ISC2 CC Practice Test 31 — 15 Questions

Question 1

An organization experiences intermittent network outages. The security team notices that the ARP cache on several switches has entries pointing to an unknown MAC address for the default gateway. Which attack is most likely occurring?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ARP spoofing. ARP spoofing (or ARP poisoning) involves sending forged ARP messages to associate the attacker's MAC with the IP of the default gateway, causing traffic to be misrouted. This can lead to man-in-the-middle attacks or denial of service.

Answer

DNS poisoning

Answer

IP spoofing

Answer

MAC flooding

Question 2

A security administrator is configuring user permissions and wants to ensure that each user has only the access rights necessary to perform their job. Which principle is being applied?

Accepted Answer

Least privilege. Least privilege means granting only the minimum permissions needed for a user to perform their job, reducing the potential impact of a compromised account.

Answer

Separation of duties

Answer

Need to know

Answer

Defense in depth

Question 3

In a defense-in-depth strategy, which access control mechanism provides the most granular control over user permissions?

Accepted Answer

Access control lists (ACLs) on files. Access control lists (ACLs) on files provide the most granular control because they allow permissions to be set at the individual file or object level, specifying exactly which users or groups can read, write, execute, or modify that specific resource. This is in contrast to broader mechanisms like network segmentation or firewall rules, which operate at the network or subnet level and cannot distinguish between individual files within a system. ACLs are a fundamental component of discretionary access control (DAC) and are implemented in file systems such as NTFS, ext4, and ZFS.

Answer

Network segmentation

Answer

Physical security controls

Answer

Firewall rules

Question 4

An organization wants to implement a system that enforces access decisions based on a user's attributes (e.g., department, clearance, time) and environmental conditions. Which model is best?

Accepted Answer

Attribute-based access control (ABAC). Attribute-based access control (ABAC) is the correct model because it evaluates access decisions based on a combination of user attributes (e.g., department, clearance), resource attributes, and environmental conditions (e.g., time of day, location). Unlike RBAC, which relies solely on predefined roles, ABAC uses policies that can incorporate dynamic factors like current time or threat level, making it ideal for fine-grained, context-aware enforcement.

Answer

Role-based access control (RBAC)

Answer

Discretionary access control (DAC)

Answer

Mandatory access control (MAC)

Question 5

Which protocol is considered insecure because it transmits data, including passwords, in cleartext, and its use should be avoided in favor of more secure alternatives?

Accepted Answer

Telnet. Telnet (port 23) transmits data in cleartext. SSH is its secure replacement.

Answer

SSH

Answer

SFTP

Answer

HTTPS

Question 6

An organization is planning to deploy a DMZ to host web and email servers accessible from the internet. Which three security best practices should be implemented for the DMZ? (Choose three.)

Accepted Answer

Use a separate VLAN for DMZ servers to isolate traffic. Firewalls on both sides, strict access rules, and separate VLANs are best practices. Direct internal access and single firewall are not recommended.

Answer

Use a single firewall to connect internet, DMZ, and internal network

Answer

Allow all traffic from the DMZ to the internal network for ease of management

Question 7

You are a security analyst at a mid-sized financial firm. The company has a policy that all remote access must be secured using a VPN. Recently, an employee reported that they were able to connect to the internal network from a coffee shop without using the VPN client. The employee accidentally left the client running but it was not authenticating. Upon investigation, you find that the network administrator had configured a rule on the firewall to allow RDP traffic from any public IP to a specific internal server for maintenance purposes. The rule was supposed to be temporary but was never removed. The server contains sensitive customer data. The incident has been reported to management. Which of the following is the most immediate corrective action you should take?

Accepted Answer

Remove the temporary firewall rule that allows RDP from any public IP. The most immediate corrective action is to remove the temporary firewall rule that allows RDP from any public IP. This directly closes the unauthorized access path and mitigates the risk of data exposure. Option B is too broad; disabling RDP on all servers would disrupt legitimate maintenance activities and is not necessary since only one rule is at fault. Option C, while important, is not immediate; conducting a full audit takes time and does not instantly remove the vulnerability. Option D is a long-term preventive measure and does not address the immediate security gap.

Answer

Disable RDP access on all servers

Answer

Conduct a full audit of all firewall rules

Answer

Implement a security awareness training program for all employees

Question 8

A system administrator implements version control for all configuration files. Which principle is being strengthened?

Accepted Answer

Integrity. Version control helps ensure data accuracy and prevents unauthorized changes, supporting integrity.

Answer

Availability

Answer

Confidentiality

Answer

Accountability

Question 9

Which three ports are commonly used by secure protocols? (Choose THREE.)

Accepted Answer

443 (HTTPS). HTTPS uses 443, SSH uses 22, and LDAPS uses 636. HTTP (80), Telnet (23), and FTP (21) are insecure or unencrypted.

Answer

80 (HTTP)

Answer

23 (Telnet)

Question 10

Refer to the exhibit. Based on the exhibit, which traffic will be permitted?

Accepted Answer

HTTP traffic from any source to 192.168.1.100. The exhibit shows an access control list (ACL) that permits TCP traffic from any source to destination host 192.168.1.100 on port 80 (HTTP). The ACL entry is `permit tcp any host 192.168.1.100 eq 80`, which matches only HTTP traffic. Therefore, only HTTP traffic from any source to 192.168.1.100 is permitted.

Answer

All traffic from 192.168.1.100

Answer

All traffic from 10.0.1.0/24

Answer

SSH traffic from any source to 192.168.1.100

Question 11

An organization is preparing its Business Continuity Plan (BCP). Which process identifies critical business functions and the impact of disruptions?

Accepted Answer

Business Impact Analysis (BIA). A Business Impact Analysis (BIA) identifies critical business functions, dependencies, and the impact of disruptions, providing metrics like MTD, RTO, and RPO.

Answer

Incident Response Plan (IRP)

Answer

Disaster Recovery Plan (DRP)

Answer

Risk Assessment

Question 12

An administrator configures a Group Policy Object (GPO) in Active Directory to enforce account lockout after 5 failed attempts within 15 minutes. Which type of control is this?

Accepted Answer

Logical access control. Logical access controls are software-based mechanisms that govern access to systems. Account lockout policies are logical controls.

Answer

Administrative access control

Answer

Compensating control

Answer

Physical access control

Question 13

A security architect is designing a system that must ensure that a sender cannot later deny having sent a message. Which cryptographic mechanism should be implemented?

Accepted Answer

Digital signatures. Digital signatures provide non-repudiation by binding the sender's identity to the message using public key cryptography. The sender cannot deny because only they possess the private key used to sign.

Answer

Symmetric encryption

Answer

Access control lists

Answer

Hashing

Question 14

Which THREE of the following are acceptable risk treatment options according to NIST risk management framework?

Accepted Answer

Risk mitigation. Risk avoidance, mitigation, transfer, and acceptance are standard. Risk identification is a step, not treatment. Risk duplication is not a term.

Answer

Risk duplication

Answer

Risk identification

Question 15

Match each access control model to its key characteristic.

Accepted Answer

DAC: Access decisions are based on the identity of the user and are at the discretion of the resource owner.. In the ISC2 CC exam, the three main access control models are DAC, MAC, and RBAC. DAC allows resource owners to control access, MAC uses labels and clearances, and RBAC uses roles.

Answer

DAC: Access decisions are based on security labels and clearance levels.

Answer

MAC: Access decisions are based on the roles assigned to users.