ISC2 CC Practice Test 5 — 10 Questions

Question 1

A company's critical database must be recovered within 4 hours after a disaster, and they can tolerate losing up to 1 hour of data. During a disaster, after the systems are restored, it takes an additional 30 minutes to verify data integrity and resume normal operations. Which metric is represented by the 4-hour requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Recovery Time Objective (RTO). Recovery Time Objective (RTO) is the maximum acceptable time to restore systems and data after a disaster.

Answer

Maximum Tolerable Downtime (MTD)

Answer

Recovery Point Objective (RPO)

Answer

Work Recovery Time (WRT)

Question 2

A financial services company is conducting a Business Impact Analysis (BIA) for its online banking platform. Which THREE of the following are correctly defined metrics used in BIA?

Accepted Answer

Recovery Time Objective (RTO) – the maximum amount of time to restore a business function after a disruption.. In BIA, Recovery Time Objective (RTO) is the maximum time allowed to recover systems after a disaster, Maximum Tolerable Downtime (MTD) is the total time a business function can be unavailable before causing irreparable harm, and Recovery Point Objective (RPO) is the maximum acceptable data loss measured in time. All three are correctly defined BIA metrics. Service Level Agreement (SLA) is a contractual term, not a BIA metric. Annualized Loss Expectancy (ALE) is a risk assessment metric, not specifically part of BIA.

Answer

Service Level Agreement (SLA) – the contractual uptime percentage guaranteed to customers.

Answer

Annualized Loss Expectancy (ALE) – the expected monetary loss per year from a risk.

Question 3

A hospital uses role-based access control (RBAC) for its electronic health records. Nurses can view patient records; doctors can view and edit; administrators can only view administrative data. Recently, a nurse was able to edit a patient's record, which should only be allowed for doctors. The investigation finds that the nurse's role was incorrectly assigned a 'doctor' role due to a misconfiguration. To prevent recurrence, the access control system should be reviewed. Which is the best long-term solution?

Accepted Answer

Conduct quarterly role reviews and recertification. The root cause is a role misconfiguration, and the best long-term solution is to implement a process of periodic role reviews and recertification. This ensures that role assignments are regularly audited and validated against current job responsibilities, preventing role creep and unauthorized privilege accumulation. In RBAC, the principle of least privilege is maintained through ongoing governance, not through a one-time fix.

Answer

Implement mandatory access control (MAC) with security labels

Answer

Remove the nurse's ability to edit records

Answer

Implement user behavior analytics to detect anomalies

Question 4

Which of the following is the best practice for managing cryptographic keys in a large organization?

Accepted Answer

Store keys in a centralized hardware security module (HSM) with strict access controls.. A centralized Hardware Security Module (HSM) provides tamper-resistant, dedicated hardware for secure key generation, storage, and cryptographic operations. Strict access controls (e.g., role-based access, multi-factor authentication) ensure that only authorized personnel can manage keys, while the HSM prevents key extraction even if the host system is compromised. This aligns with NIST SP 800-57 guidelines for key management in large organizations.

Answer

Embed keys in application code to ensure availability.

Answer

Distribute keys to administrators via email for convenience.

Answer

Use a single key for all encryption to simplify management.

Question 5

Refer to the exhibit.
```
-rw-r-x--- 1 user1 developers 1024 Apr 12 10:00 config.cfg
```
The security policy states that only the file owner (user1) and members of the developers group should be able to read the file. Which change is necessary to align with the principle of least privilege?

Accepted Answer

Change the file mode to 640.

Answer

Add world read permission.

Answer

Change group permissions to rw-r--.

Answer

Change the owner to user2.

Question 6

Which THREE of the following are considered risk management strategies? (Select THREE)

Accepted Answer

Risk acceptance. Risk management strategies include acceptance, mitigation, transfer, and avoidance. Acceptance, mitigation, and transfer are correct.

Answer

Risk assessment

Answer

Risk analysis

Question 7

An organization is adopting the 3-2-1 backup rule. They currently have data on a primary server and a daily backup to an external hard drive. To comply with the rule, what is the minimum additional requirement?

Accepted Answer

A cloud backup stored offsite. 3-2-1 rule: 3 copies, 2 different media, 1 offsite. They have 2 copies on 1 media (hard drive). Need a third copy on different media and offsite.

Answer

A second external hard drive stored on-site

Answer

An incremental backup to a network share

Answer

A full backup on tape stored in the same room

Question 8

During an incident, the IR team identifies that the root cause is a zero-day vulnerability. Which of the following is the best immediate action?

Accepted Answer

Implement compensating controls. When a zero-day vulnerability is the root cause, no vendor patch exists yet (option C is impossible). Rebuilding systems (option B) without addressing the vulnerability leaves them re-exposed. The best immediate action is to implement compensating controls—such as firewall rules, IDS/IPS signatures, or application-layer filtering—to mitigate the risk until a permanent fix is available. This aligns with incident response containment strategies that prioritize reducing impact while preserving forensic evidence.

Answer

Report to CERT/CC

Answer

Rebuild all affected systems

Answer

Apply a vendor patch

Question 9

After a major power outage, an organization needs to declare a disaster and activate its DRP. Which THREE elements should be included in the initial crisis communication?

Accepted Answer

A statement that a disaster has been declared. Initial communication should confirm the disaster, provide initial instructions, and outline next steps without revealing sensitive details.

Answer

Details of the vulnerability exploited

Answer

Names of affected customers

Question 10

An organization's backup strategy includes daily full backups. However, recovery tests show that restoring from tape takes 6 hours longer than expected. What is the most likely cause?

Accepted Answer

Improperly documented recovery procedures. Improperly documented recovery procedures can lead to incorrect steps or delays during restoration, which is a common cause of extended recovery times.

Answer

Tape drive failure

Answer

Inadequate storage capacity

Answer

Insufficient bandwidth