ISC2 CC Practice Exam 51 — 20 Questions

Question 1

After an incident is resolved, which phase involves reviewing what happened, documenting lessons learned, and updating procedures?

Accepted Answer

Lessons learned. The lessons learned phase captures improvements for future incidents.

Answer

Eradication

Answer

Containment

Answer

Recovery

Question 2

Which type of backup copies all data that has changed since the last full backup, regardless of any subsequent incremental or differential backups?

Accepted Answer

Differential backup. Differential backup backs up all changes since the last full backup. Incremental backs up changes since any last backup.

Answer

Full backup

Answer

Incremental backup

Answer

Synthetic full backup

Question 3

A company’s disaster recovery plan specifies an RTO of 4 hours and an RPO of 1 hour for its critical database. The database is backed up every hour using incremental backups. After a catastrophic failure, restoration takes 3 hours, but the database must be rolled forward using transaction logs. The total time to make the database fully operational is 5 hours. Which statement is correct?

Accepted Answer

RTO is exceeded but RPO is likely met. The RTO was exceeded (5 hours > 4 hours), but the RPO may still be met if the last backup was within 1 hour; the scenario does not indicate data loss beyond 1 hour.

Answer

Both RTO and RPO are exceeded

Answer

RPO is exceeded but RTO is met

Answer

Both RTO and RPO are met

Question 4

During which phase of the incident response process would the team identify the root cause of a security incident?

Accepted Answer

Analysis. The analysis phase involves examining the incident to determine the root cause, scope, and impact.

Answer

Eradication

Answer

Preparation

Answer

Detection

Question 5

During a disaster recovery test, the IT team successfully restored systems from backups and achieved the recovery time objective (RTO). However, users could not resume normal work because additional configuration and data validation were needed. Which metric was NOT met?

Accepted Answer

Work Recovery Time (WRT). Work Recovery Time (WRT) is the time needed to return to normal operations after systems are restored; it is separate from RTO.

Answer

Recovery Point Objective (RPO)

Answer

Maximum Tolerable Downtime (MTD)

Answer

Recovery Time Objective (RTO)

Question 6

An organization wants to ensure that its critical business functions can continue operating during a disruption. Which plan specifically addresses keeping the business running during a disruption?

Accepted Answer

Business Continuity Plan (BCP). The Business Continuity Plan (BCP) focuses on maintaining business operations during a disruption, while the Disaster Recovery Plan (DRP) focuses on restoring IT systems after a disruption.

Answer

Incident Response Plan (IRP)

Answer

Disaster Recovery Plan (DRP)

Answer

Business Impact Analysis (BIA)

Question 7

An organization is selecting a recovery site strategy that offers the fastest recovery time, measured in hours, to minimize downtime for critical applications. Which recovery site type best meets this requirement?

Accepted Answer

Hot site. The hot site is the best choice for the fastest recovery time, as it is fully equipped and operational with real-time data replication, allowing recovery within hours. In contrast, a warm site requires activation and data restoration, typically taking days, while a cold site needs hardware and software installation, taking weeks. Cloud-based recovery can be fast but may involve data retrieval and configuration delays, making it slower than a hot site for critical applications.

Answer

Cloud-based recovery

Answer

Cold site

Answer

Warm site

Question 8

A security administrator is reviewing physical access controls. Which control is considered an external perimeter security measure?

Accepted Answer

Fencing around the property. External perimeter controls include fencing, bollards, and lighting to deter or delay intruders.

Answer

Biometric reader on server room door

Answer

Cable locks on laptops

Answer

Visitor badge policy

Question 9

According to NIST SP 800-63, which password policy is recommended to enhance security?

Accepted Answer

Favor length over complexity and check against breached password lists. NIST SP 800-63 recommends favoring long passwords over complex ones and avoiding frequent forced changes.

Answer

Allow passwords as short as 4 characters

Answer

Enforce maximum complexity with special characters and numbers

Answer

Require frequent password changes every 30 days

Question 10

An organization is designing a defense-in-depth strategy for physical security. Which of the following are examples of layered physical controls? (Choose THREE.)

Accepted Answer

Fencing and bollards around the property. Defense in depth uses multiple layers: perimeter, building, room, and equipment controls.

Answer

Encryption of data at rest

Answer

Intrusion detection system on the network

Question 11

A company is developing a disaster recovery plan for its database server. The database is updated transactionally and cannot tolerate any data loss. Which backup strategy meets this requirement?

Accepted Answer

Continuous database mirroring. Continuous database mirroring (C) is correct because it maintains a synchronous copy of the database on a secondary server, ensuring that every committed transaction is immediately written to both servers. This provides zero data loss (RPO=0) and automatic failover, which is required for a transactional database that cannot tolerate any data loss.

Answer

Log shipping with 15-minute intervals

Answer

Full backups nightly

Answer

Differential backups every 6 hours

Question 12

A security analyst notices a high volume of ICMP Echo Reply packets from an external server to an internal host that never sent Echo Requests. Which type of attack is likely occurring?

Accepted Answer

Smurf attack. Unsolicited ICMP replies may indicate a DoS attack using reflected traffic.

Answer

SYN flood

Answer

ARP poisoning

Answer

DNS amplification

Question 13

An attacker sends an email to an employee that appears to come from the CEO, asking for sensitive data. This is an example of which type of threat?

Accepted Answer

Phishing. The attack is a form of phishing, where an attacker uses social engineering via email (appearing to be the CEO) to trick the employee into revealing sensitive data. Phishing is a broader category of social engineering attacks that often use spoofing techniques, but the threat itself is classified as phishing.

Answer

Spoofing

Answer

Man-in-the-middle

Answer

Sniffing

Question 14

Which protocol is used to resolve IP addresses to MAC addresses on a local network?

Accepted Answer

ARP. ARP (Address Resolution Protocol) maps IP to MAC addresses.

Answer

DNS

Answer

DHCP

Answer

ICMP

Question 15

Which of the following are effective defenses against man-in-the-middle attacks? (Choose THREE)

Accepted Answer

Educating users to verify certificates. HTTPS, VPNs, and certificate validation help prevent MITM.

Answer

Using HTTP instead of HTTPS

Answer

Disabling ARP

Question 16

A security analyst is deploying network security devices. Which TWO of the following are characteristics of an Intrusion Detection System (IDS)?

Accepted Answer

Operates in passive mode by monitoring a copy of traffic. IDS is passive, monitors traffic, and generates alerts but does not block traffic. It can be network-based or host-based.

Answer

Can be placed inline to block malicious traffic

Answer

Can automatically reconfigure firewall rules

Answer

Ensures zero false positives

Question 17

Which firewall type inspects the entire packet, including application data, and can enforce rules based on user identity?

Accepted Answer

Next-generation firewall (NGFW). Next-generation firewalls (NGFW) combine deep inspection with application ID and user ID.

Answer

Application proxy firewall

Answer

Packet filtering firewall

Answer

Stateful inspection firewall

Question 18

A network administrator is troubleshooting connectivity issues and suspects a problem at the Data Link layer. Which of the following addresses would be most relevant to examine?

Accepted Answer

MAC address. The Data Link layer (Layer 2) uses MAC addresses to identify devices on the same network segment. IP addresses operate at the Network layer (Layer 3), and port numbers at the Transport layer (Layer 4).

Answer

IP address

Answer

Port number

Answer

Domain name

Question 19

A network administrator is designing a DMZ to host a web server, an email server, and a DNS server. Which TWO of the following principles should be applied to secure the DMZ? (Select TWO.)

Accepted Answer

Use a firewall to control traffic between the DMZ and internal network.. Proper segmentation and access control are key; placing servers on separate VLANs and restricting inbound/outbound traffic with firewalls are essential.

Answer

Place all DMZ servers on the same VLAN to simplify management.

Answer

Allow all outbound traffic from the DMZ to the internet for ease of use.

Answer

Disable logging on DMZ devices to conserve resources.

Question 20

A security analyst is investigating a potential DDoS attack. Which of the following are common indicators of a DDoS? (Choose TWO)

Accepted Answer

Unusually high traffic volume from multiple IP addresses. High volume of traffic from many sources and increased latency are signs of DDoS.

Answer

Low CPU usage on servers

Answer

Single source sending many packets

Answer

Decrease in DNS queries