ISC2 CC Practice Test 34 — 15 Questions

Question 1

A financial services firm has a data center that houses customer financial records. They have implemented a defense-in-depth strategy including firewalls, IDS/IPS, and encryption. Recently, an internal audit revealed that a junior administrator has been logging into the database server with a shared admin account and has made unauthorized changes to customer records. The company wants to prevent such incidents in the future while maintaining operational efficiency. The current environment uses Linux servers with PostgreSQL databases. There is no centralized authentication system. What is the BEST action to take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Disable all shared accounts and implement individual accounts with role-based access control and audit logging. The core issue is the lack of accountability due to a shared admin account. Disabling shared accounts and implementing individual accounts with role-based access control (RBAC) and audit logging directly addresses this by ensuring each action is tied to a specific user, enabling non-repudiation and precise forensic analysis. This aligns with the principle of least privilege and is the most effective way to prevent unauthorized changes while maintaining operational efficiency through granular permission management.

Answer

Increase the frequency of password changes for the shared admin account

Answer

Use database encryption to prevent unauthorized changes

Answer

Implement a network access control (NAC) solution to restrict database access to specific IP addresses

Question 2

During a forensic investigation, an analyst acquires a live system memory dump. Which tool is most appropriate for capturing the contents of volatile memory on a Windows system?

Accepted Answer

DumpIt. DumpIt is a lightweight, standalone tool designed specifically for capturing the full contents of volatile memory (RAM) on a Windows system. It creates a raw memory dump file without requiring installation or complex configuration, making it ideal for forensic acquisition of live system memory.

Answer

Wireshark

Answer

FTK Imager

Answer

dd

Question 3

After a security audit, a company discovers that several employees have access to financial systems that are not required for their job roles. Which access control model would best prevent this issue in the future?

Accepted Answer

Role-based access control (RBAC). Role-based access control (RBAC) assigns permissions based on job roles, ensuring users have only the access needed for their role. DAC allows owners to give access arbitrarily, which could lead to over-provisioning. MAC is rigid and label-based, not ideal for dynamic business needs. ABAC is flexible but more complex to implement than RBAC for this scenario.

Answer

Mandatory access control (MAC)

Answer

Discretionary access control (DAC)

Answer

Attribute-based access control (ABAC)

Question 4

Which TWO of the following are examples of physical access controls?

Accepted Answer

Biometric scanners. Biometric scanners (Option B) are physical access controls because they authenticate individuals based on unique biological traits (e.g., fingerprints, iris patterns) to grant or deny entry to a physical space, such as a server room or data center. This is a tangible, hardware-based mechanism that directly controls physical access, aligning with the definition of physical access controls in the CC exam.

Answer

Encryption

Answer

Intrusion Prevention Systems (IPS)

Answer

Firewalls

Question 5

Which two of the following are common types of security controls?

Accepted Answer

Preventative. Detective and Preventative controls are foundational security control categories. Corrective is also a category but not listed as one of the two most common; Reactive and Predictive are not standard categories.

Answer

Corrective

Answer

Predictive

Answer

Reactive

Question 6

A company experiences a ransomware attack that encrypts all files on a critical server. The backup strategy includes nightly backups stored on a separate network. What should be the first action during recovery?

Accepted Answer

Verify the integrity and availability of the backup data.. Before any recovery action, you must verify that the backup data is intact, uncorrupted, and free from the ransomware. If the backup itself is encrypted or compromised, restoring it would re-infect the environment. This step aligns with the 3-2-1 backup rule and ensures the recovery point is clean.

Answer

Restore all files from the most recent backup.

Answer

Isolate the affected server from the network.

Answer

Report the incident to law enforcement.

Question 7

After a security breach, investigators find that an attacker exploited a vulnerability in a publicly accessible application to gain access to internal databases. Which security principle would have most effectively limited the impact?

Accepted Answer

Defense in depth

Answer

Accountability

Answer

Confidentiality

Answer

Non-repudiation

Question 8

Refer to the exhibit. A firewall rule set is shown (first match applies). An analyst reviews these rules. Which of the following best describes the traffic outcome for a packet from source IP 10.0.0.1 to destination 192.168.1.1?

Accepted Answer

The packet is denied because rule 1 matches and denies it.. Rule 1 matches the source IP 10.0.0.1 (which falls within the 10.0.0.0/8 range) and the destination 192.168.1.1 (within 192.168.1.0/24), and since the action is 'deny', the packet is denied immediately. Firewalls using 'first match applies' logic stop processing as soon as a matching rule is found, so subsequent rules are never evaluated. Therefore, the correct outcome is denial.

Answer

The packet is permitted because the last rule permits any any.

Answer

The packet is permitted because rule 2 explicitly permits the traffic.

Answer

The packet is denied because there is no explicit permit for 10.0.0.0/8 to 192.168.1.0/24.

Question 9

An organization's security policy requires that all network traffic logs be retained for at least one year. The SIEM system is running low on storage, and the administrator must decide which data to archive first. Which data set is the least critical for ongoing security monitoring and can be archived earliest?

Accepted Answer

DNS query logs from internal DNS servers. DNS query logs from internal DNS servers are the least critical for ongoing security monitoring because they primarily contain name resolution requests, which are high-volume and low-signal data. While they can be useful for threat hunting or forensic analysis of malware command-and-control (C2) traffic, they are not essential for real-time alerting or immediate incident response. Archiving them first preserves storage for more actionable logs like IDS alerts, firewall denies, and authentication failures.

Answer

Intrusion detection system alerts

Answer

Firewall deny logs

Answer

Authentication logs from domain controllers

Question 10

A security policy requires that all changes to a production system go through a formal change management process with approval from a change control board. This is an example of which security principle?

Accepted Answer

Governance. Governance involves establishing policies, processes, and oversight to ensure security aligns with business objectives. The formal change management process is a governance mechanism.

Answer

Least privilege

Answer

Defense in depth

Answer

Separation of duties

Question 11

An organization has a policy that all servers must have security patches applied within 30 days of release. Which of the following is the best practice for patching?

Accepted Answer

Test patches in a non-production environment before deploying to production. Testing patches in a non-production environment first allows the organization to identify compatibility issues, performance regressions, or conflicts with existing software before risking production systems. This aligns with the change management principle of validating changes in a controlled setting, ensuring that the 30-day patching deadline can be met without introducing instability. Skipping testing (A) or applying patches simultaneously (B) could lead to widespread outages, while only applying critical patches (D) would leave the organization exposed to non-critical vulnerabilities that could be chained in an attack.

Answer

Skip patches that have not been widely tested

Answer

Apply patches to all servers simultaneously

Answer

Only apply critical patches

Question 12

An organization wants to ensure that no single employee can both request and approve a payment. Which access control principle does this enforce?

Accepted Answer

Separation of duties. Separation of duties (SoD) is the access control principle that prevents a single individual from having conflicting permissions, such as both requesting and approving a payment. By splitting the payment lifecycle into distinct roles (e.g., requester vs. approver), the organization enforces a dual-control mechanism that reduces the risk of fraud or error. This is commonly implemented in financial systems using role-based access control (RBAC) where the 'payment request' and 'payment approval' roles are mutually exclusive.

Answer

Least privilege

Answer

Need to know

Answer

Defense in depth

Question 13

A company implements a policy that requires two employees to approve any financial transaction over $10,000. Which security principle is being applied?

Accepted Answer

Separation of duties. Separation of duties ensures that no single individual has control over all critical functions, reducing the risk of fraud or error. In this scenario, requiring two approvals for large transactions institutionalizes the principle.

Answer

Need to know

Answer

Defense in depth

Answer

Least privilege

Question 14

An organization's security policy requires that all employees change their passwords every 90 days. This is an example of which type of security control?

Accepted Answer

Preventive control. Password expiration policies, such as requiring a change every 90 days, are classified as preventive controls because they proactively reduce the risk of credential compromise by limiting the window of opportunity for an attacker to use a stolen or guessed password. This control enforces a security baseline before any unauthorized access can occur, directly preventing prolonged use of compromised credentials.

Answer

Deterrent control

Answer

Detective control

Answer

Corrective control

Question 15

A company wants to implement a security control that ensures users are who they claim to be before granting access to a system. Which type of control should they prioritize?

Accepted Answer

Authentication. Authentication verifies identity. Authorization determines permissions. Accounting tracks actions. Auditing reviews logs.

Answer

Auditing

Answer

Authorization

Answer

Accounting