ISC2 CC Practice Test 50 — 15 Questions

Question 1

An organization is planning to implement a security awareness program. Which TWO topics should be included to address common social engineering attacks?

Accepted Answer

Recognizing phishing emails. Option A (Recognizing phishing emails) is correct because phishing is one of the most common social engineering attacks, and training users to identify suspicious senders, spoofed domains, urgent language, and malicious links or attachments directly reduces the risk of credential theft and malware infection. Option B (Awareness of tailgating and piggybacking) is correct because these are physical social engineering techniques in which an attacker follows an authorized person into a restricted area, so awareness training helps employees enforce badge checks and challenge unknown individuals. Option C is not a social engineering topic; understanding encryption algorithms is a technical cryptographic concept rather than a human-focused attack vector. Option D is also technical rather than social engineering, since configuring firewall rules is an administrative network security task performed by IT staff. Option E, while valuable for overall security, addresses credential hygiene rather than the manipulation tactics that define social engineering attacks.

Answer

Understanding encryption algorithms

Answer

Configuring firewall rules

Answer

Proper password management using a password manager

Question 2

During a security audit, it is discovered that a contractor has access to customer databases that were not required for their project. Which step should be taken first to mitigate the risk?

Accepted Answer

Revoke the contractor's access immediately. The immediate priority is to revoke the contractor's access to the unauthorized customer databases to stop any potential data exfiltration or misuse. Access controls follow the principle of least privilege, and any discovered over-provisioning must be corrected instantly to contain the risk. Delaying revocation for notification, assessment, or logging leaves the sensitive data exposed to an unauthorized user.

Answer

Notify the contractor's manager

Answer

Perform a risk assessment

Answer

Log the access for evidence

Question 3

An organization's security policy requires that all access to sensitive data must be approved by a data owner. An administrator configures a system to enforce this. Which principle is being implemented?

Accepted Answer

Authorization. Authorization is the process of granting or denying access to a resource based on a subject's rights or permissions, which is exactly what the data owner approval workflow enforces — access is only permitted after the owner authorizes it. The scenario describes a decision point where permission is explicitly granted, which is the definition of authorization.

Answer

Accountability

Answer

Least privilege

Answer

Non-repudiation

Question 4

An attacker sends a forged ARP response to a switch, associating the attacker's MAC address with the IP address of the default gateway. The switch updates its ARP cache accordingly. This is an example of which attack?

Accepted Answer

ARP spoofing. ARP spoofing (or ARP poisoning) involves sending fake ARP messages to associate the attacker's MAC with a legitimate IP, enabling man-in-the-middle attacks.

Answer

MAC flooding

Answer

DNS spoofing

Answer

IP spoofing

Question 5

After a ransomware attack, the IT team restores systems from backups. The CEO asks how quickly data can be recovered. Which metric addresses the acceptable amount of data loss?

Accepted Answer

Recovery Point Objective (RPO). RPO (Recovery Point Objective) defines the maximum acceptable amount of data loss measured in time — i.e., how far back in time you can afford to lose data. The CEO's question about 'acceptable amount of data loss' maps directly to RPO. RTO, by contrast, addresses how quickly systems must be restored, not how much data can be lost.

Answer

Work Recovery Time (WRT)

Answer

Recovery Time Objective (RTO)

Answer

Maximum Tolerable Downtime (MTD)

Question 6

A security administrator is configuring a system to prevent unauthorized access after a user leaves their workstation unattended. Which access control mechanism should be implemented?

Accepted Answer

Session timeout. A session timeout automatically locks or logs out a user after a period of inactivity, directly addressing the risk of an unattended workstation being used by an unauthorized person. It is the standard control for this scenario because it terminates the authenticated session without requiring the user to manually log off. Password complexity, biometrics, and account lockout address different threats.

Answer

Password complexity

Answer

Biometric authentication

Answer

Account lockout

Question 7

In incident response, which TWO are considered volatile data that should be collected first? (Select exactly 2.)

Accepted Answer

Network connections. Option B (Network connections) is correct because active connections, ARP caches, routing tables, and open sockets reside only in memory and kernel state and are lost on shutdown or reboot, making them highly volatile and requiring immediate capture with tools like netstat, ss, or netflow. Option E (Memory contents) is correct because RAM holds running processes, encryption keys, injected code, and uncommitted data that vanish when power is removed, so it must be acquired first using a memory imager such as FTK Imager or WinPmem. Option A (Hard drive contents) is not the most volatile since disk data persists across reboots and is collected later in the order of volatility. Option C (Backup tapes) is non-volatile offline media that retains data indefinitely and is not time-sensitive. Option D (System logs) may be stored on disk and, while useful, are less volatile than live network state and RAM, so they are not among the first two to collect.

Answer

Hard drive contents

Answer

Backup tapes

Answer

System logs

Question 8

Which TWO are essential elements of a business impact analysis (BIA)?

Accepted Answer

Identification of critical business functions. Option C is correct because a BIA must identify the critical business functions (and the processes and resources supporting them) so that recovery priorities, dependencies, and RTO/RPO targets can be established. Option E is correct because the BIA must determine the maximum acceptable outage (MAO), also expressed as maximum tolerable downtime (MTD), which sets the upper limit of tolerable disruption and drives the recovery time objective (RTO) and continuity strategies. Options A, B, and D are not essential BIA elements: a network topology diagram is a technical/infrastructure artifact used in DR planning, a list of all employees is an HR record rather than an impact analysis input, and IP address assignment is a network administration task unrelated to assessing business impact.

Answer

A network topology diagram

Answer

List of all employees

Answer

Assignment of IP addresses

Question 9

A security analyst detects unusual outbound network traffic from a server that typically only handles internal file sharing. The traffic appears to be exfiltrating sensitive data. Which phase of the incident response process should the analyst initiate next?

Accepted Answer

Analysis. The analyst has detected unusual outbound traffic indicating potential data exfiltration. According to the incident response process, after detection and initial validation, the next phase is analysis, where the analyst investigates the scope, impact, and nature of the incident. Containment (A) would come after analysis to prevent further damage. Eradication (D) and lessons learned (C) are later phases. Therefore, the analyst should initiate analysis next.

Answer

Containment

Answer

Lessons learned

Answer

Eradication

Question 10

In risk management, which term describes the probability that a threat will exploit a vulnerability and cause harm to an asset?

Accepted Answer

Risk. Risk is defined as the likelihood of a threat exploiting a vulnerability, resulting in harm to an asset.

Answer

Vulnerability

Answer

Control

Answer

Threat

Question 11

Which protocol is considered insecure because it transmits data, including passwords, in cleartext, and its use should be avoided in favor of more secure alternatives?

Accepted Answer

Telnet. Telnet transmits all data, including usernames and passwords, in cleartext over the network, making it trivial to intercept with packet capture. It lacks encryption and integrity protection, so it is considered insecure and should be replaced by SSH for remote administration. This is why Telnet is the correct answer.

Answer

SSH

Answer

SFTP

Answer

HTTPS

Question 12

Which TWO are appropriate methods to test a disaster recovery plan?

Accepted Answer

Parallel test. A parallel test (A) is a recognized DR testing method in which the recovery site is brought online and processes data alongside the primary production site without cutting over live operations, so recovery capability is validated with minimal risk to the business. A simulation test (D) is also a standard DR testing approach, typically a tabletop or walkthrough exercise where the team rehearses roles, procedures, and decision-making for a disaster scenario without actually activating recovery systems. Regression testing (B) is a software quality technique that re-runs existing test cases to confirm changes did not break prior functionality, so it does not validate disaster recovery. Acceptance testing (C) verifies that a system meets business or user requirements before go-live, not the organization's ability to recover from a disaster. Unit testing (E) validates individual code components in isolation and has no bearing on DR plan validation.

Answer

Regression test

Answer

Acceptance test

Answer

Unit test

Question 13

A security operations center (SOC) analyst is investigating a potential data exfiltration. Which two indicators are most likely signs of data exfiltration?

Accepted Answer

Unexpected large file transfers via FTP. Option C is correct because unexpected large file transfers via FTP are a classic exfiltration indicator: FTP (ports 20/21) is a cleartext file-transfer protocol, and a sudden, high-volume upload to an external server strongly suggests data being moved out of the environment. Option E is correct because unusual outbound traffic to a foreign IP indicates beaconing or bulk data transfer to an external command-and-control or staging host, which is a hallmark of exfiltration, especially when the destination is atypical for the organization. Option A is not correct because a large number of failed login attempts indicates brute-force or password-spraying activity against authentication, which is an intrusion attempt rather than evidence of data leaving the network. Option B is not correct because frequent DNS queries to known malicious domains point to malware beaconing, command-and-control communication, or domain generation algorithm activity, which is a precursor or concurrent compromise indicator, not exfiltration itself. Option D is not correct because multiple antivirus alerts indicate malware detection or endpoint compromise, which may precede exfiltration but does not by itself demonstrate that data was transferred out.

Answer

Large number of failed login attempts

Answer

Frequent DNS queries to known malicious domains

Answer

Multiple antivirus alerts

Question 14

An organization wants to ensure that its critical business functions can continue operating during a disruption. Which plan specifically addresses keeping the business running during a disruption?

Accepted Answer

Business Continuity Plan (BCP). The Business Continuity Plan (BCP) is specifically designed to ensure that critical business functions continue operating during and after a disruption. It encompasses strategies for maintaining operations, while DRP focuses on recovering IT infrastructure. Thus, BCP is the correct answer.

Answer

Incident Response Plan (IRP)

Answer

Disaster Recovery Plan (DRP)

Answer

Business Impact Analysis (BIA)

Question 15

A security analyst is reviewing network traffic and notices that some devices are using a protocol that does not guarantee delivery and has no error recovery. Which ONE transport layer protocol fits this description? (Select ONE)

Accepted Answer

UDP. UDP (User Datagram Protocol) is a connectionless transport layer protocol that does not guarantee delivery, ordering, or error recovery. It is designed for speed and low overhead, making it suitable for applications like streaming, DNS, and VoIP where occasional packet loss is acceptable. The question explicitly asks for a protocol that does not guarantee delivery and has no error recovery, which matches UDP's characteristics.

Answer

TCP

Answer

HTTP

Answer

ICMP

Answer

ARP