ISC2 CC Practice Exam 52 — 20 Questions

Question 1

A network administrator needs to segment traffic between departments without additional hardware. Which technology allows this logical separation on a Layer 2 switch?

Accepted Answer

VLAN. VLANs (Virtual Local Area Networks) allow logical segmentation on a switch, separating traffic at Layer 2 without extra hardware.

Answer

Subnetting

Answer

VPN

Answer

DMZ

Question 2

A network administrator needs to allow secure remote management of a router. Which protocol and port should be used?

Accepted Answer

SSH on port 22. SSH (port 22) provides encrypted remote access, unlike Telnet which sends data in cleartext.

Answer

FTP on port 21

Answer

HTTP on port 80

Answer

Telnet on port 23

Question 3

Which firewall type operates at Layer 3 and Layer 4, making decisions based solely on source/destination IP and port numbers?

Accepted Answer

Packet filtering firewall. Packet filtering firewalls are stateless and examine packet headers in isolation.

Answer

Stateful inspection firewall

Answer

Next-generation firewall (NGFW)

Answer

Application proxy firewall

Question 4

Which OSI layer is responsible for routing packets based on IP addresses?

Accepted Answer

Layer 3 – Network. Layer 3 (Network) handles packet forwarding and routing using IP addresses.

Answer

Layer 1 – Physical

Answer

Layer 4 – Transport

Answer

Layer 2 – Data Link

Question 5

An organization uses a network segmentation strategy that creates separate broadcast domains on a single switch. Which technology is being used?

Accepted Answer

VLAN. VLANs (Virtual Local Area Networks) logically segment a switch into multiple isolated broadcast domains, improving security and reducing broadcast traffic.

Answer

DMZ

Answer

Honeypot

Answer

Subnetting

Question 6

A SOC analyst detects a pattern of outbound traffic from an internal server to a known malicious IP address. Which SOC tier should this alert be escalated to for a deeper investigation?

Accepted Answer

Tier 2. Tier 2 analysts conduct deeper investigation to confirm if the activity is malicious and determine the scope.

Answer

Tier 3

Answer

Tier 1

Answer

Incident Response Team

Question 7

What is the primary purpose of using security baselines derived from CIS Benchmarks?

Accepted Answer

To establish a secure starting point for system configuration. CIS Benchmarks provide hardened configuration standards to reduce vulnerabilities and improve security posture.

Answer

To ensure all systems have the same software versions

Answer

To monitor network traffic for anomalies

Answer

To automate patch deployment

Question 8

An organization is implementing a patch management policy. Which THREE steps are part of the standard patch lifecycle?

Accepted Answer

Deploying the patch to production systems. The standard patch lifecycle includes vulnerability disclosure, testing in staging, and deployment to production. Emergency patching is a separate process, and verifying backup is not a standard step in patching.

Answer

Emergency patching without testing

Answer

Verifying backups before deployment

Question 9

Which of the following is the most effective way to prevent tailgating in a secured facility?

Accepted Answer

Training employees to not hold doors open for unknown individuals.. Tailgating occurs when an unauthorized person follows an authorized person through a door. Employee awareness training teaches staff not to hold doors open for strangers.

Answer

Installing security cameras at all entrances.

Answer

Using keycard access for all doors.

Answer

Hiring security guards to monitor entrances.

Question 10

An organization needs to retain authentication logs for compliance with PCI DSS. What is the minimum retention period required, and how long must the logs be immediately available?

Accepted Answer

12 months retention, 3 months immediately available. PCI DSS requires logs to be retained for at least 12 months, with the most recent 3 months immediately accessible for analysis.

Answer

18 months retention, 6 months immediately available

Answer

6 months retention, 1 month immediately available

Answer

24 months retention, 12 months immediately available

Question 11

An organization's incident response plan specifies containment, eradication, and recovery phases. During containment, the team isolates a compromised server from the network. However, the server is a domain controller. What is the PRIMARY risk of this action?

Accepted Answer

Loss of authentication services. Isolating a domain controller from the network prevents it from processing authentication requests (Kerberos and NTLM), which halts user logins, resource access, and group policy updates across the domain. This loss of authentication services is the primary risk because the domain controller is the authoritative source for identity verification in Active Directory.

Answer

Data loss on the server

Answer

Violation of chain of custody

Answer

Propagation of malware to other systems

Question 12

Which TWO of the following controls are examples of defense in depth?

Accepted Answer

Network firewall. Defense in depth uses multiple layers of security controls. Network firewall (Option C) provides network-level protection, and anti-malware software (Option D) provides host-level protection, together forming overlapping layers. Single sign-on (Option A) is an authentication convenience, not a security layer. Encryption at rest (Option B) is a data protection control but is not typically considered a separate layer in defense in depth; it is often categorized under data security. Strong password policy (Option E) is a procedural control that supports authentication but does not constitute a distinct defensive layer.

Answer

Single sign-on

Answer

Encryption at rest

Answer

Strong password policy

Question 13

An online retailer has a DR plan that includes active-active data centers. During a major DDoS attack, one data center's external connectivity is saturated. The internal network is operational. The security team has identified the attack traffic pattern and is working with the ISP to filter. To maintain service availability, what action should be taken?

Accepted Answer

Redirect all traffic to a cloud-based scrubbing center.. A cloud-based scrubbing center (DDoS mitigation service) can filter malicious traffic before it reaches the retailer's network, preserving the active-active data center architecture. Since the internal network is operational, the attack only saturates external connectivity; redirecting traffic to the scrubbing center allows clean traffic to be re-injected into the data centers, maintaining service availability without taking any site offline.

Answer

Shut down the attacked data center and fail all traffic to the other data center.

Answer

Implement rate limiting on the affected network segment.

Answer

Continue monitoring and let the ISP handle the attack.

Question 14

Refer to the exhibit. Based on the log entries, what type of attack is most likely occurring?

Accepted Answer

Dictionary attack.. The log entries show repeated failed login attempts using different usernames and passwords, which is characteristic of a dictionary attack where an attacker uses a list of common usernames and passwords to gain unauthorized access. Unlike a brute-force attack that tries all possible combinations, a dictionary attack uses a predefined list of likely credentials, making it more efficient and matching the pattern in the logs.

Answer

Brute-force attack.

Answer

Privilege escalation.

Answer

Denial of service.

Question 15

A company wants to host a public-facing web server and an email server while protecting the internal network. Which network architecture is best suited for this purpose?

Accepted Answer

DMZ. A DMZ (demilitarized zone) is a segmented network that sits between the internet and the internal network, hosting public-facing servers while allowing controlled access from both sides.

Answer

Subnetting

Answer

Full mesh topology

Answer

Virtual LAN (VLAN)

Question 16

The exhibit shows a syslog-ng client configuration and a firewall rule on the central logging server (IP 10.0.0.10). The client (192.168.1.100) is not sending logs to the server. What is the most likely cause?

Accepted Answer

The firewall rule restricts source port 6514, but the client uses a random ephemeral source port. The firewall rule on the central logging server (10.0.0.10) specifies a source port of 6514. However, syslog-ng clients, when sending over TCP or TLS, typically use a random ephemeral source port (e.g., above 1024) rather than a fixed source port. Since the firewall restricts the source port to exactly 6514, the client's packets are dropped, preventing logs from reaching the server.

Answer

The syslog-ng configuration uses TLS, but the firewall rule does not allow TLS traffic

Answer

The syslog-ng client uses UDP by default, but the firewall allows only TCP

Answer

The firewall rule does not include the client IP 192.168.1.100

Question 17

During a phishing investigation, a security analyst identifies that an employee clicked a malicious link. The analyst isolates the workstation. What is the NEXT best step?

Accepted Answer

Capture a memory image of the workstation for analysis. After isolating the workstation, the next best step is to capture a memory image (RAM) to preserve volatile evidence such as running processes, network connections, and malware artifacts that would be lost on shutdown. This follows the order of volatility (RFC 3227) and is critical for forensic analysis to determine the scope of the compromise.

Answer

Update the company's acceptable use policy

Answer

Notify all employees about phishing risks

Answer

Reimage the workstation

Question 18

A government agency stores classified documents on a secure server. The server is connected to the internet, but access is restricted using a firewall and requires two-factor authentication. An auditor discovers that the server's operating system has not been patched for over a year, making it vulnerable to remote code execution attacks. Which security principle is most directly compromised by this missing patch, and what is the best corrective action?

Accepted Answer

Integrity; apply the security patch immediately. Integrity. An unpatched vulnerability that allows remote code execution directly compromises integrity because an attacker could modify or delete data on the server. The best corrective action is to apply the security patch immediately to close the vulnerability. While testing in a dev environment is good practice, the urgency of a remote code execution risk requires immediate patching in production after appropriate risk assessment. Confidentiality and availability could also be affected, but integrity is the most directly compromised principle because code execution enables data alteration. Option A delays patching, which is not ideal given the severity. Option B is excessive and disrupts operations. Option D does not address the vulnerability.

Answer

Confidentiality; test the patch in a dev environment first before applying to production

Answer

Non-repudiation; disconnect the server from the internet

Answer

Availability; use a load balancer to distribute traffic

Question 19

Which TWO of the following are examples of security principles?

Accepted Answer

Least privilege. Least privilege is a foundational security principle that dictates users, processes, or systems should only be granted the minimum access rights necessary to perform their functions. This reduces the attack surface and limits potential damage from compromised accounts or insider threats. It is a design concept, not a specific technology, which is why it qualifies as a security principle.

Answer

Encryption

Answer

Firewall

Answer

VLAN

Question 20

A company's network uses a perimeter firewall and an internal firewall. The DMZ sits between them. A new application server needs to be accessible from the internet on TCP port 8443 and must be able to make outbound HTTPS connections to an external license server. Which firewall rules should be implemented? (Assume default deny)

Accepted Answer

Allow inbound from internet to server on 8443; allow outbound from server to internet on 443 with stateful inspection. It allows inbound traffic on TCP 8443 to the server and outbound traffic on TCP 443 from the server to the internet. Stateful inspection automatically tracks the outbound HTTPS connection and permits the return traffic (the license server's response) without needing an explicit inbound rule. This matches the requirement while maintaining a default-deny posture.

Answer

Allow inbound from internet to server on 8443; allow outbound from server to internet on 443; allow inbound from internet to server on 443 for license server response

Answer

Allow inbound from internet to server on 8443; allow outbound from server to internet on 443

Answer

Allow inbound from internet to server on 8443 and 443; allow outbound from server to internet on any