ISC2 CC Practice Test 34 — 15 Questions

Question 1

A multinational financial services organization operates three data centers in different geographic regions. Each data center runs a mix of critical and non-critical applications. The DR plan specifies Recovery Time Objectives (RTOs) ranging from 4 hours for critical applications to 72 hours for non-critical. During a scheduled DR test, the team attempts to fail over the primary customer database to the secondary site. The failover fails because the replication link between sites was saturated due to a large data synchronization job running concurrently. The test is declared a failure, and senior management is concerned about the DR plan's reliability. The IT director suggests increasing bandwidth between sites. The security architect proposes implementing network prioritization for replication traffic. The business continuity manager recommends revising the RTOs to be more realistic based on current bandwidth. The system administrator thinks the issue will resolve if the test is repeated during off-peak hours. Which of the following is the BEST course of action to address the root cause of the failure?

Accepted Answer

Implement Quality of Service (QoS) policies to prioritize database replication traffic over other data transfers.. The root cause is that the replication link was saturated by a large data synchronization job, which delayed the critical database replication traffic needed to meet the 4-hour RTO. Implementing Quality of Service (QoS) policies directly addresses this by prioritizing database replication traffic over other data transfers, ensuring that critical replication gets the necessary bandwidth even during concurrent large jobs. This is the most effective solution because it resolves the contention without requiring additional bandwidth or changing RTOs.

Answer

Increase the bandwidth on the replication link by ordering a faster circuit from the ISP.

Answer

Reschedule the next DR test to occur during a scheduled maintenance window with no other replication activity.

Answer

Revise the RTO for the customer database from 4 hours to 8 hours to account for current bandwidth limitations.

Question 2

A security analyst notices repeated failed login attempts from a single external IP address targeting the company's VPN concentrator. Which type of attack is most likely occurring?

Accepted Answer

Brute force. Repeated failed login attempts from a single external IP targeting a VPN concentrator are the hallmark of a brute force attack. The attacker systematically tries many username/password combinations to gain unauthorized access, exploiting weak or common credentials rather than exploiting a protocol vulnerability.

Answer

Spoofing

Answer

Man-in-the-Middle (MITM)

Answer

Denial of Service (DoS)

Question 3

During a security assessment, a penetration tester captures unencrypted credentials over the network. Which protocol is most likely being used?

Accepted Answer

FTP. FTP (File Transfer Protocol) transmits data, including credentials, in cleartext over the network. When a penetration tester captures unencrypted credentials, FTP is a likely candidate because it does not encrypt the authentication process, making it vulnerable to packet sniffing attacks.

Answer

SMTPS

Answer

SSH

Answer

HTTPS

Question 4

Which two of the following are common methods to secure a virtual private network (VPN) connection? (Choose two.)

Accepted Answer

SSL/TLS. SSL/TLS is a common method to secure VPN connections, typically used in SSL VPNs. It operates at the transport layer (Layer 4) and provides encryption, authentication, and integrity for data transmitted over the internet, often using port 443 to bypass firewalls. This makes it ideal for remote access VPNs where clients connect via a web browser or a lightweight client.

Answer

ICMP

Answer

LDAP

Answer

SNMP

Question 5

A network administrator notices unusual traffic from an internal workstation to an external IP address on port 443. The workstation has no business reason for such communication. Which action should the administrator take first?

Accepted Answer

Investigate the workstation for possible malware.. Option C is correct because the first priority when encountering unexpected outbound traffic to an external IP on port 443 (HTTPS) is to investigate the workstation for possible malware. This traffic could indicate a command-and-control (C2) beacon or data exfiltration, and immediate investigation allows the administrator to gather forensic evidence before taking disruptive actions. Disabling the port or blocking traffic without investigation could destroy evidence or alert an attacker, while allowing the traffic would be negligent.

Answer

Disable the workstation's network port.

Answer

Block all outbound traffic from that workstation immediately.

Answer

Configure a firewall rule to allow the traffic and log it.

Question 6

A network administrator is implementing a defense-in-depth strategy. Which THREE of the following are considered network security controls? (Select THREE)

Accepted Answer

Virtual Private Network (VPN). A Virtual Private Network (VPN) is a network security control because it creates an encrypted tunnel (using protocols such as IPsec or TLS) between a remote user and the corporate network, ensuring data confidentiality and integrity over untrusted networks like the internet. This protects data in transit and authenticates endpoints, which is a core network-layer security function.

Answer

Full disk encryption

Answer

Antivirus software

Question 7

Refer to the exhibit. A network administrator configured the above on a switch port. After connecting a single workstation, the port goes into err-disabled state within minutes. What is the most likely cause?

Accepted Answer

The workstation is sending traffic with multiple source MAC addresses.. The port-security configuration with a maximum MAC address count of 2 and violation mode 'shutdown' causes the port to err-disable when a single workstation sends traffic with multiple source MAC addresses. This is a classic symptom of a device (e.g., a virtual machine host or a switch behind the port) generating frames from different MACs, exceeding the allowed limit and triggering the violation.

Answer

The port-security maximum is set to 2, so it should allow up to 2 MACs; the issue is elsewhere.

Answer

Sticky MAC learning is disabled.

Answer

The violation mode should be 'restrict' instead of 'shutdown'.

Question 8

A security administrator is concerned about MAC address spoofing on the network. Which technology can help mitigate this risk by associating a specific MAC address with a port?

Accepted Answer

Port security. Port security is the correct answer because it directly mitigates MAC address spoofing by allowing an administrator to statically or dynamically associate a specific MAC address with a switch port. When a device with a different MAC address attempts to use that port, port security can either disable the port (errdisable) or drop the traffic, preventing unauthorized access. This is a Layer 2 security feature that enforces MAC-to-port binding.

Answer

Dynamic ARP inspection

Answer

DHCP snooping

Answer

VLAN hopping prevention

Question 9

Which TWO technologies provide network segmentation? (Choose two.)

Accepted Answer

Routers with ACLs. Routers with ACLs (Access Control Lists) provide network segmentation by filtering traffic based on Layer 3 (IP addresses) and Layer 4 (port numbers) criteria, effectively dividing a network into separate security zones or subnets. VLANs (Virtual Local Area Networks) segment a network at Layer 2 by logically grouping devices into separate broadcast domains, even if they share the same physical switch. Both technologies isolate traffic to enforce security policies and reduce attack surfaces.

Answer

Firewalls

Answer

Hubs

Answer

Switches

Question 10

A network technician is setting up a remote access VPN for employees using IPsec. The company's firewall is configured to allow IPsec traffic. Employees report that they can successfully establish the VPN connection (tunnel appears up), but they cannot ping or access any internal resources (e.g., file servers). The firewall logs show that packets from the VPN client IP addresses are being dropped at the firewall interface. Which of the following is the MOST likely cause of this issue?

Accepted Answer

The firewall's access control list does not permit traffic from the VPN subnet to the internal network.. The VPN tunnel is established, meaning Phase 1 and Phase 2 of IPsec are complete and the client has a valid IP from the pool. However, packets from the VPN subnet are being dropped at the firewall interface, which indicates that the firewall's access control list (ACL) does not include a permit statement for traffic sourced from the VPN client subnet destined to the internal network. Without this ACL entry, the firewall will drop the traffic even though the tunnel is up.

Answer

The VPN client is not assigned a correct IP address from the pool.

Answer

The firewall's intrusion prevention system is blocking the traffic.

Answer

The IPsec encryption algorithm is incompatible between client and firewall.

Question 11

Which of the following protocols provides secure remote administration of a network device over an untrusted network?

Accepted Answer

SSH. SSH (Secure Shell) is correct because it encrypts all traffic, including authentication credentials and commands, using strong cryptographic algorithms, making it safe for remote administration over untrusted networks. It operates on TCP port 22 and provides confidentiality, integrity, and authentication, unlike cleartext protocols. SSH is the standard for secure CLI access to network devices such as routers and switches.

Answer

SNMPv1

Answer

Telnet

Answer

HTTP

Question 12

Refer to the exhibit. Based on the exhibit, why was the packet denied?

Accepted Answer

The packet was blocked by an inbound access list. The exhibit shows an inbound access list applied to the interface, and the packet is denied because its source IP matches a deny entry in that inbound ACL. Inbound access lists filter traffic before it is processed by the router, so the packet is dropped upon arrival. The correct answer is D because the packet was blocked by an inbound access list, as indicated by the ACL configuration and the deny action.

Answer

Source IP is internal

Answer

The packet was blocked by an outbound access list

Answer

Destination IP is external

Question 13

A security engineer is reviewing logs and notices that an internal server is receiving excessive SYN packets from an external IP, but never completing the three-way handshake. What type of attack is likely occurring?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets to a target server without completing the handshake (i.e., not sending the final ACK). This exhausts the server's connection table resources, preventing legitimate connections. The log evidence—excessive SYN packets from an external IP with no handshake completion—is the classic signature of a SYN flood.

Answer

Smurf attack

Answer

Ping of death

Answer

ARP poisoning

Question 14

Which THREE security mechanisms should be implemented to secure a network against ARP spoofing attacks? (Choose three.)

Accepted Answer

IP Source Guard. IP Source Guard (A) is correct because it uses DHCP snooping binding table entries to filter traffic on a per-port basis, dropping packets where the source IP address does not match the binding. This prevents an attacker from spoofing a legitimate host's IP address in ARP spoofing attacks by ensuring only valid IP-to-MAC mappings are allowed on the port.

Answer

Port security

Answer

MAC address filtering

Question 15

During a phishing investigation, a security analyst identifies that an employee clicked a malicious link. The analyst isolates the workstation. What is the NEXT best step?

Accepted Answer

Capture a memory image of the workstation for analysis. After isolating the workstation, the next best step is to capture a memory image (RAM) to preserve volatile evidence such as running processes, network connections, and malware artifacts that would be lost on shutdown. This follows the order of volatility (RFC 3227) and is critical for forensic analysis to determine the scope of the compromise.

Answer

Update the company's acceptable use policy

Answer

Notify all employees about phishing risks

Answer

Reimage the workstation