ISC2 CC Practice Test 37 — 15 Questions

Question 1

A company follows the 3-2-1 backup rule. It has two full backups: one on an external hard drive in the server room and one on tape in a safe on-site. Which step should be taken to fully comply with the rule?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Store the tape copy in a secure offsite location. The 3-2-1 rule requires three copies of data (including the original), stored on at least two different media types, with at least one copy stored offsite. Currently, the company has the original data plus two backups (external HDD and tape) — three copies total — but both backups are on-site. To fully comply, one of the backup copies must be moved to an offsite location. Option B, storing the tape copy offsite, satisfies the '1 offsite' requirement.

Answer

No action needed; the rule is satisfied

Answer

Use cloud storage as an additional copy

Answer

Add a third copy to the external hard drive

Question 2

An organization is designing a defense-in-depth strategy for physical security. Which of the following are examples of layered physical controls? (Choose THREE.)

Accepted Answer

Fencing and bollards around the property. Option A (fencing and bollards around the property) is correct because these are perimeter physical controls that create the outermost defensive layer, deterring or blocking vehicles and intruders before they reach the building. Option B (biometric reader on server room door) is correct because it is an interior physical access control that authenticates a person's unique biological trait, adding a stronger layer protecting the high-value server room beyond the building entrance. Option E (access badge system at building entrance) is correct because it is a physical access control at the facility boundary, verifying authorized personnel and forming a layer between the perimeter and the server room. Option C (encryption of data at rest) is not a physical control but a logical/cryptographic control protecting data confidentiality. Option D (intrusion detection system on the network) is a logical/technical monitoring control, not a physical security layer.

Answer

Encryption of data at rest

Answer

Intrusion detection system on the network

Question 3

Refer to the exhibit.
```
C:\> netstat -an | find "LISTENING"
  TCP    0.0.0.0:80     0.0.0.0:0    LISTENING
  TCP    0.0.0.0:443    0.0.0.0:0    LISTENING
  TCP    192.168.1.10:3389  0.0.0.0:0    LISTENING
```
A server administrator runs this command and sees the output. Which service is listening on a port that should typically be disabled to reduce the attack surface?

Accepted Answer

Remote Desktop (port 3389). Remote Desktop Protocol (RDP) on port 3389 is a high-risk service that should typically be disabled on servers unless absolutely necessary, as it provides a direct graphical interface for remote administration and is a common target for brute-force attacks. The output shows RDP listening on a specific internal IP (192.168.1.10), indicating it is bound to a routable interface, which increases exposure. In contrast, HTTP (port 80) and HTTPS (port 443) are standard web services that are often required for a server's function, so they are not typically disabled for attack surface reduction.

Answer

HTTP (port 80)

Answer

All of the above

Answer

HTTPS (port 443)

Question 4

During a security incident, a forensic analyst needs to acquire the contents of RAM from a live system. Which tool should be used?

Accepted Answer

Memory dump tool like DumpIt. DumpIt is a purpose-built memory acquisition tool that captures the contents of volatile RAM on a live Windows system, preserving evidence such as running processes, encryption keys, and network connections. RAM contents are lost on power-off, so a live memory dump tool is required. Disk cloning, network capture, and antivirus scanning do not capture volatile memory.

Answer

Disk cloning tool like dd

Answer

Network monitoring tool like Wireshark

Answer

Antivirus scanner

Question 5

Which TWO of the following are fundamental security principles? (Select TWO.)

Accepted Answer

Defense in depth. Defense in depth (C) is a fundamental security principle because it layers multiple independent controls (network, host, application, data) so that if one control fails, others still protect the asset. Least privilege (D) is also fundamental: users, processes, and services should be granted only the minimum access rights needed to perform their function, limiting the blast radius of compromise or misuse. The other options are not fundamental security principles: fail-open (A) is an availability-oriented failure mode that weakens security by allowing access when a control fails, need to share (B) is the opposite of the need-to-know principle, and complexity (E) is a known enemy of security that increases attack surface and misconfiguration risk.

Answer

Fail-open

Answer

Need to share

Answer

Complexity

Question 6

Based on the exhibit, which statement about the access control list is true?

Accepted Answer

All IP traffic is permitted except ICMP. The exhibit shows an access control list (ACL) that explicitly denies ICMP traffic with the entry 'deny icmp any any' and then permits all other IP traffic with 'permit ip any any'. Since ACLs are processed sequentially and the 'permit ip any any' matches all IP protocols (including HTTP, HTTPS, etc.) except those already denied, the result is that all IP traffic is permitted except ICMP. This makes option A correct.

Answer

HTTP traffic is denied

Answer

Only HTTP traffic is permitted

Answer

ICMP echo requests are permitted

Question 7

An organization is developing a data classification policy. Which THREE of the following should be classified as Confidential or higher? (Select THREE)

Accepted Answer

Customer personally identifiable information (PII). Option A (customer PII) is correct because personally identifiable information is regulated by laws such as GDPR and CCPA and its exposure can cause identity theft, so it must be classified Confidential or higher. Option C (financial records and projections) is correct because unaudited financials, forecasts, and internal accounting data are material non-public information whose disclosure can harm the organization or violate securities regulations. Option D (trade secrets and intellectual property) is correct because trade secrets derive their value from secrecy, and unauthorized disclosure destroys legal protection and competitive advantage. Option B (public company press releases) is not correct because press releases are intentionally published for public consumption and are therefore Public. Option E (marketing brochures) is not correct because marketing brochures are distributed externally to promote products and contain no sensitive data, making them Public as well.

Answer

Public company press releases

Answer

Marketing brochures

Question 8

An organization decides to implement multiple security controls, including firewalls, intrusion detection systems, and antivirus software. Which security principle does this represent?

Accepted Answer

Defense in depth. Defense in depth is the practice of layering multiple independent security controls (firewalls, IDS, antivirus, etc.) so that if one control fails, others still provide protection. Deploying firewalls, IDS, and antivirus together is the textbook example of this layered approach, reducing the likelihood that a single bypass compromises the environment.

Answer

Least privilege

Answer

Risk avoidance

Answer

Separation of duties

Question 9

Which of the following is a common mitigation technique for a SYN flood attack?

Accepted Answer

SYN cookies. SYN cookies are the canonical mitigation for SYN flood attacks. When the SYN backlog is exhausted or under stress, the server encodes connection state into the initial sequence number (ISN) of the SYN-ACK rather than allocating a half-open socket, so no state is consumed until the client returns the final ACK. This defeats the attacker's ability to exhaust the backlog with spoofed SYNs.

Answer

Use UDP instead of TCP

Answer

Disable TCP timestamps

Answer

Increase the TCP backlog queue

Question 10

According to the (ISC)² Code of Ethics, which principle has the highest priority?

Accepted Answer

Protect society. The (ISC)² Code of Ethics prioritizes protecting society, the common good, and public safety above all.

Answer

Act honorably

Answer

Advance the profession

Answer

Provide diligent service

Question 11

Which TWO are principles of access control?

Accepted Answer

Separation of duties. Separation of duties (A) is a fundamental access control principle because it divides critical tasks among multiple people so that no single individual has enough authority to compromise the system, thereby preventing fraud and error. Least privilege (E) is also a core access control principle, requiring that users be granted only the minimum permissions necessary to perform their job functions, which limits the potential damage from accidents or malicious activity. In contrast, security through obscurity (B) is a discouraged practice of relying on secrecy of design rather than sound security controls, not an access control principle. Multifactor authentication (C) and single sign-on (D) are authentication mechanisms or convenience technologies, not foundational access control principles.

Answer

Security through obscurity

Answer

Multifactor authentication

Answer

Single sign-on (SSO)

Question 12

Which TWO of the following are examples of integrity controls? (Select TWO)

Accepted Answer

Digital signatures. Digital signatures (B) are an integrity control because they use asymmetric cryptography to create a verifiable value over a message, allowing the recipient to detect any modification to the data and confirm the signer's identity. Hashing (E) is also an integrity control because a cryptographic hash function such as SHA-256 produces a fixed-length digest that changes if even one bit of the input changes, enabling detection of unauthorized alteration. Redundancy (A) primarily supports availability by duplicating components or data, not by detecting modification. Firewalls (C) are network access controls that enforce confidentiality and availability boundaries rather than data integrity. Encryption (D) is chiefly a confidentiality control, since it protects data from disclosure, although it may incidentally hinder tampering.

Answer

Redundancy

Answer

Firewalls

Answer

Encryption

Question 13

A company's backup strategy requires daily full backups of all servers. The backup window is 4 hours. What is the primary risk if backups consistently take longer than the window?

Accepted Answer

Backups may interfere with production operations. When backups consistently exceed the 4-hour window, they overlap with production hours, causing resource contention (CPU, I/O, network bandwidth) that degrades application performance and user experience. This directly risks production operations, as backup jobs compete with live workloads for system resources.

Answer

Compliance requirements may be violated

Answer

Backup media may fill up

Answer

Backups may be corrupted

Question 14

What is the primary purpose of a Privileged Access Management (PAM) solution?

Accepted Answer

To control and monitor privileged access to critical systems. A Privileged Access Management (PAM) solution is specifically designed to secure, control, and monitor the use of privileged accounts—such as root, administrator, or service accounts—that have elevated access to critical systems. It typically provides features like credential vaulting, session recording, just-in-time access, and approval workflows to prevent misuse and detect malicious activity. Unlike general IAM or SSO tools, PAM focuses on the highest-risk accounts and enforces least privilege for administrative actions. Thus, option D accurately captures its primary purpose.

Answer

To provide single sign-on for all applications

Answer

To manage visitor access to the building

Answer

To enforce password complexity for all users

Question 15

An organization decides to accept the risk of using a legacy system that cannot be patched due to critical business operations. This is an example of:

Accepted Answer

Risk acceptance. Risk acceptance is the deliberate decision to acknowledge a risk and take no action to reduce it, typically because the cost of mitigation outweighs the benefit or because the risk is unavoidable. In this scenario, the organization recognizes the vulnerability in the legacy system but chooses to continue operating it due to critical business needs, which is a textbook example of risk acceptance. This is a formal risk response strategy where the organization documents the decision and may implement compensating controls, but does not eliminate or transfer the risk.

Answer

Risk transfer

Answer

Risk avoidance

Answer

Risk mitigation