ISC2 CC Practice Test 40 — 15 Questions

Question 1

Which TWO of the following are valid types of disaster recovery tests?

Accepted Answer

Tabletop exercise.. Options A and E are correct. Tabletop exercises involve team members discussing simulated scenarios, and parallel tests involve running the primary and backup systems simultaneously to verify failover. Option B is not a standard DR test type; full-scale simulations typically involve prior notification. Option C is unit testing of applications, not related to disaster recovery testing. Option D is a security assessment, not a DR test.

Answer

Full-scale simulation without prior notification.

Answer

Unit testing of individual applications.

Answer

Vulnerability scan.

Question 2

During a security incident, a forensic analyst needs to acquire the contents of RAM from a live system. Which tool should be used?

Accepted Answer

Memory dump tool like DumpIt. DumpIt is a specialized memory dump tool designed for live RAM acquisition. Options A, B, and D are incorrect as they are used for disk cloning, network monitoring, and antivirus scanning respectively, not memory acquisition.

Answer

Disk cloning tool like dd

Answer

Network monitoring tool like Wireshark

Answer

Antivirus scanner

Question 3

A security analyst notices that system logs are being overwritten before the retention period ends. What is the most likely cause?

Accepted Answer

Log rotation settings are misconfigured. Misconfigured log rotation settings can cause logs to be overwritten before the retention period ends. Log rotation manages log file size and age; incorrect settings (e.g., too low a maximum file size or too short a rotation interval) can lead to premature overwriting. Option A is incorrect because malware deleting logs would remove them, not overwrite them. Option B is incorrect because a SIEM consuming logs does not inherently overwrite local logs; it reads or copies them. Option D is incorrect because insufficient disk space would typically cause log failure or inability to write new logs, not overwriting of existing logs.

Answer

Malware is deleting logs

Answer

SIEM is consuming logs too quickly

Answer

Disk space is insufficient

Question 4

An organization wants to ensure that a critical database can be restored within 2 hours after a failure. Which metric should the organization define?

Accepted Answer

Recovery Time Objective (RTO). (Recovery Time Objective). RTO defines the maximum acceptable time to restore a system after a failure, which directly aligns with the requirement to restore the database within 2 hours. Option A (MTD) is the total downtime an organization can tolerate, but it is not the specific metric for restoration time; option B (SLA) is a contractual agreement; option C (RPO) deals with data loss, not downtime.

Answer

Maximum Tolerable Downtime (MTD)

Answer

Service Level Agreement (SLA)

Answer

Recovery Point Objective (RPO)

Question 5

A security operations center (SOC) analyst notices unusual outbound network traffic from a server that typically only receives connections. The traffic is encrypted and goes to an unknown external IP. Which step should the analyst perform FIRST?

Accepted Answer

Check the server's running processes and connections. The first step when encountering suspicious outbound traffic is to investigate without disrupting potential evidence. Checking the server's running processes and open connections (Option A) allows the analyst to identify the source process or compromised service generating the traffic. This preserves volatile data and informs subsequent containment decisions. Powering off the server (B) or blocking traffic (C) prematurely may destroy evidence and hinder root cause analysis. Notifying the system owner (D) is important but should occur after initial investigation to provide accurate information.

Answer

Power off the server

Answer

Block the outbound traffic at the firewall

Answer

Notify the system owner

Question 6

A security analyst observes these SSH logs. What is the MOST likely attack?

Accepted Answer

Brute force attack on SSH service. Repeated failed login attempts from the same IP indicate a brute force attack on the SSH service. Option B is incorrect because session hijacking involves taking over an existing authenticated session, not repeated login attempts. Option C is incorrect because phishing is a social engineering attack, not evident in these logs. Option D is incorrect because a denial of service attack would typically show a flood of traffic, not repeated authentication attempts.

Answer

Session hijacking via SSH

Answer

Phishing attack targeting root and admin accounts

Answer

Denial of service attack on port 22

Question 7

A security administrator needs to ensure that a user cannot view the contents of a file but can execute it. Which access control principle should be applied?

Accepted Answer

Apply least privilege. Least privilege grants only the permissions necessary to perform a task. The user only needs execute, not read. Option A (separation of duties) divides tasks among different people, which is not relevant. Option B (least privilege) is correct because it restricts access to the minimum required. Option C (defense in depth) uses multiple layers of security. Option D (need-to-know) limits access to sensitive information but does not cover execution. Therefore, Option B is correct.

Answer

Enforce separation of duties

Answer

Use defense in depth

Answer

Implement need-to-know

Question 8

A company deploys a web application that stores user passwords using a salted hash. During a security review, an auditor recommends switching from SHA-1 to SHA-256. What is the primary security benefit of this change?

Accepted Answer

It increases collision resistance. SHA-1 is considered weak due to collision vulnerabilities, while SHA-256 is more resistant. The change improves integrity protection for stored passwords. Option C (collision resistance) is correct. Option A (availability) is not directly related. Option B (encryption) is wrong because hashing is not encryption. Option D (non-repudiation) requires digital signatures, not just hashing.

Answer

It improves system availability

Answer

It provides encryption of the passwords at rest

Answer

It enhances non-repudiation

Question 9

Which TWO of the following are primary goals of the security principle of confidentiality?

Accepted Answer

Protect data in transit. Correct: D and E. Confidentiality ensures that data is not disclosed to unauthorized individuals or systems. Protecting data in transit (D) prevents interception during transmission, and preventing unauthorized disclosure (E) is the core goal. Data accuracy (A) is integrity, system uptime (B) is availability, and authentication (C) is identity verification—none are confidentiality goals.

Answer

Ensure data accuracy

Answer

Maintain system uptime

Answer

Provide user authentication

Question 10

Refer to the exhibit. Which security principle is this policy primarily enforcing?

Accepted Answer

Least privilege. Correct: D - Least privilege. The policy allows only get access to a specific bucket from a specific IP range, granting the minimum necessary access. Confidentiality is addressed indirectly, but the design emphasizes least privilege. Defense in depth and non-repudiation are not shown.

Answer

Non-repudiation

Answer

Defense in depth

Answer

Confidentiality

Question 11

An organization deploys firewalls at the network perimeter, antivirus on endpoints, and encryption for data at rest. This approach best exemplifies which security principle?

Accepted Answer

Defense in depth. Correct: D - Defense in depth. Defense in depth uses multiple, overlapping security controls such as firewalls, antivirus, and encryption to protect assets. Option A is wrong because separation of duties divides critical tasks among multiple people to prevent fraud. Option B is wrong because diversity of defense, while related, is not the primary principle demonstrated; the key is the layered approach. Option C is wrong because least privilege restricts access rights to the minimum necessary.

Answer

Separation of duties

Answer

Diversity of defense

Answer

Least privilege

Question 12

An organization's security policy mandates that data must be encrypted both at rest and in transit. Which combination of controls meets this requirement?

Accepted Answer

Full-disk encryption and TLS for network communications. Full-disk encryption protects data at rest, and TLS encrypts data in transit. Option A is incorrect because AES is an encryption algorithm, not a protocol; IPsec encrypts in transit but does not provide at-rest encryption. Option B is incorrect because BitLocker and EFS both provide at-rest encryption but do not encrypt data in transit. Option C is incorrect because S/MIME encrypts email in transit but does not provide at-rest encryption, and RBAC manages access control, not encryption.

Answer

AES encryption for files and IPsec for network traffic

Answer

BitLocker and EFS

Answer

S/MIME for email and RBAC for file access

Question 13

A security engineer is designing a system that must ensure that any changes to a configuration file are logged with the identity of the person who made the change. Which principle is being implemented?

Accepted Answer

Accountability. Accountability ensures that actions can be traced to a specific individual through logging and identification. The scenario requires logging the identity of the person making a change, which directly supports accountability. Non-repudiation goes further by providing cryptographic proof (e.g., digital signatures) to prevent denial of the action, which is not explicitly required here. Therefore, Accountability is the correct principle.

Answer

Non-repudiation

Answer

Confidentiality

Answer

Integrity

Question 14

The exhibit shows a snippet of /var/log/auth.log on a Linux server. Which security principle is most likely violated if the failed attempts continue without action?

Accepted Answer

Least privilege. The log shows failed SSH login attempts for the root user. Allowing direct root login over SSH violates the principle of least privilege because root is a highly privileged account that should not be used for routine access. Instead, administrators should log in with a regular user account and escalate privileges only when needed. Continuing inaction perpetuates this violation. Options A (non-repudiation), B (separation of duties), and D (defense in depth) are less directly related to the specific issue of root login.

Answer

Non-repudiation

Answer

Separation of duties

Answer

Defense in depth

Question 15

The exhibit shows the current iptables rules. Which security principle is most clearly enforced by the default policy?

Accepted Answer

Fail-safe defaults. The default policy is DROP on the INPUT chain, meaning any traffic not explicitly allowed is denied. This enforces the 'fail-safe defaults' principle (also known as default deny), which dictates that access should be denied unless explicitly permitted. This is correct because it ensures that any unintended or unauthorized traffic is blocked by default. In contrast, least privilege (Option D) focuses on granting minimal necessary permissions to users, separation of duties (Option C) involves dividing responsibilities, and defense in depth (Option B) refers to multiple layers of security controls—none of which are directly demonstrated by the default policy alone. Therefore, the correct answer is A.

Answer

Defense in depth

Answer

Separation of duties

Answer

Least privilege