ISC2 CC Practice Test 45 — 15 Questions

Question 1

An organization uses a SIEM to correlate logs from multiple sources. A rule triggers when a user logs in from two geographically distant locations within a short time. What type of attack does this rule primarily detect?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Credential theft or session hijacking. The SIEM rule detects impossible travel — a user authenticating from two geographically distant locations within a time window too short for physical travel. This behavior strongly indicates that an attacker has stolen the user's credentials (credential theft) or taken over an active session (session hijacking) and is using them from a different location. The SIEM correlates authentication logs (e.g., from Active Directory, VPN, or web apps) with geolocation data (IP-to-location mapping) to flag this anomaly.

Answer

Denial of service attack

Answer

Brute-force attack

Answer

Man-in-the-middle attack

Question 2

A security analyst is evaluating controls to protect the confidentiality of customer data. Which TWO of the following are effective controls? (Select TWO).

Accepted Answer

Encryption of data at rest. Encryption of data at rest (C) is correct because it renders stored customer data unreadable to unauthorized parties, protecting confidentiality even if the storage media or database is compromised. Role-based access controls (E) are correct because RBAC enforces least privilege, ensuring only authorized users with the appropriate role can access customer data, directly limiting exposure. Hashing of passwords (A) protects password integrity/verification but is not a general confidentiality control for customer data, and hashes are one-way rather than reversible protection of data. Redundant network links (B) address availability through fault tolerance, not confidentiality. Regular data backups (D) support availability and recovery, not confidentiality, since backups can themselves expose data if unprotected.

Answer

Hashing of passwords

Answer

Redundant network links

Answer

Regular data backups

Question 3

When implementing a role-based access control (RBAC) system, what is the primary challenge organizations face?

Accepted Answer

Role explosion. Role explosion is the primary challenge in RBAC because as organizations grow, the number of distinct roles can proliferate rapidly, leading to administrative overhead, complexity in role management, and potential security gaps. This occurs when roles are defined too granularly or for every unique combination of permissions, making it difficult to maintain least privilege and audit access. Proper RBAC design requires careful role engineering to minimize the number of roles while still mapping to job functions.

Answer

Managing password complexity

Answer

Ensuring users do not share passwords

Answer

Defining roles that align with job functions

Question 4

A company is experiencing a distributed denial-of-service (DDoS) attack that is overwhelming the network bandwidth. Which THREE mitigation techniques are most effective?

Accepted Answer

Enable rate limiting on network devices. Traffic filtering, rate limiting, and using a CDN can help absorb DDoS traffic. Changing IP addresses is reactive and not a standard mitigation; disabling ICMP may help against some attacks but is not a primary mitigation.

Answer

Disable ICMP on all devices

Answer

Change the public IP address of the server

Question 5

A small business owner wants to ensure that their company's data remains accurate and unaltered during transmission over the internet. They regularly send financial reports to their accountant via email. The owner is concerned that a hacker might intercept and modify the reports before they reach the accountant. Which security principle is most directly threatened in this scenario, and what is the best technical control to implement?

Accepted Answer

Integrity; apply a digital signature or hash to the files. Integrity ensures data has not been altered or tampered with during transmission or storage. A digital signature (which uses the sender's private key to sign a hash of the file) or a cryptographic hash allows the recipient to verify that the file arrived exactly as sent. If a hacker modifies the report in transit, the hash/signature verification will fail, exposing the tampering.

Answer

Confidentiality; encrypt the email attachments

Answer

Non-repudiation; require read receipts

Answer

Availability; use a redundant email server

Question 6

An organization is experiencing network attacks where the attacker forges the source IP address. Which two types of attacks commonly use IP spoofing? (Choose TWO.)

Accepted Answer

SYN flood. SYN floods often spoof source IPs to hide the attacker, and DNS amplification attacks use spoofed source IPs to direct responses to the victim. ARP spoofing is local and does not involve IP spoofing in the same way, while MAC flooding and ping of death are different.

Answer

ARP spoofing

Answer

MAC flooding

Answer

Ping of death

Question 7

A security engineer is configuring a network intrusion detection system (NIDS) to monitor traffic on a critical subnet. To minimize false positives, which of the following should the engineer baseline first?

Accepted Answer

The normal traffic patterns during peak business hours. Baselining normal traffic patterns during peak business hours establishes a reference of legitimate network behavior, which is essential for a NIDS to distinguish benign anomalies from actual threats. Without this baseline, the NIDS may generate false positives by flagging legitimate peak-hour traffic spikes as malicious. This aligns with the principle that anomaly-based detection relies on a statistical model of normal activity to reduce noise.

Answer

The results of a recent vulnerability scan

Answer

The latest attack signatures from the vendor

Answer

The firewall logs from the past 24 hours

Question 8

Which recovery site strategy provides the shortest recovery time objective (RTO), typically measured in hours, by maintaining a fully mirrored environment that can be activated immediately?

Accepted Answer

Hot site. A hot site is fully configured with hardware, software, and real-time data replication, enabling recovery within hours.

Answer

Warm site

Answer

Reciprocal agreement

Answer

Cold site

Question 9

What is the primary goal of data classification?

Accepted Answer

To determine the appropriate level of security controls. Data classification is the process of categorizing data based on its sensitivity, value, and regulatory requirements so that appropriate security controls (encryption, access control, retention, handling procedures) can be applied proportionally. Its primary purpose is to ensure that protection levels match the data's risk profile. This is the foundational step in any data governance or security program.

Answer

To improve data access speed

Answer

To comply with marketing requirements

Answer

To reduce storage costs

Question 10

A financial institution requires near-instantaneous recovery of its trading platform after a disaster. The recovery time objective (RTO) is 2 hours, and the recovery point objective (RPO) is 15 minutes. Which recovery site strategy best meets these requirements?

Accepted Answer

Hot site. A hot site is a fully operational duplicate of the primary data center with real-time or near-real-time data replication, allowing recovery within minutes. It is the only strategy that can meet an RTO of 2 hours and an RPO of 15 minutes for a trading platform. Hot sites are expensive but necessary for near-instantaneous recovery.

Answer

Reciprocal agreement

Answer

Warm site

Answer

Cold site

Question 11

After a security incident, an investigator needs to analyze logs to determine the timeline of events. Which TWO types of logs are most likely to provide evidence of lateral movement within the network?

Accepted Answer

Authentication logs. Authentication logs (B) are correct because they record logon events such as successful and failed authentications, Kerberos ticket requests, and remote logon types (e.g., Type 3 network logons in Windows Security event 4624), which directly reveal an attacker moving from one host to another using compromised credentials. Firewall logs (C) are correct because they capture allowed and denied connections between internal hosts and across network segments, letting an investigator trace internal-to-internal traffic and identify the source and destination of lateral movement. DNS logs (A) can show name resolution but do not by themselves prove a session or movement between hosts. System logs (D) and application logs (E) may contain related events, but they are less directly indicative of network-based lateral movement than authentication and firewall records.

Answer

DNS logs

Answer

System logs

Answer

Application logs

Question 12

Based on the incident log, at which step did the incident response team contain the threat?

Accepted Answer

14:25 - Isolated WKS-045 from network. Containment is the immediate step to prevent the threat from spreading, and isolating WKS-045 from the network at 14:25 achieves this by cutting off its network connectivity. This aligns with the NIST SP 800-61 incident response lifecycle, where containment is prioritized before eradication or recovery. The log shows isolation occurred before scanning or removal, making it the correct containment action.

Answer

14:30 - Scanned system, detected Trojan.Downloader

Answer

14:45 - Removed malware via AV

Answer

14:35 - Escalated to incident handler

Question 13

The exhibit shows the current iptables rules. Which security principle is most clearly enforced by the default policy?

Accepted Answer

Fail-safe defaults. The default policy in iptables, typically DROP or REJECT for INPUT and FORWARD chains, enforces fail-safe defaults by denying all traffic that is not explicitly allowed. This security principle ensures that only permitted traffic passes, aligning with a deny-by-default posture.

Answer

Defense in depth

Answer

Separation of duties

Answer

Least privilege

Question 14

An administrator configures a Group Policy Object (GPO) in Active Directory to enforce account lockout after 5 failed attempts within 15 minutes. Which type of control is this?

Accepted Answer

Logical access control. Logical access controls are software-based mechanisms that govern access to systems. Account lockout policies are logical controls.

Answer

Administrative access control

Answer

Compensating control

Answer

Physical access control

Question 15

A software company's incident response plan defines a severity level of 'Critical' for incidents that cause a complete outage of customer-facing services. A developer accidentally deploys a faulty update that crashes the production web servers, making the service unavailable to all customers. Which incident response phase should the team be in when they apply a rollback to the previous working version?

Accepted Answer

Recovery. The recovery phase focuses on restoring systems to normal operation after an incident has been contained and eradicated. Applying a rollback to a previous working version is a recovery action because it brings the production web servers back online and functional. This phase ensures the service is fully restored and verified. It follows containment (limiting impact) and eradication (removing the cause).

Answer

Preparation

Answer

Containment

Answer

Eradication