ISC2 CC Practice Test 31 — 15 Questions

Question 1

A financial services firm is redesigning its internal network after an incident in which malware spread from a compromised workstation to several unrelated departments. The security architect proposes dividing the flat network into smaller zones so that a future compromise stays contained. Which two measures best support this goal? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Applying the principle of least privilege to internal firewall rule sets and access control lists. Containment requires both breaking the flat network into isolated zones and restricting what traffic may cross between them. VLANs with firewall-enforced inter-VLAN rules provide the zones, while least-privilege ACLs and rule sets ensure that any permitted crossing is minimal, together limiting how far a single compromised workstation can spread.

Answer

Deploying a signature-based intrusion detection sensor on the core switch

Answer

Increasing the bandwidth of the internal network backbone between departments

Answer

Enabling dynamic host configuration protocol snooping on all access switches

Question 2

During an incident investigation, an analyst needs to determine which user account created a specific file on a shared drive at a particular time. The organization enables auditing on the file server. Which Windows event log should the analyst review?

Accepted Answer

The Security log, because object access auditing records file creation events there.. Attribution of file activity requires object access auditing, which writes events to the Security log when enabled through audit policy. Those events include the account, object name, and access type, which directly answers who created the file and when. The System, Application, and Setup logs serve other purposes and do not capture user file operations, so they cannot provide the needed evidence.

Answer

The Application log, because file operations are generated by applications writing to disk.

Answer

The Setup log, because it tracks changes to files installed by administrators.

Answer

The System log, because it records all file system changes performed by services and users.

Question 3

An organization implements a role-based access control (RBAC) system. To maintain the principle of least privilege, what should the administrator do when a user changes roles?

Accepted Answer

Remove the previous role's access and assign the new role's access.

Answer

Keep all access and let the manager manually remove as needed.

Answer

Use a single role for all users to simplify management.

Answer

Add the new role's access while keeping the previous role's access.

Question 4

A company's web server is experiencing a high volume of traffic from thousands of different IP addresses, causing service degradation. The security team determines it is a distributed denial-of-service (DDoS) attack. Which mitigation strategy is most effective for this scenario?

Accepted Answer

Use a cloud-based DDoS mitigation service.. A cloud-based DDoS mitigation service is specifically designed to absorb and filter large volumetric attacks by leveraging distributed scrubbing centers and high bandwidth. It can handle thousands of source IPs and protect the origin server without requiring on-premises hardware upgrades. This is the most effective and scalable solution for the described scenario.

Answer

Configure an intrusion prevention system (IPS) to block the attack.

Answer

Increase the web server's bandwidth and CPU resources.

Answer

Install a host-based firewall on the web server.

Question 5

A financial services firm wants to give remote employees encrypted access to internal trading applications without exposing those applications directly to the internet. The security team requires that only the remote client's traffic to specific internal resources is tunneled, and that the internal application servers never initiate connections back to the client. Which technology best meets these requirements?

Accepted Answer

A remote access VPN terminating on a VPN concentrator. Remote employees need an encrypted path into the internal network that they initiate, so internal servers never connect back to them. A remote access VPN terminated on a concentrator provides exactly this client-initiated tunnel and can be scoped to specific internal resources. Site-to-site tunnels, reverse proxies, and NAC address different problems and do not meet both stated constraints.

Answer

A network access control (NAC) solution

Answer

A reverse proxy published in the DMZ

Answer

A site-to-site IPsec tunnel between two data centers

Question 6

An employee receives an email that appears to be from the IT department, asking them to click a link and reset their password due to a security breach. The link leads to a website that looks identical to the company's login page. Which type of attack is this?

Accepted Answer

Phishing. The attack uses email to impersonate the IT department and lure the employee to a fake login page, which is the definition of phishing. While spear phishing and whaling are subsets, the scenario does not indicate a targeted or executive-focused attack, and vishing involves voice, not email.

Answer

Vishing

Answer

Whaling

Answer

Spear phishing

Question 7

An organization's business continuity plan (BCP) requires that its payroll system be operational within 8 hours of a disruption, but the system can tolerate losing up to 4 hours of payroll transaction data. Which pair of metrics BEST represents these two requirements?

Accepted Answer

RTO = 8 hours; RPO = 4 hours. The recovery time objective (RTO) is the maximum acceptable time to restore a system after disruption, so the 8-hour restoration requirement maps to RTO. The recovery point objective (RPO) is the maximum acceptable data loss expressed in time, so the 4-hour data-loss tolerance maps to RPO. These two metrics together define how quickly the payroll system must return and how much payroll data the organization can afford to lose.

Answer

RPO = 8 hours; MTD = 4 hours

Answer

RTO = 4 hours; RPO = 8 hours

Answer

MTD = 8 hours; RTO = 4 hours

Question 8

A security administrator is configuring a network tap to monitor traffic between two switches. The administrator needs to ensure that the monitoring device receives a copy of all traffic, including packets that might be dropped due to errors. Which type of tap should be used?

Accepted Answer

Passive tap. A passive tap splits the signal without regeneration, ensuring that all traffic, including errored packets, is copied to the monitoring port. Active and regenerating taps may filter or drop errored frames. For complete traffic capture, a passive tap is the correct choice.

Answer

Active tap

Answer

Regenerating tap

Answer

Aggregating tap

Question 9

A financial services firm suffers a ransomware outbreak that encrypts file servers and the backup catalog. The incident response team must decide the immediate next step while the attack is still spreading. Which action BEST aligns with the containment objective of the incident response plan?

Accepted Answer

Disconnect affected network segments and disable compromised accounts to stop lateral movement. Containment aims to stop an incident from spreading and to limit its damage. With ransomware actively propagating, isolating affected network segments and disabling compromised accounts halts lateral movement and preserves the environment for eradication and recovery. Restoring, notifying, or rebuilding before the threat is contained risks reinfection, destroys evidence, and expands the breach rather than limiting it.

Answer

Notify regulators and affected customers about the data breach before taking any technical action

Answer

Immediately restore encrypted file servers from the most recent offline backup to shorten downtime

Answer

Rebuild all servers from scratch using the original installation media and reapply the latest patches

Question 10

A company allows employees to connect to the corporate network from home using a VPN. The security team wants to ensure that a remote employee's device meets minimum security requirements, such as current antivirus and patched operating system, before granting access to internal applications. Which control should be implemented?

Accepted Answer

Network access control (NAC) with posture assessment. NAC with posture assessment checks the endpoint's security state before granting network access, which is exactly what is needed to enforce antivirus and patch requirements for remote VPN users. RBAC governs user permissions, MFA verifies identity, and disk encryption protects data at rest; none of them validate the device's health at connection time.

Answer

Multi-factor authentication (MFA) for VPN logins

Answer

Full-disk encryption on employee laptops

Answer

Role-based access control (RBAC) on internal applications

Question 11

An organization's BCP identifies a customer-facing order system as critical. The BIA shows the business can tolerate 12 hours of downtime and 1 hour of data loss. The current architecture uses nightly full backups to tape with a 10-hour restore time. Which change BEST closes the gap between current capability and the stated requirements?

Accepted Answer

Implement continuous replication to a secondary site with automated failover to meet the 12-hour RTO and 1-hour RPO. The stated requirements are a 12-hour RTO and a 1-hour RPO. Nightly tape backups with a 10-hour restore already meet the RTO but leave up to 24 hours of potential data loss, violating the RPO. Continuous replication to a secondary site with automated failover reduces data loss to minutes and restores service quickly, satisfying both the recovery point and recovery time objectives in one architectural change.

Answer

Document a manual workaround in the BCP that allows order entry staff to record transactions on paper until systems return

Answer

Increase backup frequency to every hour while keeping the nightly tape full backup and 10-hour restore process

Answer

Move backups from tape to disk to reduce restore time, keeping the nightly full backup schedule

Question 12

A software company allows developers to work from home and connect to internal code repositories over the internet. The security team wants to verify the identity of each developer and the health of their device before granting access, without exposing the repositories directly to the internet. Which solution should the team implement?

Accepted Answer

Deploy a remote access VPN that authenticates users and then performs a posture check before allowing access to the repository subnet.. A remote access VPN authenticates each developer and can enforce a posture check that verifies device health before allowing access to internal repositories. The repositories stay on an internal subnet and are not published to the internet. A reverse proxy with basic authentication, a site-to-site tunnel to home routers, and a jump host without device checks each fail at least one requirement.

Answer

Expose the repositories through a jump host with SSH key authentication and no device checks.

Answer

Use a site-to-site IPsec tunnel between each developer's home router and the corporate gateway.

Answer

Publish the code repositories through a reverse proxy with HTTP basic authentication.

Question 13

A security auditor discovers that a user's account has been granted full access to all financial databases, even though the user only needs to view quarterly reports. Which access control principle has been violated most directly?

Accepted Answer

Least privilege. Least privilege requires granting only the minimum permissions necessary to perform job functions.

Answer

Separation of duties

Answer

Need-to-know

Answer

Defense in depth

Question 14

Which principle of the CIA triad ensures that data is not disclosed to unauthorized individuals?

Accepted Answer

Confidentiality. Confidentiality is the CIA triad principle that ensures information is not disclosed to unauthorized individuals, systems, or processes. It is enforced through encryption, access controls, and data classification. Authentication verifies identity but does not itself guarantee confidentiality, and integrity and availability address different properties.

Answer

Authentication

Answer

Integrity

Answer

Availability

Question 15

A small company with 50 employees uses a flat network with no VLANs. They recently experienced a ransomware attack that spread from an infected workstation to a file server. The IT manager wants to implement network segmentation to prevent future lateral movement. The company uses a single /24 subnet (192.168.1.0/24) with a single switch and a router/firewall. They have three departments: Sales, HR, and IT. Each department has about 15-20 computers. The file server is in the IT department. The company has a limited budget and cannot purchase new hardware. Which of the following is the MOST effective and practical approach to segment the network given these constraints?

Accepted Answer

Create three VLANs on the switch, one for each department, and configure ACLs on the router to allow only necessary inter-VLAN traffic.. Creating three VLANs on the existing switch segments the flat /24 network into separate broadcast domains, preventing lateral movement by default. Configuring ACLs on the router allows only necessary inter-VLAN traffic (e.g., Sales and HR can access the file server in IT), which stops the ransomware from spreading across departments without requiring new hardware.

Answer

Replace the switch with three separate physical switches, each connected to a separate router interface.

Answer

Implement MAC address filtering on the switch to only allow authorized devices to communicate with the file server.

Answer

Install a software firewall on each workstation to block traffic from other subnets.