ISC2 CC Practice Test 36 — 15 Questions

Question 1

You are a SOC analyst for a financial institution. At 2:00 AM, your SIEM generates a critical alert from the email security gateway indicating that an internal user received a phishing email with a malicious attachment. The email was delivered to the user's inbox, and the user's account activity logs show that the attachment was opened 10 minutes ago. The user is a junior accountant who works in the accounts payable department. You have access to endpoint detection tools, email logs, and network traffic data. The organization's incident response policy requires containment within 30 minutes of detection. Which action should you take FIRST?

Accepted Answer

Isolate the user's workstation from the network to prevent lateral movement.. The incident response policy requires containment within 30 minutes. Isolating the workstation (e.g., via network access control or disabling the switch port) immediately stops any ongoing malicious activity, such as command-and-control communication or lateral movement, which is the highest priority after detection. This aligns with the NIST SP 800-61 containment strategy and the SANS PICERL model, where containment precedes eradication and recovery.

Answer

Scan the user's workstation with antivirus software.

Answer

Block the sender's email address at the email gateway.

Answer

Send an email to the user instructing them to delete the email.

Question 2

During a security incident, the incident response team isolates a compromised workstation from the network. What is the primary purpose of this action?

Accepted Answer

To prevent further damage.. Isolating a compromised workstation by disconnecting it from the network (e.g., disabling its switch port or unplugging the Ethernet cable) immediately stops all inbound and outbound traffic. This containment action prevents the attacker from moving laterally to other systems, exfiltrating data, or deploying additional malware, thereby limiting the scope and impact of the incident.

Answer

To comply with legal requirements.

Answer

To preserve forensic evidence.

Answer

To allow normal operations to continue.

Question 3

Refer to the exhibit. Based on the log entries, what type of attack is most likely occurring?

Accepted Answer

Dictionary attack.. The log entries show repeated failed login attempts using different usernames and passwords, which is characteristic of a dictionary attack where an attacker uses a list of common usernames and passwords to gain unauthorized access. Unlike a brute-force attack that tries all possible combinations, a dictionary attack uses a predefined list of likely credentials, making it more efficient and matching the pattern in the logs.

Answer

Brute-force attack.

Answer

Privilege escalation.

Answer

Denial of service.

Question 4

You are an IT administrator for a small business. The company has a backup system that performs nightly full backups of critical servers to an external hard drive. One morning, a user reports that they accidentally deleted an important file from a shared drive. You need to restore the file from last night's backup. However, when you connect the external hard drive to the backup server, the drive is not recognized, and you hear clicking sounds. The backup software shows that the most recent backup job completed successfully with no errors. What is the most likely cause of the problem?

Accepted Answer

The external hard drive has suffered a mechanical failure.. The clicking sound from the external hard drive is a classic symptom of a mechanical failure, typically caused by a stuck read/write head or a failing spindle motor. Since the backup software reported a successful completion, the data was likely written to the drive, but the drive's physical components have since failed, preventing the system from recognizing it. This is a hardware-level issue that cannot be resolved by software or driver updates.

Answer

The backup software did not actually write the data.

Answer

The file was not included in the backup job.

Answer

The backup server has a driver issue.

Question 5

Refer to the exhibit. Given the ACL shown, which traffic is allowed to reach 10.0.0.1?

Accepted Answer

HTTP and HTTPS only.. The ACL permits TCP traffic to destination 10.0.0.1 with destination port numbers 80 (HTTP) and 443 (HTTPS). Since the ACL ends with an implicit deny any, only HTTP and HTTPS traffic is allowed to reach 10.0.0.1. Option B is correct because the ACL explicitly permits these two services.

Answer

No traffic is allowed.

Answer

Only traffic from the internal network.

Answer

All TCP traffic from any source.

Question 6

Which TWO of the following are commonly used techniques to detect phishing emails? (Choose two.)

Accepted Answer

Sandboxing email attachments in a secure environment.. Sandboxing email attachments in a secure environment (Option C) is a common technique to detect phishing emails because it allows suspicious attachments to be executed and analyzed in an isolated virtual machine. This process observes the attachment's behavior for malicious activities, such as attempting to connect to a command-and-control server or dropping malware, without risking the actual endpoint. It is a core technology used in advanced email security gateways and threat intelligence platforms.

Answer

Scanning for specific file extensions.

Answer

Disabling automatic image loading.

Answer

Implementing DKIM and DMARC records.

Question 7

Which THREE of the following are common components of a disaster recovery plan?

Accepted Answer

Backup procedures. Backup procedures are a core component of a disaster recovery plan (DRP) because they ensure that critical data can be restored after a disruptive event. This includes defining backup frequency, storage locations (e.g., off-site or cloud), and the specific data to be backed up. Without documented backup procedures, recovery of systems and data would be uncoordinated and unreliable.

Answer

Password policy

Answer

Employee background checks

Question 8

A security analyst notices repeated failed login attempts from a single IP address targeting multiple user accounts. Which security control should be implemented to mitigate this attack?

Accepted Answer

Implement account lockout after a threshold of failed attempts.. Option A is correct because implementing an account lockout policy after a defined threshold of failed attempts (e.g., 5 failed attempts within 15 minutes) directly mitigates brute-force password guessing attacks from a single source. This control prevents an attacker from continuously trying different passwords across multiple accounts, effectively rate-limiting the attack at the authentication layer.

Answer

Enable single sign-on (SSO).

Answer

Require complex passwords.

Answer

Disable the accounts after one failed attempt.

Question 9

A medium-sized company uses a SIEM solution to collect logs from firewalls, servers, and endpoints. The security team receives an alert indicating a possible data exfiltration: an employee's workstation is sending large amounts of data to an external IP address outside business hours. The employee works in the finance department and has access to sensitive financial records. The SIEM shows the connection is ongoing. The security team must respond immediately to contain the incident while preserving evidence. The company's incident response plan designates the security team as first responders. Which of the following is the BEST first action?

Accepted Answer

Block the external IP address at the firewall and disconnect the workstation from the network.. Option B is correct because it stops the data flow and isolates the system, containing the incident. Option A could tip off an attacker if malicious and delays containment. Option C is important but should be performed after containment to preserve evidence. Option D delays response and may allow further damage.

Answer

Notify the employee's manager and wait for further instructions.

Answer

Call the employee to ask if they are transferring files for a legitimate business purpose.

Answer

Take a forensic image of the workstation's hard drive before anything else.

Question 10

A small business owner wants to ensure that their company's data remains accurate and unaltered during transmission over the internet. They regularly send financial reports to their accountant via email. The owner is concerned that a hacker might intercept and modify the reports before they reach the accountant. Which security principle is most directly threatened in this scenario, and what is the best technical control to implement?

Accepted Answer

Integrity; apply a digital signature or hash to the files. Correct: Integrity is threatened; using digital signatures or hashing ensures data integrity. Option A is wrong because confidentiality protects secrecy, not accuracy; Option B is wrong because availability ensures access, not integrity; Option D is wrong because non-repudiation prevents denial, but the immediate threat is modification.

Answer

Confidentiality; encrypt the email attachments

Answer

Non-repudiation; require read receipts

Answer

Availability; use a redundant email server

Question 11

You are the IT security officer for a hospital that handles protected health information (PHI). The hospital uses an electronic health record (EHR) system. You receive a report that a nurse accessed the medical records of a celebrity patient without a legitimate medical reason. The access was logged. The hospital policy requires all employees to access only the minimum necessary information for their job duties. The nurse claims they were just curious. This is a violation of which security principle, and what is the best course of action?

Accepted Answer

Least privilege; revoke the nurse's access to the EHR system and initiate disciplinary proceedings. Correct: Violation of least privilege; the nurse should have only been granted access to records necessary for their job. The best course is to revoke access and follow disciplinary procedures (B). Option A is wrong because it doesn't address the root cause; Option C is wrong because encryption doesn't prevent unauthorized access; Option D is wrong because disabling access for all nurses is excessive.

Answer

Confidentiality; encrypt all patient records

Answer

Accountability; disable access for all nurses to the EHR

Answer

Least privilege; send a warning to the nurse

Question 12

A company has implemented a role-based access control (RBAC) system. A new employee in the finance department is granted the 'Finance User' role, which allows them to view invoices but not create payments. However, after a system upgrade, it is discovered that the 'Finance User' role now includes the ability to create payments due to a misconfiguration. The employee did not request this additional privilege and has not exploited it. The security team is notified. Which principle has been violated, and what is the most appropriate immediate action?

Accepted Answer

Least privilege; correct the role permissions to only what is necessary. Correct: Least privilege is violated because the employee has more permissions than needed. The immediate action is to correct the role permissions and revert the misconfiguration (C). Option A is wrong because the employee did not misuse the privilege; Option B is wrong because disabling the account prevents work; Option D is wrong because removing the role altogether is too broad.

Answer

Separation of duties; disable the employee's account until an investigation is complete

Answer

Accountability; remove the 'Finance User' role from all employees

Answer

Least privilege; revoke the employee's access permanently

Question 13

A government agency stores classified documents on a secure server. The server is connected to the internet, but access is restricted using a firewall and requires two-factor authentication. An auditor discovers that the server's operating system has not been patched for over a year, making it vulnerable to remote code execution attacks. Which security principle is most directly compromised by this missing patch, and what is the best corrective action?

Accepted Answer

Integrity; apply the security patch immediately. Correct: Availability and integrity could be compromised by unpatched vulnerabilities. The best action is to apply the patch (B) as soon as possible. Option A is wrong because patching after testing is good but immediate application is needed; Option A delays; Option C is wrong because it doesn't fix the vulnerability; Option D is wrong because disconnecting all servers is excessive.

Answer

Confidentiality; test the patch in a dev environment first before applying to production

Answer

Non-repudiation; disconnect the server from the internet

Answer

Availability; use a load balancer to distribute traffic

Question 14

A small manufacturing company's IT infrastructure consists of a single server running ERP and file services, with a nightly backup to an external hard drive. The server fails due to hardware failure. The company's BCP states that the ERP system must be restored within 8 hours. The backup is 12 hours old. The IT administrator has a spare server of similar configuration. What is the BEST course of action?

Accepted Answer

Install the backup onto the spare server and restore the data from the external hard drive.. Option C is correct because the spare server has a similar configuration, allowing the IT administrator to install the backup software and restore the ERP system and file data from the external hard drive. This approach meets the 8-hour RTO by leveraging the existing backup, even though it is 12 hours old, as the restore process is straightforward and does not require ordering new hardware or migrating to a cloud platform.

Answer

Use cloud-based ERP temporarily.

Answer

Perform a bare-metal restore using the backup.

Answer

Order a new server from the vendor (lead time 3 days).

Question 15

A small financial firm has a single server that hosts a critical database and also runs a web application. The server is located in a closet with a simple lock. An intern accidentally left the closet door open, and an unauthorized person gained physical access, connected a laptop to the server, and copied the database. The company wants to prevent such incidents in the future. Which of the following is the most effective course of action?

Accepted Answer

Move the database to a separate server and apply encryption.. Moving the database to a separate server and encrypting it reduces the risk of data theft from physical access. CCTV is detective, 2FA protects remote access, and strong ACLs can be bypassed with physical control of the server.

Answer

Require two-factor authentication for database access.

Answer

Implement strong access controls on the database files.

Answer

Install a CCTV camera in the server closet.