ISC2 CC Practice Test 33 — 15 Questions

Question 1

An analyst is reviewing a series of failed login attempts from multiple IP addresses targeting a single user account. This pattern is indicative of what type of attack?

Accepted Answer

Password spraying. Password spraying involves an attacker attempting a small number of common passwords (e.g., 'Password123', 'Welcome1') against many user accounts, or in this case, multiple IP addresses targeting a single user account. This pattern avoids account lockout thresholds by keeping attempts per IP low, making it distinct from brute force attacks that hammer a single account with many passwords from one source.

Answer

Keylogging

Answer

Brute force

Answer

Credential stuffing

Question 2

A security analyst notices that an internal web server is receiving a high volume of TCP SYN packets from a single external IP address, but the server is not sending SYN-ACK replies. The server's CPU and memory usage are normal. What is the most likely cause?

Accepted Answer

The server is under a SYN flood attack, filling the connection queue. A SYN flood attack works by sending a high volume of TCP SYN packets to a server, filling its half-open connection queue (the backlog) and preventing it from completing the three-way handshake. Since the server's CPU and memory are normal, the issue is not resource exhaustion but rather the queue being saturated, causing the server to stop sending SYN-ACK replies to new connection requests.

Answer

A firewall rule is blocking inbound SYN-ACK packets

Answer

The server's TCP/IP stack has crashed

Answer

The server is experiencing a distributed denial-of-service (DDoS) attack

Question 3

Which of the following is a primary goal of security operations?

Accepted Answer

Reduce attack surface. Reducing the attack surface is a primary goal of security operations because it minimizes the number of potential entry points an attacker can exploit. By disabling unnecessary services, applying strict access controls, and segmenting networks, the organization lowers its risk of compromise. This directly supports the core security operations objective of protecting assets and maintaining confidentiality, integrity, and availability.

Answer

Minimize user complaints

Answer

Increase network speed

Answer

Ensure compliance with marketing standards

Question 4

A SOC analyst is reviewing logs from a web server and sees the following entry:
GET /../../../../etc/passwd HTTP/1.1
Which type of attack is being attempted?

Accepted Answer

Directory traversal. The log entry shows a GET request with '../' sequences attempting to navigate outside the web root to access the '/etc/passwd' file. This is the classic signature of a directory traversal attack, which exploits insufficient path sanitization to read arbitrary files on the server. The correct answer is C because the attack targets the file system, not the application's data layer or client-side scripts.

Answer

Cross-site scripting

Answer

SQL injection

Answer

Cross-site request forgery

Question 5

An organization implements an access control system where users are assigned to groups, and permissions are granted to groups rather than individuals. This is known as:

Accepted Answer

Role-Based Access Control (RBAC). Role-Based Access Control (RBAC) assigns permissions to roles (or groups) rather than to individual users. Users are then made members of these roles, inheriting the permissions associated with the role. This matches the description in the question, where users are assigned to groups and permissions are granted to those groups.

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Answer

Attribute-Based Access Control (ABAC)

Question 6

A company's security policy requires that all incident response activities be logged and that evidence be preserved for potential legal action. During an incident, a responder mistakenly uses a personal USB drive to copy log files. Which principle of forensic evidence handling has been violated?

Accepted Answer

Chain of custody. The chain of custody is a documented record that tracks the seizure, control, transfer, analysis, and disposition of evidence. By using a personal USB drive to copy log files, the responder introduces an unverified and uncontrolled storage medium, breaking the documented chain and making it impossible to prove that the evidence was not tampered with or contaminated. This directly violates the requirement to preserve evidence for potential legal action.

Answer

Integrity

Answer

Availability

Answer

Confidentiality

Question 7

A network administrator needs to ensure that sensitive financial data remains confidential while in transit over the internet. Which technology should they implement?

Accepted Answer

TLS 1.3. TLS encrypts data in transit. AES is encrypting at rest. SHA-256 is hashing. VPN can also encrypt but TLS is more specific for web traffic.

Answer

Digital signatures

Answer

SHA-256

Answer

AES-256

Question 8

Which authentication factor does a smart card represent?

Accepted Answer

Something you have. A smart card is a physical device that stores cryptographic keys or certificates, making it a classic 'something you have' factor. It requires possession of the card to authenticate, even if the user knows a PIN, because the PIN unlocks the card but does not replace the physical possession requirement.

Answer

Something you know

Answer

Somewhere you are

Answer

Something you are

Question 9

Drag and drop the steps to recover a system from a verified backup after a ransomware attack into the correct order.

Accepted Answer

Step 1: Isolate the infected system, Step 2: Wipe the infected system, Step 3: Restore data from the verified backup, Step 4: Scan the restored system for malware.. Recovery requires isolation, backup verification, wiping, restoration, and scanning.

Answer

Step 1: Wipe the infected system, Step 2: Isolate the infected system, Step 3: Restore data from the verified backup, Step 4: Scan the restored system for malware.

Answer

Step 1: Isolate the infected system, Step 2: Restore data from the verified backup, Step 3: Wipe the infected system, Step 4: Scan the restored system for malware.

Answer

Step 1: Scan the infected system, Step 2: Isolate the infected system, Step 3: Wipe the infected system, Step 4: Restore data from the verified backup.

Question 10

Which TWO of the following are methods to ensure non-repudiation? (Select two).

Accepted Answer

Audit logs. Digital signatures provide cryptographic proof of origin, and audit logs provide a record of actions. Together they ensure that a party cannot deny involvement.

Answer

Biometric authentication

Answer

Access control lists

Answer

Encryption

Question 11

Which control type is considered a physical security control?

Accepted Answer

Security cameras. Security cameras are a physical security control because they deter, detect, and record unauthorized physical access or activity in a facility. They are deployed as part of a layered physical security strategy, often integrated with access control systems and monitored by security personnel. Unlike logical or administrative controls, cameras directly protect tangible assets and premises.

Answer

Firewall rules

Answer

User training

Answer

Encryption

Question 12

During a security incident, the incident response team isolates a compromised workstation from the network. What is the primary purpose of this action?

Accepted Answer

To prevent further damage.. Isolating a compromised workstation by disconnecting it from the network (e.g., disabling its switch port or unplugging the Ethernet cable) immediately stops all inbound and outbound traffic. This containment action prevents the attacker from moving laterally to other systems, exfiltrating data, or deploying additional malware, thereby limiting the scope and impact of the incident.

Answer

To comply with legal requirements.

Answer

To preserve forensic evidence.

Answer

To allow normal operations to continue.

Question 13

A security analyst is troubleshooting an access control issue where a user cannot access a file even though they seem to have the correct permissions. Which three of the following should the analyst investigate? (Select THREE)

Accepted Answer

File ownership. File ownership (A) is correct because Linux and Windows access control models (POSIX ACLs, NTFS) check the file's owner and group before applying permissions. If the user is not the owner or in the owning group, the 'other' permissions apply, which may deny access even if the user has a seemingly matching permission entry. The analyst must verify the file's owner and group against the user's identity.

Answer

Password expiration

Answer

Network connectivity

Question 14

Refer to the exhibit. A security analyst is reviewing firewall logs and notices repeated denied TCP packets from 192.0.2.10 to internal hosts. The packets are being denied by the access-group "OUTSIDE_IN". What is the most likely reason for these denials?

Accepted Answer

An external host is performing a port scan against internal systems.. The repeated denied TCP packets from 192.0.2.10 (an external IP) to multiple internal hosts indicate a port scan. The access-group 'OUTSIDE_IN' is applied to the outside interface, and the firewall is denying these packets because they match a deny ACE (access control entry) that blocks unsolicited inbound traffic. This pattern of multiple denied connections from a single external source to different internal destinations is characteristic of a reconnaissance scan, not a DoS attack or data exfiltration.

Answer

The firewall is misconfigured and blocking legitimate traffic.

Answer

An internal host has been compromised and is exfiltrating data.

Answer

An external host is launching a denial-of-service (DoS) attack.

Question 15

A security analyst notices repeated failed login attempts to a critical server from a single external IP address. Which immediate action should the analyst take?

Accepted Answer

Block the IP address at the firewall.. Blocking the IP address at the firewall is the immediate action because it stops the ongoing brute-force attack at the network perimeter without affecting the server's availability or internal operations. Firewall rules can be applied quickly using access control lists (ACLs) to deny traffic from the specific external IP, which is a standard first response to mitigate a single-source attack.

Answer

Enable two-factor authentication.

Answer

Disable the server's network interface.

Answer

Change the server's IP address.