ISC2 CC Practice Test 49 — 15 Questions

Question 1

A help desk technician needs to reset a user's password, but the security policy requires that the technician does not know the new password. Which access control concept prevents the technician from knowing the password?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Need to know. The 'need to know' concept restricts access to information based on whether the user requires that information to perform their job functions. In this scenario, the technician must reset the password but does not need to know the new password itself, so the policy enforces that the technician cannot view or retain the new password. This is distinct from least privilege, which limits permissions to the minimum necessary, but does not inherently prevent knowledge of the password if the technician has the reset permission.

Answer

Discretionary access control (DAC)

Answer

Least privilege

Answer

Separation of duties

Question 2

A SOC analyst reviews an alert indicating a high number of failed login attempts from a single external IP address targeting multiple user accounts. Which security control is most effective at preventing this type of attack?

Accepted Answer

Implementing account lockout policies. Account lockout policies directly mitigate brute-force attacks by temporarily disabling an account after a defined number of failed login attempts (e.g., 5 failures within 15 minutes). This prevents the attacker from continuing to guess passwords for multiple user accounts from a single external IP, without affecting legitimate users who can be unlocked after a lockout duration or via an administrative reset.

Answer

Deploying a web application firewall

Answer

Enabling verbose logging for authentication events

Answer

Increasing password complexity requirements

Question 3

A company recently experienced a DoS attack targeting their web server. They want to implement a solution that can differentiate between legitimate traffic and attack traffic based on behavior patterns. Which technology should they deploy?

Accepted Answer

Intrusion Prevention System (IPS). An Intrusion Prevention System (IPS) is the correct choice because it can analyze traffic patterns and behavior in real time, using signature-based and anomaly-based detection to distinguish legitimate traffic from DoS attack traffic. Unlike a WAF, which focuses on application-layer threats like SQL injection, an IPS can inspect network and transport layers to identify volumetric or protocol-based DoS patterns and actively block malicious flows.

Answer

Web Application Firewall (WAF)

Answer

Load balancer

Answer

Stateful firewall

Question 4

According to the (ISC)² Code of Ethics, which principle has the highest priority?

Accepted Answer

Protect society. The (ISC)² Code of Ethics prioritizes protecting society, the common good, and public safety above all.

Answer

Act honorably

Answer

Advance the profession

Answer

Provide diligent service

Question 5

Match each type of malware to its primary behavior.

Accepted Answer

Virus: Malware that replicates by attaching to other programs and requires user action to spread.. Common malware types include viruses (need host), worms (self-spreading), and trojans (deceptive). Distractors confuse their replication methods.

Answer

Virus: Self-replicating malware that spreads automatically over networks.

Answer

Worm: Malware that replicates by attaching to other programs and requires user action.

Answer

Trojan Horse: Malware that replicates by attaching to other programs.

Question 6

An organization's backup schedule: Full backup every Sunday, incremental backups Monday-Saturday. If a failure occurs on Thursday, how many backup sets are needed to restore the data?

Accepted Answer

4 (Sunday full and Monday, Tuesday, Wednesday incrementals). For incremental backups, you need the last full backup and all incrementals since then. So Sunday full + Monday, Tuesday, Wednesday incrementals (4 sets).

Answer

5 (Sunday full and all incrementals through Thursday)

Answer

1 (Sunday full only)

Answer

2 (Sunday full and Wednesday incremental)

Question 7

Refer to the exhibit. An IDS generates this alert for traffic from an internal server (10.1.1.50) to an external IP on port 443. The security team investigates and finds that the server is a web application that normally uses TLS 1.2. What does this alert most likely indicate?

Accepted Answer

An attacker is performing an SSL stripping attack, downgrading the connection to SSLv3. The alert indicates a downgrade from TLS 1.2 to SSLv3, which is the hallmark of an SSL stripping attack. In this attack, an adversary intercepts the client's TLS handshake request and forces the connection to use the weaker SSLv3 protocol, often by manipulating the ClientHello message to remove TLS options. This allows the attacker to exploit known vulnerabilities in SSLv3, such as POODLE, to decrypt or hijack the session.

Answer

The server is experiencing a buffer overflow attack

Answer

The server's certificate has expired and the client is falling back to SSLv3

Answer

The server has been misconfigured to use SSLv3 instead of TLS

Question 8

A security operations center (SOC) analyst receives an alert for a potential malware infection on a workstation. Which of the following is the first action the analyst should take?

Accepted Answer

Isolate the workstation from the network to prevent spread. When a potential malware infection is detected, the immediate priority is containment to prevent lateral movement and further compromise. Isolating the workstation from the network (e.g., disabling the network interface or disconnecting the cable) stops the malware from communicating with command-and-control servers or spreading to other hosts. This aligns with the NIST incident response framework's containment phase, which precedes eradication and recovery actions.

Answer

Reimage the workstation

Answer

Run a full antivirus scan

Answer

Notify law enforcement

Question 9

During a disaster recovery exercise, the system fails to achieve the RTO. Analysis shows that restoring the database from tape takes 3 hours, but the RTO is 2 hours. Which is the most effective solution?

Accepted Answer

Implement a hot standby database replica. The RTO (Recovery Time Objective) is a business requirement that cannot be changed by simply adjusting the backup method. A hot standby database replica (e.g., using synchronous replication or Oracle Data Guard) provides near-instant failover, reducing recovery time to minutes, which directly meets the 2-hour RTO. This solution addresses the root cause—the restore process is too slow—by eliminating the need to restore from backup entirely.

Answer

Use differential instead of full backups

Answer

Switch from tape to disk-based backups

Answer

Increase the RTO to 3 hours

Question 10

Which data classification level typically requires the highest level of protection and is reserved for information that could cause catastrophic harm if disclosed?

Accepted Answer

Restricted. Restricted or top secret classification is used for information that could cause exceptionally grave damage to the organization or nation if disclosed.

Answer

Confidential

Answer

Public

Answer

Internal

Question 11

Which OSI layer is responsible for routing packets across networks using IP addresses?

Accepted Answer

Layer 3 - Network. The Network layer (Layer 3) is responsible for logical addressing and routing. It uses IP addresses to determine the best path for packets to travel from source to destination across different networks. Protocols like IP (IPv4/IPv6), OSPF, and BGP operate at this layer to perform routing decisions.

Answer

Layer 1 - Physical

Answer

Layer 4 - Transport

Answer

Layer 2 - Data Link

Question 12

A security engineer is reviewing logs and notices that an internal server is receiving excessive SYN packets from an external IP, but never completing the three-way handshake. What type of attack is likely occurring?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending a high volume of SYN packets to a target server without completing the handshake (i.e., not sending the final ACK). This exhausts the server's connection table resources, preventing legitimate connections. The log evidence—excessive SYN packets from an external IP with no handshake completion—is the classic signature of a SYN flood.

Answer

Smurf attack

Answer

Ping of death

Answer

ARP poisoning

Question 13

Which TWO of the following are core components of the ISC2 Code of Ethics? (Choose two.)

Accepted Answer

Advance and protect the profession.. The ISC2 Code of Ethics explicitly requires members to 'advance and protect the profession' as one of its four mandatory canons. This means acting honorably, maintaining competence, and not engaging in conduct that brings discredit upon the profession. It is a core ethical duty for all certified professionals.

Answer

Disclose all confidential information to law enforcement.

Answer

Ensure maximum profitability for the organization.

Answer

Always follow orders from management.

Question 14

Which TWO of the following are types of security controls used in defense in depth? (Select TWO.)

Accepted Answer

Detective controls. Detective controls are a core type of security control in a defense-in-depth strategy, designed to identify and alert on ongoing or past security incidents. Examples include intrusion detection systems (IDS) like Snort or Suricata, which analyze network traffic for malicious patterns, and security information and event management (SIEM) systems that correlate logs to detect anomalies. These controls provide visibility into the security posture, enabling timely response to threats that bypass preventive measures.

Answer

Corrective controls

Answer

Compensating controls

Answer

Administrative controls

Question 15

Which THREE of the following are examples of implementing defense in depth? (Select THREE.)

Accepted Answer

Using a firewall to filter traffic. A firewall is a fundamental component of defense in depth, providing network-level traffic filtering based on rules. It acts as a first line of defense by blocking unauthorized access and malicious traffic, thereby reducing the attack surface. This layered security approach ensures that even if other controls fail, the firewall can still prevent or mitigate threats.

Answer

Enabling single sign-on for all applications

Answer

Allowing all traffic by default