ISC2 CC Practice Test 4 — 10 Questions

Question 1

A company's SIEM solution aggregates logs from various sources and generates an alert when multiple failed logins occur within a short timeframe. Which log source is most likely to provide the data for this alert?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Authentication logs. Authentication logs record login attempts, including failures, and are the primary source for detecting brute-force attacks.

Answer

System logs

Answer

Firewall logs

Answer

Application logs

Question 2

During a forensic investigation, it is crucial to preserve the original evidence. What is the first step the investigator should take when acquiring a hard drive?

Accepted Answer

Create a forensic image using a write blocker. Creating a bit-for-bit forensic image using a write blocker preserves the original evidence. Option D (calculate the hash) is done after imaging to verify integrity. Option A (booting the drive) would modify data and compromise the evidence. Option B (turning off the computer and removing the hard drive) may be necessary but is not the first step in acquisition; the first step is to create a forensic image with a write blocker.

Answer

Boot the drive to check for operating system errors

Answer

Turn off the computer and remove the hard drive

Answer

Calculate the hash of the original drive

Question 3

A company's security policy requires that all sensitive data be encrypted both at rest and in transit. This is an example of applying which security principle?

Accepted Answer

Defense in depth

Answer

Separation of duties

Answer

Need to know

Answer

Least privilege

Question 4

An organization's BIA determines that the payroll system has a Maximum Tolerable Downtime (MTD) of 4 hours. The current recovery plan has an RTO of 2 hours and an RPO of 1 hour. What is the maximum Work Recovery Time (WRT) allowed to meet the MTD?

Accepted Answer

2 hours. MTD = RTO + WRT. Given MTD=4, RTO=2, so WRT ≤ 2 hours.

Answer

3 hours

Answer

4 hours

Answer

1 hour

Question 5

During an incident, the incident response team discovers that an attacker has exfiltrated sensitive customer data. According to incident response best practices, whose approval is REQUIRED before contacting law enforcement?

Accepted Answer

Legal counsel. Legal counsel approval is required before contacting law enforcement because they ensure that the disclosure complies with data privacy laws (e.g., GDPR, CCPA) and does not violate chain-of-custody requirements or expose the organization to liability. The incident response team must coordinate with legal to determine the appropriate timing and scope of law enforcement involvement, as premature contact can compromise ongoing forensic investigations or breach legal agreements.

Answer

CISO

Answer

CEO

Answer

Public relations

Question 6

A multinational corporation has a policy that all sensitive emails must be digitally signed and encrypted. However, during a recent internal audit, it was discovered that many employees were not using digital signatures because the process was cumbersome. As a result, the company could not prove that certain emails were actually sent by the claimed sender. The security team needs to improve compliance without sacrificing security. Which of the following is the best approach?

Accepted Answer

Integrate the signing process seamlessly into the email client to reduce friction.. Integrating the signing process seamlessly into the email client reduces friction and increases compliance while maintaining security. Training alone does not address the cumbersome process, reducing encryption strength weakens security, and allowing personal certificates complicates management.

Answer

Implement a mandatory training program emphasizing the importance of digital signatures.

Answer

Reduce the encryption strength to speed up the signing process.

Answer

Allow employees to use personal signing certificates.

Question 7

A small business has a single server that hosts critical applications. The server's hard drive fails, and the most recent backup is 3 days old. The backup is stored on an external drive that is kept in the same room as the server. The server is also the domain controller and file server. After replacing the drive and restoring from backup, the IT administrator discovers that some user files are missing because they were created after the backup. The administrator needs to minimize data loss in the future. Which of the following should be implemented?

Accepted Answer

Use a cloud-based backup solution.. A cloud-based backup solution automatically stores backups offsite, ensuring that even if the local site is compromised or the backup drive fails, recent data is recoverable. This minimizes data loss by enabling more frequent backups (e.g., hourly or continuous) without relying on manual intervention or physical media rotation, directly addressing the 3-day gap in the scenario.

Answer

Perform daily backups and store them offsite.

Answer

Implement RAID 1 for disk redundancy.

Answer

Enable versioning on the file server.

Question 8

In a directory service like Active Directory, which component is used to organize users, groups, and computers into a hierarchical structure for applying policies?

Accepted Answer

Organizational Units (OUs). Organizational Units (OUs) are containers in Active Directory that allow hierarchical organization and Group Policy application.

Answer

Group Policy Objects (GPOs)

Answer

Domain controllers

Answer

LDAP

Question 9

A company experiences a data breach where customer PII was exfiltrated. The incident response team contains the breach and restores systems. Which step in the risk management process should the company prioritize next to prevent recurrence?

Accepted Answer

Risk mitigation. After an incident, risk treatment involves implementing controls to reduce risk. Risk identification already occurred.

Answer

Risk communication

Answer

Risk assessment

Answer

Risk identification

Question 10

Based on the exhibit, what is the most likely result of the client's HTTP request?

Accepted Answer

The HTTP request is blocked, but other traffic from the client is allowed.. The exhibit shows an extended ACL applied inbound on the client's interface that denies TCP traffic from the client to the server on port 80 (HTTP) but permits all other IP traffic. Therefore, the HTTP request is blocked, but any other traffic from the client (e.g., DNS, ICMP) is allowed. Option D correctly states that the HTTP request is blocked but other traffic is allowed.

Answer

The HTTP request is permitted because the ACL is applied to the wrong interface.

Answer

The HTTP request is permitted because the ACL only blocks traffic from the router's own IP.

Answer

The HTTP request is blocked, and all other traffic from the client is also blocked.