ISC2 CC Practice Test 42 — 15 Questions

Question 1

Which of the following ensures that data has not been tampered with during transmission?

Accepted Answer

Hashing. Integrity ensures data accuracy and completeness; hashing detects changes.

Answer

Redundancy

Answer

Encryption

Answer

Authentication

Question 2

Which THREE of the following are core principles of the CIA triad?

Accepted Answer

Confidentiality. Options A, B, and E are correct: confidentiality, integrity, and availability are the three pillars. Non-repudiation (C) and accountability (D) are related but not part of the CIA triad.

Answer

Non-repudiation

Answer

Accountability

Question 3

A network administrator is troubleshooting connectivity issues and notices that frames are being dropped due to excessive collisions. Which OSI layer is most directly associated with this issue?

Accepted Answer

Data Link. Collisions occur at the Data Link layer (Layer 2) where frames are transmitted over shared media. Hubs and CSMA/CD operate at this layer.

Answer

Physical

Answer

Network

Answer

Transport

Question 4

A company has implemented a policy where all employees must use a smart card and PIN to access the data center. Which security principle does this practice support?

Accepted Answer

Defense in depth. The use of both a smart card (something you have) and a PIN (something you know) creates a multi-factor authentication mechanism. This layered approach ensures that even if one factor is compromised, the other still provides protection, which is the core of the defense-in-depth principle. Defense in depth is about implementing multiple, overlapping security controls rather than relying on a single point of defense.

Answer

Keep it simple

Answer

Least privilege

Answer

Fail-safe

Question 5

An organization's security policy requires that all access to sensitive data must be approved by a data owner. An administrator configures a system to enforce this. Which principle is being implemented?

Accepted Answer

Authorization. Authorization is the process of granting or denying access to resources based on the authenticated user's permissions. In this scenario, the requirement that access must be approved by a data owner before granting access is a classic example of implementing authorization controls. Option A (Accountability) is incorrect because accountability involves tracking user actions and holding users responsible, not requiring approval. Option B (Least privilege) is incorrect because least privilege is about granting the minimum necessary permissions, but it does not require a separate approval step by a data owner. Option C (Non-repudiation) is incorrect because non-repudiation ensures that a party cannot deny having performed an action, typically through digital signatures or logs, not through access approvals.

Answer

Accountability

Answer

Least privilege

Answer

Non-repudiation

Question 6

A security policy requires that all changes to production systems be approved by a change management board. Which THREE of the following principles best support this requirement?

Accepted Answer

Non-repudiation. Separation of duties ensures approval and implementation are done by different people. Accountability ensures actions are traceable. Non-repudiation provides proof of approval. Least privilege and defense in depth are less directly related.

Answer

Defense in depth

Answer

Least privilege

Question 7

Your organization is implementing a new access control system to protect a highly sensitive research database. The security policy mandates that no single individual should have the ability to both approve and execute changes to the database. This is to prevent fraud and errors. Which security principle does this policy enforce, and which of the following best implements it?

Accepted Answer

Separation of duties; require that one person submits a change request and another person implements it. Correct: Separation of duties; requiring two different people for approval and execution (C). This principle prevents a single individual from having conflicting responsibilities, reducing risk of fraud or error. Option A is wrong because defense in depth involves multiple layers of security, not separation of roles. Option B is wrong because accountability through logging and auditing does not prevent a single person from both approving and executing changes. Option D is wrong because least privilege would still allow the same person to both approve and execute, albeit with limited permissions, violating the policy.

Answer

Defense in depth; require both parties to authenticate

Answer

Accountability; log all changes and have an auditor review them

Answer

Least privilege; assign the same person as approver and executor but with limited permissions

Question 8

An organization implements a rule that an employee cannot approve their own expenses. This is an example of which security principle?

Accepted Answer

Separation of duties. Correct: B - Separation of duties. Separation of duties prevents a single individual from having conflicting roles. Option A is wrong because least privilege limits access to only necessary resources. Option C is wrong because defense in depth uses multiple layers. Option D is wrong because accountability tracks actions to individuals.

Answer

Least privilege

Answer

Defense in depth

Answer

Accountability

Question 9

Based on the exhibit, which statement about the access control list is true?

Accepted Answer

All IP traffic is permitted except ICMP. The exhibit shows an access control list (ACL) that explicitly denies ICMP traffic with the entry 'deny icmp any any' and then permits all other IP traffic with 'permit ip any any'. Since ACLs are processed sequentially and the 'permit ip any any' matches all IP protocols (including HTTP, HTTPS, etc.) except those already denied, the result is that all IP traffic is permitted except ICMP. This makes option A correct.

Answer

HTTP traffic is denied

Answer

Only HTTP traffic is permitted

Answer

ICMP echo requests are permitted

Question 10

Which TWO scenarios best illustrate the principle of least privilege?

Accepted Answer

An administrator uses a separate standard account for daily work and an admin account only when needed. It demonstrates the principle of least privilege by using a separate standard user account for daily tasks and elevating to an administrative account only when necessary. This minimizes the attack surface by ensuring that administrative privileges are not active during routine activities, reducing the risk of accidental system changes or malware execution with elevated rights. In Windows environments, this is commonly implemented via User Account Control (UAC) and the use of a standard vs. administrator account.

Answer

Regular employees can install software on their workstations

Answer

The CEO has root access to all servers

Answer

All users have full control over shared folders

Question 11

Which security control is most effective in preventing unauthorized physical access to a data center?

Accepted Answer

Mantraps.. Mantraps create a double-door system that prevents tailgating, making them highly effective. Other controls like video surveillance and guards are deterrents but less direct at preventing unauthorized entry.

Answer

Video surveillance.

Answer

Biometric door locks.

Answer

Security guards.

Question 12

Which TWO of the following are common indicators of a potential data breach? (Choose two.)

Accepted Answer

Unauthorized access to sensitive files. Unusual outbound network traffic (e.g., data exfiltration) and unauthorized access attempts are typical signs of a breach.

Answer

Increased employee productivity

Answer

Regular software updates

Answer

Multiple failed login attempts from a single account

Question 13

A security operations center (SOC) analyst receives an alert for a high volume of outbound traffic from an internal server to a known malicious IP address. Which step should the analyst take next?

Accepted Answer

Isolate the server from the network.. Isolating the server stops the suspicious traffic and prevents further data exfiltration or lateral movement while the incident is investigated. Other actions are either too broad or premature.

Answer

Shut down the server.

Answer

Disregard the alert as a false positive.

Answer

Block all outbound traffic from the server.

Question 14

A security team is conducting a risk assessment for a new cloud application. They have identified a vulnerability in the application that could allow unauthorized access to sensitive data. Which three risk management strategies should they consider? (Choose three.)

Accepted Answer

Risk avoidance. Risk avoidance (B) is correct because it involves eliminating the vulnerability by not deploying the cloud application or removing the vulnerable component entirely, thus preventing any possibility of unauthorized access to sensitive data. This strategy is appropriate when the risk exceeds the organization's risk appetite and cannot be effectively reduced through other means.

Answer

Risk ignorance

Answer

Risk acceptance

Question 15

Which THREE are common indicators of a compromised system? (Select THREE.)

Accepted Answer

Unexpected software installations. Unexpected software installations are a common indicator of compromise because attackers often deploy malware, backdoors, or remote access tools (RATs) without user consent. In a CC context, this aligns with the principle that unauthorized software changes signal a breach, as legitimate installations typically follow change management processes. The presence of unknown executables or services in the system's process list or startup entries is a red flag.

Answer

High CPU usage during business hours

Answer

System uptime greater than 30 days