ISC2 CC Practice Exam 53 — 20 Questions

Question 1

An organization implements a role-based access control (RBAC) system. To maintain the principle of least privilege, what should the administrator do when a user changes roles?

Accepted Answer

Remove the previous role's access and assign the new role's access.

Answer

Keep all access and let the manager manually remove as needed.

Answer

Use a single role for all users to simplify management.

Answer

Add the new role's access while keeping the previous role's access.

Question 2

A security operations team is implementing a new SIEM solution. They want to ensure that logs from all critical systems are collected and analyzed in real time. Which of the following is the MOST important consideration when designing the log collection architecture?

Accepted Answer

Ensure sufficient network bandwidth and storage capacity. The most critical factor in real-time log collection is ensuring that the network can handle the volume of log data without congestion and that storage can ingest and retain the data without dropping events. Without sufficient bandwidth, logs will be delayed or lost, defeating the purpose of real-time analysis. Storage capacity directly impacts the ability to retain and query logs for immediate and historical investigation.

Answer

Use a standardized log format for all systems

Answer

Encrypt all log transmissions in transit

Answer

Define a log retention policy of at least one year

Question 3

A Privileged Access Management (PAM) solution is used to:

Accepted Answer

Control and monitor privileged accounts and sessions. PAM solutions control, monitor, and audit privileged access to critical systems.

Answer

Encrypt data at rest

Answer

Manage user passwords and enforce complexity

Answer

Provide single sign-on for all applications

Question 4

A network engineer is configuring a firewall rule to allow inbound HTTPS traffic to a web server. Which port must be opened?

Accepted Answer

443. HTTPS (HTTP Secure) uses TLS/SSL encryption over TCP port 443 by default. To allow inbound HTTPS traffic to a web server, the firewall rule must permit TCP destination port 443. Port 80 is used for unencrypted HTTP, not HTTPS.

Answer

3389

Answer

22

Answer

80

Question 5

A security auditor discovers that a user's account has been granted full access to all financial databases, even though the user only needs to view quarterly reports. Which access control principle has been violated most directly?

Accepted Answer

Least privilege. Least privilege requires granting only the minimum permissions necessary to perform job functions.

Answer

Separation of duties

Answer

Need-to-know

Answer

Defense in depth

Question 6

A security analyst detects unusual outbound network traffic from a server that normally does not communicate externally. After confirming a malware infection, the analyst isolates the server from the network. Which incident response phase is the analyst performing?

Accepted Answer

Containment. Isolating the server is a containment action to prevent spread.

Answer

Recovery

Answer

Detection

Answer

Eradication

Question 7

An organization requires that financial transactions over $10,000 be approved by two different managers. This is an example of which access control principle?

Accepted Answer

Separation of duties. Separation of duties ensures that no single individual has complete control over a critical action, reducing the risk of fraud or error.

Answer

Defense in depth

Answer

Need to know

Answer

Least privilege

Question 8

A security analyst investigates a possible data exfiltration. The analyst sees a large amount of data being sent to an external IP address at regular intervals. Which of the following is the most likely technique being used?

Accepted Answer

DNS tunneling. DNS tunneling encodes data within DNS queries and responses, allowing attackers to bypass network security controls by exfiltrating data through UDP port 53, which is often allowed through firewalls. The regular intervals of large data transfers to an external IP address are characteristic of a DNS tunnel, as the attacker segments data into multiple DNS queries to avoid detection.

Answer

SQL injection

Answer

Phishing

Answer

Man-in-the-middle

Question 9

A small company with 50 employees uses a flat network with no VLANs. They recently experienced a ransomware attack that spread from an infected workstation to a file server. The IT manager wants to implement network segmentation to prevent future lateral movement. The company uses a single /24 subnet (192.168.1.0/24) with a single switch and a router/firewall. They have three departments: Sales, HR, and IT. Each department has about 15-20 computers. The file server is in the IT department. The company has a limited budget and cannot purchase new hardware. Which of the following is the MOST effective and practical approach to segment the network given these constraints?

Accepted Answer

Create three VLANs on the switch, one for each department, and configure ACLs on the router to allow only necessary inter-VLAN traffic.. Creating three VLANs on the existing switch segments the flat /24 network into separate broadcast domains, preventing lateral movement by default. Configuring ACLs on the router allows only necessary inter-VLAN traffic (e.g., Sales and HR can access the file server in IT), which stops the ransomware from spreading across departments without requiring new hardware.

Answer

Replace the switch with three separate physical switches, each connected to a separate router interface.

Answer

Implement MAC address filtering on the switch to only allow authorized devices to communicate with the file server.

Answer

Install a software firewall on each workstation to block traffic from other subnets.

Question 10

A security team is designing a network for a hospital. They need to ensure that patient data is accessible to doctors only when needed, but also protected from unauthorized access. Which principle BEST balances these requirements?

Accepted Answer

Balancing the CIA triad. The question asks for the principle that best balances accessibility with protection. The CIA triad (Confidentiality, Integrity, Availability) is the foundational model for balancing these three competing priorities. In a hospital network, doctors need availability of patient data when needed, but confidentiality must protect against unauthorized access; balancing the triad means making trade-offs between these goals, such as using role-based access controls to ensure availability for authorized users while enforcing confidentiality. Option D directly addresses this balancing act, whereas the other options focus on a single aspect.

Answer

Defense in depth

Answer

Least privilege

Answer

Non-repudiation

Question 11

Based on the backup schedule, what is the maximum potential data loss?

Accepted Answer

33 hours (data since Tuesday 01:00). Maximum potential data loss is determined by the interval between the last successful backup and the point of failure. In a differential backup scheme, each differential contains all changes since the last full backup. If the most recent differential backup fails or is unavailable, the last successful backup becomes the previous differential. Here, the backup schedule includes a full backup on Monday at 01:00 and differential backups every 12 hours starting Tuesday at 01:00 (i.e., Tuesday 01:00, Tuesday 13:00, Wednesday 01:00, etc.). To maximize potential data loss, we assume the most recent differential backup (Tuesday 13:00) is lost, so the last successful backup is the differential from Tuesday 01:00. If a failure occurs just before the next scheduled differential (Wednesday 10:00), the data loss spans from Tuesday 01:00 to Wednesday 10:00, which is 33 hours. This is the maximum possible data loss given the schedule. Answer C correctly identifies this.

Answer

9 hours (since Tuesday 01:00)

Answer

2 days (data since Monday)

Answer

1 day (data since last full backup)

Question 12

A multinational financial services organization operates three data centers in different geographic regions. Each data center runs a mix of critical and non-critical applications. The DR plan specifies Recovery Time Objectives (RTOs) ranging from 4 hours for critical applications to 72 hours for non-critical. During a scheduled DR test, the team attempts to fail over the primary customer database to the secondary site. The failover fails because the replication link between sites was saturated due to a large data synchronization job running concurrently. The test is declared a failure, and senior management is concerned about the DR plan's reliability. The IT director suggests increasing bandwidth between sites. The security architect proposes implementing network prioritization for replication traffic. The business continuity manager recommends revising the RTOs to be more realistic based on current bandwidth. The system administrator thinks the issue will resolve if the test is repeated during off-peak hours. Which of the following is the BEST course of action to address the root cause of the failure?

Accepted Answer

Implement Quality of Service (QoS) policies to prioritize database replication traffic over other data transfers.. The root cause is that the replication link was saturated by a large data synchronization job, which delayed the critical database replication traffic needed to meet the 4-hour RTO. Implementing Quality of Service (QoS) policies directly addresses this by prioritizing database replication traffic over other data transfers, ensuring that critical replication gets the necessary bandwidth even during concurrent large jobs. This is the most effective solution because it resolves the contention without requiring additional bandwidth or changing RTOs.

Answer

Increase the bandwidth on the replication link by ordering a faster circuit from the ISP.

Answer

Reschedule the next DR test to occur during a scheduled maintenance window with no other replication activity.

Answer

Revise the RTO for the customer database from 4 hours to 8 hours to account for current bandwidth limitations.

Question 13

Which TWO of the following are components of the identification and authentication process? (Select TWO.)

Accepted Answer

Password. Identification claims an identity; authentication proves it.

Answer

Group policy

Answer

Access control list (ACL)

Answer

Role-based access control (RBAC)

Question 14

Which THREE of the following are considered fundamental security principles? (Select three).

Accepted Answer

Separation of duties. Separation of duties is a fundamental security principle that prevents any single individual from having excessive control over critical processes by dividing responsibilities among multiple people. This reduces the risk of fraud, error, or abuse, as collusion would be required to bypass controls. It is a core concept in access control models and compliance frameworks like SOX and PCI DSS.

Answer

Single sign-on

Answer

Hashing

Question 15

A company classifies its data into four categories: Public, Internal, Confidential, and Restricted. Which classification requires the highest level of protection?

Accepted Answer

Restricted. Restricted is the highest classification, often equated with top secret, requiring stringent controls.

Answer

Internal

Answer

Public

Answer

Confidential

Question 16

A security team is designing a visitor management policy. Which TWO of the following are essential components? (Select TWO.)

Accepted Answer

Requiring an escort for visitors. Visitor sign-in and escort policy are core to visitor management.

Answer

Requiring visitors to provide a biometric scan

Answer

Performing background checks on all visitors

Answer

Issuing temporary visitor badges

Question 17

You are a SOC analyst for a financial institution. At 2:00 AM, your SIEM generates a critical alert from the email security gateway indicating that an internal user received a phishing email with a malicious attachment. The email was delivered to the user's inbox, and the user's account activity logs show that the attachment was opened 10 minutes ago. The user is a junior accountant who works in the accounts payable department. You have access to endpoint detection tools, email logs, and network traffic data. The organization's incident response policy requires containment within 30 minutes of detection. Which action should you take FIRST?

Accepted Answer

Isolate the user's workstation from the network to prevent lateral movement.. The incident response policy requires containment within 30 minutes. Isolating the workstation (e.g., via network access control or disabling the switch port) immediately stops any ongoing malicious activity, such as command-and-control communication or lateral movement, which is the highest priority after detection. This aligns with the NIST SP 800-61 containment strategy and the SANS PICERL model, where containment precedes eradication and recovery.

Answer

Scan the user's workstation with antivirus software.

Answer

Block the sender's email address at the email gateway.

Answer

Send an email to the user instructing them to delete the email.

Question 18

During a disaster recovery exercise, the team discovers that the backup site does not have the latest security patches applied. Which of the following steps should be taken FIRST?

Accepted Answer

Document the finding and assess risk. The first step in any incident or exercise finding is to document the issue and assess the risk it poses. Patching the backup site immediately (Option A) could introduce instability or conflicts with the current exercise, while shutting it down (Option B) would disrupt the DR test. By documenting and assessing risk first, the team can determine the appropriate remediation priority based on the backup site's role and the criticality of the missing patches.

Answer

Patch the backup site immediately

Answer

Shut down the backup site

Answer

Continue the exercise and note the issue

Question 19

What is the primary goal of data classification?

Accepted Answer

To determine the appropriate level of security controls. Data classification assigns sensitivity labels to enable appropriate protection.

Answer

To improve data access speed

Answer

To comply with marketing requirements

Answer

To reduce storage costs

Question 20

A company implements a new firewall and intrusion detection system to reduce the risk of network breaches. This is an example of:

Accepted Answer

Risk mitigation. Risk mitigation involves implementing controls to reduce the likelihood or impact of a risk.

Answer

Risk avoidance

Answer

Risk acceptance

Answer

Risk transfer