ISC2 CC Practice Test 49 — 15 Questions

Question 1

A company stores customer records that include names, addresses, and Social Security numbers. According to ISC2 Code of Ethics, which canon has the highest priority when handling this sensitive data?

Accepted Answer

Protect society, the common good, and the public trust. The ISC2 Code of Ethics explicitly orders its canons by priority, with the protection of society, the common good, and the public trust as the highest. When handling sensitive data like SSNs, the potential harm to individuals and society from a breach outweighs obligations to clients or the profession. This canon ensures that security professionals prioritize the safety and well-being of the public above all else.

Answer

Act honorably, honestly, justly, and responsibly

Answer

Advance and protect the profession

Answer

Provide diligent and competent service to principals

Question 2

An organization decides to implement an Intrusion Prevention System (IPS) to protect its network. Which statement about an IPS compared to an IDS is correct?

Accepted Answer

An IPS is placed inline and can automatically block malicious traffic.. An IPS is deployed inline in the traffic path, so it can inspect packets in real time and actively drop or reset malicious sessions, whereas an IDS is passive and only alerts. This inline placement is what enables automatic blocking. The other options describe IDS behavior or overstate the IPS's scope.

Answer

An IPS is placed out of band and monitors traffic.

Answer

An IPS generates alerts but does not block traffic.

Answer

An IPS operates only at the application layer.

Question 3

Which of the following is a best practice for securing physical access to a data center?

Accepted Answer

Implement mantrap entry with biometric verification.. Implementing mantrap entry with biometric verification is a best practice because it enforces two-factor authentication (something you have, like a badge, and something you are, like a fingerprint) and prevents tailgating. Mantraps are interlocking doors that allow only one person at a time, enhancing physical security.

Answer

Allow employees to use personal badges for entry.

Answer

Install CCTV only at the main entrance.

Answer

Use a single-factor authentication for all doors.

Question 4

Which THREE of the following are considered fundamental security principles? (Select three).

Accepted Answer

Separation of duties. Separation of duties is a fundamental security principle that prevents any single individual from having excessive control over critical processes by dividing responsibilities among multiple people. This reduces the risk of fraud, error, or abuse, as collusion would be required to bypass controls. It is a core concept in access control models and compliance frameworks like SOX and PCI DSS.

Answer

Single sign-on

Answer

Hashing

Question 5

During a ransomware incident, the incident response team isolates affected systems. Which of the following is the NEXT best step?

Accepted Answer

Preserve forensic evidence from the isolated systems.. After isolating affected systems during a ransomware incident, the next best step is to preserve forensic evidence from those systems. This ensures that data such as memory dumps, logs, and encrypted files are captured intact for analysis, which is critical for understanding the attack vector, identifying the ransomware variant, and potentially recovering data without paying the ransom. Forensic preservation must occur before any remediation steps like wiping or rebuilding, as those actions would destroy the evidence needed for investigation and legal proceedings.

Answer

Wipe and rebuild all affected systems.

Answer

Notify law enforcement immediately.

Answer

Pay the ransom to restore operations quickly.

Question 6

An LDAP distinguished name is formatted as: CN=John Smith,OU=Sales,DC=company,DC=com. What does OU represent?

Accepted Answer

Organizational Unit. In LDAP distinguished names, OU stands for 'Organizational Unit'. An OU is a container object within a directory that is used to organize entries such as users, groups, and computers. In the DN 'CN=John Smith,OU=Sales,DC=company,DC=com', the OU=Sales indicates that John Smith resides in the Sales organizational unit within the company.com domain.

Answer

Organization Unit

Answer

Object Unit

Answer

Operating Unit

Question 7

Which THREE of the following are essential components of a security baseline configuration for a server?

Accepted Answer

Disable unnecessary services.. A security baseline configuration for a server must minimize the attack surface, so option A (Disable unnecessary services) is correct because every running service is a potential entry point and removing unneeded ones reduces exploitable ports and daemons. Option B (Enable auditing and logging) is correct because it provides the visibility needed to detect, investigate, and respond to security events, and is a standard hardening requirement in frameworks like CIS Benchmarks and NIST SP 800-123. Option C (Apply the latest security patches) is correct because unpatched software is a primary vector for exploitation, and timely patching of the OS and applications is a foundational baseline control. Option D (Install all optional software for functionality) is not part of a security baseline because installing unnecessary software expands the attack surface and contradicts the principle of least functionality. Option E (Grant administrative rights to all users) is not part of a security baseline because it violates least privilege and dramatically increases the risk of privilege abuse and compromise.

Answer

Install all optional software for functionality.

Answer

Grant administrative rights to all users.

Question 8

Which TWO of the following are examples of implementing the principle of least privilege?

Accepted Answer

Assigning a database administrator only the permissions required for their specific tasks. Option B is correct because least privilege means granting an identity only the minimum access rights needed to perform its job function; giving a database administrator just the permissions required for their specific tasks directly enforces that restriction. Option E is correct because granting a user read-only access to a file they only need to view limits them to the least access necessary (read) rather than granting write or modify rights. Option A is not least privilege because a security camera is a physical monitoring control, not an access-rights restriction. Option C is not least privilege because two-factor authentication strengthens authentication assurance but does not limit the permissions an administrator holds. Option D is not least privilege because a firewall filtering inbound traffic to port 443 is a network access control, not the assignment of minimal permissions to a user or role.

Answer

Installing a security camera at the data center entrance

Answer

Requiring two-factor authentication for system administrators

Answer

Implementing a firewall to block all incoming traffic except on port 443

Question 9

During a security audit, it is discovered that a single administrator can create user accounts, assign privileges, and review audit logs. Which principle is most likely being violated?

Accepted Answer

Separation of duties. Separation of duties requires that conflicting critical tasks be performed by different individuals to prevent fraud or error. The administrator has both operational and oversight roles, violating this principle.

Answer

Least privilege

Answer

Need to know

Answer

Defense in depth

Question 10

A network administrator needs to allow secure remote management of a router. Which protocol and port should be used?

Accepted Answer

SSH on port 22. SSH on TCP port 22 provides encrypted, authenticated remote management of network devices, protecting credentials and session data from eavesdropping. It is the standard secure replacement for Telnet and is widely supported on routers and switches.

Answer

FTP on port 21

Answer

HTTP on port 80

Answer

Telnet on port 23

Question 11

During an incident, a security analyst identifies a SQL injection attack. The team contains the threat by blocking the attacker's IP. Which step should be performed next in the incident response process?

Accepted Answer

Eradication. The incident response lifecycle is Preparation, Detection, Containment, Eradication, Recovery, and Lessons Learned. After containing the threat by blocking the attacker's IP, the next step is eradication, which involves removing the root cause — such as patching the SQL injection vulnerability, removing malware, or closing the attack vector. Recovery (restoring systems) follows eradication.

Answer

Detection

Answer

Lessons Learned

Answer

Recovery

Question 12

Which of the following is a primary benefit of implementing network segmentation?

Accepted Answer

Reduced attack surface. Network segmentation divides a network into smaller, isolated segments, which limits an attacker's ability to move laterally after compromising a single host. By restricting traffic between segments using VLANs, ACLs, or firewall rules, the attack surface is reduced because fewer systems are exposed to potential threats. This is a primary security benefit, as it contains breaches and minimizes the impact of malware or unauthorized access.

Answer

Eliminates the need for firewalls

Answer

Increased bandwidth

Answer

Simplified IP address management

Question 13

A security auditor discovers that during a VLAN hopping attack, a threat actor was able to send frames from a workstation on VLAN 10 to a target on VLAN 20. Which configuration flaw is most likely responsible?

Accepted Answer

Dynamic Trunking Protocol (DTP) is enabled on access ports. A VLAN hopping attack exploits the Dynamic Trunking Protocol (DTP) to negotiate a trunk link between the attacker's workstation and the switch. If DTP is enabled on an access port, the attacker can send DTP frames to form a trunk, allowing frames from VLAN 10 to be tagged and forwarded to VLAN 20. Disabling DTP on all access ports with the 'switchport nonegotiate' command prevents this attack.

Answer

The trunk port is set to native VLAN 1

Answer

The switch is using default VLAN 1 for management

Answer

Port security is not configured

Question 14

A security engineer is designing a DMZ for a web server that must be accessible from the internet. The web server needs to query an internal database server. Which network security approach best limits exposure?

Accepted Answer

Place the web server in the DMZ and the database server in the internal network, with a firewall allowing only specific traffic from the web server to the database.. It implements a true DMZ architecture: the web server resides in the DMZ (a semi-trusted zone) while the database server remains in the internal network, protected by a firewall that permits only specific traffic (e.g., TCP/3306 for MySQL or TCP/1433 for MSSQL) from the web server. This minimizes the attack surface by ensuring that even if the web server is compromised, the database server is not directly reachable from the internet, and the firewall enforces strict stateful inspection and access control.

Answer

Use a single firewall with rules that allow all traffic from the internet to the internal network.

Answer

Place both servers in the same subnet with a firewall allowing all traffic.

Answer

Place the database server in the DMZ with the web server.

Question 15

A security analyst is investigating a potential DDoS attack on the company's web server. Which two symptoms are indicative of a SYN flood attack? (Select TWO.)

Accepted Answer

Large number of half-open connections. Options D and E are both correct indicators of a SYN flood attack. Option D is correct because a SYN flood sends many SYN packets to initiate TCP connections but never completes the three-way handshake, leaving numerous half-open connections in the SYN_RECEIVED state on the server, which exhausts resources. Option E is correct because the attack generates a high number of SYN packets from the attacker, and since the handshake is never completed, the corresponding ACK packets are absent. Both symptoms—half-open connections and SYN packets without ACK—are characteristic of a SYN flood.

Answer

Increased DNS query responses

Answer

High number of ICMP echo replies

Answer

Unusual outbound traffic on port 80