ISC2 CC Practice Test 47 — 15 Questions

Question 1

Which of the following is a recommended practice for administrative accounts?

Accepted Answer

Use a separate admin account distinct from daily use account. Admins should have a separate account for privileged tasks to reduce risk.

Answer

Use the same account for daily work and admin tasks

Answer

Grant admin rights to all users for convenience

Answer

Disable all admin accounts to improve security

Question 2

Which of the following is a recommended practice for password security according to NIST SP 800-63?

Accepted Answer

Use a minimum of 8 characters and check against breached password lists. NIST SP 800-63 recommends favoring password length over complexity and checking passwords against breached lists.

Answer

Require frequent password changes every 30 days

Answer

Set maximum password age to 90 days

Answer

Enforce complex passwords with special characters

Question 3

A security analyst notices repeated failed login attempts from a single external IP address targeting the company's VPN concentrator. Which type of attack is most likely occurring?

Accepted Answer

Brute force. Repeated failed login attempts from a single external IP targeting a VPN concentrator are the hallmark of a brute force attack. The attacker systematically tries many username/password combinations to gain unauthorized access, exploiting weak or common credentials rather than exploiting a protocol vulnerability.

Answer

Spoofing

Answer

Man-in-the-Middle (MITM)

Answer

Denial of Service (DoS)

Question 4

Which of the following is an example of a logical access control?

Accepted Answer

Password policies. Logical access controls are technology-based mechanisms that restrict access to systems and data, such as passwords.

Answer

Security guards

Answer

Perimeter fencing

Answer

Biometric reader on server room door

Question 5

In the context of identification and authentication, which of the following is an example of authentication?

Accepted Answer

Providing a fingerprint scan. Authentication is the process of proving a claimed identity. Providing a fingerprint matches the user's biometric data, verifying identity.

Answer

Entering a username

Answer

Being assigned a user ID

Answer

Swiping an access badge

Question 6

An organization wants to ensure that even if an attacker compromises a user's account, the damage is limited. Which principle is most directly applied?

Accepted Answer

Least privilege. Least privilege reduces the blast radius of an account compromise.

Answer

Separation of duties

Answer

Defense in depth

Answer

Need-to-know

Question 7

An account lockout policy is designed to mitigate which type of attack?

Accepted Answer

Brute force. Account lockout prevents brute force attacks by disabling the account after several failed attempts.

Answer

SQL injection

Answer

Man-in-the-middle

Answer

Phishing

Question 8

Which of the following is an example of a physical access control at the building entrance?

Accepted Answer

Access badges. Access badges are a common physical control at building entrances.

Answer

Password complexity requirements

Answer

Biometric reader on a server room door

Answer

Account lockout policy

Question 9

An LDAP distinguished name (DN) is formatted as: CN=John Smith,OU=Sales,DC=company,DC=com. Which component represents the organizational unit?

Accepted Answer

OU=Sales. OU stands for Organizational Unit in LDAP DNs.

Answer

DC=com

Answer

CN=John Smith

Answer

DC=company

Question 10

An organization wants to implement defense in depth for its server room. Which THREE controls should be included?

Accepted Answer

Cable locks on all servers. Defense in depth uses multiple overlapping controls. These three represent different layers.

Answer

Group Policy to enforce password complexity

Answer

Visitor sign-in log at the front desk

Question 11

A network administrator is configuring a wireless network for a small office. Security requirements include strong encryption and pre-shared key authentication. Which protocol should be used?

Accepted Answer

WPA2-PSK with AES. WPA2-PSK with AES is the correct choice because it provides strong encryption (AES-CCMP) and uses a pre-shared key for authentication, meeting the requirements for a small office without a RADIUS server. WPA2-PSK is widely supported and offers robust security against common attacks when a strong passphrase is used.

Answer

WPA3-Enterprise with 802.1X

Answer

Open with MAC address filtering

Answer

WEP with TKIP

Question 12

An organization wants to implement the principle of least privilege for its database administrators. Which approach best achieves this goal?

Accepted Answer

Use role-based access control (RBAC) to grant permissions specific to each administrator's duties.. Role-based access control (RBAC) directly enforces the principle of least privilege by granting database administrators only the permissions required for their specific job functions. Unlike MAC, which focuses on data classification labels, RBAC maps roles (e.g., backup admin, security admin) to precise sets of privileges, ensuring no user has unnecessary access.

Answer

Implement mandatory access control (MAC) with labels for all data.

Answer

Allow administrators to self-assign permissions as needed.

Answer

Assign each administrator full database admin rights for simplicity.

Question 13

A security administrator notices that a user with standard privileges was able to modify a system file. Which security principle has been violated?

Accepted Answer

Least privilege. The principle of least privilege requires that users be granted only the permissions necessary to perform their job functions. A standard user modifying a system file indicates they have been assigned unnecessary administrative rights, violating this principle. This could occur if the user is a member of a group like Administrators or has been granted explicit write access to protected directories such as %SystemRoot%\System32.

Answer

Need to know

Answer

Defense in depth

Answer

Separation of duties

Question 14

A security architect is designing controls to protect a data center. Which TWO of the following are examples of physical access controls? (Select TWO.)

Accepted Answer

Biometric reader on server room door. Physical access controls include barriers and objects that physically restrict entry.

Answer

Session timeout settings

Answer

Password complexity policy

Answer

Role-based access control (RBAC)

Question 15

You are designing a backup strategy for a critical database. The business requires that in the event of a failure, data loss must not exceed 15 minutes. Which metric primarily addresses this requirement?

Accepted Answer

Recovery Point Objective (RPO). Recovery Point Objective (RPO) defines the maximum acceptable data loss in terms of time, which directly addresses the requirement that data loss must not exceed 15 minutes. Recovery Time Objective (RTO) is about downtime duration, not data loss. MTBF relates to reliability, and SLA is a service agreement. RPO is the metric that specifies the tolerable amount of data loss measured in time.

Answer

Service Level Agreement (SLA)

Answer

Mean Time Between Failures (MTBF)

Answer

Recovery Time Objective (RTO)