ISC2 CC Practice Test 43 — 15 Questions

Question 1

During a security incident, the incident response team needs to preserve evidence for potential legal action. Which of the following is the most important action to take when collecting volatile data from a compromised server?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Capture the contents of RAM.. Volatile data in RAM is lost when power is removed. Capturing RAM preserves evidence that might contain running processes, network connections, and encryption keys. Disk images are non-volatile and can be collected later.

Answer

Make a bit-for-bit copy of all storage.

Answer

Create a forensic image of the hard drive.

Answer

Review system logs.

Question 2

A network administrator needs to segment traffic and isolate sensitive systems. Which two technologies can achieve this? (Choose TWO.)

Accepted Answer

VLANs. VLANs provide logical segmentation at Layer 2, and subnetting divides IP networks, often used with routing to isolate traffic. DMZ is a specific segment for public servers, not general segmentation. Firewalls and IDS are security devices, not segmentation technologies.

Answer

Intrusion Detection System

Answer

Stateful firewall

Answer

DMZ

Question 3

An organization experiences a ransomware attack that encrypts critical files. The incident response team follows the standard IR phases. After containing the infection and eradicating the malware, what is the next phase?

Accepted Answer

Recovery. After eradication, the next phase is recovery, where systems are restored and returned to normal operations.

Answer

Detection

Answer

Preparation

Answer

Lessons learned

Question 4

Which TWO of the following are fundamental security principles? (Select TWO.)

Accepted Answer

Defense in depth. Defense in depth is a fundamental security principle that implements multiple layers of security controls (e.g., firewalls, IDS/IPS, encryption, access controls) so that if one layer fails, others still provide protection. This layered approach ensures no single point of failure can compromise the entire system, aligning with the CC exam's emphasis on holistic security strategies.

Answer

Fail-open

Answer

Need to share

Answer

Complexity

Question 5

Refer to the exhibit. A security analyst observes repeated outbound connection attempts from an internal server to external IP addresses on a non-standard port. What is the MOST likely interpretation?

Accepted Answer

The server is infected with malware. Repeated outbound connection attempts from an internal server to external IP addresses on a non-standard port are a classic indicator of malware command-and-control (C2) activity. Malware often uses non-standard ports to evade detection and establish outbound communication with an external attacker. This behavior is not typical of legitimate services, which use well-known ports and protocols.

Answer

The server is being used for remote desktop access

Answer

The server is performing a port scan

Answer

The server is a legitimate mail server

Question 6

A security operations center (SOC) analyst is investigating an alert about a user downloading a suspicious file. The analyst opens the file on a sandboxed virtual machine and observes that it attempts to modify registry keys and establish persistence. This type of analysis is known as:

Accepted Answer

Dynamic analysis. Dynamic analysis involves executing a suspicious file in a controlled environment, such as a sandboxed virtual machine, to observe its runtime behavior. In this scenario, the analyst runs the file and directly observes registry modifications and persistence mechanisms, which are characteristic of dynamic analysis. This approach captures actual system interactions that static analysis cannot reveal.

Answer

Static analysis

Answer

Reverse engineering

Answer

Threat hunting

Question 7

Refer to the exhibit. A security analyst observes that users from the 192.168.1.0/24 network cannot access HTTPS websites, but HTTP access works fine. What is the most likely cause?

Accepted Answer

The ACL is applied to the wrong interface or direction.. The exhibit shows an ACL that permits both HTTP (TCP 80) and HTTPS (TCP 443) inbound on the outside interface. However, the issue is that internal users cannot initiate outbound HTTPS connections. Since the ACL is applied inbound on the outside interface, it only controls incoming traffic, not outgoing. Therefore, the most likely cause is that the ACL is applied to the wrong interface or direction. The implicit deny at the end of the ACL would block any traffic not explicitly permitted, but because the ACL correctly permits HTTPS inbound, the failure of outbound HTTPS suggests a placement error. This is a common scenario where an ACL that should be applied outbound on the inside interface is mistakenly applied inbound on the outside interface, resulting in asymmetric filtering.

Answer

The implicit deny at the end of the ACL blocks HTTPS traffic.

Answer

The ACL is missing a permit statement for TCP port 443 return traffic.

Answer

The ACL explicitly denies TCP port 443.

Question 8

Which TWO are appropriate methods to test a disaster recovery plan?

Accepted Answer

Parallel test. A parallel test is appropriate because it runs the DR site in parallel with the production environment, allowing validation of failover processes and data replication without impacting live operations. This method verifies that the backup systems can handle real workloads and that synchronization mechanisms (e.g., asynchronous replication or log shipping) are functioning correctly. It provides a high-confidence check of the DR plan's effectiveness while maintaining business continuity.

Answer

Regression test

Answer

Acceptance test

Answer

Unit test

Question 9

Which TWO of the following are types of security controls?

Accepted Answer

Corrective. Preventive and corrective controls are recognized types. The other options are not standard categories or are too broad.

Answer

Network

Answer

All of the above

Answer

None of the above

Question 10

A company's security policy states that employees should only have access to the data necessary to perform their job functions. This is an example of which principle?

Accepted Answer

Least privilege. The principle of least privilege dictates that users and systems should be granted only the minimum permissions necessary to perform their tasks. By restricting data access to job-required information, the company directly implements this security control, reducing the attack surface and limiting potential damage from compromised accounts.

Answer

Defense in depth

Answer

Separation of duties

Answer

Fail-safe

Question 11

A security analyst at a Security Operations Centre (SOC) receives an alert from the SIEM indicating multiple failed login attempts for a user account followed by a successful login from an unusual geographic location. According to SOC tier responsibilities, which tier should perform the initial triage of this alert?

Accepted Answer

Tier 1 analyst. Tier 1 analysts are responsible for monitoring alerts and performing initial triage to determine if further investigation is needed.

Answer

IT support team

Answer

Tier 2 analyst

Answer

Tier 3 analyst

Question 12

You are an IT administrator for a small business. The company has a backup system that performs nightly full backups of critical servers to an external hard drive. One morning, a user reports that they accidentally deleted an important file from a shared drive. You need to restore the file from last night's backup. However, when you connect the external hard drive to the backup server, the drive is not recognized, and you hear clicking sounds. The backup software shows that the most recent backup job completed successfully with no errors. What is the most likely cause of the problem?

Accepted Answer

The external hard drive has suffered a mechanical failure.. The clicking sound from the external hard drive is a classic symptom of a mechanical failure, typically caused by a stuck read/write head or a failing spindle motor. Since the backup software reported a successful completion, the data was likely written to the drive, but the drive's physical components have since failed, preventing the system from recognizing it. This is a hardware-level issue that cannot be resolved by software or driver updates.

Answer

The backup software did not actually write the data.

Answer

The file was not included in the backup job.

Answer

The backup server has a driver issue.

Question 13

Refer to the exhibit. An administrator configures the above ACLs on a router. The goal is to allow internal users (192.168.1.0/24) to browse the web, and to allow SSH management from the internet to a server at 10.0.0.10. However, users report that they cannot browse external websites. What is the most likely reason?

Accepted Answer

ACL 100 is applied outbound on the internal interface, so it does not filter outbound traffic from internal users. ACL 100 is applied outbound on the internal interface (e.g., GigabitEthernet0/0). Outbound ACLs filter traffic leaving the interface, but internal users' web traffic originates from the internal network and must be allowed inbound on the internal interface (or outbound on the external interface). Since ACL 100 is applied outbound on the internal interface, it only filters traffic that has already been routed out of that interface, which is not the path for internal users' outbound web requests. The correct approach is to apply the ACL inbound on the internal interface or outbound on the external interface.

Answer

ACL 100 does not permit DNS traffic, so users cannot resolve domain names

Answer

ACL 110 blocks the return traffic from the internet

Answer

The implicit deny at the end of ACL 100 blocks established connections

Question 14

Which TWO of the following are principles of the CIA triad? (Select TWO.)

Accepted Answer

Confidentiality. Confidentiality is a core principle of the CIA triad, ensuring that data is accessible only to authorized entities. This is typically enforced through encryption (e.g., AES-256) and access control mechanisms, preventing unauthorized disclosure.

Answer

Non-repudiation

Answer

Accountability

Answer

Authorization

Question 15

A mid-sized e-commerce company has a primary data center in New York and a disaster recovery site in Dallas. The application stack includes a web server, application server, and a PostgreSQL database. The database uses synchronous replication to the DR site. During a routine failover test, the IT team discovers that after failing over to Dallas, the web servers in New York continue to attempt connections to the original database IP, causing application errors. The DNS records have been updated to point to the DR database IP, but the web servers are not refreshing their DNS cache. The company uses a standard TTL of 300 seconds. The IT manager needs a solution that ensures minimal disruption during future failovers. Which action should be taken?

Accepted Answer

Implement a load balancer or proxy with a virtual IP that can be switched during failover, and update the web server configuration to connect to the virtual IP. It decouples the web servers from the database IP address by introducing a load balancer or proxy with a virtual IP (VIP). During failover, the VIP is simply moved to the DR database, and the web servers continue connecting to the same VIP without any DNS dependency or cache refresh issues. This eliminates the problem of stale DNS caches and ensures minimal disruption, as the connection endpoint remains constant.

Answer

Add a static host entry in the web servers' hosts file pointing to the DR database IP

Answer

Increase the DNS TTL to 86400 seconds to ensure all caches are updated quickly

Answer

Configure the web servers to use a different DNS resolver that does not cache