ISC2 CC Practice Test 41 — 15 Questions

Question 1

A small business owner wants to ensure that their company's data remains accurate and unaltered during transmission over the internet. They regularly send financial reports to their accountant via email. The owner is concerned that a hacker might intercept and modify the reports before they reach the accountant. Which security principle is most directly threatened in this scenario, and what is the best technical control to implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Integrity; apply a digital signature or hash to the files. Integrity is the principle threatened because the scenario involves potential unauthorized modification of data. Digital signatures or hashes provide integrity by allowing verification that the data has not been altered. Option A (Confidentiality) is incorrect because encryption protects against unauthorized disclosure, not alteration. Option B (Non-repudiation) is incorrect because non-repudiation prevents denial of actions, but does not ensure data is unaltered. Option D (Availability) is incorrect because availability ensures data is accessible, not accurate.

Answer

Confidentiality; encrypt the email attachments

Answer

Non-repudiation; require read receipts

Answer

Availability; use a redundant email server

Question 2

A company is designing a new application that processes credit card payments. They want to ensure that no single administrator can bypass security controls to approve a fraudulent transaction. Which principle should be implemented?

Accepted Answer

Separation of duties. Separation of duties ensures that no single administrator has the authority to both initiate and approve a credit card transaction. By dividing critical functions among multiple individuals, the company prevents a single compromised account from authorizing fraudulent payments. This principle directly addresses the risk of insider threats or credential misuse in payment processing systems.

Answer

Defense in depth

Answer

Least privilege

Answer

Need to know

Question 3

Which two of the following are examples of physical access controls? (Select TWO)

Accepted Answer

Security guards. Security guards are a physical access control because they provide a human barrier to unauthorized entry, monitoring and challenging individuals who attempt to access restricted areas. They enforce physical security policies through observation, verification, and intervention, making them a classic example of a deterrent and preventive physical control.

Answer

Encryption

Answer

Password policies

Answer

Firewall rules

Question 4

You are a security analyst at a medium-sized company with 500 employees. The company uses a centralized log management system that collects logs from all servers and network devices. For the past week, you have noticed a pattern: every night at 2:00 AM, a series of failed login attempts occurs on the domain controller from an internal IP address (10.10.50.100). The attempts use the username "Administrator" and are always from the same workstation in the accounting department. The accounting department operates 9 AM to 6 PM, so no one is in the office at 2 AM. You have checked the workstation's physical security; it is in a locked office with access only by authorized accounting staff. The workstation is running Windows 10 with up-to-date antivirus and has no signs of compromise. You also checked the network switch logs and see that the workstation is connected to a specific port. You suspect the workstation might be compromised or being used remotely. What is the most appropriate next step?

Accepted Answer

Perform a forensic analysis of the workstation to identify any malware or remote access tools.. The pattern of failed logins at 2 AM from a locked workstation with no signs of compromise strongly suggests a remote access tool (RAT) or hidden malware that is not detected by standard antivirus. Forensic analysis of the workstation is the most appropriate next step to identify the specific malware or remote access tool, its persistence mechanism, and the attacker's entry point, which is essential before taking any remediation actions. This aligns with the incident response process of identification and analysis before containment or eradication.

Answer

Reimage the workstation with a clean OS image and reset all passwords.

Answer

Increase the password complexity requirements for the domain.

Answer

Immediately block the IP address at the firewall and disable the administrator account.

Question 5

Which THREE components are part of the AAA framework?

Accepted Answer

Authentication. Authentication is correct because the AAA framework (Authentication, Authorization, and Accounting) uses authentication to verify the identity of a user or device before granting access. This is typically done via credentials such as username/password, digital certificates, or tokens, and is the first step in the AAA process.

Answer

Accountability

Answer

Auditing

Question 6

In a Bell-LaPadula MAC model, which of the following operations is prohibited?

Accepted Answer

A Top Secret subject writes to an Unclassified object. In the Bell-LaPadula model, the *-property (star property) prohibits a subject from writing to an object at a lower classification level. A Top Secret subject writing to an Unclassified object would cause a downgrade of sensitive information, violating this property. Therefore, option D is the prohibited operation.

Answer

A Top Secret subject reads a Confidential object

Answer

A Top Secret subject reads a Top Secret object

Answer

A Top Secret subject writes to a Top Secret object

Question 7

Refer to the exhibit. A security analyst reviews this log entry. What type of attack is most likely occurring?

Accepted Answer

Brute-force attack. The log entry shows repeated failed authentication attempts against a single username from a single source IP, trying numerous different passwords in a short period. This pattern is characteristic of a brute-force attack, where an attacker systematically tries many password guesses against one target account.

Answer

Pass-the-hash attack

Answer

Password spraying attack

Answer

Kerberos ticket attack

Question 8

Refer to the exhibit. Based on the report, which improvement is most appropriate?

Accepted Answer

Switch to synchronous replication. Asynchronous replication can lead to data inconsistency during failover. Switching to synchronous replication ensures data consistency at the cost of some latency.

Answer

Increase backup frequency

Answer

Reduce network failover time

Answer

Implement load balancing

Question 9

Which TWO are best practices for managing backup media?

Accepted Answer

Encrypt backup data. Encrypting backup data ensures confidentiality and integrity during transit and at rest, protecting against unauthorized access if media is lost or stolen. This is a critical best practice for compliance with standards like GDPR or HIPAA, and aligns with the principle of defense in depth. Without encryption, backup media becomes a significant security vulnerability.

Answer

Keep backups on the same server for easy access

Answer

Use only tape media

Answer

Test backups annually

Question 10

A SOC analyst is reviewing a security alert about a potential brute-force attack on the company's VPN server. The analyst sees multiple failed login attempts from different IP addresses within a short time frame. Which TWO actions should the analyst take to verify and respond to this incident? (Choose two.)

Accepted Answer

Implement an account lockout policy after a certain number of failed attempts. Options A and B are correct. Implementing an account lockout policy after a certain number of failed attempts helps mitigate brute-force attacks by slowing down attackers. Reviewing VPN server logs for successful logins following the failed attempts helps determine if the attack succeeded and if any accounts were compromised. Option C (notifying all users to change passwords) is premature and may cause unnecessary alarm; password changes should be based on confirmed compromise. Option D (blocking all source IPs) is not practical because attackers often use many IPs, and legitimate users may be affected. Option E (disabling VPN access) would disrupt business operations and is an extreme measure not yet warranted.

Answer

Notify all users to change their passwords immediately

Answer

Block all source IP addresses that appeared in the failed attempts

Answer

Disable VPN access until the attack source is identified

Question 11

An organization is planning to implement a security awareness program. Which TWO topics should be included to address common social engineering attacks?

Accepted Answer

Recognizing phishing emails. Phishing awareness and tailgating awareness are both critical social engineering topics. USB drop attacks are also social engineering, but the question asks for TWO; phishing and tailgating are the most common.

Answer

Understanding encryption algorithms

Answer

Configuring firewall rules

Answer

Proper password management using a password manager

Question 12

An organization is implementing a security baseline for new servers. Which THREE components are typically included in a hardened baseline configuration? (Choose three.)

Accepted Answer

Disabling unnecessary services and ports.. Hardened baselines include disabling unnecessary services to reduce attack surface, enforcing strong password policies, and applying security updates to fix known vulnerabilities.

Answer

Allowing remote desktop access from any IP address.

Answer

Enabling automatic login for administrators.

Question 13

An organization must retain authentication logs for compliance with PCI DSS. What is the minimum retention period and the requirement for immediate availability?

Accepted Answer

12 months retention with 3 months immediately available. PCI DSS requires a minimum of 12 months retention with at least 3 months immediately available for analysis.

Answer

6 months retention with 1 month immediately available

Answer

24 months retention with 12 months immediately available

Answer

18 months retention with 6 months immediately available

Question 14

An organization implements a security baseline using CIS Benchmarks for all new servers. After a routine scan, a server is found to have a configuration that deviates from the baseline. The deviation was introduced by a system administrator to resolve a performance issue. What is the best course of action?

Accepted Answer

Document the change and submit it through the change control process. Any change to a security baseline should go through the change control process to ensure it is reviewed and approved, preventing unauthorized changes that could introduce vulnerabilities.

Answer

Ignore the deviation since it was done for a valid reason

Answer

Revert the change immediately without discussion

Answer

Update the baseline to match the new configuration

Question 15

A security analyst reviews firewall logs and sees a series of outbound connections from an internal server to a known command-and-control (C2) IP address at regular intervals. Which step should the analyst take first according to incident response best practices?

Accepted Answer

Check if the IP address is associated with known malware or threats.. Per incident response best practices, the first step is to verify the alert through threat intelligence to confirm it's not a false positive. Checking if the IP address is associated with known malware or threats (option B) validates the alert before taking any disruptive actions. Immediately isolating, quarantining, or blocking (options A, C, D) without confirmation can cause unnecessary disruption if the alert is benign.

Answer

Isolate the server from the network immediately.

Answer

Quarantine the server and begin forensic analysis.

Answer

Terminate the outbound connections by blocking the IP.