ISC2 CC Practice Test 45 — 15 Questions

Question 1

After a security breach, it was discovered that an attacker used a stolen certificate to sign malicious code. Which security principle was compromised?

Accepted Answer

Non-repudiation. Non-repudiation ensures that an entity cannot deny having performed an action, such as signing code. When an attacker uses a stolen certificate to sign malicious code, the legitimate owner of the certificate cannot deny the signature, because the cryptographic proof (the digital signature) is bound to the certificate. This compromises the principle of non-repudiation, as the signature can no longer be reliably attributed to the intended signer.

Answer

Integrity

Answer

Confidentiality

Answer

Availability

Question 2

During a routine security audit, an analyst finds that several critical servers have misconfigured firewall rules allowing inbound SSH access from the entire internet. Which immediate action should the analyst take?

Accepted Answer

Modify the firewall rules to allow SSH only from specific management IPs. The immediate priority is to eliminate the critical vulnerability by restricting inbound SSH access to only authorized management IPs. This aligns with the principle of least privilege and the immediate remediation steps in security incident response, as leaving the misconfiguration active even briefly exposes the servers to potential compromise.

Answer

Disable SSH on all servers

Answer

Notify the server owners and wait for their response

Answer

Document the finding and include it in the audit report

Question 3

A company conducts a background check on a new vendor before signing a contract. This activity is an example of:

Accepted Answer

Due diligence. Due diligence involves investigating and verifying a vendor's security posture and trustworthiness before engagement.

Answer

Risk avoidance

Answer

Due care

Answer

Risk transfer

Question 4

Which of the following is considered sensitive personally identifiable information (PII)?

Accepted Answer

Medical records. Sensitive PII includes medical records, financial information, and biometrics, which require extra protection.

Answer

Date of birth

Answer

Telephone number

Answer

Email address

Question 5

A healthcare organization uses a legacy application that stores patient records in plain text. The IT team is planning to upgrade the system but needs to ensure compliance with HIPAA. The new system will be hosted on-premises and accessed by doctors and nurses via a web portal. The security team proposes implementing a VPN for remote access, but the CEO wants to allow access from any device without VPN for convenience. Which principle should guide the decision?

Accepted Answer

Defense in depth. Defense in depth emphasizes multiple layers of security; a VPN alone is insufficient to protect sensitive health records. The CEO's request sacrifices security for convenience, and risk acceptance is not the best approach when stronger controls are feasible.

Answer

Least privilege

Answer

Security is an enabler

Answer

Risk acceptance

Question 6

An employee receives an email that appears to be from the CEO requesting an urgent wire transfer to a new vendor. The email contains several grammatical errors and the sender's address is slightly misspelled. What type of security incident is this?

Accepted Answer

Phishing attack. This is a social engineering attack, specifically phishing (or CEO fraud), where the attacker impersonates a trusted figure to trick the employee.

Answer

USB drop attack

Answer

Tailgating incident

Answer

Password attack

Question 7

Refer to the exhibit. Given the ACL shown, which traffic is allowed to reach 10.0.0.1?

Accepted Answer

HTTP and HTTPS only.. The ACL permits TCP traffic to destination 10.0.0.1 with destination port numbers 80 (HTTP) and 443 (HTTPS). Since the ACL ends with an implicit deny any, only HTTP and HTTPS traffic is allowed to reach 10.0.0.1. Option B is correct because the ACL explicitly permits these two services.

Answer

No traffic is allowed.

Answer

Only traffic from the internal network.

Answer

All TCP traffic from any source.

Question 8

A security administrator notices that an employee is able to access files in a project folder they should not have access to. Which security principle is being violated?

Accepted Answer

Least privilege. The scenario describes an employee accessing files they should not have access to, which directly violates the principle of least privilege. This principle mandates that users and processes should be granted only the minimum permissions necessary to perform their job functions. The administrator's observation indicates that the employee's access rights exceed what is required, leading to unauthorized file access.

Answer

Non-repudiation

Answer

Separation of duties

Answer

Defense in depth

Question 9

A company uses a proxy server for internet access. Employees can browse websites (HTTP/HTTPS), but they cannot connect to external FTP servers using FTP client software (e.g., FileZilla). The proxy is configured to allow HTTP and HTTPS only. The security team wants to allow FTP while maintaining security (e.g., logging and filtering). The FTP traffic is used for occasional file transfers with partners. Which of the following is the BEST solution to meet both requirements?

Accepted Answer

Install a separate FTP proxy in the DMZ and adjust firewall rules to allow FTP traffic to that proxy.. Deploying a dedicated FTP proxy in the DMZ allows the security team to inspect, log, and filter FTP traffic while keeping the existing HTTP/HTTPS proxy unchanged. Firewall rules can be tightened to permit FTP only to that proxy, which then forwards connections to external FTP servers, maintaining a secure, auditable chokepoint without exposing internal clients directly to FTP.

Answer

Use SSH tunneling to encapsulate FTP traffic over SSH to a jump server.

Answer

Configure the proxy to allow FTP traffic by adding FTP as an allowed protocol.

Answer

Enable FTP passive mode on the proxy.

Question 10

A security analyst recommends implementing digital signatures to ensure that a software update has not been altered during distribution. Which aspect of the CIA triad is primarily being addressed?

Accepted Answer

Integrity. Digital signatures provide integrity by allowing verification that data has not been modified and confirming the source.

Answer

Availability

Answer

Confidentiality

Answer

Non-repudiation

Question 11

An organization decides to purchase cyber insurance to cover potential losses from a data breach. This is an example of which risk treatment strategy?

Accepted Answer

Risk transfer. Risk transfer involves shifting the financial impact of a risk to another party, such as through insurance.

Answer

Risk mitigation

Answer

Risk acceptance

Answer

Risk avoidance

Question 12

Refer to the exhibit. A security analyst sees this log entry from a firewall. What is the most likely reason for this denial?

Accepted Answer

The destination port is not allowed. The firewall log entry indicates a packet was denied due to a policy violation, and the most common reason for such a denial in a stateful firewall is that the destination port is not permitted by the configured access control list (ACL) or security policy. Firewalls evaluate traffic against rules that specify allowed source/destination IPs, ports, and protocols; if the destination port is not explicitly allowed, the packet is dropped. This is a standard security practice to restrict unauthorized services.

Answer

The source IP is blacklisted

Answer

The access-group is misconfigured

Answer

The packet is malformed

Question 13

In a typical Windows environment, which access control model is used for managing file permissions?

Accepted Answer

Discretionary Access Control (DAC). In a typical Windows environment, file permissions are managed using Discretionary Access Control (DAC), where the owner of a resource (e.g., a file or folder) can grant or deny access to other users or groups. This is implemented via NTFS permissions, which allow the owner to set ACLs (Access Control Lists) on objects, giving them discretion over who can read, write, or execute. Windows does not enforce a system-wide policy beyond the owner's decisions, which is the hallmark of DAC.

Answer

Role-Based Access Control (RBAC)

Answer

Mandatory Access Control (MAC)

Answer

Attribute-Based Access Control (ABAC)

Question 14

A company is implementing an access control system to protect sensitive data. Employees in the finance department must access financial records, but only during business hours and from company-issued devices. Which access control model best supports these requirements?

Accepted Answer

Rule-Based Access Control (RuBAC). Rule-Based Access Control (RuBAC) is the correct choice because it enforces access decisions based on a set of predefined rules, such as time-of-day restrictions and device compliance. In this scenario, the rules 'business hours only' and 'company-issued devices only' are static conditions that can be implemented as access control rules (e.g., using a firewall ACL or a policy engine) without requiring user attributes or labels. RuBAC is ideal when access is governed by operational policies that are not tied to user identity or data classification.

Answer

Attribute-Based Access Control (ABAC)

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Question 15

A network administrator notices unusual traffic from an internal workstation to an external IP address on port 443. The workstation has no business reason for such communication. Which action should the administrator take first?

Accepted Answer

Investigate the workstation for possible malware.. The first priority when encountering unexpected outbound traffic to an external IP on port 443 (HTTPS) is to investigate the workstation for possible malware. This traffic could indicate a command-and-control (C2) beacon or data exfiltration, and immediate investigation allows the administrator to gather forensic evidence before taking disruptive actions. Disabling the port or blocking traffic without investigation could destroy evidence or alert an attacker, while allowing the traffic would be negligent.

Answer

Disable the workstation's network port.

Answer

Block all outbound traffic from that workstation immediately.

Answer

Configure a firewall rule to allow the traffic and log it.