ISC2 CC Practice Test 48 — 15 Questions

Question 1

A company is designing a secure network architecture for its new headquarters. The security team proposes implementing multiple layers of security controls, including firewalls, intrusion detection systems, and access control lists. Which security principle is being primarily applied?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Defense in depth. Defense in depth is the principle of layering multiple independent security controls so that if one fails, others still protect the asset. Firewalls, IDS, and ACLs are complementary layers at different points in the network, which is the textbook definition of defense in depth. The other options describe different principles that are not about layering controls.

Answer

Separation of duties

Answer

Least privilege

Answer

Need-to-know

Question 2

An organization labels data as 'Confidential' and requires encryption both at rest and in transit. This classification is an example of:

Accepted Answer

Data classification. Labeling data as 'Confidential' with handling requirements like encryption at rest and in transit is the definition of data classification — assigning sensitivity levels that drive protective controls. Classification is the foundational step that determines which encryption, access, and retention policies apply.

Answer

Risk transfer

Answer

Due care

Answer

Data retention

Question 3

Which THREE of the following are best practices for securing a network firewall? (Select THREE.)

Accepted Answer

Disable unused services and ports. Disabling unused services and ports reduces the attack surface by eliminating potential entry points for attackers. A firewall should only have necessary ports (e.g., TCP 80/443 for web traffic) open, as each open service represents a vector for exploitation. This aligns with the principle of least privilege and is a fundamental hardening step.

Answer

Allow all traffic by default and block specific threats

Answer

Place the firewall outside the network perimeter

Question 4

A critical zero-day vulnerability is actively being exploited in the wild, affecting an organization's internet-facing application. Which patching approach should be taken?

Accepted Answer

Deploy an emergency patch without testing.. When a zero-day vulnerability is actively exploited in the wild against an internet-facing application, the risk of waiting for full testing outweighs the risk of deploying an untested emergency patch. An emergency patch (or vendor hotfix) is deployed immediately with expedited change approval, because the active exploitation represents an imminent, ongoing threat that standard change-management timelines cannot accommodate.

Answer

Isolate the application from the network and wait for a vendor patch.

Answer

Implement a web application firewall (WAF) as a permanent solution.

Answer

Follow the standard patch lifecycle with testing.

Question 5

Which TWO of the following are principles of the CIA triad? (Select TWO.)

Accepted Answer

Confidentiality. Confidentiality (A) is a core principle of the CIA triad because it ensures that information is accessible only to authorized parties, typically enforced through encryption, access controls, and classification. Integrity (B) is also a core principle, guaranteeing that data remains accurate, complete, and unaltered except by authorized actions, supported by hashing, checksums, and version controls. Together with Availability, these three form the CIA triad, the foundational model for information security. Non-repudiation (C) is a related security property ensuring a party cannot deny an action, but it is not one of the three CIA principles. Accountability (D) and Authorization (E) are important access-control and governance concepts, yet neither is a member of the CIA triad.

Answer

Non-repudiation

Answer

Accountability

Answer

Authorization

Question 6

Refer to the exhibit. A security analyst reviews this log entry. What type of attack is most likely occurring?

Accepted Answer

Brute-force attack. The log entry shows repeated failed authentication attempts against a single username from a single source IP, trying numerous different passwords in a short period. This pattern is characteristic of a brute-force attack, where an attacker systematically tries many password guesses against one target account.

Answer

Pass-the-hash attack

Answer

Password spraying attack

Answer

Kerberos ticket attack

Question 7

During an incident, the incident response team identifies that a malware infection is spreading. They isolate affected systems to prevent further damage. Which phase of the incident response process are they performing?

Accepted Answer

Containment. Containment is the incident response phase focused on limiting the scope and impact of an incident by stopping the spread of malware and preventing further damage. Isolating affected systems directly aligns with this goal, as it prevents lateral movement and additional infections. This phase occurs after detection and before eradication and recovery.

Answer

Recovery

Answer

Eradication

Answer

Detection

Question 8

Which TWO of the following are examples of multi-factor authentication? (Select TWO.)

Accepted Answer

Password and SMS one-time code. Option B (Password and SMS one-time code) is correct because it combines two different authentication factor categories: something you know (the password) and something you have (the SMS one-time code delivered to your phone), which is the definition of multi-factor authentication. Option C (Biometric and PIN) is correct because it pairs something you are (the biometric, such as a fingerprint) with something you know (the PIN), satisfying the requirement for multiple distinct factor types. Option A is not multi-factor because a smart card and an RSA token are both something you have, so they belong to the same factor category. Option D is not multi-factor because a fingerprint and a retina scan are both inherence factors (something you are). Option E is not multi-factor because a password and a security question are both knowledge factors (something you know).

Answer

Smart card and RSA token

Answer

Fingerprint and retina scan

Answer

Password and security question

Question 9

A security analyst is implementing controls to protect the integrity of a database. Which TWO of the following controls would best achieve this goal?

Accepted Answer

Digital signatures. Digital signatures (C) are correct because they provide integrity and authenticity by allowing the recipient to verify that the data has not been altered and that it originated from a trusted source, using asymmetric cryptography to sign and verify a hash of the data. Hashing (D) is correct because it produces a fixed-length digest of the database contents, so any modification to the data changes the hash value, enabling detection of unauthorized or accidental changes and thereby protecting integrity. Encryption (B) primarily provides confidentiality, not integrity, since ciphertext can still be modified without detection unless combined with a MAC or signature. Load balancing (A) and redundant servers (E) improve availability and performance through distribution and failover, but they do not detect or prevent unauthorized data modification, so they do not directly protect integrity.

Answer

Load balancing

Answer

Encryption

Answer

Redundant servers

Question 10

An organization wants to ensure that an email message has not been altered during transmission. Which security control should be used?

Accepted Answer

Digital signature. A digital signature uses the sender's private key to cryptographically sign the message hash, allowing the recipient to verify both the origin and that the message was not altered in transit. Any modification to the message invalidates the signature because the recomputed hash will not match. This provides integrity and non-repudiation, which is exactly what the organization needs.

Answer

Access control

Answer

Encryption

Answer

Load balancing

Question 11

In the OSI model, which layer uses MAC addresses to forward frames and supports VLANs?

Accepted Answer

Layer 2 - Data Link. The Data Link layer (Layer 2) is responsible for framing, MAC addressing, and forwarding frames within a local network segment. VLANs (802.1Q) are a Layer 2 construct that logically segments a switch into multiple broadcast domains, and VLAN tags are inserted into Ethernet frames — making Layer 2 the correct answer. Switches use MAC address tables to forward frames and enforce VLAN membership.

Answer

Layer 4 - Transport

Answer

Layer 3 - Network

Answer

Layer 1 - Physical

Question 12

A security professional is reviewing authentication methods. Which TWO are examples of Type 2 (possession) factors? (Select TWO)

Accepted Answer

A hardware OTP token. A hardware OTP token (B) is correct because it is a physical device the user must possess, and it generates one-time passcodes, making it a classic Type 2 possession factor. A smart card (E) is also correct because it is a physical object the user holds and inserts or taps to authenticate, fitting the possession category. In contrast, a PIN (A) and a password (D) are knowledge factors (Type 1) because they rely on something the user knows, and a fingerprint (C) is an inherence factor (Type 3) because it relies on a biometric characteristic of the user.

Answer

A PIN

Answer

A fingerprint

Answer

A password

Question 13

During a penetration test, an analyst uses a tool to intercept and modify traffic between a client and server by exploiting the Address Resolution Protocol (ARP). This attack is an example of which type of threat?

Accepted Answer

Man-in-the-middle (MITM). ARP poisoning lets an attacker send forged ARP replies so that the victim's traffic is redirected through the attacker's machine. Because the attacker sits between the client and the server, silently relaying and potentially altering packets, this is a classic man-in-the-middle (MITM) attack. The interception and modification of traffic is the defining characteristic that distinguishes MITM from mere spoofing or sniffing.

Answer

Spoofing

Answer

Denial of Service (DoS)

Answer

Sniffing

Question 14

A security analyst notices multiple failed login attempts from a single IP address within a short period. Which control would best mitigate this brute force attack?

Accepted Answer

Account lockout. Account lockout is the most direct mitigation because it disables the account after a defined number of failed attempts, breaking the brute-force loop before the attacker can guess the password. It is a preventive control that directly targets the repeated-failure pattern described in the scenario.

Answer

Session timeout

Answer

Password complexity

Answer

Least privilege

Question 15

A company requires that financial transactions be approved by two different managers before execution. This is an example of which access control principle?

Accepted Answer

Separation of duties. Separation of duties (SoD) requires that critical tasks be divided among multiple people so that no single individual can complete a sensitive transaction alone. Requiring two managers to approve financial transactions is the textbook example: it prevents fraud and errors by ensuring collusion is needed to bypass the control. SoD is a foundational principle in ISC2's access control domain.

Answer

Need-to-know

Answer

Defense in depth

Answer

Least privilege