ISC2 CC Practice Test 44 — 15 Questions

Question 1

An organization is implementing a new access control system based on the principle of least privilege. Which two of the following practices are essential to achieving least privilege? (Select TWO)

Accepted Answer

Review permissions regularly. Regular permission reviews are essential to maintaining least privilege over time. Users' roles and responsibilities change, and without periodic audits, excessive permissions can accumulate, violating the principle. This aligns with the NIST SP 800-53 AC-6 control for least privilege, which requires organizations to review user access rights at defined intervals.

Answer

Grant users default full access and restrict later

Answer

Enable accounts after use

Answer

Provide write access to all users

Question 2

Refer to the exhibit. What does this indicate?

Accepted Answer

The source file changed during backup. The exhibit shows a backup verification failure where the checksum or hash of the source file does not match the backup copy. This typically occurs when the source file is modified during the backup process (e.g., an open file that is being written to), causing the verification algorithm to detect a mismatch. The correct answer is A because the backup software correctly identifies that the source changed, not that the backup medium or file is corrupt.

Answer

The backup medium has errors

Answer

The verification algorithm is incorrect

Answer

The backup file is corrupt

Question 3

The exhibit shows recent authentication logs. What type of attack is most likely indicated?

Accepted Answer

Brute-force attack. The exhibit shows repeated authentication attempts with different passwords for the same username, which is the hallmark of a brute-force attack. In authentication logs, a high frequency of failed login attempts (e.g., multiple 'Failed password' entries in quick succession) indicates an attacker systematically guessing credentials. This aligns with the CC domain of Access Controls, where brute-force attacks target weak password policies.

Answer

Man-in-the-middle attack

Answer

Phishing attack

Answer

Privilege escalation

Question 4

A security analyst reviews firewall logs and notices a large number of outbound connections from a single internal IP to a known malicious IP on port 445. The analyst quarantines the workstation and runs an antivirus scan, which finds no malware. What should the analyst do next?

Accepted Answer

Analyze network traffic to identify the process responsible for the connections.. The absence of malware detection does not rule out malicious activity; the connections could be caused by a legitimate process that has been abused (e.g., a vulnerable service or script) or by fileless malware that evades signature-based scans. Analyzing network traffic with tools like Wireshark or NetFlow can identify the source process (e.g., via Windows Event Logs or Sysmon), the exact data being sent, and whether the traffic is encrypted or uses SMB protocol specifics on port 445. This forensic step is essential before taking irreversible actions like reimaging or broad blocking.

Answer

Conclude that the scan is clean and remove the quarantine.

Answer

Reimage the workstation immediately.

Answer

Block all outbound traffic on port 445 from the internal network.

Question 5

An organization wants to ensure that system logs are tamper-proof after generation. Which control should be implemented?

Accepted Answer

Use a write-once read-many (WORM) storage device.. WORM storage prevents modification or deletion of logs, ensuring tamper-proofing after generation. Option A (compressing logs) does not prevent tampering. Option C (local hard drive) is not tamper-proof. Option D (encryption in transit) protects during transmission but not at rest on the storage device.

Answer

Compress logs before archiving.

Answer

Store logs on the local hard drive of each server.

Answer

Encrypt logs during transmission.

Question 6

A security analyst is reviewing an alert from the IDS that shows a large number of TCP SYN packets sent to a single port on multiple internal hosts from a single external IP address. The analyst suspects a reconnaissance attack. Which type of attack is this most likely?

Accepted Answer

SYN scan. This is most likely a SYN scan (option D), a reconnaissance technique where an attacker sends TCP SYN packets to a specific port on multiple hosts to determine if the port is open. A SYN scan is stealthier than a full TCP connect scan because it never completes the three-way handshake, leaving fewer logs. The IDS alert describes the hallmark behavior of a SYN scan: a single external IP targeting the same port across many internal hosts.

Answer

SYN flood

Answer

Ping sweep

Answer

Smurf attack

Question 7

An organization wants to detect and alert on potential network intrusions but does not want to risk blocking legitimate traffic. Which system should they deploy?

Accepted Answer

Network-based Intrusion Detection System (NIDS). A Network-based Intrusion Detection System (NIDS) passively monitors network traffic and generates alerts when suspicious patterns are detected, but it does not take any inline action to block traffic. This makes it the correct choice for an organization that wants to detect and alert on potential intrusions without any risk of blocking legitimate traffic, as the NIDS operates out-of-band and cannot drop packets.

Answer

Unified Threat Management (UTM) appliance

Answer

Firewall with deep packet inspection

Answer

Network-based Intrusion Prevention System (NIPS)

Question 8

A system administrator is configuring permissions for a new file server. To adhere to the principle of least privilege, which approach should the administrator take?

Accepted Answer

Grant each user only the permissions necessary to perform their job duties.

Answer

Grant permissions only to the IT department.

Answer

Grant permissions based on the user's department membership.

Answer

Grant all users full control to simplify management.

Question 9

During a security incident, the incident response team needs to preserve evidence. Which of the following actions should be performed first?

Accepted Answer

Capture a memory dump. Capturing a memory dump (volatile data) is the first priority because it contains critical evidence such as running processes, network connections, and encryption keys that will be lost when the system is powered off. The order of volatility dictates that volatile data must be collected before any non-volatile data, and before any actions that could alter system state.

Answer

Notify law enforcement

Answer

Power off the system

Answer

Run antivirus scan

Question 10

A SOC analyst reviews a SIEM alert indicating a high volume of outbound traffic from a server to an external IP address known for command-and-control activity. The analyst has confirmed the alert is not a false positive. What is the most appropriate next step?

Accepted Answer

Conduct a deeper investigation to identify affected systems and data.. Tier 2 analysts conduct deeper investigation to determine the scope and impact of a confirmed incident before initiating response actions.

Answer

Escalate the alert to Tier 3 for advanced analysis.

Answer

Block the external IP address at the firewall immediately.

Answer

Reboot the server to terminate any malicious processes.

Question 11

During a security audit, a penetration tester captures network traffic and finds that some packets have the IP ID field set to 0 and the DF (Don't Fragment) flag set. What is this technique attempting to do?

Accepted Answer

Perform a stealth scan using a zombie host to hide the attacker's identity. Setting the IP ID field to 0 and the DF flag in packets is characteristic of an idle scan (also known as a stealth scan). This technique uses a zombie host (with an incremental IP ID) to probe a target; by sending packets with DF set and IP ID 0 to the zombie, the attacker can observe changes in the zombie's IP ID to infer open ports on the target, thereby hiding the attacker's true IP address.

Answer

Spoof the source IP address of the attacker's machine

Answer

Launch a denial-of-service attack against the target

Answer

Evade a firewall by fragmenting packets

Question 12

According to NIST SP 800-63 recommendations for password policies, which THREE practices are recommended? (Select THREE.)

Accepted Answer

Allow users to paste passwords to facilitate password manager use. NIST SP 800-63 recommends checking passwords against breached lists, setting minimum length (8+ characters, 15+ for high assurance), and avoiding frequent forced changes unless compromised.

Answer

Require complex combinations of uppercase, lowercase, numbers, and symbols

Answer

Require frequent password changes every 30 days

Question 13

Which of the following are core principles of information security?

Accepted Answer

Integrity. The core principles of information security, known as the CIA triad, are Confidentiality, Integrity, and Availability. Therefore, the correct answers are Integrity (B), Confidentiality (C), and Availability (E). Integrity ensures data accuracy and prevents unauthorized modification, often verified through hashing. Confidentiality ensures data is accessible only to authorized users, typically via encryption. Availability ensures that systems and data are accessible when needed. The other options—Authentication (A) and Non-repudiation (D)—are important security concepts but are not part of the CIA triad.

Answer

Authentication

Answer

Non-repudiation

Question 14

Which THREE are examples of administrative access controls?

Accepted Answer

Password complexity requirements. Password complexity requirements are administrative access controls because they are defined in security policies and enforced through user behavior and organizational rules, not through hardware or software mechanisms. They fall under the administrative category of access control, which includes policies, procedures, and guidelines that govern user actions and access rights.

Answer

Mantraps

Answer

Guard patrols

Question 15

During a security assessment, a penetration tester captures unencrypted credentials over the network. Which protocol is most likely being used?

Accepted Answer

FTP. FTP (File Transfer Protocol) transmits data, including credentials, in cleartext over the network. When a penetration tester captures unencrypted credentials, FTP is a likely candidate because it does not encrypt the authentication process, making it vulnerable to packet sniffing attacks.

Answer

SMTPS

Answer

SSH

Answer

HTTPS