ISC2 CC Practice Test 33 — 15 Questions

Question 1

An organization wants to separate its internal network from a publicly accessible web server. Which network segmentation technique should be used to isolate the web server while allowing controlled access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DMZ. A DMZ (Demilitarized Zone) is a segmented network that sits between the internal trusted network and the untrusted internet, specifically designed to host publicly accessible services like web servers while isolating them from internal systems. Firewall rules control traffic between the internet, the DMZ, and the internal network, so if the web server is compromised, the attacker cannot directly reach internal resources.

Answer

Honeypot

Answer

Subnetting

Answer

VLAN

Question 2

An account lockout policy is implemented to protect against which type of attack?

Accepted Answer

Brute force. An account lockout policy locks an account after a specified number of failed login attempts (e.g., 5 attempts), which directly thwarts brute-force attacks that rely on trying many password combinations. By locking the account, the attacker is prevented from continuing automated guessing, and the legitimate user or admin is alerted. This is the primary defensive purpose of account lockout.

Answer

Man-in-the-middle

Answer

Social engineering

Answer

Phishing

Question 3

Which of the following best describes the purpose of a session timeout?

Accepted Answer

To automatically log out inactive users. A session timeout is a security control that automatically terminates a user's authenticated session after a defined period of inactivity. Its core purpose is to prevent unauthorized access when a user leaves a workstation unattended, reducing the window of opportunity for someone else to use the still-authenticated session. It does not enforce password rules, restrict data by need-to-know, or block brute-force attempts.

Answer

To enforce password complexity

Answer

To restrict access based on need-to-know

Answer

To prevent brute-force attacks

Question 4

A security analyst detects a large number of incomplete TCP connection requests (SYN segments) directed at a server. This is indicative of which type of attack?

Accepted Answer

SYN flood. A SYN flood exploits the TCP three-way handshake by sending numerous SYN packets with spoofed source addresses, leaving the server with half-open connections that exhaust its backlog queue. The server responds with SYN-ACK to unreachable hosts and waits for the final ACK that never arrives, consuming resources until legitimate connections are refused. This matches the scenario of many incomplete TCP connection requests.

Answer

ICMP flood

Answer

UDP flood

Answer

Smurf attack

Question 5

Which principle ensures that a user is granted only the permissions necessary to perform their job functions, thereby reducing the potential impact of a compromised account?

Accepted Answer

Least privilege. Least privilege is the principle that users, processes, and systems should be granted only the minimum access rights required to perform their legitimate tasks, and no more. This limits the blast radius if an account is compromised, because the attacker inherits only the narrow permissions of that account. It is a foundational concept in access control and is explicitly required by standards like NIST SP 800-53 (AC-6).

Answer

Need-to-know

Answer

Separation of duties

Answer

Defense in depth

Question 6

An organization uses a Privileged Access Management (PAM) solution. Which of the following is a primary benefit of PAM?

Accepted Answer

Controls and monitors privileged access. PAM solutions are designed to secure, control, and monitor privileged accounts — the accounts with elevated access such as root, domain admin, and service accounts. Core PAM capabilities include credential vaulting, session recording, just-in-time access, and approval workflows for privileged actions. The primary benefit is therefore controlling and monitoring privileged access to reduce the risk of misuse or compromise.

Answer

Provides a single sign-on for all users

Answer

Eliminates the need for passwords

Answer

Automates user provisioning for all accounts

Question 7

Which TWO of the following are recognized as benefits of network segmentation?

Accepted Answer

Reduced attack surface. Network segmentation is recognized for reducing the attack surface (A) because dividing the network into isolated zones limits which hosts and services are reachable from any given segment, so an attacker on one segment cannot directly probe or exploit systems in other segments. It also provides containment of breaches (E), since a compromise in one segment is confined by the segmentation controls (e.g., firewalls, VLANs, ACLs) and cannot freely spread laterally to other segments. The unmarked options do not belong: easier monitoring (B) is not a guaranteed benefit because segmentation adds more boundaries and traffic paths to instrument, increased broadcast domains (C) is the opposite of segmentation, which shrinks broadcast domains, and simplified IP address management (D) is not inherent to segmentation and can actually become more complex with multiple subnets.

Answer

Easier monitoring

Answer

Increased broadcast domains

Answer

Simplified IP address management

Question 8

A security administrator is implementing controls to prevent a single employee from approving and disbursing payments. Which principle is being applied?

Accepted Answer

Separation of duties. Separation of duties is the principle that no single individual should have control over all aspects of a critical process. By preventing one employee from both approving and disbursing payments, the company ensures that multiple people are involved, reducing the risk of fraud or error.

Answer

Need-to-know

Answer

Defense in depth

Answer

Least privilege

Question 9

A security analyst notices that a user is accessing files in a department they do not work in. Which principle is being violated?

Accepted Answer

Need-to-know. The need-to-know principle restricts access to information only to individuals who require it to perform their specific job duties. A user accessing files in a department they do not work in violates this principle because they have no legitimate need for that information.

Answer

Least privilege

Answer

Defense in depth

Answer

Separation of duties

Question 10

A system administrator uses a separate administrative account with elevated privileges only when performing system maintenance, and uses a standard user account for daily activities like email. This practice aligns with which principle?

Accepted Answer

Least privilege. The scenario describes using a separate administrative account with elevated privileges only for system maintenance, while using a standard user account for daily activities like email. This aligns with the principle of least privilege, which dictates that users should be granted only the minimum access rights necessary to perform their job functions, and only for the duration needed. By not using the admin account for routine tasks, the administrator reduces the attack surface and potential damage from accidental or malicious actions.

Answer

Need-to-know

Answer

Defense in depth

Answer

Separation of duties

Question 11

Which principle ensures that users are granted only the minimum permissions necessary to perform their job functions?

Accepted Answer

Least privilege. The principle of least privilege states that users (and processes) should be granted only the minimum permissions necessary to perform their job functions, reducing the attack surface and limiting the blast radius of a compromised account. It is a foundational access-control principle in cybersecurity and is explicitly tested in the ISC2 CC exam. Defense in depth, separation of duties, and need-to-know are related but distinct concepts.

Answer

Defense in depth

Answer

Separation of duties

Answer

Need-to-know

Question 12

A user logs into a system using a password and a one-time passcode from a mobile authenticator app. This is an example of:

Accepted Answer

Multi-factor authentication. Using a password (something you know) and a one-time passcode from a mobile authenticator app (something you have) combines two different authentication factors: knowledge and possession. This is the definition of multi-factor authentication (MFA).

Answer

Biometric authentication

Answer

Two-step verification using same factor

Answer

Single-factor authentication

Question 13

Refer to the exhibit.
```
-rw-r-x--- 1 user1 developers 1024 Apr 12 10:00 config.cfg
```
The security policy states that only the file owner (user1) and members of the developers group should be able to read the file. Which change is necessary to align with the principle of least privilege?

Accepted Answer

Change the file mode to 640.. The current mode -rw-r-x--- gives the owner rw, the group r-x, and others no access. The policy requires only the owner and group members to read the file, so group should be r-- (read only, no execute) and others should have no permissions. Mode 640 (rw-r-----) achieves exactly this: owner rw, group r, others none.

Answer

Add world read permission.

Answer

Change group permissions to rw-r--.

Answer

Change the owner to user2.

Question 14

Which port number is associated with HTTPS, and what protocol encrypts the communication?

Accepted Answer

Port 443, SSL/TLS. HTTPS uses TCP port 443 by default, and the communication is encrypted using SSL/TLS (with TLS 1.2/1.3 being the modern versions). Port 443 is the IANA-assigned port for HTTP over TLS, and SSL/TLS provides the encryption, integrity, and server authentication for the session.

Answer

Port 80, SSL/TLS

Answer

Port 8080, SSL/TLS

Answer

Port 443, SSH

Question 15

A security engineer is designing a physical security plan. Which combination of controls best represents defense in depth for a data center?

Accepted Answer

Perimeter fencing, access badges at building entrance, biometric reader on server room, and cable locks on servers. Defense in depth involves implementing multiple layers of security controls so that if one layer fails, others still provide protection. The combination of perimeter fencing, access badges at the building entrance, biometric reader on the server room, and cable locks on servers represents multiple physical security layers, from the outer perimeter to the individual server level. This is a classic example of defense in depth.

Answer

Visitor sign-in and escort policy only

Answer

A single high-tech lock on the server room door

Answer

A strong password policy for all employees