ISC2 CC Practice Test 32 — 15 Questions

Question 1

A software developer is designing a web application that will store user credentials. What is the most secure method for storing passwords?

Accepted Answer

Hash passwords using a strong algorithm like bcrypt with a unique salt. Hashing with salt protects passwords even if database is compromised. Encryption is reversible, so less secure for passwords.

Answer

Use a tokenization service to replace passwords with tokens

Answer

Encrypt passwords using AES-256 and store the key separately

Answer

Store passwords in a secure database with access controls

Question 2

A network administrator configures the ACL on a router as shown. What is the effect of this access list?

Accepted Answer

Blocks Telnet traffic entering the interface, but allows all other traffic. The ACL denies TCP traffic to port 23 (Telnet) and permits all other IP traffic. Option B is wrong because SSH is port 22. Option C is wrong because the ACL is applied inbound on Gig0/1, so it filters incoming traffic only, not outgoing. Option D is wrong because it applies to all TCP traffic, not just Telnet.

Answer

Blocks SSH traffic (port 22) from entering the interface

Answer

Blocks Telnet traffic leaving the interface, but allows all other traffic

Answer

Blocks all TCP traffic except Telnet

Question 3

Refer to the exhibit. Which security control is MOST likely triggered?

Accepted Answer

Account lockout policy. The log shows an account lockout after multiple failed authentication attempts, indicating an account lockout policy is in effect.

Answer

Intrusion prevention system

Answer

Antivirus software

Answer

Firewall rule

Question 4

During a security audit, it is discovered that a single administrator can create user accounts, assign privileges, and review audit logs. Which principle is most likely being violated?

Accepted Answer

Separation of duties. Separation of duties requires that conflicting critical tasks be performed by different individuals to prevent fraud or error. The administrator has both operational and oversight roles, violating this principle.

Answer

Least privilege

Answer

Need to know

Answer

Defense in depth

Question 5

An organization is designing a security architecture for a cloud-based application. They implement firewalls, intrusion detection systems, and encryption, and also conduct regular security awareness training. This approach demonstrates which security principle?

Accepted Answer

Defense in depth. Defense in depth uses multiple layered controls. The combination of technical and administrative controls is key.

Answer

Security through obscurity

Answer

Least privilege

Answer

Separation of duties

Question 6

A SOC team is reviewing security controls for a new critical application. Which THREE of the following are essential components of a security operations capability?

Accepted Answer

SIEM for log aggregation and alerting. SIEM, patch management, and configuration management are all core security operations functions. Backup management, while important, is not typically a SOC function.

Answer

Vulnerability scanning tools

Answer

Data backup and recovery procedures

Question 7

Which TWO of the following are core principles of the CIA triad?

Accepted Answer

Integrity. The CIA triad consists of Confidentiality, Integrity, and Availability. Options A and C are correct. Option B (Non-repudiation) is separate. Option D (Authentication) is separate. Option E (Authorization) is separate.

Answer

Non-repudiation

Answer

Authorization

Answer

Authentication

Question 8

Refer to the exhibit. A user from IP 10.0.1.5 attempts to download an object from example-bucket. What will happen?

Accepted Answer

Denied because the deny statement overrides. The policy includes both an allow for the 10.0.0.0/16 range and a more specific deny for the 10.0.1.0/24 subnet. Since 10.0.1.5 falls within the deny condition, the explicit deny overrides the allow, resulting in denied access.

Answer

Access denied due to implicit deny

Answer

Allowed because the allow statement matches

Answer

Allowed because the deny statement is invalid

Question 9

An organization's backup strategy includes daily full backups and hourly incremental backups. During a restoration, they discover that a critical file was corrupted 6 hours ago. Which backup set is required for the restoration?

Accepted Answer

The most recent full backup plus the incremental backups from the last 6 hours.. Restoring a file that was corrupted 6 hours ago requires the most recent full backup as the base, plus all incremental backups taken in the last 6 hours. Incremental backups only store changes since the last backup (full or incremental), so to reconstruct the file as it existed 6 hours ago, you need the full backup and every incremental backup from that point forward until the corruption time. Without all those increments, the file state cannot be fully reconstructed.

Answer

The most recent incremental backup only.

Answer

The most recent full backup only.

Answer

The most recent full backup plus all incremental backups since.

Question 10

You are a security analyst investigating a potential insider threat incident. An employee from the finance department has been behaving suspiciously: printing large volumes of sensitive financial reports, accessing files outside their normal work hours, and attempting to bypass the company's data loss prevention (DLP) controls by renaming files before emailing them. The employee has been with the company for 10 years and has a clean record. The company's policy requires that any investigation be conducted discreetly to avoid alerting the employee. You need to gather evidence to confirm or refute the suspicion. Which of the following actions should you take FIRST?

Accepted Answer

Review the employee's system logs and DLP alerts in detail to establish a pattern.. The first step in any insider threat investigation is to gather and analyze available evidence discreetly, as required by policy. Reviewing system logs (e.g., Windows Event Logs, file server audit logs) and DLP alerts allows you to establish a behavioral pattern—such as anomalous access times, file rename operations, and email attachments—without alerting the employee. This evidence-based approach ensures you can confirm or refute the suspicion before taking any disruptive or confrontational actions.

Answer

Confront the employee directly to ask for an explanation.

Answer

Disable the employee's network access immediately to prevent data exfiltration.

Answer

Notify the employee's manager about the suspicion.

Question 11

A system administrator runs `iptables -L INPUT` and sees this rule. What is the immediate effect on the system?

Accepted Answer

New SSH connections are blocked, but current SSH sessions remain active.. The rule drops all new TCP connections to port 22 (SSH) from any source, preventing new SSH connections.

Answer

All SSH traffic is blocked, including established sessions.

Answer

The rule has no effect because the policy is ACCEPT.

Answer

All outbound SSH connections are blocked.

Question 12

A company's security policy states that sensitive data must be encrypted using AES-256. During an audit, it is found that some data is encrypted with AES-128. Which security objective is most directly compromised?

Accepted Answer

Confidentiality. AES-256 offers a higher security margin than AES-128. Using weaker encryption (AES-128) directly reduces the confidentiality protection, making it easier for an attacker to decrypt the data.

Answer

Integrity

Answer

Availability

Answer

Non-repudiation

Question 13

A company is evaluating a new cloud service provider and performs a thorough investigation of the provider's security practices and compliance with industry standards. This activity is best described as:

Accepted Answer

Due diligence. Due diligence involves investigating and assessing risks before making decisions, such as vendor selection.

Answer

Risk transfer

Answer

Risk avoidance

Answer

Due care

Question 14

Which THREE are primary phases of the incident response lifecycle?

Accepted Answer

Containment. Containment is a primary phase of the incident response lifecycle because it focuses on stopping the spread of an incident and preventing further damage. In the NIST SP 800-61 framework, containment is explicitly listed as a core phase, following detection and analysis. This phase includes actions such as isolating affected systems, blocking malicious IPs via ACLs, or disabling compromised accounts to limit the blast radius.

Answer

Forensic Analysis

Answer

Data Archiving

Question 15

An organization wants to ensure that data remains unaltered during transmission over the internet. Which security goal is being addressed?

Accepted Answer

Integrity. Integrity ensures that data is not altered during transmission, typically verified through cryptographic hash functions (e.g., SHA-256) or message authentication codes (MACs) such as HMAC. Protocols like TLS use integrity checks to detect any unauthorized modification of packets in transit, directly addressing the requirement that data remains unaltered.

Answer

Non-repudiation

Answer

Availability

Answer

Confidentiality