ISC2 CC Practice Test 39 — 15 Questions

Question 1

A company is implementing a security information and event management (SIEM) system. Which data source is most critical for detecting an ongoing brute-force attack?

Accepted Answer

Authentication logs.. Authentication logs record successful and failed login attempts, which are directly indicative of brute-force attacks. Other logs may provide supporting information but are not as directly tied to the attack.

Answer

DNS logs.

Answer

Firewall logs.

Answer

Application logs.

Question 2

An organization is implementing a new logging policy. Which type of data should be excluded from logs to comply with privacy regulations?

Accepted Answer

Personal identifiable information (PII). Personal Identifiable Information (PII) should be excluded from logs to comply with privacy regulations like GDPR. Options A, B, and D are typically safe to log and important for security monitoring.

Answer

System performance metrics

Answer

User authentication attempts

Answer

Network traffic patterns

Question 3

Which THREE of the following are considered essential security principles according to ISC2?

Accepted Answer

Separation of duties. Correct: A, C, E. Separation of duties, non-repudiation, and least privilege are considered essential security principles according to ISC2. Encryption and biometrics are security mechanisms or controls, not foundational principles.

Answer

Encryption

Answer

Biometrics

Question 4

Which TWO principles are essential for ensuring accountability in an information system? (Choose two.)

Accepted Answer

Audit trails

Answer

Confidentiality

Answer

Availability

Answer

Least privilege

Question 5

Which THREE are core components of the CIA triad? (Choose three.)

Accepted Answer

Confidentiality

Answer

Accountability

Answer

Non-repudiation

Question 6

An organization is developing a security policy that defines the rules for acceptable use of company resources. Which principle should guide the creation of this policy to ensure it is enforceable and effective?

Accepted Answer

Least privilege. Least privilege minimizes risk by granting only necessary access. Other principles are less relevant for policy enforcement.

Answer

Non-repudiation

Answer

Defense in depth

Answer

Separation of duties

Question 7

Refer to the exhibit. The security principle demonstrated by the default policy is:

Accepted Answer

Least privilege. Correct: D - Least privilege. The default DROP policy denies all traffic by default, allowing only explicitly permitted services, which follows the principle of least privilege. Option A (Separation of duties) is about dividing responsibilities among multiple people. Option B (Defense in depth) is about multiple layers of security. Option C (Need to know) is about limiting access to information necessary for a job. None of these describes a default deny policy.

Answer

Separation of duties

Answer

Defense in depth

Answer

Need to know

Question 8

Which TWO of the following are examples of administrative security controls? (Choose two.)

Accepted Answer

Security awareness training

Answer

Intrusion detection system

Answer

Firewall

Answer

Encryption

Question 9

A security analyst discovers that an employee shared their password with a colleague to complete a task. Which security principle has been violated?

Accepted Answer

Accountability. Accountability relies on unique identification. Password sharing breaks this link.

Answer

Availability

Answer

Confidentiality

Answer

Integrity

Question 10

An organization wants to implement a policy where employees must use a smart card and a PIN to access sensitive data. This is an example of:

Accepted Answer

Multi-factor authentication (two factors). Multi-factor authentication (MFA) requires two or more different types of authentication factors. Here, the smart card (something you have) and PIN (something you know) constitute two factors, making it MFA.

Answer

Single factor authentication

Answer

Two-factor authentication

Answer

Biometric authentication

Question 11

Refer to the exhibit.
```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*"
    }
  ]
}
```
A security analyst reviews this AWS S3 bucket policy. The policy currently allows anyone to read objects. Which change would implement the principle of least privilege?

Accepted Answer

Add a principal element with specific user ARNs.

Answer

Remove the policy entirely.

Answer

Add a condition to require MFA.

Answer

Change "Allow" to "Deny".

Question 12

Which TWO of the following are fundamental principles of information security that form the CIA triad?

Accepted Answer

Confidentiality. Correct: Confidentiality and Integrity are part of the CIA triad. Option C (Privacy) is not part of CIA; Option D (Non-repudiation) is not; Option E (Accountability) is related but not a core CIA principle.

Answer

Privacy

Answer

Non-repudiation

Answer

Accountability

Question 13

During a security incident, a company must notify stakeholders without revealing sensitive details that could worsen the situation. Which TWO groups should typically be notified immediately according to incident response best practices? (Select TWO)

Accepted Answer

Legal department. Legal must be notified for regulatory and liability issues, and management/executives for decision-making and resource allocation. Customers and PR may be notified later, and law enforcement depends on the incident.

Answer

All affected customers immediately

Answer

General public via press release

Answer

Local law enforcement automatically

Question 14

Refer to the exhibit. A security analyst sees these logs from a Linux server. Which security control should the analyst recommend to address this pattern?

Accepted Answer

Implement two-factor authentication for SSH access.. The logs show repeated failed SSH login attempts from a single IP (192.168.1.100) targeting the root account, which is a classic brute-force attack pattern. Two-factor authentication (2FA) for SSH access is the most effective control because it adds a second authentication factor (e.g., TOTP or hardware token) that an attacker cannot bypass even if they guess the password, thus neutralizing the brute-force attack regardless of the number of attempts or the account targeted.

Answer

Enable account lockout after 5 failed attempts.

Answer

Disable root login via SSH.

Answer

Block the IP address 192.168.1.100 via firewall.

Question 15

Which TWO are key components of an effective incident response plan? (Select TWO.)

Accepted Answer

Communication plan for stakeholders. Options D and E are correct because an effective incident response plan must include a communication plan for stakeholders (D) to ensure timely and accurate information sharing during a security incident, and a post-incident review process (E) to analyze the incident, identify lessons learned, and improve future response efforts. Option D includes predefined escalation paths, contact lists, and communication channels to coordinate response and manage external notifications. Option E ensures that after an incident, the team conducts a thorough review to update policies, procedures, and controls, preventing recurrence. Without both components, the plan lacks coordination and continuous improvement.

Answer

Business continuity procedures

Answer

List of forensic tools

Answer

Backup verification schedule