ISC2 CC Practice Test 35 — 15 Questions

Question 1

Match each authentication factor to an example.

Accepted Answer

Something you know: Password. Multi-factor authentication (MFA) requires at least two distinct types of factors. Knowledge (something you know), possession (something you have), inherence (something you are), and location (somewhere you are) are common categories.

Answer

Something you know: Smart card

Answer

Something you have: Password

Question 2

A security engineer is configuring a network intrusion detection system (NIDS) to monitor traffic on a critical subnet. To minimize false positives, which of the following should the engineer baseline first?

Accepted Answer

The normal traffic patterns during peak business hours. Baselining normal traffic patterns during peak business hours establishes a reference of legitimate network behavior, which is essential for a NIDS to distinguish benign anomalies from actual threats. Without this baseline, the NIDS may generate false positives by flagging legitimate peak-hour traffic spikes as malicious. This aligns with the principle that anomaly-based detection relies on a statistical model of normal activity to reduce noise.

Answer

The results of a recent vulnerability scan

Answer

The latest attack signatures from the vendor

Answer

The firewall logs from the past 24 hours

Question 3

Refer to the exhibit. The IDS alert indicates a possible SpyEye botnet check-in from an internal host. What immediate action should the analyst take?

Accepted Answer

Isolate the internal host from the network. Isolating the internal host immediately stops the potential command-and-control (C2) communication with the SpyEye botnet, preventing data exfiltration or further compromise. This is the first step in incident response (containment) before any forensic analysis or remediation, as per NIST SP 800-61 guidelines. Delaying containment could allow the botnet to receive new instructions or spread laterally.

Answer

Ignore the alert as it is a false positive

Answer

Block the destination IP at the firewall

Answer

Run a full antivirus scan on the internal host

Question 4

Which THREE of the following are recognized security principles according to NIST and ISC2?

Accepted Answer

Separation of duties. Least privilege, separation of duties, and defense in depth are fundamental. Security through obscurity is not a recognized principle.

Answer

Security through obscurity

Answer

Single point of failure

Question 5

A company's network uses 802.1X authentication for wired and wireless access. Which component authenticates the user credentials against an identity store?

Accepted Answer

Authentication server (RADIUS). In 802.1X, the authentication server (typically a RADIUS server) is the component that validates user credentials against an identity store such as LDAP, Active Directory, or a local database. The supplicant (client) provides credentials, the authenticator (switch or access point) relays EAP frames, but only the RADIUS server performs the actual authentication decision.

Answer

Supplicant

Answer

Authenticator

Answer

Access point

Question 6

A company uses a stateful firewall. A user reports that an application requiring multiple dynamic ports is not working. The firewall logs show that packets from the server are being dropped. What is the most likely cause?

Accepted Answer

The firewall is only allowing packets that match an established session, but the application's control channel is not being tracked correctly.. A stateful firewall tracks sessions by monitoring the control channel. For applications like FTP that use dynamic ports, the firewall must inspect the control channel to dynamically open pinholes for data channels. If the control channel is not tracked correctly, the firewall will not recognize the data channel packets as part of an established session and will drop them, even if the initial control session was allowed.

Answer

The firewall does not have a rule allowing inbound traffic for the application.

Answer

The firewall is not inspecting application-layer data.

Answer

The firewall's state table is full and cannot track new sessions.

Question 7

Refer to the exhibit. A network administrator configured the above on a switch port. After connecting a single workstation, the port goes into err-disabled state within minutes. What is the most likely cause?

Accepted Answer

The workstation is sending traffic with multiple source MAC addresses.. The port-security configuration with a maximum MAC address count of 2 and violation mode 'shutdown' causes the port to err-disable when a single workstation sends traffic with multiple source MAC addresses. This is a classic symptom of a device (e.g., a virtual machine host or a switch behind the port) generating frames from different MACs, exceeding the allowed limit and triggering the violation.

Answer

The port-security maximum is set to 2, so it should allow up to 2 MACs; the issue is elsewhere.

Answer

Sticky MAC learning is disabled.

Answer

The violation mode should be 'restrict' instead of 'shutdown'.

Question 8

Which three of the following are best practices for securing a network switch? (Choose three.)

Accepted Answer

Disable unused ports.. Disabling unused ports on a network switch prevents unauthorized physical access and eliminates the risk of an attacker connecting to an open port to launch attacks such as ARP spoofing or DHCP starvation. This is a fundamental security best practice that reduces the attack surface by ensuring that only necessary ports are active and can be administratively controlled.

Answer

Enable Telnet for remote management.

Answer

Set all ports to trunk mode by default.

Question 9

Which two of the following are common methods to secure a virtual private network (VPN) connection? (Choose two.)

Accepted Answer

SSL/TLS. SSL/TLS is a common method to secure VPN connections, typically used in SSL VPNs. It operates at the transport layer (Layer 4) and provides encryption, authentication, and integrity for data transmitted over the internet, often using port 443 to bypass firewalls. This makes it ideal for remote access VPNs where clients connect via a web browser or a lightweight client.

Answer

ICMP

Answer

LDAP

Answer

SNMP

Question 10

A network administrator is configuring a switch to logically separate the Accounting and HR departments on the same physical switch. Which technology should be used?

Accepted Answer

VLAN. VLANs can partition a physical switch into multiple logical segments, isolating traffic between groups.

Answer

Subnetting

Answer

DMZ

Answer

Honeypot

Question 11

A security analyst receives an alert indicating multiple failed login attempts from a single IP address targeting a user account. Which action should the analyst take FIRST?

Accepted Answer

Verify the alert and check if the account is compromised. The first step in incident response is to validate the alert. The analyst must verify that the failed login attempts are not a false positive (e.g., a user mistyping their password) and then check if the account has been compromised by reviewing logs for successful logins from the same IP or anomalous behavior. Prematurely disabling the account or blocking the IP could disrupt legitimate access or alert an attacker, while escalation to law enforcement is premature without confirmation of a breach.

Answer

Disable the user account immediately

Answer

Escalate the alert to law enforcement

Answer

Block the IP address at the firewall

Question 12

During a forensic investigation, the analyst needs to acquire a memory image from a live Windows system without altering evidence. Which tool is MOST appropriate?

Accepted Answer

FTK Imager. FTK Imager can acquire a memory image from a live Windows system with minimal impact on evidence integrity. Option A (Volatility) is a memory analysis tool, not an acquisition tool. Option B (EnCase) is a comprehensive forensic suite that can acquire memory but may alter evidence during the process. Option C (dd) is primarily used for disk imaging and is not suitable for memory acquisition.

Answer

Volatility

Answer

EnCase

Answer

dd

Question 13

Match each phase of the incident response process to its description.

Accepted Answer

Preparation: Developing procedures, tools, and training before an incident.. The NIST SP 800-61 incident response process includes Preparation, Detection and Analysis, Containment, Eradication and Recovery, and Post-Incident Activity. Options A, B, and C are correct; D and E swap definitions between the last two phases.

Answer

Eradication and Recovery: Conducting a post-mortem and applying lessons learned.

Answer

Post-Incident Activity: Removing the root cause and restoring normal operations.

Question 14

In incident response, which TWO are considered volatile data that should be collected first? (Select exactly 2.)

Accepted Answer

Network connections. Network connections (option B) are volatile because they represent active communication channels that disappear when the system is powered off or disconnected. In incident response, collecting network connection data (e.g., using netstat -an) first preserves evidence of ongoing malicious activity, such as command-and-control (C2) traffic or lateral movement, before it is lost.

Answer

Hard drive contents

Answer

Backup tapes

Answer

System logs

Question 15

A company has a disaster recovery plan that includes a hot site. Which of the following is the PRIMARY advantage of a hot site over a cold site?

Accepted Answer

Faster recovery time. A hot site is a fully operational duplicate of the primary data center, complete with live servers, storage, networking, and synchronized data. This eliminates the need to procure and configure hardware after a disaster, enabling recovery in minutes or hours rather than days or weeks. The primary advantage is therefore a significantly faster recovery time objective (RTO) compared to a cold site, which has no pre-installed equipment.

Answer

Easier maintenance

Answer

Greater security

Answer

Lower cost