ISC2 CC Practice Test 38 — 15 Questions

Question 1

A SOC analyst detects a pattern of outbound traffic from an internal server to a known malicious IP address. Which SOC tier should this alert be escalated to for a deeper investigation?

Accepted Answer

Tier 2. Tier 2 analysts handle escalated alerts that require deeper investigation, correlation across data sources, and threat hunting beyond the initial triage performed by Tier 1. An outbound connection to a known malicious IP is a confirmed suspicious indicator that exceeds Tier 1's scope of basic validation and false-positive filtering, so it escalates to Tier 2. Tier 3 is reserved for advanced threat hunting, malware reverse engineering, and major incidents.

Answer

Tier 3

Answer

Tier 1

Answer

Incident Response Team

Question 2

After an incident is resolved, which phase involves reviewing what happened, documenting lessons learned, and updating procedures?

Accepted Answer

Lessons learned. The Lessons Learned phase occurs after an incident is resolved and focuses on reviewing the response, documenting what happened, and updating procedures to prevent recurrence. It is a post-incident activity, distinct from the active response phases. Containment, eradication, and recovery all happen during the incident lifecycle before lessons learned.

Answer

Eradication

Answer

Containment

Answer

Recovery

Question 3

According to modern password guidance from NIST SP 800-63, which of the following is the most important factor when setting password requirements?

Accepted Answer

Enforcing a minimum length of at least 8 characters. NIST SP 800-63B explicitly recommends enforcing a minimum password length of at least 8 characters (and encourages longer, up to 64) as the primary strength control, while deprecating composition rules and mandatory rotation. Length is the dominant factor in resisting brute-force and dictionary attacks because it exponentially increases the search space. The guidance prioritizes memorized secrets that are long and unique over complex-but-short passwords.

Answer

Requiring a mix of uppercase, lowercase, numbers, and special characters

Answer

Using randomly generated passwords

Answer

Changing passwords every 30 days

Question 4

An organization has implemented a network-based intrusion prevention system (IPS) in inline mode. After deployment, users report that legitimate web traffic is being blocked. What is the most likely cause?

Accepted Answer

The IPS signature set is too aggressive or includes false positives.. An inline IPS actively inspects and can block traffic based on its signature database. If the signature set is too aggressive or contains false positives, legitimate traffic matching those signatures will be incorrectly blocked. This is the most direct cause of blocking legitimate web traffic after deployment.

Answer

The IPS is not receiving traffic due to a tap failure.

Answer

The IPS is placed behind the firewall instead of in front.

Answer

The IPS is configured in promiscuous mode.

Question 5

A security administrator notices that a user with standard privileges was able to modify a system file. Which security principle has been violated?

Accepted Answer

Least privilege. The principle of least privilege requires that users be granted only the permissions necessary to perform their job functions. A standard user modifying a system file indicates they have been assigned unnecessary administrative rights, violating this principle. This could occur if the user is a member of a group like Administrators or has been granted explicit write access to protected directories such as %SystemRoot%\System32.

Answer

Need to know

Answer

Defense in depth

Answer

Separation of duties

Question 6

An organization decides to implement a security control that can detect and block attacks in real-time by sitting inline in the network. Which of the following should be chosen to meet these requirements?

Accepted Answer

Intrusion Prevention System (IPS). An IPS is designed to sit inline in the traffic path, inspect packets in real time, and actively block malicious traffic by dropping or resetting connections. This matches the requirement to both detect and block attacks inline. An IDS only detects and alerts; it cannot block because it is not inline.

Answer

Intrusion Detection System (IDS)

Answer

Packet filtering firewall

Answer

Honeypot

Question 7

A security manager is designing a policy to prevent one person from both approving and disbursing payments. Which principle is being applied?

Accepted Answer

Separation of duties. Separation of duties ensures that no single individual has control over two or more phases of a critical transaction, such as both approving and disbursing payments. By splitting these responsibilities, the organization reduces the risk of fraud or error because collusion between two or more people would be required to bypass controls. In payment systems, this is often enforced through dual-authorization workflows in ERP or financial management software.

Answer

Need to know

Answer

Least privilege

Answer

Defense in depth

Question 8

A company's network uses a perimeter firewall and an internal firewall. The DMZ sits between them. A new application server needs to be accessible from the internet on TCP port 8443 and must be able to make outbound HTTPS connections to an external license server. Which firewall rules should be implemented? (Assume default deny)

Accepted Answer

Allow inbound from internet to server on 8443; allow outbound from server to internet on 443 with stateful inspection. It allows inbound traffic on TCP 8443 to the server and outbound traffic on TCP 443 from the server to the internet. Stateful inspection automatically tracks the outbound HTTPS connection and permits the return traffic (the license server's response) without needing an explicit inbound rule. This matches the requirement while maintaining a default-deny posture.

Answer

Allow inbound from internet to server on 8443; allow outbound from server to internet on 443; allow inbound from internet to server on 443 for license server response

Answer

Allow inbound from internet to server on 8443; allow outbound from server to internet on 443

Answer

Allow inbound from internet to server on 8443 and 443; allow outbound from server to internet on any

Question 9

Which of the following protocols operates at the Transport layer and provides reliable, connection-oriented communication?

Accepted Answer

TCP. TCP provides reliable delivery via acknowledgments and retransmissions, and uses a three-way handshake to establish a connection. UDP is connectionless and unreliable.

Answer

HTTP

Answer

IP

Answer

UDP

Question 10

Which authentication factor does a smart card represent?

Accepted Answer

Something you have. A smart card is a physical device that stores cryptographic keys or certificates, making it a classic 'something you have' factor. It requires possession of the card to authenticate, even if the user knows a PIN, because the PIN unlocks the card but does not replace the physical possession requirement.

Answer

Something you know

Answer

Somewhere you are

Answer

Something you are

Question 11

Which two of the following are characteristics of a stateful firewall? (Choose TWO.)

Accepted Answer

Tracks connection state. A stateful firewall tracks the state of active connections and can block unsolicited inbound traffic. Packet filtering is stateless, and application inspection is typical of proxy firewalls.

Answer

Inspects application-layer data

Answer

Operates only at Layer 3

Answer

Filters packets based on static rules only

Question 12

Match each network security concept to its purpose.

Accepted Answer

Firewall: Filters network traffic based on a set of security rules.. The correct matches are: Firewall filters traffic, IDS monitors and alerts, IPS blocks threats, VPN encrypts connections. Common confusions include swapping firewall and IPS functions, or confusing IDS with firewall capabilities.

Answer

Firewall: Detects and blocks suspicious activity.

Answer

IDS: Filters traffic based on rules.

Question 13

A company's security policy mandates that all changes to the firewall configuration must be approved by two different administrators before implementation. This is an example of which security principle?

Accepted Answer

Separation of duties. The requirement for two different administrators to approve firewall configuration changes enforces separation of duties. This principle ensures that no single individual has the authority to make unilateral changes, reducing the risk of unauthorized or malicious modifications. In firewall management, this prevents a single admin from bypassing security controls or introducing backdoors without oversight.

Answer

Defense in depth

Answer

Need to know

Answer

Least privilege

Question 14

An organization wants to implement a network security device that can block malicious traffic in real-time and must be placed inline. Which device should be chosen?

Accepted Answer

Intrusion Prevention System (IPS). An Intrusion Prevention System (IPS) is deployed inline in the traffic path and can actively block malicious traffic in real time by dropping or resetting malicious packets. Because it sits inline, it can make blocking decisions on live traffic, which is exactly what the requirement specifies. This distinguishes it from detection-only or passive tools.

Answer

Vulnerability scanner

Answer

Packet sniffer

Answer

Intrusion Detection System (IDS)

Question 15

A company places a web server and an email server in a separate network segment that is accessible from the internet but isolated from the internal LAN. What is this segment called?

Accepted Answer

DMZ. A DMZ (demilitarized zone) is a perimeter network segment that hosts internet-facing services such as web and email servers while keeping them isolated from the trusted internal LAN. It creates a buffer zone so that if a public-facing server is compromised, the attacker cannot directly pivot into internal systems. This matches the scenario exactly: internet-accessible but separated from the internal network.

Answer

VLAN

Answer

Honeypot

Answer

Subnet