ISC2 CC Practice Test 37 — 15 Questions

Question 1

A small company has a single flat network with no segmentation. They recently experienced a malware outbreak that spread quickly across all devices. The IT manager wants to implement network segmentation to contain future outbreaks with minimal cost and complexity. The company currently has a single switch and a router/firewall appliance. The network consists of three departments: Sales, HR, and Engineering. After analyzing the requirements, what is the best course of action?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Replace the single switch with multiple managed switches and create VLANs for each department, then connect them to the firewall. VLANs logically segment the flat network into separate broadcast domains for Sales, HR, and Engineering, containing malware spread at Layer 2. Using multiple managed switches with VLANs and trunking to the firewall allows inter-VLAN traffic to be inspected and controlled by the firewall, providing segmentation with minimal cost and complexity. This approach leverages existing hardware (router/firewall) and avoids the expense of additional appliances.

Answer

Deploy a next-generation firewall between the switch and the router to inspect traffic

Answer

Implement 802.1X authentication on the switch to control device access

Answer

Install host-based firewalls on all endpoints

Question 2

During a disaster recovery exercise, the backup systems are not available because the storage array failed. Which of the following should be done FIRST?

Accepted Answer

Activate the disaster recovery plan. When backup systems are unavailable due to a storage array failure, the first action must be to activate the disaster recovery plan (DRP). The DRP is the predefined, documented set of procedures that guides the organization through the recovery process, including escalation, communication, and alternative recovery methods. Without activating the plan, subsequent steps like contacting vendors or restoring from tape lack coordination and may violate recovery time objectives (RTOs) and recovery point objectives (RPOs).

Answer

Contact the vendor

Answer

Restore from offsite tape

Answer

Order replacement hardware

Question 3

An employee receives an email from the CEO asking for an urgent wire transfer to a new vendor. The email address is slightly misspelled. What type of attack is this?

Accepted Answer

Phishing. This is a social engineering attack, specifically phishing (or business email compromise), aiming to trick the employee into transferring money.

Answer

Shoulder surfing

Answer

USB drop attack

Answer

Tailgating

Question 4

During a tabletop exercise for a data center outage, the IT manager realizes that the disaster recovery plan does not specify how to failover the database cluster. The primary data center fails completely. The standby site has a replica of the database, but the application team cannot promote it because they lack the necessary privileges. What is the most likely cause of this gap?

Accepted Answer

The DR plan did not include role-based access for failover operations. The scenario explicitly states that the application team lacks the necessary privileges to promote the standby database. This indicates that the disaster recovery plan did not define role-based access controls (RBAC) or assign failover permissions to specific personnel or groups. Without documented roles and privileges, even a fully replicated standby database cannot be promoted, causing a failover gap.

Answer

The standby site's network connectivity was not tested

Answer

The database replication configuration was incorrect

Answer

The database failover procedure was not documented

Question 5

An organization has implemented a network-based intrusion prevention system (IPS) in inline mode. After deployment, users report that legitimate web traffic is being blocked. What is the most likely cause?

Accepted Answer

The IPS signature set is too aggressive or includes false positives.. An inline IPS actively inspects and can block traffic based on its signature database. If the signature set is too aggressive or contains false positives, legitimate traffic matching those signatures will be incorrectly blocked. This is the most direct cause of blocking legitimate web traffic after deployment.

Answer

The IPS is not receiving traffic due to a tap failure.

Answer

The IPS is placed behind the firewall instead of in front.

Answer

The IPS is configured in promiscuous mode.

Question 6

A network administrator needs to provide secure remote access to internal resources for employees working from home. The solution must encrypt all traffic and authenticate users before granting access. Which protocol should be used?

Accepted Answer

SSL/TLS VPN. C is correct because SSL/TLS VPNs (e.g., Cisco AnyConnect) provide encrypted tunnels over HTTPS (port 443) and support user authentication via certificates, RADIUS, or LDAP. This allows secure remote access to internal resources without requiring a persistent IPsec tunnel, making it ideal for home workers with dynamic IPs.

Answer

SSH

Answer

IPsec

Answer

SNMPv3

Question 7

A security analyst detects unusual outbound traffic from a server that suggests a data breach. According to GDPR, within what timeframe must the organization notify the supervisory authority?

Accepted Answer

72 hours. GDPR mandates notification within 72 hours of awareness of a breach.

Answer

48 hours

Answer

7 days

Answer

24 hours

Question 8

An organization is updating its incident response plan. Which THREE elements should be included in the preparation phase? (Select THREE.)

Accepted Answer

Conducting tabletop exercises. Preparation includes establishing tools, training staff, and developing the plan.

Answer

Restoring data from backups

Answer

Notifying law enforcement

Question 9

An organization is choosing a backup strategy to minimize restore time. Which TWO backup types require only the most recent full backup and the latest differential backup to restore?

Accepted Answer

Full backup. To restore using only the most recent full backup and the latest differential backup, both a full backup and a differential backup are required. The differential backup captures all changes since the last full backup, so restoring the full backup followed by the latest differential provides the complete data. Therefore, the correct answer is full and differential.

Answer

Synthetic full backup

Answer

Incremental backup

Answer

Reverse incremental backup

Question 10

Which phase of the incident response process involves restoring systems to normal operations and confirming they are functioning correctly?

Accepted Answer

Recovery. Recovery is the phase after eradication where systems are restored and tested.

Answer

Detection

Answer

Containment

Answer

Eradication

Question 11

Which of the following is a potential security issue commonly found in firewall configurations?

Accepted Answer

Outbound traffic is not inspected for malicious content. A common firewall misconfiguration is to inspect only inbound traffic while allowing outbound traffic without inspection. This can allow malicious content such as command-and-control traffic or data exfiltration to leave the network undetected. Outbound traffic inspection is often overlooked, making it a potential security issue.

Answer

Logging is not enabled at session start

Answer

The source is too restrictive

Answer

The policy does not specify a destination

Question 12

Which of the following is the primary purpose of a visitor log and escort policy?

Accepted Answer

To provide a record of visitor access and ensure they are supervised. Visitor management controls physical access and ensures visitors are monitored.

Answer

To enforce least privilege for employees

Answer

To authenticate visitors using biometrics

Answer

To prevent visitors from accessing the internet

Question 13

An LDAP distinguished name is formatted as: CN=John Smith,OU=Sales,DC=company,DC=com. What does OU represent?

Accepted Answer

Organizational Unit. OU stands for Organizational Unit, a container within a directory tree.

Answer

Organization Unit

Answer

Object Unit

Answer

Operating Unit

Question 14

An organisation implements an account lockout policy that locks an account after 5 failed login attempts within 15 minutes. This control is designed to prevent:

Accepted Answer

Brute-force attacks. Account lockout mitigates brute-force password guessing attacks.

Answer

Denial-of-service attacks

Answer

Man-in-the-middle attacks

Answer

Phishing attacks

Question 15

A system administrator has an account with full administrative privileges. To reduce risk, the organization implements a policy requiring the admin to use a separate, non-privileged account for daily tasks like email and web browsing. This practice aligns with which principle?

Accepted Answer

Least privilege. Least privilege for administrators means using a separate admin account only when needed, limiting exposure of high-privilege credentials.

Answer

Separation of duties

Answer

Need-to-know

Answer

Defense in depth