ISC2 CC Practice Questions 2 — 50 Questions

Question 1

A small business with limited budget wants to ensure critical business functions can resume within 24 hours of a disaster. Their data changes infrequently. Which recovery solution is MOST cost-effective?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud backup with instant restore. Cloud backup with instant restore (Option B) is the most cost-effective solution because the business has a limited budget, data changes infrequently, and the RTO is 24 hours. Cloud backup eliminates the need for maintaining physical infrastructure, and instant restore from cloud snapshots can meet the 24-hour RTO without the high costs of a warm or hot site.

Answer

Warm site with daily backups

Answer

Cold site with monthly backups

Answer

Hot site with real-time replication

Question 2

Which security control would best mitigate the risk of network sniffing on a wired LAN segment?

Accepted Answer

Using encryption protocols (e.g., IPsec, TLS). Encrypting traffic (e.g., using HTTPS, VPN) makes sniffed data unreadable.

Answer

Implementing VLANs

Answer

Disabling unused ports on the switch

Answer

Deploying an intrusion detection system

Question 3

A user reports that they received a suspicious email with an attachment claiming to be an invoice. What should the user do?

Accepted Answer

Report the email to the security team without opening the attachment. The user should immediately report the suspicious email to the security team without opening the attachment. Opening the attachment could trigger a malicious payload, such as a macro-enabled document or executable, that exploits vulnerabilities in the email client or operating system. The security team can analyze the email headers, attachment hash, and sender domain using tools like sandboxing or threat intelligence feeds to determine if it is a phishing attempt or malware delivery.

Answer

Reply to the email and ask for confirmation

Answer

Delete the email immediately

Answer

Open the attachment to check what it contains

Question 4

A security analyst is reviewing data handling procedures. Which THREE of the following are considered sensitive PII?

Accepted Answer

Financial account numbers. Sensitive PII includes medical records, financial account numbers, and biometric data. Name and phone number are general PII.

Answer

Phone number

Answer

Name and email address

Question 5

What is the difference between due care and due diligence in security governance?

Accepted Answer

Due care refers to implementing security controls; due diligence refers to investigating risks and verifying controls. Due care is the minimum standard of care (implementing basic security), while due diligence is investigating before acting (e.g., vendor assessments).

Answer

Due care is proactive; due diligence is reactive

Answer

They are synonymous

Answer

Due diligence is required by law; due care is voluntary

Question 6

A network security team is implementing a defense-in-depth strategy. Which TWO of the following controls are examples of network segmentation? (Choose two.)

Accepted Answer

Implementing firewall rules between internal zones.. Implementing firewall rules between internal zones is a form of network segmentation. By creating distinct security zones (e.g., inside, outside, DMZ) and applying access control lists (ACLs) or stateful firewall policies between them, traffic is restricted to only what is explicitly permitted, thereby isolating network segments and limiting lateral movement.

Answer

Deploying an intrusion detection system (IDS) on the core switch.

Answer

Placing public-facing servers in a DMZ.

Answer

Using VPN for remote access.

Question 7

Which TWO of the following are common indicators of a phishing email? (Select TWO.)

Accepted Answer

The email contains a sense of urgency, such as 'Your account will be closed.'. Phishing emails commonly exploit urgency to bypass rational decision-making. Attackers use phrases like 'Your account will be closed' to pressure recipients into clicking malicious links or providing credentials without verifying the source. This social engineering tactic is a hallmark of phishing campaigns.

Answer

The email contains an attachment with a .txt extension

Answer

The email has a high-importance flag set by the sender

Answer

The email is sent to multiple recipients in the 'To' field

Question 8

An analyst reviews the exhibit. Which security principle is being violated by allowing root login via SSH?

Accepted Answer

Least privilege. Allowing root login via SSH violates the principle of least privilege because it grants unrestricted administrative access to the system, bypassing any need for privilege escalation. In a properly secured SSH configuration, root login should be disabled (e.g., `PermitRootLogin no` in `/etc/ssh/sshd_config`), forcing administrators to log in as a regular user and then use `sudo` or `su` to elevate privileges only when necessary. This minimizes the attack surface and ensures that actions are auditable and tied to a specific user account.

Answer

Fail-safe

Answer

Defense in depth

Answer

Separation of duties

Question 9

Refer to the exhibit. What is the effect of this ACL?

Accepted Answer

HTTPS traffic from 10.0.1.0/24 to 192.168.2.100 is permitted; all other HTTPS is denied. The ACL explicitly permits HTTPS (TCP port 443) traffic from source network 10.0.1.0/24 to destination host 192.168.2.100. Since ACLs have an implicit deny all at the end, any HTTPS traffic not matching this permit statement is denied. Option C correctly states that only this specific traffic is permitted and all other HTTPS is denied.

Answer

All HTTPS traffic is permitted

Answer

Only hosts from 10.0.1.0/24 can access HTTPS on 192.168.2.100

Answer

The ACL is invalid due to ordering

Question 10

Drag and drop the steps to configure a wireless access point with WPA2-PSK security into the correct order.

Accepted Answer

Set SSID, then select WPA2 security mode, then set PSK passphrase, then apply settings.. Configuring a wireless access point with WPA2-PSK requires a logical sequence: first set the SSID to identify the network, then choose WPA2 as the security mode, then define the pre-shared key (PSK) passphrase, and finally apply the settings. This order ensures all necessary parameters are in place before the configuration is activated, preventing the AP from broadcasting with incomplete security settings.

Answer

Set SSID, then set PSK passphrase, then select WPA2 security mode, then apply settings.

Answer

Select WPA2 security mode, then set SSID, then set PSK passphrase, then apply settings.

Answer

Set SSID, then select WPA2 security mode, then apply settings, then set PSK passphrase.

Question 11

During a DDoS attack, a company's web server is overwhelmed with a high volume of SYN packets from spoofed IP addresses, never completing the TCP handshake. Which type of attack is this?

Accepted Answer

SYN flood. A SYN flood sends many SYN packets to exhaust server resources by leaving half-open connections.

Answer

ICMP flood

Answer

UDP flood

Answer

Amplification attack

Question 12

A network administrator is troubleshooting a connectivity issue between two segments separated by a firewall. The firewall rule allows traffic from 10.1.1.0/24 to 10.2.2.0/24 on TCP 443. Users in 10.1.1.0/24 can access the web server at 10.2.2.10, but users in 10.2.2.0/24 cannot access a web server in 10.1.1.0/24. What is the most likely cause?

Accepted Answer

The firewall is not stateful and does not automatically allow return traffic; a separate rule is needed.. The firewall rule only permits traffic from 10.1.1.0/24 to 10.2.2.0/24 on TCP 443. When users in 10.2.2.0/24 initiate a connection to the web server in 10.1.1.0/24, the firewall sees a new session that does not match the existing rule (source/destination reversed). If the firewall is not stateful, it will not automatically allow the return traffic for the reverse direction, and no separate rule exists to permit that traffic, causing the connectivity failure.

Answer

The web server in 10.1.1.0 is blocking the IP range of 10.2.2.0/24.

Answer

The firewall rule is incorrectly applied to the wrong interface.

Answer

The subnet masks are misconfigured, causing routing issues.

Question 13

A security team discovers that an internal database server is sending large amounts of data to an unknown external IP address. The server is not supposed to communicate externally. Which security control should be implemented to prevent such data exfiltration?

Accepted Answer

Configure a firewall to deny all outbound traffic from the database server except to specific authorized destinations. A firewall with restrictive egress rules blocks unauthorized outbound traffic, preventing data exfiltration. Option A (VPN) would not stop the traffic; it could even encrypt and tunnel it. Option B (IDS) can detect but not block. Option D (DLP) monitors content but may not effectively block at the network level.

Answer

Implement a VPN for all external communications

Answer

Install an intrusion detection system (IDS) on the network segment

Answer

Deploy a data loss prevention (DLP) system on the server

Question 14

A security team implements a policy that requires all access to sensitive data to be logged and audited. Which principle is being enforced?

Accepted Answer

Accountability. Accountability is enforced because logging and auditing create a traceable record of who accessed sensitive data and what actions they performed. This allows security teams to hold individuals responsible for their actions by correlating log entries with specific user identities, typically via authentication systems like LDAP or SAML. The policy directly supports the principle that users must be answerable for their access to protected resources.

Answer

Non-repudiation

Answer

Integrity

Answer

Least privilege

Question 15

An administrator reviews the exhibit. Which security principle is being violated?

Accepted Answer

Least privilege. The user has write access to HR documents, which may not be necessary for their role, violating least privilege.

Answer

Non-repudiation

Answer

Separation of duties

Answer

Accountability

Question 16

A company's security policy requires that all privileged access to critical servers be logged and monitored. The IT team has implemented a jump server (bastion host) for administrators to connect to critical servers. All SSH connections to the jump server are logged, and from there, administrators connect to target servers. The security team notices that some administrators are bypassing the jump server and connecting directly to critical servers from their workstations. The direct connections are not logged. The security team needs to enforce the policy without disrupting operations. Which of the following is the BEST solution?

Accepted Answer

Implement a host-based firewall on each critical server to block direct connections.. A host-based firewall on each critical server can enforce the security policy by blocking direct SSH connections (TCP port 22) from any source other than the jump server's IP address. This ensures that all administrative access must go through the jump server, where logging is already in place, without disrupting legitimate operations through the authorized path.

Answer

Send a warning email to all administrators reminding them of the policy.

Answer

Disable direct SSH access to critical servers at the network firewall level.

Answer

Revoke local administrator rights on workstations.

Question 17

According to modern password guidance from NIST SP 800-63, which of the following is the most important factor when setting password requirements?

Accepted Answer

Enforcing a minimum length of at least 8 characters. NIST SP 800-63 recommends favoring password length over complexity, with a minimum of 8 characters (or 15+ for high assurance) and avoiding frequent forced changes unless compromised.

Answer

Requiring a mix of uppercase, lowercase, numbers, and special characters

Answer

Using randomly generated passwords

Answer

Changing passwords every 30 days

Question 18

Which THREE elements are essential components of a business continuity plan (BCP)?

Accepted Answer

Data backup schedules and procedures. Data backup schedules and procedures are essential because they ensure that critical data can be restored after a disruption. A BCP must specify the frequency of backups (e.g., daily incremental, weekly full), the retention policy, and the recovery point objective (RPO) to meet business requirements. Without defined schedules and procedures, data loss or corruption could render the recovery process ineffective.

Answer

Incident response team roster

Answer

Detailed network topology diagrams

Question 19

Which metric is used to define the maximum amount of data loss an organization can tolerate during a disaster?

Accepted Answer

RPO. RPO (Recovery Point Objective) defines the maximum acceptable amount of data loss measured in time, such as seconds, minutes, or hours. It determines the age of the backup or replication data that must be restored to resume normal operations after a disaster. For example, an RPO of 1 hour means the organization can tolerate losing up to 1 hour's worth of data.

Answer

RTO

Answer

SLA

Answer

MTBF

Question 20

A security team is analyzing network segmentation strategies. Which THREE of the following are benefits of using VLANs for network segmentation?

Accepted Answer

They allow logical grouping of users regardless of physical location. VLANs provide logical separation, improve security, reduce broadcast domain size, and allow flexible grouping without physical rewiring.

Answer

They eliminate the need for IP addressing

Answer

They increase the collision domain size