ISC2 CC Practice Test 47 — 15 Questions

Question 1

Which THREE are common indicators of a compromised system? (Select THREE.)

Accepted Answer

Unexpected software installations. Unexpected software installations are a common indicator of compromise because attackers often deploy malware, backdoors, or remote access tools (RATs) without user consent. In a CC context, this aligns with the principle that unauthorized software changes signal a breach, as legitimate installations typically follow change management processes. The presence of unknown executables or services in the system's process list or startup entries is a red flag.

Answer

High CPU usage during business hours

Answer

System uptime greater than 30 days

Question 2

An organization wants to ensure that no single employee can both request and approve a payment. Which access control principle does this enforce?

Accepted Answer

Separation of duties. Separation of duties (SoD) is the access control principle that prevents a single individual from having conflicting permissions, such as both requesting and approving a payment. By splitting the payment lifecycle into distinct roles (e.g., requester vs. approver), the organization enforces a dual-control mechanism that reduces the risk of fraud or error. This is commonly implemented in financial systems using role-based access control (RBAC) where the 'payment request' and 'payment approval' roles are mutually exclusive.

Answer

Least privilege

Answer

Need to know

Answer

Defense in depth

Question 3

Which of the following best describes the difference between due care and due diligence in security governance?

Accepted Answer

Due care is the minimum standard of care; due diligence is the investigation and assessment. Due care refers to the minimum standard of care that an organization must exercise to protect its assets, often defined by laws, regulations, or industry best practices. Due diligence is the ongoing process of investigation, assessment, and verification to ensure that due care is maintained. In security governance, due care is the baseline, while due diligence is the active effort to identify and mitigate risks.

Answer

Due care is proactive, due diligence is reactive

Answer

They are synonymous

Answer

Due care applies to vendors; due diligence applies to employees

Question 4

An employee receives an email from the CEO asking for an urgent wire transfer to a new vendor. The email address is slightly misspelled. What type of attack is this?

Accepted Answer

Phishing. Phishing is a social engineering attack where an attacker impersonates a trusted entity (here, the CEO) via email to trick the recipient into performing a harmful action, such as transferring funds. The slightly misspelled email address is a classic phishing indicator — attackers register look-alike domains to deceive recipients. This specific CEO-impersonation variant is often called Business Email Compromise (BEC), a form of phishing.

Answer

Shoulder surfing

Answer

USB drop attack

Answer

Tailgating

Question 5

An organization has an RTO of 4 hours and an RPO of 1 hour for its customer database. After a disaster, the IT team restores the database from backups that are 2 hours old, and the system becomes operational in 3 hours. Which of the following is true?

Accepted Answer

The RTO was met, but the RPO was not.. The RTO of 4 hours was met because the system became operational in 3 hours, which is within the 4-hour target. However, the RPO of 1 hour was not met because the restored data was 2 hours old, meaning up to 2 hours of data was lost, exceeding the 1-hour maximum tolerable data loss. Therefore, the RTO was met but the RPO was not.

Answer

Neither the RTO nor RPO was met.

Answer

The RPO was met, but the RTO was not.

Answer

Both the RTO and RPO were met.

Question 6

A company experiences a ransomware attack that encrypts all files on a server. Which security control would MOST effectively allow recovery without paying the ransom?

Accepted Answer

Regular backups. Regular backups are the most effective control for recovering from ransomware because they allow restoration of data to a known-good state without paying the ransom. Ransomware encrypts files in place, so preventive controls like firewalls or antivirus may fail against new variants, but offline or immutable backups preserve a clean copy. The key is that backups must be isolated (offline, air-gapped, or immutable) to prevent the ransomware from encrypting them too.

Answer

Firewall

Answer

Intrusion detection system

Answer

Antivirus software

Question 7

In an LDAP directory, an entry is represented as 'CN=John Smith,OU=Sales,DC=company,DC=com'. What does 'CN' stand for?

Accepted Answer

Common Name. In LDAP Distinguished Names (DNs), CN stands for Common Name, which identifies the specific object or entity within the directory hierarchy — in this case, the user 'John Smith'. LDAP DNs are read right-to-left, with the most specific attribute (CN) appearing first and the root domain components (DC) appearing last. CN is one of the most frequently used RDN (Relative Distinguished Name) attributes for naming users, groups, and other objects.

Answer

Container Name

Answer

Country Name

Answer

Context Name

Question 8

Refer to the exhibit. Based on the exhibit, why was the packet denied?

Accepted Answer

The packet was blocked by an inbound access list. The exhibit shows an inbound access list applied to the interface, and the packet is denied because its source IP matches a deny entry in that inbound ACL. Inbound access lists filter traffic before it is processed by the router, so the packet is dropped upon arrival. The correct answer is D because the packet was blocked by an inbound access list, as indicated by the ACL configuration and the deny action.

Answer

Source IP is internal

Answer

The packet was blocked by an outbound access list

Answer

Destination IP is external

Question 9

Which document outlines the procedures for maintaining critical business functions during a disruption?

Accepted Answer

Business Continuity Plan. The Business Continuity Plan (BCP) is the correct answer because it specifically outlines the procedures and strategies to maintain critical business functions during a disruption. Unlike other plans that focus on IT recovery or incident response, the BCP ensures that essential business operations continue, often by leveraging alternate work sites, manual workarounds, or scaled-down processes, until normal operations can be restored.

Answer

Continuity of Operations Plan

Answer

Incident Response Plan

Answer

Disaster Recovery Plan

Question 10

A company is designing a new authentication system for remote employees. They want to ensure that if one authentication factor is compromised, the system remains secure. Which security principle should they apply?

Accepted Answer

Defense in depth. Defense in depth is the correct principle because it involves implementing multiple layers of security controls so that if one authentication factor is compromised, other layers still protect the system. In this scenario, requiring multiple authentication factors (e.g., password plus biometric or token) ensures that a single compromised factor does not grant full access, maintaining overall system security.

Answer

Fail-safe

Answer

Least privilege

Answer

Need to know

Question 11

A company's business continuity plan includes an alternate work site with full IT capabilities. Which type of recovery site does this describe?

Accepted Answer

Hot site. A hot site is a fully equipped alternate work site with all necessary IT infrastructure—servers, networking, telecommunications, and power—ready to take over operations immediately. The question specifies 'full IT capabilities,' which aligns with the hot site's purpose of enabling rapid failover with minimal downtime, typically within hours.

Answer

Mobile site

Answer

Cold site

Answer

Warm site

Question 12

Which of the following is a recommended practice for password security according to NIST SP 800-63?

Accepted Answer

Use a minimum of 8 characters and check against breached password lists. NIST SP 800-63B recommends a minimum of 8 characters and checking new passwords against lists of commonly used or breached passwords. It also advises against arbitrary complexity rules and frequent expiration, focusing instead on length and breach checks. This approach balances usability with security by preventing weak, compromised passwords.

Answer

Require frequent password changes every 30 days

Answer

Set maximum password age to 90 days

Answer

Enforce complex passwords with special characters

Question 13

You are the incident response lead for a financial services company. At 09:00, the SOC detects unusual outbound traffic from a server in the DMZ to an external IP known to be a command-and-control (C2) server. The server runs a legacy application that cannot be patched. The server is critical for customer transactions, but an alternate manual process can sustain operations for up to 4 hours. The CTO wants to keep the server online to avoid customer impact. The CEO is concerned about data exfiltration. The compliance officer reminds you of regulatory requirements to report breaches within 72 hours. Which action should you take FIRST?

Accepted Answer

Disconnect the server from the network and activate the manual process.. The correct first action is to disconnect the server from the network and activate the manual process. This immediately stops potential data exfiltration to the C2 server and contains the incident, aligning with the NIST incident response lifecycle's containment phase. Since the server runs a legacy application that cannot be patched and the manual process can sustain operations for up to 4 hours, isolation is both feasible and necessary to prevent further compromise while maintaining business continuity.

Answer

Report the incident to the regulatory authority immediately.

Answer

Perform a forensic analysis of the server to determine the scope of compromise.

Answer

Keep the server online under close monitoring to minimize customer disruption.

Question 14

A company wants to ensure that a message received was not altered in transit. Which principle is of primary concern?

Accepted Answer

Integrity. Integrity ensures that data has not been altered or tampered with during transmission. In the context of a received message, integrity guarantees that the message content remains exactly as sent by the originator. This is typically achieved using cryptographic hash functions or message authentication codes (MACs) that detect any modification. Thus, integrity is the primary concern when verifying that a message was not altered in transit.

Answer

Availability

Answer

Authentication

Answer

Confidentiality

Question 15

Which type of authentication factor involves something the user knows?

Accepted Answer

Type 1 (knowledge). Type 1 authentication is 'something you know' — knowledge factors such as passwords, PINs, or security questions. This is the classic knowledge-based factor and is correctly identified as Type 1 in the standard authentication factor taxonomy.

Answer

Type 2 (possession)

Answer

Type 4 (location)

Answer

Type 3 (inherence)