ISC2 CC Practice Test 48 — 15 Questions

Question 1

A security architect is designing an access control policy based on the principle of need-to-know. Which TWO practices support this principle? (Select TWO.)

Accepted Answer

Implementing data classification labels. Need-to-know means only accessing data necessary for job functions. Data classification and role-based access help enforce this.

Answer

Using a single sign-on solution

Answer

Requiring two-factor authentication

Answer

Granting all employees access to the company directory

Question 2

You are the lead SOC analyst for a medium-sized financial services company. The company uses a hybrid infrastructure with on-premises servers and cloud services (AWS). The SIEM is Splunk Enterprise, collecting logs from firewalls, IDS/IPS, endpoints (Windows and Linux), and AWS CloudTrail. Recently, the company experienced a ransomware attack that encrypted critical file servers. The initial infection vector was a phishing email that led to the download of a malicious macro-enabled document. The document was executed on a Windows workstation, which then established a C2 connection to an external IP. The C2 traffic was over HTTPS, and the workstation was part of the domain. After the attack, the forensic team found that the workstation had Windows Event Logs cleared, and the local admin account had been used to disable the antivirus. The C2 IP was later blocked, but the ransomware had already spread to file servers via SMB. As part of the lessons learned, you need to recommend improvements to prevent and detect such attacks in the future. Which of the following is the BEST course of action to address the specific weaknesses exploited in this incident?

Accepted Answer

Implement application whitelisting, disable macros by default, enforce strong local administrator passwords, and segment the network to restrict SMB traffic between workstations and servers.. Directly addresses the attack chain: disabling macros by default prevents the initial infection vector, application whitelisting blocks unauthorized executables (including the ransomware), strong local admin passwords hinder credential abuse, and network segmentation restricts SMB lateral movement. This combination targets the specific weaknesses exploited (macro execution, antivirus disablement via local admin, and SMB propagation) rather than just detecting or patching after the fact.

Answer

Increase the frequency of vulnerability scans and patch all systems within 24 hours of patch release.

Answer

Deploy additional IDS/IPS sensors and tune the SIEM to detect C2 traffic patterns.

Answer

Require multi-factor authentication (MFA) for all remote access and privileged account use.

Question 3

An organization's password policy requires passwords to be at least 8 characters long and prohibits common passwords found in breach databases. This policy aligns with which guideline?

Accepted Answer

NIST SP 800-63. NIST SP 800-63 recommends favoring length over complexity, minimum 8 characters, and checking passwords against known breached lists.

Answer

COBIT

Answer

ISO 27001

Answer

PCI DSS

Question 4

A security analyst is investigating a potential man-in-the-middle attack. Which two techniques are commonly used by attackers to perform MITM attacks? (Choose two.)

Accepted Answer

ARP poisoning. ARP poisoning and rogue Wi-Fi are common MITM techniques. IP spoofing can be part of MITM but is not a standalone technique; SYN flood is DoS.

Answer

SYN flood

Answer

Packet sniffing

Answer

IP spoofing

Question 5

Which layer of the OSI model is responsible for routing packets based on IP addresses?

Accepted Answer

Network layer. The Network layer (Layer 3) handles logical addressing and routing of packets.

Answer

Data Link layer

Answer

Transport layer

Answer

Physical layer

Question 6

An organization has multiple network segments for accounting, HR, and engineering. They want to prevent unauthorized traffic between segments while allowing necessary communication. Which security control should be implemented?

Accepted Answer

VLAN segmentation with ACLs. VLAN segmentation with ACLs is the correct choice because VLANs create separate broadcast domains at Layer 2, isolating traffic between network segments (accounting, HR, engineering). ACLs applied to the Layer 3 interface (SVI) or trunk ports then enforce granular rules to permit only necessary inter-VLAN communication, such as allowing HR to access a shared server while blocking all other cross-segment traffic.

Answer

Intrusion Detection System (IDS)

Answer

Proxy server

Answer

Honeypot

Question 7

An organization wants to place its public web server, email server, and DNS server in a network that is accessible from the internet but isolated from the internal corporate network. Which network design should be used?

Accepted Answer

DMZ. A DMZ (demilitarized zone) is a buffer network for public-facing servers.

Answer

VPN

Answer

VLAN

Answer

Subnet

Question 8

A configuration management tool detects that a critical server's security settings have changed from the approved baseline. What is the first action the security team should take?

Accepted Answer

Investigate the root cause of the configuration change. The first step is to investigate the cause of the drift, as it may indicate a misconfiguration or compromise.

Answer

Isolate the server from the network

Answer

Automatically revert the settings to the baseline

Answer

Update the baseline to match the current configuration

Question 9

A security administrator is concerned about MAC address spoofing on the network. Which technology can help mitigate this risk by associating a specific MAC address with a port?

Accepted Answer

Port security. Port security is the correct answer because it directly mitigates MAC address spoofing by allowing an administrator to statically or dynamically associate a specific MAC address with a switch port. When a device with a different MAC address attempts to use that port, port security can either disable the port (errdisable) or drop the traffic, preventing unauthorized access. This is a Layer 2 security feature that enforces MAC-to-port binding.

Answer

Dynamic ARP inspection

Answer

DHCP snooping

Answer

VLAN hopping prevention

Question 10

Which protocol is considered insecure because it transmits data, including credentials, in cleartext?

Accepted Answer

Telnet. Telnet (port 23) sends all data in cleartext, making it vulnerable to eavesdropping. SSH is the secure alternative.

Answer

SFTP

Answer

SSH

Answer

HTTPS

Question 11

A security analyst needs to ensure that log data cannot be altered after it is written. Which of the following is the most effective method to protect log integrity?

Accepted Answer

Implementing write-once storage for log files. Write-once storage (e.g., WORM drives) ensures data cannot be modified, deleted, or overwritten, preserving integrity.

Answer

Storing logs on the same server as the application

Answer

Using a separate log server with read-only access

Answer

Encrypting logs with a symmetric key

Question 12

To protect the integrity of log files, which of the following is a best practice?

Accepted Answer

Use write-once storage or a separate log server. Using write-once storage (e.g., WORM) or a separate log server prevents tampering with log data.

Answer

Store logs on the same server as the application

Answer

Allow administrators to edit logs for accuracy

Answer

Encrypt logs but store them locally

Question 13

A company deploys a new intrusion detection system (IDS) on the internal network. Which of the following best describes the primary purpose of this system?

Accepted Answer

Detect and alert on potential security incidents.. An intrusion detection system (IDS) is a passive monitoring technology that analyzes network traffic or system activity for signs of malicious behavior or policy violations. Unlike an intrusion prevention system (IPS), an IDS does not take inline action to block traffic; its primary purpose is to detect suspicious activity and generate alerts for security personnel to investigate and respond.

Answer

Block malicious traffic in real time.

Answer

Encrypt sensitive data at rest.

Answer

Prevent unauthorized access to the network.

Question 14

An organization classifies data as 'Confidential' and requires encryption both at rest and in transit. Which data classification level best fits this requirement?

Accepted Answer

Confidential. Confidential data typically requires strong protection like encryption; restricted/top secret may require even higher controls.

Answer

Restricted/Top Secret

Answer

Internal/Private

Answer

Public

Question 15

An employee reports receiving a suspicious email with an attachment from an unknown sender. What is the first action the employee should take?

Accepted Answer

Report the email to the security team.. Reporting the email to the security team allows professionals to analyze and respond appropriately. Deleting the email or opening the attachment can be dangerous; forwarding may spread the threat.

Answer

Open the attachment to check its content.

Answer

Forward the email to all employees as a warning.

Answer

Delete the email immediately.