ISC2 CC Practice Test 36 — 15 Questions

Question 1

Drag and drop the steps to implement a firewall rule allowing inbound HTTPS traffic into the correct order.

Accepted Answer

Step 1: Define source and destination zones. Step 2: Specify protocol (TCP) and port (443). Step 3: Set action to allow. Step 4: Save and apply the rule.. The correct sequence to implement a firewall rule for inbound HTTPS traffic is: first define the source and destination zones to control traffic direction, then specify the protocol (TCP) and destination port (443) for HTTPS, next set the action to 'allow', and finally save and apply the rule. Zones provide context, the port identifies the service, the action permits the traffic, and saving ensures the rule is active. Common mistakes include swapping the order of zones and port specification, setting the action prematurely, or saving before defining the action.

Answer

Step 1: Specify protocol (TCP) and port (443). Step 2: Define source and destination zones. Step 3: Set action to allow. Step 4: Save and apply the rule.

Answer

Step 1: Define source and destination zones. Step 2: Set action to allow. Step 3: Specify protocol (TCP) and port (443). Step 4: Save and apply the rule.

Answer

Step 1: Define source and destination zones. Step 2: Specify protocol (TCP) and port (443). Step 3: Save and apply the rule. Step 4: Set action to allow.

Question 2

Which of the following best describes the principle of confidentiality in the CIA triad?

Accepted Answer

Preventing unauthorized disclosure of information. Confidentiality ensures that information is not disclosed to unauthorized individuals, entities, or processes. Encryption and access controls are primary mechanisms to enforce confidentiality.

Answer

Ensuring data is accurate and complete

Answer

Verifying the identity of users

Answer

Ensuring systems and data are accessible when needed

Question 3

During a data breach investigation, the incident response team discovers that personally identifiable information (PII) of EU residents was exfiltrated. Under GDPR, what is the maximum time frame for notifying the supervisory authority?

Accepted Answer

72 hours. GDPR requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.

Answer

7 days

Answer

48 hours

Answer

24 hours

Question 4

Which of the following is the PRIMARY purpose of a business impact analysis (BIA)?

Accepted Answer

Identify critical business processes and their recovery priorities. The primary purpose of a business impact analysis (BIA) is to identify critical business processes and quantify the impact of their disruption, which directly determines recovery priorities and objectives (RTO/RPO). This output drives the business continuity and disaster recovery strategy, not asset inventory or cost estimation.

Answer

Determine the cost of implementing security controls

Answer

List all IT assets

Answer

Assign incident response roles

Question 5

A company is selecting a recovery site strategy. They need to balance cost and recovery time. Which THREE factors should they consider when choosing between hot, warm, and cold sites? (Select three.)

Accepted Answer

Cost of the facility and equipment. Key factors: cost, recovery time objective (RTO), and data synchronization capabilities. Geography and vendor lock-in are considerations but not primary for site type selection.

Answer

Geographic diversity

Answer

Vendor lock-in risks

Question 6

Which incident category involves an attacker tricking an employee into revealing their login credentials through a fraudulent email?

Accepted Answer

Social engineering. Social engineering, specifically phishing, uses deception to obtain sensitive information.

Answer

Malware

Answer

Unauthorised access

Answer

Denial of service

Question 7

A network administrator is designing a DMZ to host a public-facing web server and a database server that should only be accessible from the web server. Which of the following firewall rule sets best achieves this design?

Accepted Answer

Allow inbound HTTP/HTTPS to web server; allow web server to database on port 3306; deny all else. It implements the principle of least privilege for a DMZ: it allows inbound HTTP/HTTPS traffic (ports 80/443) to the public-facing web server, then permits only the web server to initiate outbound connections to the database server on port 3306 (MySQL/MariaDB default), and denies all other traffic. This ensures the database is not directly accessible from the internet, reducing the attack surface while still supporting the required application flow.

Answer

Allow web server to initiate outbound connections to internet; allow database to initiate connections to web server; deny all else

Answer

Allow inbound HTTP/HTTPS to web server; allow all traffic from web server to database; deny all else

Answer

Allow inbound HTTP/HTTPS to web server; allow inbound SQL from internet to database; deny all else

Question 8

During an incident, the security team detects unusual outbound traffic from a server that normally does not communicate externally. The traffic appears to be encrypted and is sent to an unknown IP address. Which incident category best describes this scenario?

Accepted Answer

Data breach. Unauthorized access or data exfiltration is indicated by unusual outbound traffic to an unknown IP, suggesting a compromised server sending data externally.

Answer

Malware

Answer

Denial of service

Answer

Social engineering

Question 9

Which incident category involves an attacker tricking an employee into revealing credentials?

Accepted Answer

Social engineering. Social engineering includes phishing, pretexting, etc., to manipulate people.

Answer

Data breach

Answer

Malware

Answer

Denial of service

Question 10

A company’s backup strategy: Full backup every Sunday, differential backups Monday through Saturday. On Thursday, the system fails. How many backups are needed to restore the data?

Accepted Answer

Two: Sunday full and Thursday differential. A differential backup contains all changes since the last full backup. So you only need the full backup from Sunday and the differential from Thursday.

Answer

One: Thursday differential only

Answer

Four: Monday through Thursday differentials

Answer

Five: Monday through Thursday differentials plus full

Question 11

An organization determines that its critical financial application has a maximum tolerable downtime (MTD) of 8 hours. The recovery time objective (RTO) is set to 6 hours, and the work recovery time (WRT) is 2 hours. If the application is restored from backup in 5 hours, but additional configuration takes 3 hours, what is the total downtime, and is the MTD met?

Accepted Answer

Total downtime 8 hours, MTD met. Total downtime = restoration (5 hours) + configuration (3 hours) = 8 hours, which equals MTD of 8 hours. So MTD is met (equal to MTD is acceptable).

Answer

Total downtime 10 hours, MTD exceeded

Answer

Total downtime 8 hours, MTD exceeded

Answer

Total downtime 5 hours, MTD met

Question 12

An organization needs to prioritize recovery of systems after a disaster. Which metric directly indicates the maximum acceptable outage time for a business function?

Accepted Answer

Maximum Tolerable Downtime (MTD). Maximum Tolerable Downtime (MTD) is the maximum time a business function can be unavailable before causing unacceptable harm.

Answer

Recovery Time Objective (RTO)

Answer

Recovery Point Objective (RPO)

Answer

Work Recovery Time (WRT)

Question 13

A company uses a backup strategy where on Monday a full backup is taken, and on Tuesday only data changed since Monday is backed up. On Wednesday, the backup includes all data changed since Monday. What type of backup is the Wednesday backup?

Accepted Answer

Differential backup. Differential backup includes changes since last full backup.

Answer

Incremental backup

Answer

Synthetic full backup

Answer

Full backup

Question 14

An organization is creating a Business Continuity Plan (BCP). Which analysis should be performed first to identify critical business functions and their dependencies?

Accepted Answer

Business Impact Analysis. A Business Impact Analysis (BIA) is the first step in BCP to identify critical functions, dependencies, and recovery priorities.

Answer

Risk Assessment

Answer

Vulnerability Assessment

Answer

Gap Analysis

Question 15

A network administrator is configuring a DMZ for a company's web and email servers. Which firewall rule is most appropriate for traffic from the internet to the DMZ?

Accepted Answer

Allow inbound HTTP, HTTPS, SMTP, and DNS to DMZ. A DMZ must selectively permit essential services from the internet to the public-facing servers while blocking all other inbound traffic. HTTP (80), HTTPS (443), SMTP (25), and DNS (53) are the standard protocols required for web and email servers to function. This rule implements the principle of least privilege by allowing only the necessary traffic to the DMZ.

Answer

Deny all inbound traffic to DMZ but allow outbound

Answer

Allow inbound only to the web server on ports 80 and 443

Answer

Allow all inbound traffic to DMZ