ISC2 CC Practice Test 50 — 15 Questions

Question 1

Which recovery site strategy provides the fastest Recovery Time Objective (RTO), typically within hours, by maintaining a fully operational mirrored environment?

Accepted Answer

Hot site. A hot site is a fully operational facility that mirrors the production environment, allowing recovery within hours.

Answer

Cold site

Answer

Warm site

Answer

Cloud-based recovery

Question 2

A company deploys a network security device that can block malicious traffic in real-time by inspecting packet payloads and application data. However, the device occasionally blocks legitimate traffic. Which device is described?

Accepted Answer

IPS. An Intrusion Prevention System (IPS) sits inline and can block traffic based on deep inspection, but may cause false positives that disrupt legitimate communications.

Answer

Firewall

Answer

WAF

Answer

IDS

Question 3

Which of the following is an example of a Type 2 authentication factor?

Accepted Answer

A security token generating a one-time passcode. Type 2 (possession) factors are items a user has, such as a smart card or OTP token.

Answer

A fingerprint

Answer

A password

Answer

A PIN

Question 4

An organization classifies data as 'confidential' and requires encryption at rest and in transit. Which data classification level is likely being used?

Accepted Answer

Confidential. Confidential data is sensitive and requires protection; it is a common classification level.

Answer

Public

Answer

Internal/Private

Answer

Restricted/Top Secret

Question 5

Which risk management strategy involves implementing security controls to reduce the likelihood or impact of a risk?

Accepted Answer

Risk mitigation. Risk mitigation applies controls to reduce risk.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk transfer

Question 6

An organization implements a policy requiring employees to use a smart card and a PIN to access the data center. This is an example of which type of authentication?

Accepted Answer

Multi-factor authentication. Multi-factor authentication combines two or more types: smart card (possession) and PIN (knowledge).

Answer

Type 3 authentication

Answer

Single-factor authentication

Answer

Type 2 authentication only

Question 7

Which of the following is an example of a vulnerability?

Accepted Answer

An unlocked server room door. A vulnerability is a weakness that can be exploited. An unpatched software flaw is a classic example.

Answer

A malicious hacker attempting to gain access

Answer

A firewall blocking unauthorized traffic

Answer

The risk of data loss

Question 8

A security professional is asked to choose an authentication method for a high-security facility. The requirement is to use something the user 'is'. Which authentication type should be selected?

Accepted Answer

Type 3 – Inherence factor. Biometrics (fingerprint, retina, iris) fall under Type 3 (inherence) authentication, which checks 'something you are'.

Answer

Multi-factor authentication

Answer

Type 2 – Possession factor

Answer

Type 1 – Knowledge factor

Question 9

Which TWO of the following are examples of Type 3 (inherence) authentication factors?

Accepted Answer

Retina scan. Type 3 factors are biometric characteristics unique to an individual.

Answer

OTP token

Answer

Smart card

Answer

Password

Question 10

An organization implements a redundant server infrastructure to ensure that services remain operational even if one server fails. This is an example of protecting which principle?

Accepted Answer

Availability. Redundancy ensures that systems remain available despite failures, directly supporting availability.

Answer

Integrity

Answer

Accountability

Answer

Confidentiality

Question 11

A user logs into a system using a password and a one-time passcode from a mobile authenticator app. This is an example of:

Accepted Answer

Multi-factor authentication. Combining two different authentication types (knowledge and possession) is multi-factor authentication.

Answer

Biometric authentication

Answer

Two-step verification using same factor

Answer

Single-factor authentication

Question 12

A security policy requires that data classified as 'Confidential' must be encrypted both at rest and in transit. Which TWO of the following are likely data handling requirements for 'Confidential' data? (Select TWO)

Accepted Answer

Access to data must be restricted to authorized personnel only. Confidential data typically requires encryption and strict access controls. Public posting would be inappropriate.

Answer

Data may be posted on the public website

Answer

Data can be shared with any vendor without a contract

Answer

Data must be deleted after 30 days regardless of business need

Question 13

A security team identifies that a server has a known vulnerability. A threat actor could exploit it to gain unauthorized access. The combination of these factors represents:

Accepted Answer

Risk. Risk is the probability that a threat exploits a vulnerability, causing harm.

Answer

Threat

Answer

Control

Answer

Vulnerability

Question 14

According to the (ISC)² Code of Ethics, which canon has the highest priority?

Accepted Answer

Protect society, the common good, necessary public trust and confidence, and the infrastructure. The first canon is to protect society, the common good, and the public trust.

Answer

Provide diligent and competent service to principals

Answer

Advance and protect the profession

Answer

Act honorably, honestly, justly, responsibly, and legally

Question 15

What is the primary purpose of a digital signature?

Accepted Answer

Provide non-repudiation and integrity. Digital signatures provide integrity by ensuring data has not been altered, and non-repudiation by proving the signer's identity and intent.

Answer

Ensure confidentiality

Answer

Authenticate users via password

Answer

Encrypt the data