ISC2 CC Practice Test 38 — 15 Questions

Question 1

Which THREE of the following are best practices for privileged account management? (Select THREE.)

Accepted Answer

Use a Privileged Access Management (PAM) solution to monitor and control admin access. Privileged accounts require special controls like separate accounts, PAM, and least privilege.

Answer

Use the same admin account for daily tasks to simplify management

Answer

Grant administrators full access to all systems at all times for convenience

Question 2

A security administrator is configuring access rights for a new employee. Which principle ensures the employee is granted only the minimum permissions necessary to perform their job duties?

Accepted Answer

Least privilege. Least privilege means granting only the minimum permissions needed, reducing the blast radius of account compromise.

Answer

Separation of duties

Answer

Need-to-know

Answer

Defense in depth

Question 3

Which THREE are key components of Active Directory? (Select THREE.)

Accepted Answer

Users. Active Directory includes users, groups, and organizational units (OUs). LDAP is a protocol, not a component.

Answer

Firewalls

Answer

LDAP

Question 4

A visitor enters a company building and is required to sign in, present identification, and wear a visitor badge. This is an example of which type of access control?

Accepted Answer

Physical access control. Visitor management procedures are part of physical access controls to monitor and restrict entry.

Answer

Logical access control

Answer

Administrative control

Answer

Technical control

Question 5

A company's network has multiple VLANs. An attacker on VLAN 10 sends a frame with a forged source MAC address to a switch, hoping to intercept traffic intended for the default gateway. Which attack is being executed?

Accepted Answer

ARP spoofing. ARP spoofing (or ARP poisoning) involves sending forged ARP messages to associate the attacker's MAC with the IP of another device (e.g., default gateway), enabling traffic interception.

Answer

IP spoofing

Answer

VLAN hopping

Answer

MAC flooding

Question 6

A security administrator is selecting controls to protect the confidentiality of a database containing customer PII. Which TWO controls are most appropriate?

Accepted Answer

Access control lists. Encryption protects data confidentiality; access controls restrict who can view data.

Answer

Hashing

Answer

Load balancing

Answer

Redundant power supplies

Question 7

Which THREE are commonly defined in a disaster recovery plan? (Select exactly 3.)

Accepted Answer

Recovery point objective. Recovery point objective (RPO) is a core metric defined in a disaster recovery plan because it specifies the maximum acceptable amount of data loss measured in time. For example, an RPO of 1 hour means backups must be taken at least every hour to ensure no more than 60 minutes of data is lost. This directly drives backup frequency and replication technology choices, such as synchronous vs. asynchronous replication.

Answer

Cost-benefit analysis

Answer

Annual loss expectancy

Question 8

An analyst reviews the firewall log exhibit. The source IP 10.0.1.100 is an internal web server. The destination IP 203.0.113.50 is an external host. What does this log pattern MOST likely indicate?

Accepted Answer

A denial-of-service (DoS) attack from the internal server to the external host. The log pattern shows the internal web server (10.0.1.100) sending traffic to an external host (203.0.113.50). In a typical network, internal web servers serve content to internal users, not initiate outbound connections to external hosts. This anomalous outbound traffic pattern, especially if it involves a high volume of packets or connections, is characteristic of a denial-of-service (DoS) attack where the internal server is used as a source to flood the external target, potentially due to compromise or misconfiguration.

Answer

A port scan from the internal server to the external host

Answer

Normal web traffic from the server to the external host

Answer

An attempted SQL injection attack from the external host to the internal server

Question 9

A security auditor discovers that a user has been granted read and write access to a sensitive file, but the user's job only requires read access. Which access control principle has been violated?

Accepted Answer

Least privilege. The principle of least privilege dictates that users should be granted only the minimum permissions necessary to perform their job functions. Granting write access when only read access is required violates this principle by providing unnecessary and potentially harmful capabilities. This is a core access control concept in the CC exam.

Answer

Job rotation

Answer

Need-to-know

Answer

Separation of duties

Question 10

A company's BCP requires that critical systems be restored within 2 hours of disruption. Which metric defines this?

Accepted Answer

Recovery Time Objective (RTO). The Recovery Time Objective (RTO) defines the maximum acceptable time that a system or application can be unavailable after a disruption. In this scenario, the requirement to restore critical systems within 2 hours directly specifies the RTO. It is a key metric in business continuity planning that drives the design of failover and recovery strategies.

Answer

Mean Time to Repair (MTTR)

Answer

Service Level Agreement (SLA)

Answer

Recovery Point Objective (RPO)

Question 11

A company's backup strategy involves daily full backups only. What is the primary risk associated with this approach?

Accepted Answer

Recovery Time Objective (RTO) may be exceeded due to long restore. With daily full backups only, the Recovery Point Objective (RPO) is effectively 24 hours, which may be acceptable depending on business requirements. However, the primary risk is that restoring from a single full backup can take a very long time, especially for large datasets, potentially exceeding the Recovery Time Objective (RTO). This is because full backups contain all data and must be restored entirely, unlike incremental or differential backups that allow faster recovery by restoring only changed blocks.

Answer

Recovery Point Objective (RPO) may be too long

Answer

High cost of backup storage

Answer

Data corruption could spread across backups

Question 12

Which statement best describes a warm site in disaster recovery?

Accepted Answer

It has hardware and network equipment but requires data restoration from backups. A warm site is a middle-ground disaster recovery option that has hardware and network infrastructure pre-installed but does not have live, synchronized data. Instead, data must be restored from backups (e.g., tape or disk snapshots) before operations can resume. This contrasts with a hot site, which maintains real-time data replication and fully active systems.

Answer

It has replicated data but no active systems

Answer

It is fully operational with real-time data synchronization

Answer

It has no hardware or infrastructure installed

Question 13

Refer to the exhibit. A DBA is investigating a replication issue. What should be the FIRST action?

Accepted Answer

Verify data integrity on primary. Checksum mismatch indicates data corruption on one side. The first step is to verify data integrity on the primary to determine which copy is correct.

Answer

Restore table from backup

Answer

Reseed replication

Answer

Fail over to standby

Question 14

During an incident, an organization needs to preserve volatile data. Which of the following should be collected FIRST?

Accepted Answer

Memory contents. Volatile data is lost when the system loses power. Memory content is the most volatile.

Answer

Backup tapes

Answer

Hard drive contents

Answer

Network logs

Question 15

Which TWO of the following are common indicators of a ransomware attack?

Accepted Answer

Files with .encrypted extension.. Options D and E are correct because ransomware typically encrypts files and appends a new extension such as .encrypted (Option D) and displays a ransom note demanding payment for decryption (Option E). These are two of the most common indicators of a ransomware attack. In contrast, new user accounts (Option A) are not typically associated with ransomware, elevated system performance (Option B) is the opposite of what occurs, and a sudden decrease in network traffic (Option C) may indicate other issues but is not a direct indicator of ransomware.

Answer

New user accounts created.

Answer

Elevated system performance.

Answer

Sudden decrease in network traffic.