ISC2 CC Practice Test 2 — 30 Questions

Question 1

A company's SIEM solution aggregates logs from various sources and generates an alert when multiple failed logins occur within a short timeframe. Which log source is most likely to provide the data for this alert?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Authentication logs. Authentication logs record login attempts, including failures, and are the primary source for detecting brute-force attacks.

Answer

System logs

Answer

Firewall logs

Answer

Application logs

Question 2

During a forensic investigation, it is crucial to preserve the original evidence. What is the first step the investigator should take when acquiring a hard drive?

Accepted Answer

Create a forensic image using a write blocker. Creating a bit-for-bit forensic image using a write blocker preserves the original evidence. Option D (calculate the hash) is done after imaging to verify integrity. Option A (booting the drive) would modify data and compromise the evidence. Option B (turning off the computer and removing the hard drive) may be necessary but is not the first step in acquisition; the first step is to create a forensic image with a write blocker.

Answer

Boot the drive to check for operating system errors

Answer

Turn off the computer and remove the hard drive

Answer

Calculate the hash of the original drive

Question 3

A company's security policy requires that all sensitive data be encrypted both at rest and in transit. This is an example of applying which security principle?

Accepted Answer

Defense in depth

Answer

Separation of duties

Answer

Need to know

Answer

Least privilege

Question 4

An organization's BIA determines that the payroll system has a Maximum Tolerable Downtime (MTD) of 4 hours. The current recovery plan has an RTO of 2 hours and an RPO of 1 hour. What is the maximum Work Recovery Time (WRT) allowed to meet the MTD?

Accepted Answer

2 hours. MTD = RTO + WRT. Given MTD=4, RTO=2, so WRT ≤ 2 hours.

Answer

3 hours

Answer

4 hours

Answer

1 hour

Question 5

During an incident, the incident response team discovers that an attacker has exfiltrated sensitive customer data. According to incident response best practices, whose approval is REQUIRED before contacting law enforcement?

Accepted Answer

Legal counsel. Legal counsel approval is required before contacting law enforcement because they ensure that the disclosure complies with data privacy laws (e.g., GDPR, CCPA) and does not violate chain-of-custody requirements or expose the organization to liability. The incident response team must coordinate with legal to determine the appropriate timing and scope of law enforcement involvement, as premature contact can compromise ongoing forensic investigations or breach legal agreements.

Answer

CISO

Answer

CEO

Answer

Public relations

Question 6

A multinational corporation has a policy that all sensitive emails must be digitally signed and encrypted. However, during a recent internal audit, it was discovered that many employees were not using digital signatures because the process was cumbersome. As a result, the company could not prove that certain emails were actually sent by the claimed sender. The security team needs to improve compliance without sacrificing security. Which of the following is the best approach?

Accepted Answer

Integrate the signing process seamlessly into the email client to reduce friction.. Integrating the signing process seamlessly into the email client reduces friction and increases compliance while maintaining security. Training alone does not address the cumbersome process, reducing encryption strength weakens security, and allowing personal certificates complicates management.

Answer

Implement a mandatory training program emphasizing the importance of digital signatures.

Answer

Reduce the encryption strength to speed up the signing process.

Answer

Allow employees to use personal signing certificates.

Question 7

A small business has a single server that hosts critical applications. The server's hard drive fails, and the most recent backup is 3 days old. The backup is stored on an external drive that is kept in the same room as the server. The server is also the domain controller and file server. After replacing the drive and restoring from backup, the IT administrator discovers that some user files are missing because they were created after the backup. The administrator needs to minimize data loss in the future. Which of the following should be implemented?

Accepted Answer

Use a cloud-based backup solution.. A cloud-based backup solution automatically stores backups offsite, ensuring that even if the local site is compromised or the backup drive fails, recent data is recoverable. This minimizes data loss by enabling more frequent backups (e.g., hourly or continuous) without relying on manual intervention or physical media rotation, directly addressing the 3-day gap in the scenario.

Answer

Perform daily backups and store them offsite.

Answer

Implement RAID 1 for disk redundancy.

Answer

Enable versioning on the file server.

Question 8

In a directory service like Active Directory, which component is used to organize users, groups, and computers into a hierarchical structure for applying policies?

Accepted Answer

Organizational Units (OUs). Organizational Units (OUs) are containers in Active Directory that allow hierarchical organization and Group Policy application.

Answer

Group Policy Objects (GPOs)

Answer

Domain controllers

Answer

LDAP

Question 9

A company experiences a data breach where customer PII was exfiltrated. The incident response team contains the breach and restores systems. Which step in the risk management process should the company prioritize next to prevent recurrence?

Accepted Answer

Risk mitigation. After an incident, risk treatment involves implementing controls to reduce risk. Risk identification already occurred.

Answer

Risk communication

Answer

Risk assessment

Answer

Risk identification

Question 10

Based on the exhibit, what is the most likely result of the client's HTTP request?

Accepted Answer

The HTTP request is blocked, but other traffic from the client is allowed.. The exhibit shows an extended ACL applied inbound on the client's interface that denies TCP traffic from the client to the server on port 80 (HTTP) but permits all other IP traffic. Therefore, the HTTP request is blocked, but any other traffic from the client (e.g., DNS, ICMP) is allowed. Option D correctly states that the HTTP request is blocked but other traffic is allowed.

Answer

The HTTP request is permitted because the ACL is applied to the wrong interface.

Answer

The HTTP request is permitted because the ACL only blocks traffic from the router's own IP.

Answer

The HTTP request is blocked, and all other traffic from the client is also blocked.

Question 11

A company's critical database must be recovered within 4 hours after a disaster, and they can tolerate losing up to 1 hour of data. During a disaster, after the systems are restored, it takes an additional 30 minutes to verify data integrity and resume normal operations. Which metric is represented by the 4-hour requirement?

Accepted Answer

Recovery Time Objective (RTO). Recovery Time Objective (RTO) is the maximum acceptable time to restore systems and data after a disaster.

Answer

Maximum Tolerable Downtime (MTD)

Answer

Recovery Point Objective (RPO)

Answer

Work Recovery Time (WRT)

Question 12

A financial services company is conducting a Business Impact Analysis (BIA) for its online banking platform. Which THREE of the following are correctly defined metrics used in BIA?

Accepted Answer

Recovery Time Objective (RTO) – the maximum amount of time to restore a business function after a disruption.. In BIA, Recovery Time Objective (RTO) is the maximum time allowed to recover systems after a disaster, Maximum Tolerable Downtime (MTD) is the total time a business function can be unavailable before causing irreparable harm, and Recovery Point Objective (RPO) is the maximum acceptable data loss measured in time. All three are correctly defined BIA metrics. Service Level Agreement (SLA) is a contractual term, not a BIA metric. Annualized Loss Expectancy (ALE) is a risk assessment metric, not specifically part of BIA.

Answer

Service Level Agreement (SLA) – the contractual uptime percentage guaranteed to customers.

Answer

Annualized Loss Expectancy (ALE) – the expected monetary loss per year from a risk.

Question 13

A hospital uses role-based access control (RBAC) for its electronic health records. Nurses can view patient records; doctors can view and edit; administrators can only view administrative data. Recently, a nurse was able to edit a patient's record, which should only be allowed for doctors. The investigation finds that the nurse's role was incorrectly assigned a 'doctor' role due to a misconfiguration. To prevent recurrence, the access control system should be reviewed. Which is the best long-term solution?

Accepted Answer

Conduct quarterly role reviews and recertification. The root cause is a role misconfiguration, and the best long-term solution is to implement a process of periodic role reviews and recertification. This ensures that role assignments are regularly audited and validated against current job responsibilities, preventing role creep and unauthorized privilege accumulation. In RBAC, the principle of least privilege is maintained through ongoing governance, not through a one-time fix.

Answer

Implement mandatory access control (MAC) with security labels

Answer

Remove the nurse's ability to edit records

Answer

Implement user behavior analytics to detect anomalies

Question 14

Which of the following is the best practice for managing cryptographic keys in a large organization?

Accepted Answer

Store keys in a centralized hardware security module (HSM) with strict access controls.. A centralized Hardware Security Module (HSM) provides tamper-resistant, dedicated hardware for secure key generation, storage, and cryptographic operations. Strict access controls (e.g., role-based access, multi-factor authentication) ensure that only authorized personnel can manage keys, while the HSM prevents key extraction even if the host system is compromised. This aligns with NIST SP 800-57 guidelines for key management in large organizations.

Answer

Embed keys in application code to ensure availability.

Answer

Distribute keys to administrators via email for convenience.

Answer

Use a single key for all encryption to simplify management.

Question 15

Refer to the exhibit.
```
-rw-r-x--- 1 user1 developers 1024 Apr 12 10:00 config.cfg
```
The security policy states that only the file owner (user1) and members of the developers group should be able to read the file. Which change is necessary to align with the principle of least privilege?

Accepted Answer

Change the file mode to 640.

Answer

Add world read permission.

Answer

Change group permissions to rw-r--.

Answer

Change the owner to user2.

Question 16

Which THREE of the following are considered risk management strategies? (Select THREE)

Accepted Answer

Risk acceptance. Risk management strategies include acceptance, mitigation, transfer, and avoidance. Acceptance, mitigation, and transfer are correct.

Answer

Risk assessment

Answer

Risk analysis

Question 17

An organization is adopting the 3-2-1 backup rule. They currently have data on a primary server and a daily backup to an external hard drive. To comply with the rule, what is the minimum additional requirement?

Accepted Answer

A cloud backup stored offsite. 3-2-1 rule: 3 copies, 2 different media, 1 offsite. They have 2 copies on 1 media (hard drive). Need a third copy on different media and offsite.

Answer

A second external hard drive stored on-site

Answer

An incremental backup to a network share

Answer

A full backup on tape stored in the same room

Question 18

During an incident, the IR team identifies that the root cause is a zero-day vulnerability. Which of the following is the best immediate action?

Accepted Answer

Implement compensating controls. When a zero-day vulnerability is the root cause, no vendor patch exists yet (option C is impossible). Rebuilding systems (option B) without addressing the vulnerability leaves them re-exposed. The best immediate action is to implement compensating controls—such as firewall rules, IDS/IPS signatures, or application-layer filtering—to mitigate the risk until a permanent fix is available. This aligns with incident response containment strategies that prioritize reducing impact while preserving forensic evidence.

Answer

Report to CERT/CC

Answer

Rebuild all affected systems

Answer

Apply a vendor patch

Question 19

After a major power outage, an organization needs to declare a disaster and activate its DRP. Which THREE elements should be included in the initial crisis communication?

Accepted Answer

A statement that a disaster has been declared. Initial communication should confirm the disaster, provide initial instructions, and outline next steps without revealing sensitive details.

Answer

Details of the vulnerability exploited

Answer

Names of affected customers

Question 20

An organization's backup strategy includes daily full backups. However, recovery tests show that restoring from tape takes 6 hours longer than expected. What is the most likely cause?

Accepted Answer

Improperly documented recovery procedures. Improperly documented recovery procedures can lead to incorrect steps or delays during restoration, which is a common cause of extended recovery times.

Answer

Tape drive failure

Answer

Inadequate storage capacity

Answer

Insufficient bandwidth