ISC2 CC Practice Test 32 — 15 Questions

Question 1

An organization wants to ensure that data remains unaltered during transmission over the internet. Which security goal is being addressed?

Accepted Answer

Integrity. Integrity ensures that data is not altered during transmission, typically verified through cryptographic hash functions (e.g., SHA-256) or message authentication codes (MACs) such as HMAC. Protocols like TLS use integrity checks to detect any unauthorized modification of packets in transit, directly addressing the requirement that data remains unaltered.

Answer

Non-repudiation

Answer

Availability

Answer

Confidentiality

Question 2

Which of the following is an example of Type 2 authentication?

Accepted Answer

Smart card. Type 2 authentication, also called 'something you have,' relies on a physical object the user possesses — a smart card is the classic example. Type 1 is 'something you know' (password, PIN), Type 2 is 'something you have' (smart card, token, phone), and Type 3 is 'something you are' (biometrics). The smart card fits Type 2 precisely.

Answer

Fingerprint scan

Answer

Password

Answer

Question 3

An organization is evaluating a new vendor that will process customer data. The security team performs a thorough assessment of the vendor's security controls and background checks. This process best demonstrates:

Accepted Answer

Due diligence. Due diligence is the ongoing process of investigation, assessment, and verification — performing a thorough security assessment and background checks on a vendor before engaging them is the textbook definition of exercising due diligence. It demonstrates that the organization took reasonable steps to understand and evaluate the risks involved. Due care, by contrast, is the ongoing action of maintaining that standard once the relationship exists.

Answer

Risk acceptance

Answer

Risk transfer

Answer

Due care

Question 4

A financial institution requires that no single employee can both initiate and approve a wire transfer. This policy enforces which security principle?

Accepted Answer

Separation of duties. Separation of duties is the security principle that requires multiple individuals to complete a task to prevent fraud and errors. By ensuring no single employee can both initiate and approve a wire transfer, the institution enforces this principle, reducing the risk of unauthorized transactions.

Answer

Defense in depth

Answer

Least privilege

Answer

Need to know

Question 5

Refer to the exhibit. The IDS alert indicates a possible SpyEye botnet check-in from an internal host. What immediate action should the analyst take?

Accepted Answer

Isolate the internal host from the network. Isolating the internal host immediately stops the potential command-and-control (C2) communication with the SpyEye botnet, preventing data exfiltration or further compromise. This is the first step in incident response (containment) before any forensic analysis or remediation, as per NIST SP 800-61 guidelines. Delaying containment could allow the botnet to receive new instructions or spread laterally.

Answer

Ignore the alert as it is a false positive

Answer

Block the destination IP at the firewall

Answer

Run a full antivirus scan on the internal host

Question 6

A healthcare organization experiences a ransomware attack that encrypts all files on file servers and workstations. The incident response team has isolated the infected systems. The backup policy includes daily incremental backups and weekly full backups stored on a separate network segment. The most recent full backup is 5 days old. The incremental backups from the past 4 days are available but are stored on the same backup server that might be compromised. To restore data with minimal loss, what should the team do?

Accepted Answer

First verify the integrity of the backups by scanning them on an isolated system, then restore the full backup and apply the most recent clean incremental backups.. The correct approach is to verify backup integrity on an isolated system before restoring, because the backup server may be compromised by the same ransomware. Once verified clean, the team restores the weekly full backup and then applies the most recent clean incremental backups to minimize data loss. This balances recovery point objective (RPO) with security assurance.

Answer

Use the most recent incremental backup to restore files directly.

Answer

Assume all backups are compromised and rebuild systems from scratch.

Answer

Restore the weekly full backup and then apply all incremental backups from the past 5 days.

Question 7

An organization uses a digital signature to verify the authenticity of a software update. This supports which part of the CIA triad?

Accepted Answer

Integrity. A digital signature provides integrity by using a hash of the message encrypted with the sender's private key; the recipient decrypts the hash with the public key and compares it to a freshly computed hash. If the values match, the data has not been altered. While digital signatures also provide authentication and non-repudiation, the question asks which CIA triad element is supported — integrity is the correct CIA component.

Answer

Non-repudiation

Answer

Availability

Answer

Confidentiality

Question 8

A security analyst wants to detect malicious traffic on the network without affecting performance. Which type of device should be deployed?

Accepted Answer

IDS. An IDS (Intrusion Detection System) monitors network traffic passively, typically via a SPAN port or network TAP, and generates alerts on suspicious activity without blocking traffic. Because it operates out-of-band and does not sit inline, it does not affect network performance or latency — exactly matching the requirement to detect without impacting performance.

Answer

Honeypot

Answer

IPS

Answer

Firewall

Question 9

In the identification and authentication process, which step occurs first?

Accepted Answer

Identification. Identification is the first step because the user must claim an identity (e.g., username) before the system can authenticate it. Authentication verifies that claim, authorization determines what the user can do, and accounting logs the activity — all of which depend on identification occurring first.

Answer

Accounting

Answer

Authentication

Answer

Authorization

Question 10

A network administrator is troubleshooting connectivity issues and notices that frames are being dropped due to excessive collisions. Which OSI layer is most directly associated with this issue?

Accepted Answer

Data Link. Excessive collisions are a Layer 2 (Data Link) phenomenon because CSMA/CD and collision detection operate at the MAC sublayer of the Data Link layer. When two stations transmit simultaneously on a shared Ethernet segment, their frames collide, and the Data Link layer handles retransmission and backoff. The Physical layer deals with the electrical/optical signalling itself, not collision semantics.

Answer

Physical

Answer

Network

Answer

Transport

Question 11

A security analyst receives an alert of unusual network traffic from an internal host to an external IP known for command-and-control. After isolating the host, what should be the next step?

Accepted Answer

Preserve forensic evidence and analyze. Preserving forensic evidence and analyzing the host is the correct next step because incident response methodology (e.g., NIST SP 800-61) requires containment followed by evidence collection and analysis to determine the scope of compromise, identify indicators of compromise (IOCs), and understand the attack vector. Wiping or reimaging destroys volatile data (e.g., memory, running processes, network connections) and artifacts (e.g., registry keys, prefetch files, event logs) that are critical for attribution and remediation. Analysis may involve memory forensics (using tools like Volatility) and disk forensics to extract malware samples, C2 communication logs, and lateral movement traces.

Answer

Wipe the host and reinstall OS

Answer

Reimage the host from backup

Answer

Notify law enforcement

Question 12

Which type of access control is implemented by a cable lock attached to a laptop?

Accepted Answer

Physical access control. A cable lock physically tethers the laptop to a fixed object, preventing theft or physical removal of the device. Because it restricts physical contact with and movement of the asset rather than controlling logical system access, it is classified as a physical access control. Physical controls are one of the three main categories (alongside administrative and technical/logical) in the (ISC)² access control taxonomy.

Answer

Administrative access control

Answer

Logical access control

Answer

Technical access control

Question 13

A security engineer is configuring a network security device that can block malicious HTTP requests based on application-layer inspection. Which device type is most suitable?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) operates at the application layer (Layer 7) and is specifically designed to inspect HTTP/HTTPS traffic, blocking malicious requests such as SQL injection, cross-site scripting (XSS), and other OWASP Top 10 attacks. It understands HTTP semantics like headers, cookies, methods, and payloads, making it the right tool for application-layer request filtering.

Answer

Intrusion Prevention System (IPS)

Answer

Network-based Intrusion Detection System (NIDS)

Answer

Stateful firewall

Question 14

A company's physical security includes fencing, security guards, access badges, and biometric locks on server room doors. This layered approach is an example of which access control concept?

Accepted Answer

Defense in depth. Defense in depth is the practice of layering multiple independent security controls so that if one fails, others still protect the asset. Fencing, guards, badges, and biometric locks each represent a different layer (perimeter, personnel, logical/physical entry, and biometric), and together they create overlapping protection for the server room. This layered approach is the defining characteristic of defense in depth.

Answer

Least privilege

Answer

Need-to-know

Answer

Separation of duties

Question 15

An organization is planning to implement a security operations center (SOC) and is considering different monitoring strategies. Which THREE of the following are essential components of a tiered SOC model? (Choose three.)

Accepted Answer

Tier 2 analysts who conduct in-depth analysis and incident response. The tiered SOC model is built around escalating analyst responsibilities, so option D is correct because Tier 1 analysts are the first line of defense, continuously monitoring SIEM alerts and performing initial triage to filter false positives before escalation. Option C is correct because Tier 2 analysts take escalated incidents, conduct in-depth analysis, correlate events across multiple data sources, and drive the incident response process. Option E is correct because Tier 3 analysts handle the most complex work, including proactive threat hunting, advanced digital forensics, and malware reverse engineering, often feeding new detection logic back to lower tiers. Options A and B are not essential components of the tiered analyst structure itself: a SOC manager is an administrative/leadership role rather than a tier, and a dedicated threat intelligence team is a supporting function that may be separate from or feed into the tiered model.

Answer

A SOC manager who oversees daily operations and reporting

Answer

A dedicated threat intelligence team that provides context on indicators