ISC2 CC Practice Test 36 — 15 Questions

Question 1

In a directory service using LDAP, what is the distinguished name (DN) for a user named John Smith in the Sales organizational unit of the company domain company.com?

Accepted Answer

CN=John Smith, OU=Sales, DC=company, DC=com. An LDAP distinguished name is written from the most specific component (the leaf object) to the least specific (the root of the directory tree), separated by commas. For John Smith in the Sales OU of company.com, the correct order is CN=John Smith, OU=Sales, DC=company, DC=com. The CN identifies the user object, the OU identifies the organizational unit, and the DC components identify the domain.

Answer

DC=company, DC=com, OU=Sales, CN=John Smith

Answer

OU=Sales, CN=John Smith, DC=company, DC=com

Answer

CN=John Smith, DC=Sales, DC=company, DC=com

Question 2

A security analyst is reviewing an alert from the IDS that shows a large number of TCP SYN packets sent to a single port on multiple internal hosts from a single external IP address. The analyst suspects a reconnaissance attack. Which type of attack is this most likely?

Accepted Answer

SYN scan. This is most likely a SYN scan (option D), a reconnaissance technique where an attacker sends TCP SYN packets to a specific port on multiple hosts to determine if the port is open. A SYN scan is stealthier than a full TCP connect scan because it never completes the three-way handshake, leaving fewer logs. The IDS alert describes the hallmark behavior of a SYN scan: a single external IP targeting the same port across many internal hosts.

Answer

SYN flood

Answer

Ping sweep

Answer

Smurf attack

Question 3

Refer to the exhibit. Which statement best describes compliance with the recovery objectives?

Accepted Answer

Compliant with RTO but not RPO. The exhibit shows the required RTO is 4 hours and the actual RTO is 4 hours, meaning the system recovers within the allowed downtime, so it is compliant with RTO. However, the backup interval is 4 hours, so the actual RPO is 4 hours, which exceeds the required RPO of 1 hour. This means up to 4 hours of data could be lost, failing RPO compliance. Therefore, the correct answer is B.

Answer

Compliant with both RTO and RPO

Answer

Compliant with neither

Answer

Compliant with RPO but not RTO

Question 4

A company's security policy requires that all incident response activities be logged and that evidence be preserved for potential legal action. During an incident, a responder mistakenly uses a personal USB drive to copy log files. Which principle of forensic evidence handling has been violated?

Accepted Answer

Chain of custody. The chain of custody is a documented record that tracks the seizure, control, transfer, analysis, and disposition of evidence. By using a personal USB drive to copy log files, the responder introduces an unverified and uncontrolled storage medium, breaking the documented chain and making it impossible to prove that the evidence was not tampered with or contaminated. This directly violates the requirement to preserve evidence for potential legal action.

Answer

Integrity

Answer

Availability

Answer

Confidentiality

Question 5

Which TWO of the following are examples of security principles?

Accepted Answer

Least privilege. Least privilege (B) is a foundational security principle stating that users, processes, and systems should be granted only the minimum access rights and permissions necessary to perform their required tasks, reducing the attack surface and limiting potential damage from compromise. Defense in depth (E) is also a core security principle advocating for multiple layered controls (administrative, technical, and physical) so that if one control fails, others still provide protection. By contrast, encryption (A) is a specific technical control or mechanism used to protect data confidentiality, not a guiding principle. A firewall (C) is a network security device or software that filters traffic based on rules, and a VLAN (D) is a network segmentation technology at Layer 2; both are implementation tools rather than overarching security principles.

Answer

Encryption

Answer

Firewall

Answer

VLAN

Question 6

During a disaster recovery test, the IT team successfully restored systems from backups and achieved the recovery time objective (RTO). However, users could not resume normal work because additional configuration and data validation were needed. Which metric was NOT met?

Accepted Answer

Work Recovery Time (WRT). Work Recovery Time (WRT) is the time required to restore business operations after systems are technically recovered. In this scenario, systems were restored within RTO, but users could not resume work due to additional configuration and data validation, meaning WRT was not met. Therefore, WRT is the metric not met.

Answer

Recovery Point Objective (RPO)

Answer

Maximum Tolerable Downtime (MTD)

Answer

Recovery Time Objective (RTO)

Question 7

Which of the following is a recommended practice for administrative accounts?

Accepted Answer

Use a separate admin account distinct from daily use account. Using a separate administrative account distinct from a daily-use account enforces least privilege and separation of duties. If the daily account is compromised via phishing or malware, the attacker does not automatically gain administrative rights. This practice also ensures accountability, as administrative actions are logged under a dedicated identity.

Answer

Use the same account for daily work and admin tasks

Answer

Grant admin rights to all users for convenience

Answer

Disable all admin accounts to improve security

Question 8

Which of the following are examples of sensitive PII? (Select all that apply.)

Accepted Answer

Medical records. Sensitive PII includes data that, if disclosed, could cause harm or be used for identity theft. Medical records and Social Security numbers are classic examples of sensitive PII because they contain highly confidential information. Phone numbers and name/email address are generally considered PII but not necessarily sensitive PII on their own.

Answer

Phone number

Answer

Name and email address

Question 9

Which two of the following are examples of physical access controls? (Select TWO)

Accepted Answer

Security guards. Security guards (A) are a physical access control because they are personnel who monitor and restrict entry to a facility, directly controlling who physically enters a protected area. Biometric door locks (E) are a physical access control because they use physiological traits such as fingerprints or retina patterns to authenticate a person and physically unlock a door. Encryption (B) is a logical/technical control that protects data confidentiality, not physical entry. Password policies (C) are administrative controls governing authentication credentials, not physical access. Firewall rules (D) are technical network controls that filter traffic, not physical access controls.

Answer

Encryption

Answer

Password policies

Answer

Firewall rules

Question 10

A security engineer is reviewing logs and notices that an internal server is receiving excessive SYN packets from an external IP, but never completing the three-way handshake. What type of attack is likely occurring?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets to a target server without completing the handshake (i.e., not sending the final ACK). This exhausts the server's connection table resources, preventing legitimate connections. The log evidence—excessive SYN packets from an external IP with no handshake completion—is the classic signature of a SYN flood.

Answer

Smurf attack

Answer

Ping of death

Answer

ARP poisoning

Question 11

A company uses a backup strategy where on Monday a full backup is taken, and on Tuesday only data changed since Monday is backed up. On Wednesday, the backup includes all data changed since Monday. What type of backup is the Wednesday backup?

Accepted Answer

Differential backup. A differential backup captures all data changed since the last full backup, regardless of how many incremental or differential backups have occurred since. Since Monday's full backup is the baseline and Wednesday's backup includes everything changed since Monday, it is a differential backup. It does not reset the baseline, so Thursday's differential would also include Tuesday's and Wednesday's changes.

Answer

Incremental backup

Answer

Synthetic full backup

Answer

Full backup

Question 12

According to the (ISC)² Code of Ethics, if a conflict arises between protecting society and providing diligent service to your employer, which should take precedence?

Accepted Answer

Protect society. The (ISC)² Code of Ethics establishes a strict priority order among its canons, with 'Protect society, the common good, necessary public trust and confidence, and the infrastructure' as the highest obligation. When this conflicts with providing diligent service to an employer or client, protecting society must take precedence. This hierarchy ensures that security professionals prioritize public safety over commercial or contractual interests.

Answer

Advance the profession

Answer

Act honorably

Answer

Provide diligent service

Question 13

A network administrator needs to ensure that sensitive financial data remains confidential while in transit over the internet. Which technology should they implement?

Accepted Answer

TLS 1.3. TLS 1.3 is the correct choice because it is a transport-layer cryptographic protocol specifically designed to provide confidentiality (encryption) and integrity for data in transit over untrusted networks like the internet. It negotiates ephemeral session keys via a handshake and encrypts application traffic using AEAD ciphers such as AES-GCM or ChaCha20-Poly1305. The other options address different security goals or operate at different layers.

Answer

Digital signatures

Answer

SHA-256

Answer

AES-256

Question 14

A company deploys a web application firewall (WAF), performs regular vulnerability scans, and implements strict access controls. Which security principle is being applied?

Accepted Answer

Defense in depth. Defense in depth is the security principle of layering multiple independent security controls so that if one fails, others still provide protection. The question describes three distinct layers: a WAF (application-layer filtering), vulnerability scanning (proactive detection), and strict access controls (preventive policy). This stacking of different types of controls across the network, host, and application layers is the textbook definition of defense in depth.

Answer

Accountability

Answer

Risk management

Answer

Least privilege

Question 15

A network engineer wants to mitigate ARP spoofing attacks. Which of the following is the most effective technique?

Accepted Answer

Implement Dynamic ARP Inspection. Dynamic ARP Inspection (DAI) is a security feature on switches that validates ARP packets in a network. It intercepts ARP requests and replies on untrusted ports, compares them against a trusted binding table (often built via DHCP snooping), and drops invalid or malicious ARP packets. This directly prevents ARP spoofing by ensuring only legitimate ARP mappings are allowed.

Answer

Enable STP

Answer

Use static ARP entries

Answer

Disable ICMP