ISC2 CC Practice Exam 51 — 20 Questions

Question 1

A SOC analyst is investigating a potential data exfiltration incident. Which TWO log sources would be most useful for identifying outbound data transfers? (Select TWO)

Accepted Answer

Firewall logs. Firewall logs (A) are correct because they record allowed and denied connections with source/destination IP addresses, ports, and byte/packet counts, letting the analyst spot large or anomalous outbound transfers to external hosts. Proxy logs (C) are correct because they capture HTTP/HTTPS requests, URLs, user agents, and often the volume of data uploaded or downloaded, which is essential for identifying web-based exfiltration channels. Patch management logs (B) only track software update deployment and compliance, so they reveal nothing about network data flows. System logs (D) contain OS, service, and application events but generally lack the destination and transfer-volume detail needed to confirm outbound exfiltration. Authentication logs (E) show logon, logoff, and failed-access events, which help with account compromise analysis but not with tracing data leaving the network.

Answer

Patch management logs

Answer

System logs

Answer

Authentication logs

Question 2

Which TWO of the following are common indicators of a phishing email?

Accepted Answer

Unexpected sender or email address. Option D is correct because phishing emails frequently originate from spoofed or look-alike domains that the recipient does not recognize, so an unexpected sender or mismatched email address is a classic red flag. Option E is correct because attackers rely on social engineering that creates urgency—phrases like "act now" or "your account will be closed"—to pressure victims into clicking links or disclosing credentials before they scrutinize the message. In contrast, option A is not an indicator since professional formatting and correct grammar are typical of legitimate email and, if anything, poor grammar is the more common phishing clue. Option B is not reliable because legitimate business email routinely carries attachments, so an attachment alone proves nothing. Option C is likewise not an indicator, as using the recipient's full name is normal, personalized behavior in genuine correspondence and does not by itself signal phishing.

Answer

Professional formatting with correct grammar

Answer

Presence of a file attachment

Answer

Use of the recipient's full name in the greeting

Question 3

Which THREE of the following are best practices for securing a remote access VPN?

Accepted Answer

Enable multi-factor authentication.. Option A (Enable multi-factor authentication) is correct because MFA adds a second verification factor beyond a password, so stolen or guessed credentials alone cannot establish a VPN session, directly mitigating credential-based attacks on remote access. Option B (Keep VPN client software up to date) is correct because VPN clients such as AnyConnect, GlobalProtect, or OpenVPN frequently receive patches for vulnerabilities (e.g., buffer overflows, TLS flaws), and running current versions closes known exploit paths on endpoints that terminate the tunnel. Option D (Enforce strong password policies) is correct because strong, complex, and rotated passwords reduce the risk of brute-force, credential-stuffing, and dictionary attacks against VPN authentication, complementing MFA as a defense-in-depth control. Option C (Use pre-shared keys for authentication) is not a best practice because PSKs are static secrets shared across users or devices, are difficult to rotate, and are vulnerable to theft and offline cracking, so they should be replaced by certificate-based or MFA-backed authentication. Option E (Implement split tunneling by default) is not a best practice because split tunneling lets remote traffic bypass the VPN and the corporate security stack, exposing the endpoint and internal network to threats; full tunneling or selective, policy-driven split tunneling is preferred.

Answer

Use pre-shared keys for authentication.

Answer

Implement split tunneling by default.

Question 4

During a disaster recovery test, the recovery time objective (RTO) for a critical application is 4 hours, but the actual recovery takes 6 hours. Which of the following best describes the impact?

Accepted Answer

The application is unavailable for 2 hours longer than acceptable.. The recovery time objective (RTO) defines the maximum acceptable downtime for an application. Since the RTO is 4 hours but the actual recovery took 6 hours, the application was unavailable for 2 hours beyond the acceptable threshold, directly impacting business continuity. This is a failure to meet the RTO, not the RPO, which concerns data loss.

Answer

Data loss beyond the recovery point objective (RPO).

Answer

The recovery point objective (RPO) is not met.

Answer

No impact because RTO is only a guideline.

Question 5

Which concept ensures that a user cannot deny having performed a specific action?

Accepted Answer

Non-repudiation. Non-repudiation ensures that a user cannot deny having performed a specific action, typically by using cryptographic mechanisms such as digital signatures or audit logs. In the context of the CC exam, this is most commonly achieved through public key infrastructure (PKI) where a private key signs an action, and the corresponding public key verifies the signature, providing irrefutable proof of origin. This prevents a user from later claiming they did not send a message or perform a transaction.

Answer

Availability

Answer

Integrity

Answer

Authorization

Question 6

A system administrator has a regular user account for daily work and a separate account with elevated privileges. Which principle is being applied?

Accepted Answer

Least privilege. The principle of least privilege states that users should be granted only the minimum levels of access—or permissions—necessary to perform their job functions. By using a regular account for daily work and a separate elevated account only when needed, the administrator is limiting the exposure of privileged access, thus applying least privilege.

Answer

Separation of duties

Answer

Need-to-know

Answer

Defense in depth

Question 7

A company's security policy requires that all sensitive data be encrypted at rest and in transit. However, a recent breach occurred because an attacker exploited a misconfigured web server that exposed a database directly. Which principle was most lacking in this scenario?

Accepted Answer

Defense in depth. Defense in depth is the principle of layering multiple security controls so that a single failure does not expose sensitive data. The scenario describes encryption at rest and in transit (two layers) but a misconfigured web server directly exposed the database — a missing network segmentation or access-control layer. The breach succeeded because no additional layer prevented direct database access, which is the essence of a defense-in-depth failure.

Answer

Least privilege

Answer

Fail securely

Answer

Complete mediation

Question 8

You are designing a backup strategy for a critical database. The business requires that in the event of a failure, data loss must not exceed 15 minutes. Which metric primarily addresses this requirement?

Accepted Answer

Recovery Point Objective (RPO). Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time. A requirement that data loss must not exceed 15 minutes directly translates to an RPO of 15 minutes. RPO determines how frequently backups or snapshots must be taken to meet the business continuity requirement.

Answer

Service Level Agreement (SLA)

Answer

Mean Time Between Failures (MTBF)

Answer

Recovery Time Objective (RTO)

Question 9

A session timeout automatically logs out a user after a period of inactivity. This control primarily protects against:

Accepted Answer

Unauthorized access from an unattended workstation. A session timeout logs a user out after inactivity, so if they walk away from an unattended workstation, an attacker cannot continue using the already-authenticated session. This directly mitigates the risk of unauthorized physical access to a logged-in session on an unattended device.

Answer

Password cracking

Answer

Brute force attacks

Answer

Shoulder surfing

Question 10

An organization enforces a password policy requiring a minimum of 15 characters with no complexity requirements, and does not force periodic changes. This policy aligns with which current best practice?

Accepted Answer

Length over complexity and no periodic changes. Current NIST SP 800-63B guidance recommends favoring password length over complexity and eliminating forced periodic rotation, because long passphrases resist brute-force and dictionary attacks better than short complex strings, and frequent changes lead users to predictable patterns (e.g., Password1!, Password2!). A 15-character minimum with no complexity rules and no forced expiration aligns with this modern best practice.

Answer

Passwords should be exactly 8 characters with at least one special character

Answer

Passwords should be changed every 30 days

Answer

Complexity requirements are more important than length

Question 11

A company configures its firewall to block all inbound traffic except for specific necessary services. This approach aligns with which access control principle?

Accepted Answer

Least privilege. Blocking all inbound traffic except explicitly required services is the definition of least privilege applied to network access control — granting only the minimum access necessary for business function. The firewall default-deny with specific allow rules embodies this principle by minimizing the attack surface.

Answer

Separation of duties

Answer

Defense in depth

Answer

Need-to-know

Question 12

A user enters a username and password to access a system. Which phase of the access control process does entering the username represent?

Accepted Answer

Identification. Entering a username is the act of claiming an identity to the system, which is the identification phase. Authentication is the subsequent step where the password is verified to prove that claimed identity.

Answer

Accounting

Answer

Authentication

Answer

Authorisation

Question 13

Which account type is considered highest risk and should be protected with strict controls, including separate daily use accounts?

Accepted Answer

Admin/root account. Admin/root accounts have unrestricted privileges over systems, data, and configurations, making them the highest-value target for attackers — compromise grants full control. Best practice is to protect them with strict controls (MFA, privileged access workstations, just-in-time elevation) and use separate, non-privileged accounts for daily tasks like email and browsing.

Answer

Standard user account

Answer

Service account

Answer

Guest account

Question 14

According to the (ISC)² Code of Ethics, which obligation has the highest priority?

Accepted Answer

Protect society, the common good, and the public trust. The Code of Ethics states the highest priority is to protect society, the common good, and the public trust.

Answer

Provide diligent and competent service to principals

Answer

Advance and protect the profession

Answer

Act honorably, honestly, justly, responsibly, and legally

Question 15

A network administrator needs to provide secure remote access to internal resources for employees working from home. The solution must encrypt all traffic and authenticate users before granting access. Which protocol should be used?

Accepted Answer

SSL/TLS VPN. C is correct because SSL/TLS VPNs (e.g., Cisco AnyConnect) provide encrypted tunnels over HTTPS (port 443) and support user authentication via certificates, RADIUS, or LDAP. This allows secure remote access to internal resources without requiring a persistent IPsec tunnel, making it ideal for home workers with dynamic IPs.

Answer

SSH

Answer

IPsec

Answer

SNMPv3

Question 16

A network administrator is troubleshooting connectivity issues and suspects a problem at the Data Link layer. Which of the following addresses would be most relevant to examine?

Accepted Answer

MAC address. The Data Link layer (Layer 2) of the OSI model deals with MAC addresses for node-to-node delivery within a local network segment. When troubleshooting connectivity issues at Layer 2, the MAC address is the most relevant address to examine because it identifies the physical network interface and is used by switches to forward frames. IP addresses operate at Layer 3, port numbers at Layer 4, and domain names at Layer 7, so they are not relevant to a Data Link layer problem.

Answer

IP address

Answer

Port number

Answer

Domain name

Question 17

A security operations center receives an alert that a workstation has been infected with ransomware. The infection is isolated to one machine. What is the first step in the containment phase of incident response?

Accepted Answer

Disconnect the workstation from the network. The first step in the containment phase is to disconnect the workstation from the network. This immediately stops the ransomware from spreading laterally to other systems via SMB, RDP, or other network protocols. Containment prioritizes preventing further damage over remediation or analysis.

Answer

Restore the workstation from a recent backup

Answer

Reboot the workstation in safe mode

Answer

Run a full antivirus scan

Question 18

Which of the following is a benefit of using VLANs in a network?

Accepted Answer

Logical segmentation without additional hardware. VLANs allow logical segmentation of a network at Layer 2, improving security and reducing broadcast traffic without requiring additional physical switches.

Answer

Elimination of all broadcast traffic

Answer

Faster data transfer speeds

Answer

Increased physical security

Question 19

A company has implemented a role-based access control (RBAC) system. A new employee in the finance department is granted the 'Finance User' role, which allows them to view invoices but not create payments. However, after a system upgrade, it is discovered that the 'Finance User' role now includes the ability to create payments due to a misconfiguration. The employee did not request this additional privilege and has not exploited it. The security team is notified. Which principle has been violated, and what is the most appropriate immediate action?

Accepted Answer

Least privilege; correct the role permissions to only what is necessary. The misconfiguration granted the employee more permissions than required, violating the principle of least privilege. The most appropriate immediate action is to correct the role permissions so they include only what is necessary, restoring least privilege without unnecessarily punishing the employee. Since the employee did not request or exploit the privilege, permanent revocation or account disablement is disproportionate.

Answer

Separation of duties; disable the employee's account until an investigation is complete

Answer

Accountability; remove the 'Finance User' role from all employees

Answer

Least privilege; revoke the employee's access permanently

Question 20

In a directory service like Active Directory, which component is used to organize users, groups, and computers into a hierarchical structure for applying policies?

Accepted Answer

Organizational Units (OUs). Organizational Units (OUs) are the container objects within Active Directory that provide the hierarchical structure used to organize users, groups, computers, and other objects. Because Group Policy can be linked directly to an OU, it is the primary mechanism for scoping policy application to a subset of the directory. This makes OUs the correct answer for organizing objects hierarchically for policy purposes.

Answer

Group Policy Objects (GPOs)

Answer

Domain controllers

Answer

LDAP