ISC2 CC Practice Test 46 — 15 Questions

Question 1

Refer to the exhibit. The network administrator configured NAT as shown. Internal hosts can access the internet, but no external hosts can access the company's web server (192.168.1.10). What is the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The pool includes the static IP causing conflict. The dynamic NAT pool includes the IP address 200.100.50.1, which is also used for the static NAT mapping to the web server. When a packet arrives from the internet destined for the static NAT address, the router first checks dynamic NAT entries and may assign that address from the pool to an internal host, causing a conflict and preventing the static translation from being applied. This is a classic IP address overlap issue where the pool should exclude the static NAT address.

Answer

The static NAT is being overridden by the dynamic NAT

Answer

The outside interface should be the inside interface

Answer

The web server is not in the access-list

Question 2

Which THREE of the following are characteristics of a stateful firewall? (Select exactly three.)

Accepted Answer

It can automatically allow return traffic for outbound connections. A stateful firewall automatically allows return traffic for outbound connections because it tracks the state of each connection in a state table. When a packet from an internal host initiates an outbound TCP connection (e.g., SYN), the firewall creates an entry in the state table. When the corresponding return packet (e.g., SYN-ACK) arrives, the firewall checks the state table and permits it without needing an explicit inbound rule, as it recognizes the packet as part of an established session.

Answer

It inspects application-layer payloads

Answer

It filters packets based solely on source/destination IP and port

Question 3

Which TWO of the following are primary objectives of an incident response plan? (Choose two.)

Accepted Answer

Return affected systems to normal operation. A primary objective of an incident response plan is to return affected systems to normal operation. This involves containment, eradication, and recovery steps to restore business functions after a security incident, ensuring the organization can resume operations securely.

Answer

Ensure business continuity during the incident

Answer

Collect evidence for legal proceedings

Answer

Identify the root cause of the incident

Question 4

Which of the following is an example of a detective control in a security operations context?

Accepted Answer

Reviewing audit logs for suspicious activity.. Detective controls are designed to identify and alert on security incidents after they have occurred. Reviewing audit logs for suspicious activity is a classic detective control because it involves examining historical records to detect unauthorized access or anomalies. In contrast, preventive controls like patching, MFA, and firewall rules aim to stop incidents before they happen.

Answer

Installing a security patch to fix a vulnerability.

Answer

Requiring multi-factor authentication for remote access.

Answer

Firewall rules blocking unauthorized traffic.

Question 5

After a major DDoS attack, a company deploys redundant internet connections and load balancers to ensure continued access to its web services. Which principle of the CIA triad is being strengthened?

Accepted Answer

Availability. Redundancy and load balancing help maintain access for authorized users, supporting availability.

Answer

Confidentiality

Answer

Non-repudiation

Answer

Integrity

Question 6

A company needs to enforce access based on attributes such as time of day and location. Which access control model is most appropriate?

Accepted Answer

Attribute-Based Access Control (ABAC). Attribute-Based Access Control (ABAC) is the correct choice because it evaluates policies based on multiple attributes (e.g., time of day, location, user role, device type) at runtime. This allows fine-grained, context-aware access decisions, such as permitting access only during business hours from a corporate office. ABAC uses a policy engine to evaluate attribute-based rules, making it ideal for dynamic environments where access depends on environmental conditions.

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Answer

Role-Based Access Control (RBAC)

Question 7

Which concept ensures that a user cannot deny having performed a specific action?

Accepted Answer

Non-repudiation. Non-repudiation ensures that a user cannot deny having performed a specific action, typically by using cryptographic mechanisms such as digital signatures or audit logs. In the context of the CC exam, this is most commonly achieved through public key infrastructure (PKI) where a private key signs an action, and the corresponding public key verifies the signature, providing irrefutable proof of origin. This prevents a user from later claiming they did not send a message or perform a transaction.

Answer

Availability

Answer

Integrity

Answer

Authorization

Question 8

Refer to the exhibit. An SOC analyst pulled this log snippet. Which type of attack is most likely in progress?

Accepted Answer

DDoS attack. The log snippet shows a massive volume of incoming traffic from multiple source IPs targeting a single destination, which is characteristic of a distributed denial-of-service (DDoS) attack. The high packet rate and diverse source addresses indicate an attempt to overwhelm the target's resources, such as bandwidth or server capacity, making services unavailable to legitimate users.

Answer

Phishing

Answer

Man-in-the-middle

Answer

Insider threat

Question 9

A security analyst is investigating a potential DDoS attack on the company's web server. Which two symptoms are indicative of a SYN flood attack? (Select TWO.)

Accepted Answer

Large number of half-open connections. Options D and E are both correct indicators of a SYN flood attack. Option D is correct because a SYN flood sends many SYN packets to initiate TCP connections but never completes the three-way handshake, leaving numerous half-open connections in the SYN_RECEIVED state on the server, which exhausts resources. Option E is correct because the attack generates a high number of SYN packets from the attacker, and since the handshake is never completed, the corresponding ACK packets are absent. Both symptoms—half-open connections and SYN packets without ACK—are characteristic of a SYN flood.

Answer

Increased DNS query responses

Answer

High number of ICMP echo replies

Answer

Unusual outbound traffic on port 80

Question 10

Refer to the exhibit. A security analyst notices that a user with the Finance role is able to write to /finance/data from a macOS device at 10:00 AM. The policy shown is the only policy affecting this resource. What is the most likely reason for this behavior?

Accepted Answer

The user's device attribute is incorrectly set to Windows.. The policy likely includes a condition such as 'Deny if device.os != "Windows"' to restrict write access to non-Windows devices. Since the user's device attribute is incorrectly set to 'Windows' (even though the actual device is macOS), the condition evaluates to false. Consequently, the Deny rule is not enforced, and the default Allow (or a broader Allow rule) permits write access. This misconfiguration results in unintended access from a macOS device.

Answer

The condition is evaluated as OR instead of AND.

Answer

The time condition is evaluated as BETWEEN 09:00 and 17:00 exclusive.

Answer

The policy is misconfigured with effect Deny.

Question 11

Refer to the exhibit. Which security principle is being supported by the logging of these events?

Accepted Answer

Accountability. Correct: D - Accountability. Logging provides a record of events that can be traced to specific sources, enabling accountability. Non-repudiation involves proof of actions by a user, but these logs do not prove user identity. Authentication and availability are not directly supported.

Answer

Availability

Answer

Authentication

Answer

Non-repudiation

Question 12

During a security audit, you discover that a financial application stores passwords using MD5 hashing without salt. What is the primary security concern with this practice?

Accepted Answer

Without salting, the hashes are vulnerable to precomputed rainbow table attacks. MD5 is a fast hash, making it susceptible to brute-force and rainbow table attacks. Without salting, identical passwords produce identical hashes, allowing precomputed rainbow tables to quickly reverse them. Hashing is one-way, so MD5 is not reversible in the true sense. Speed is a vulnerability, not a benefit. Compliance is secondary but not the primary security concern.

Answer

MD5 is reversible, allowing attackers to recover plaintext passwords

Answer

MD5 is too slow, causing performance issues during authentication

Answer

Storing hashes violates PCI DSS compliance, but does not affect security

Question 13

A financial company requires that any transaction over $10,000 must be approved by two different managers before being processed. This is an example of which access control principle?

Accepted Answer

Separation of Duties. The requirement for two different managers to approve a transaction over $10,000 enforces Separation of Duties (SoD). This access control principle ensures that no single individual has the authority to execute a high-risk action alone, thereby preventing fraud or error by splitting critical tasks across multiple roles. In this scenario, one manager cannot both initiate and approve the transaction, which directly aligns with SoD's goal of distributing responsibility.

Answer

Least Privilege

Answer

Need-to-Know

Answer

Dual Control

Question 14

A company's security policy mandates that all changes to the firewall configuration must be approved by two different administrators before implementation. This is an example of which security principle?

Accepted Answer

Separation of duties. The requirement for two different administrators to approve firewall configuration changes enforces separation of duties. This principle ensures that no single individual has the authority to make unilateral changes, reducing the risk of unauthorized or malicious modifications. In firewall management, this prevents a single admin from bypassing security controls or introducing backdoors without oversight.

Answer

Defense in depth

Answer

Need to know

Answer

Least privilege

Question 15

A security engineer is designing a backup strategy for a critical database. The database must be recoverable within four hours in the event of a failure. Which security principle primarily drives this requirement?

Accepted Answer

Availability. Availability ensures that systems and data are accessible when needed. The requirement to recover the database within four hours defines a Recovery Time Objective (RTO), which is an availability requirement. Therefore, Option A is correct. Option B (Integrity) ensures data accuracy and protection from unauthorized modification, not recovery time. Option C (Non-repudiation) prevents denial of actions, which is unrelated. Option D (Confidentiality) protects data from unauthorized disclosure.

Answer

Integrity

Answer

Non-repudiation

Answer

Confidentiality