ISC2 CC Practice Test 42 — 15 Questions

Question 1

Which phase of the incident response process involves restoring systems to normal operations and confirming they are functioning correctly?

Accepted Answer

Recovery. Recovery is the phase after eradication where systems are restored and tested.

Answer

Detection

Answer

Containment

Answer

Eradication

Question 2

Which THREE of the following are examples of risk mitigation? (Select THREE)

Accepted Answer

Implementing access controls to limit user permissions. Option A is correct because implementing access controls (e.g., role-based access control following least privilege) directly reduces the likelihood and impact of unauthorized actions, which is the essence of risk mitigation. Option C is correct because encrypting sensitive data at rest (e.g., AES-256) reduces the impact of a data breach by rendering stolen data unreadable, thereby lowering overall risk. Option D is correct because installing antivirus/anti-malware on all endpoints provides detective and preventive controls that reduce the likelihood of malware infections and their spread. Option B is not mitigation but risk acceptance, since the organization consciously chooses to tolerate the vulnerability without applying controls. Option E is risk transference (sharing risk with an insurer via a financial mechanism), not mitigation, because it does not reduce the likelihood or impact of the risk itself.

Answer

Deciding not to fix a low-risk vulnerability due to cost

Answer

Purchasing cyber insurance

Question 3

A medium-sized company uses a network with three VLANs: VLAN 10 (Users, 192.168.10.0/24), VLAN 20 (Servers, 192.168.20.0/24), and VLAN 30 (DMZ, 192.168.30.0/24). A Layer 3 switch with an ACL is used for inter-VLAN routing. The company has a web server in the DMZ that must be accessible from the internet (via a public IP mapped to 192.168.30.10). Users in VLAN 10 need to access the web server on its private IP (192.168.30.10) for internal testing. The ACL is applied inbound on the VLAN 10 SVI. The ACL currently has the following entries: permit ip 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255; deny ip any 192.168.20.0 0.0.0.255; permit ip any any. Recently, the security team noticed that users can access the web server on its private IP, but they cannot access the web server via the public IP (which goes through the firewall and then to the DMZ). The firewall logs show that traffic from the users to the public IP is allowed and reaches the DMZ web server, but the return traffic is blocked. The web server's default gateway is the Layer 3 switch (192.168.30.1). Which of the following is the most likely cause of the problem?

Accepted Answer

The web server's default gateway should be set to the firewall, not the Layer 3 switch. The most likely cause is that the DMZ web server's default gateway is misconfigured. Because it points to the Layer 3 switch instead of the firewall, replies to public-IP requests are routed toward the L3 switch rather than back through the firewall. This breaks the firewall's stateful inspection/NAT path, so the return traffic is blocked or never completes. Private-IP access works because the L3 switch can route directly to VLAN 10. The VLAN 10 ACL is inbound and does not block the outbound request; no DMZ SVI ACL is described.

Answer

The ACL on the DMZ SVI (VLAN 30) is blocking the return traffic from the web server to the firewall

Answer

The ACL on the VLAN 10 SVI is blocking the traffic to the public IP because it only allows private IP ranges

Answer

The firewall is blocking the return traffic due to a stateful inspection rule

Question 4

A security administrator is configuring a system to detect unauthorized changes to critical files by calculating and storing a hash value for each file. Which security goal is primarily supported?

Accepted Answer

Integrity. Hashing critical files and storing their hash values allows the administrator to later recompute the hash and compare it to the stored value. If the file contents change, the hash will differ, revealing unauthorized modification. This directly supports the security goal of integrity, which ensures data has not been altered in an unauthorized manner. Authentication, confidentiality, and availability are not the primary goals addressed by this mechanism.

Answer

Authentication

Answer

Confidentiality

Answer

Availability

Question 5

Which two protocols operate at the Transport layer of the OSI model? (Choose TWO.)

Accepted Answer

TCP. TCP and UDP are the primary Transport layer protocols. IP is Network layer, Ethernet is Data Link, and HTTP is Application layer.

Answer

HTTP

Answer

IP

Answer

Ethernet

Question 6

An organization has a legacy system that cannot be patched due to vendor end-of-life. The system is critical for operations. Which compensating control is most appropriate to reduce the risk of exploitation?

Accepted Answer

Isolate the system on a separate network segment with strict access controls. Isolating the legacy system on a separate network segment with strict access controls (firewalls, ACLs, micro-segmentation) is a compensating control that reduces the attack surface and limits lateral movement even though the system itself cannot be patched. It directly addresses the risk of exploitation by containing the system.

Answer

Increase logging and monitoring without any network changes

Answer

Apply a virtual patch using a web application firewall

Answer

Remove the system from the network entirely

Question 7

An organization is developing a security policy. Which TWO of the following are core components of the CIA triad?

Accepted Answer

Confidentiality. The CIA triad consists of Confidentiality, Integrity, and Availability. Authentication and Non-repudiation are related but not part of the core triad.

Answer

Authorization

Answer

Authentication

Answer

Non-repudiation

Question 8

An organization is selecting a network security solution to protect against advanced threats. Which THREE features are characteristic of a Next-Generation Firewall (NGFW)? (Select THREE.)

Accepted Answer

Application identification and control. Option B is correct because an NGFW performs deep packet inspection to identify applications (e.g., via App-ID) and enforce granular control based on the application rather than just port, which is essential against advanced threats that tunnel over allowed ports. Option C is correct because NGFWs integrate with directory services (e.g., Active Directory, LDAP) to map traffic to specific users and groups, enabling identity-based policies that traditional firewalls cannot enforce. Option E is correct because NGFWs bundle an integrated IPS that inspects traffic for known exploit signatures and behavioral anomalies, providing inline threat prevention without a separate appliance. Option A is not correct because static packet filtering based on IP and port is a first-generation firewall capability, not a distinguishing NGFW feature. Option D is not correct because stateful packet inspection is a baseline capability of traditional stateful firewalls and is not unique to NGFWs.

Answer

Static packet filtering based on IP and port

Answer

Stateful packet inspection

Question 9

An organization wants to ensure that only authorized devices can connect to the wired network. Which TWO methods can be used to enforce this?

Accepted Answer

802.1X authentication. 802.1X authentication (A) is correct because it enforces port-based network access control on wired switches, requiring devices to authenticate via EAPOL to a RADIUS server before the port is authorized to pass traffic. Port security (C) is correct because it restricts which MAC addresses may be learned on a switch port, limiting connections to known/authorized devices and taking action (shutdown, restrict, or protect) on violations. Firewall rules (B) filter traffic by IP/port but do not authenticate or identify devices at the access layer, so they cannot ensure only authorized devices connect. NAT (D) merely translates addresses for routing/Internet access and provides no device authorization. VLAN segmentation (E) isolates traffic into logical groups but does not by itself verify or restrict which devices are permitted to connect.

Answer

Firewall rules

Answer

NAT

Answer

VLAN segmentation

Question 10

An organization wants to ensure the integrity of a software update before deployment. Which two methods can be used to verify integrity? (Choose two.)

Accepted Answer

Digital signature. Option C (Digital signature) is correct because a digital signature, created by the software publisher using their private key and verified with their public key, cryptographically proves both the integrity and authenticity of the update — any modification to the package invalidates the signature. Option E (Hashing) is correct because computing a hash (e.g., SHA-256) of the downloaded update and comparing it to the publisher's published hash value detects any alteration of the file's contents, confirming integrity. Option A (Encryption) is not correct because encryption provides confidentiality, not integrity verification, and does not by itself prove the file was unmodified. Option B (Redundant servers) is not correct because redundancy only improves availability and fault tolerance, not data integrity. Option D (Access control lists) is not correct because ACLs restrict who may access a resource, which is an authorization control rather than a mechanism for verifying that a file's contents are intact.

Answer

Encryption

Answer

Redundant servers

Answer

Access control lists

Question 11

In a defense-in-depth strategy, which access control mechanism provides the most granular control over user permissions?

Accepted Answer

Access control lists (ACLs) on files. Access control lists (ACLs) on files provide the most granular control because they allow permissions to be set at the individual file or object level, specifying exactly which users or groups can read, write, execute, or modify that specific resource. This is in contrast to broader mechanisms like network segmentation or firewall rules, which operate at the network or subnet level and cannot distinguish between individual files within a system. ACLs are a fundamental component of discretionary access control (DAC) and are implemented in file systems such as NTFS, ext4, and ZFS.

Answer

Network segmentation

Answer

Physical security controls

Answer

Firewall rules

Question 12

A security analyst is evaluating a new vendor for cloud services. The analyst reviews the vendor's security certifications, conducts background checks, and visits the data center. This process is an example of:

Accepted Answer

Due diligence. Due diligence involves investigating and verifying before making a decision, such as vendor risk assessment.

Answer

Due care

Answer

Governance

Answer

Risk acceptance

Question 13

Which THREE of the following are recognized security principles according to NIST and ISC2?

Accepted Answer

Separation of duties. Separation of duties (A) is a recognized NIST and ISC2 security principle because it divides critical functions among multiple individuals so that no single person can execute a fraudulent or damaging action alone, providing built-in checks and balances. Least privilege (C) is endorsed by both NIST and ISC2 as the practice of granting users, processes, and systems only the minimum access rights necessary to perform their authorized tasks, thereby limiting the blast radius of compromise or error. Defense in depth (D) is a core principle in both frameworks, layering multiple overlapping controls (physical, technical, administrative) so that the failure of one control does not result in total compromise. Security through obscurity (B) is not a recognized principle because it relies on secrecy of design or implementation rather than sound security controls, and it fails once the hidden detail is discovered. Single point of failure (E) is not a principle but an anti-pattern or risk condition that security design seeks to eliminate through redundancy and diversity.

Answer

Security through obscurity

Answer

Single point of failure

Question 14

An organization is planning to deploy a DMZ to host web and email servers accessible from the internet. Which three security best practices should be implemented for the DMZ? (Choose three.)

Accepted Answer

Use a separate VLAN for DMZ servers to isolate traffic. Option C is correct because placing DMZ servers on a dedicated VLAN segments their broadcast domain and Layer 2 traffic from the internal LAN, so a compromised web or email host cannot directly reach internal systems at Layer 2 and lateral movement is constrained. Option D is correct because a dual-firewall (screened subnet) design puts one firewall between the internet and the DMZ and a second between the DMZ and the internal network, enforcing defense in depth so that even if a DMZ host is compromised, the internal firewall still blocks access to internal resources. Option E is correct because strict access control rules implementing least privilege—permitting only the specific ports and protocols required (for example, TCP 80/443 to the web server and TCP 25/587 to the mail server)—minimize the attack surface and prevent unnecessary services from being reachable. Option A is not correct because a single firewall with three interfaces, while workable, does not provide the layered separation and defense in depth that a dual-firewall DMZ design offers. Option B is not correct because allowing all traffic from the DMZ to the internal network violates least privilege and would let a compromised DMZ host pivot freely into the internal network.

Answer

Use a single firewall to connect internet, DMZ, and internal network

Answer

Allow all traffic from the DMZ to the internal network for ease of management

Question 15

After a security breach, investigators find that an attacker exploited a vulnerability in a publicly accessible application to gain access to internal databases. Which security principle would have most effectively limited the impact?

Accepted Answer

Defense in depth. Defense in depth is the principle of layering multiple security controls so that if one fails, others still protect the assets. In this scenario, a publicly accessible application was exploited to reach internal databases; defense in depth would have included network segmentation, least privilege, and additional controls that could have prevented or limited the attacker's lateral movement.

Answer

Accountability

Answer

Confidentiality

Answer

Non-repudiation