organization requires that a financial transaction must be initiated by one employee and approved by a manager before processing. Which access control principle does this enforce?

Accepted Answer

Separation of duties. Separation of duties (SoD) is the principle that no single individual should have enough privileges to complete a sensitive transaction alone; it requires splitting critical tasks among multiple people. Here, one employee initiates and a different manager approves, which is the textbook definition of SoD. It prevents fraud and errors by ensuring collusion is needed to abuse the process.

Answer

Defense in depth

Answer

Least privilege

Answer

Need-to-know

Question 16

An organization wants to ensure that a critical database can be restored within 2 hours after a failure. Which metric should the organization define?

Accepted Answer

Recovery Time Objective (RTO). Recovery Time Objective (RTO) defines the maximum acceptable time to restore a system or service after a disruption. A requirement to restore a critical database within 2 hours is exactly an RTO. RTO drives backup, replication, and failover design decisions.

Answer

Maximum Tolerable Downtime (MTD)

Answer

Service Level Agreement (SLA)

Answer

Recovery Point Objective (RPO)

Question 17

During an incident, an organization needs to preserve volatile data. Which of the following should be collected FIRST?

Accepted Answer

Memory contents. Volatile data is lost when the system loses power. Memory content is the most volatile.

Answer

Backup tapes

Answer

Hard drive contents

Answer

Network logs

Question 18

Match each security policy type to its focus.

Accepted Answer

Acceptable Use Policy: Defines acceptable behavior for using organizational resources. The correct matches pair each policy type with its primary focus. Common confusions involve swapping definitions between similar policies, such as Acceptable Use with Access Control, or Incident Response with Data Retention.

Answer

Acceptable Use Policy: Defines rules for granting and revoking access to information systems

Answer

Incident Response Policy: Specifies how long data must be stored and when to dispose

Question 19

A security analyst is investigating a potential breach. The analyst discovers that an attacker gained access to a server by exploiting a known vulnerability that was not patched. The attacker then installed malware that encrypted critical files and demanded payment. Which of the following best describes the role of the unpatched vulnerability in this incident?

Accepted Answer

It is a weakness that was exploited by a threat.. The unpatched vulnerability is a weakness in the system that was exploited by a threat (the attacker). In risk management, a vulnerability is a flaw or gap that can be leveraged to compromise security. The threat is the actor or event that exploits the vulnerability, and the risk is the potential for loss. The impact is the resulting damage. Therefore, the vulnerability's role is that of a weakness exploited by a threat, making it the correct description.

Answer

It is the risk that materialized.

Answer

It is the impact of the security incident.

Answer

It is the threat that exploited the system.

Question 20

A security manager is advised to implement 'due care' in their organization. Which action best exemplifies due care?

Accepted Answer

Regularly updating antivirus software. Due care means taking reasonable steps to protect assets, such as implementing basic security controls like patch management.

Answer

Purchasing cyber insurance

Answer

Performing a background check on a new vendor

Answer

Accepting the risk of a legacy system