ISC2 CC Practice Exam 54 — 20 Questions

Question 1

An organization wants to implement a system that enforces access decisions based on a user's attributes (e.g., department, clearance, time) and environmental conditions. Which model is best?

Accepted Answer

Attribute-based access control (ABAC). Attribute-based access control (ABAC) is the correct model because it evaluates access decisions based on a combination of user attributes (e.g., department, clearance), resource attributes, and environmental conditions (e.g., time of day, location). Unlike RBAC, which relies solely on predefined roles, ABAC uses policies that can incorporate dynamic factors like current time or threat level, making it ideal for fine-grained, context-aware enforcement.

Answer

Role-based access control (RBAC)

Answer

Discretionary access control (DAC)

Answer

Mandatory access control (MAC)

Question 2

A hospital uses role-based access control (RBAC) for its electronic health records. Nurses can view patient records; doctors can view and edit; administrators can only view administrative data. Recently, a nurse was able to edit a patient's record, which should only be allowed for doctors. The investigation finds that the nurse's role was incorrectly assigned a 'doctor' role due to a misconfiguration. To prevent recurrence, the access control system should be reviewed. Which is the best long-term solution?

Accepted Answer

Conduct quarterly role reviews and recertification. The root cause is a role misconfiguration, and the best long-term solution is to implement a process of periodic role reviews and recertification. This ensures that role assignments are regularly audited and validated against current job responsibilities, preventing role creep and unauthorized privilege accumulation. In RBAC, the principle of least privilege is maintained through ongoing governance, not through a one-time fix.

Answer

Implement mandatory access control (MAC) with security labels

Answer

Remove the nurse's ability to edit records

Answer

Implement user behavior analytics to detect anomalies

Question 3

During a disaster recovery exercise, the system fails to achieve the RTO. Analysis shows that restoring the database from tape takes 3 hours, but the RTO is 2 hours. Which is the most effective solution?

Accepted Answer

Implement a hot standby database replica. The RTO (Recovery Time Objective) is a business requirement that cannot be changed by simply adjusting the backup method. A hot standby database replica (e.g., using synchronous replication or Oracle Data Guard) provides near-instant failover, reducing recovery time to minutes, which directly meets the 2-hour RTO. This solution addresses the root cause—the restore process is too slow—by eliminating the need to restore from backup entirely.

Answer

Use differential instead of full backups

Answer

Switch from tape to disk-based backups

Answer

Increase the RTO to 3 hours

Question 4

Which of the following is considered sensitive personally identifiable information (PII)?

Accepted Answer

Medical records. Medical records are classified as sensitive PII because they contain protected health information (PHI) that, if disclosed, can cause significant harm such as discrimination, identity theft, or privacy violations. Regulations like HIPAA and GDPR treat health data as a special category requiring stricter safeguards than ordinary identifiers. Date of birth, telephone number, and email address are direct identifiers but are not inherently sensitive on their own.

Answer

Date of birth

Answer

Telephone number

Answer

Email address

Question 5

After a ransomware attack, which team is primarily responsible for coordinating the response?

Accepted Answer

Incident Response Team. The Incident Response Team (IRT) is primarily responsible for coordinating the response to a ransomware attack because it follows a predefined incident response plan (IRP) that includes containment, eradication, and recovery procedures. The IRT typically includes security analysts, forensic experts, and system administrators who execute technical steps such as isolating affected systems, analyzing the ransomware strain, and restoring from backups. This team operates under the NIST SP 800-61 framework, ensuring a structured and rapid response to minimize damage.

Answer

Executive Management

Answer

IT Support

Answer

Legal Department

Question 6

Which statement best describes a warm site in disaster recovery?

Accepted Answer

It has hardware and network equipment but requires data restoration from backups. A warm site is a middle-ground disaster recovery option that has hardware and network infrastructure pre-installed but does not have live, synchronized data. Instead, data must be restored from backups (e.g., tape or disk snapshots) before operations can resume. This contrasts with a hot site, which maintains real-time data replication and fully active systems.

Answer

It has replicated data but no active systems

Answer

It is fully operational with real-time data synchronization

Answer

It has no hardware or infrastructure installed

Question 7

A system administrator needs to grant a contractor temporary access to a server for patching. The contractor should only have access during the patching window. Which access control implementation method is most appropriate?

Accepted Answer

Time-based ACL (rule-based access control). Time-based ACLs (rule-based access control) allow the administrator to define a specific time range during which the contractor's access is permitted. This directly matches the requirement for temporary access only during the patching window, as the ACL can be configured with a time-range object that automatically enables and disables the permit statement without manual intervention.

Answer

Group-based permissions with a recurring schedule

Answer

Discretionary access control (DAC)

Answer

Mandatory access control (MAC)

Question 8

During a disaster recovery exercise, the backup systems are not available because the storage array failed. Which of the following should be done FIRST?

Accepted Answer

Activate the disaster recovery plan. When backup systems are unavailable due to a storage array failure, the first action must be to activate the disaster recovery plan (DRP). The DRP is the predefined, documented set of procedures that guides the organization through the recovery process, including escalation, communication, and alternative recovery methods. Without activating the plan, subsequent steps like contacting vendors or restoring from tape lack coordination and may violate recovery time objectives (RTOs) and recovery point objectives (RPOs).

Answer

Contact the vendor

Answer

Restore from offsite tape

Answer

Order replacement hardware

Question 9

A medium-sized company uses a SIEM solution to collect logs from firewalls, servers, and endpoints. The security team receives an alert indicating a possible data exfiltration: an employee's workstation is sending large amounts of data to an external IP address outside business hours. The employee works in the finance department and has access to sensitive financial records. The SIEM shows the connection is ongoing. The security team must respond immediately to contain the incident while preserving evidence. The company's incident response plan designates the security team as first responders. Which of the following is the BEST first action?

Accepted Answer

Block the external IP address at the firewall and disconnect the workstation from the network.. The best first action because it immediately stops the ongoing data exfiltration and isolates the system, containing the incident and preserving evidence. Option B delays containment, Option C may alert a potential insider threat, and Option D should be performed after containment to avoid further data loss.

Answer

Notify the employee's manager and wait for further instructions.

Answer

Call the employee to ask if they are transferring files for a legitimate business purpose.

Answer

Take a forensic image of the workstation's hard drive before anything else.

Question 10

After a major power outage, an organization needs to declare a disaster and activate its DRP. Which THREE elements should be included in the initial crisis communication?

Accepted Answer

A statement that a disaster has been declared. Option A is correct because the initial crisis communication must explicitly state that a disaster has been declared, which formally triggers the DRP and informs stakeholders that recovery procedures are now in effect. Option C is correct because providing contact information for the incident response team ensures that responders and key personnel can be reached immediately to coordinate recovery activities. Option D is correct because instructing employees to work remotely helps maintain business continuity and safety by directing staff away from potentially affected facilities. Option B is not included because details of the exploited vulnerability are typically investigated and disclosed later by security or forensic teams, not in the initial crisis notification. Option E is also not included because naming affected customers raises privacy and legal concerns and is not part of the immediate internal crisis communication.

Answer

Details of the vulnerability exploited

Answer

Names of affected customers

Question 11

An organization deploys a network security device that inspects application-layer payloads, can block malicious HTTP requests, and uses OWASP rules. Which type of device is this?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) operates at Layer 7, inspects HTTP/HTTPS payloads, blocks malicious requests such as SQL injection and XSS, and commonly uses rule sets like the OWASP ModSecurity Core Rule Set. The question's emphasis on application-layer payload inspection, HTTP request blocking, and OWASP rules maps directly to WAF capabilities. WAFs are typically deployed in front of web servers or via cloud services (AWS WAF, Cloud Armor, Azure WAF).

Answer

Intrusion Detection System (IDS)

Answer

Next-Generation Firewall (NGFW)

Answer

Intrusion Prevention System (IPS)

Question 12

A security analyst is investigating a potential DDoS attack. Which of the following are common indicators of a DDoS? (Choose TWO)

Accepted Answer

Unusually high traffic volume from multiple IP addresses. Option B is correct because a DDoS (Distributed Denial-of-Service) attack by definition originates from many compromised hosts (a botnet), so the analyst would observe an unusually high volume of traffic arriving from numerous, often geographically dispersed IP addresses. Option D is correct because the flood of requests exhausts server, bandwidth, or connection-table resources, which manifests as slow network performance, increased latency, timeouts, and unresponsive services for legitimate users. Option A is wrong because a DDoS typically drives CPU, memory, and bandwidth utilization up, not down. Option C is wrong because traffic from a single source describes a DoS attack, not a distributed one. Option E is wrong because DNS query volume usually spikes during many DDoS attacks (e.g., DNS amplification/reflection) rather than decreasing.

Answer

Low CPU usage on servers

Answer

Single source sending many packets

Answer

Decrease in DNS queries

Question 13

A security analyst is deploying network security devices. Which TWO of the following are characteristics of an Intrusion Detection System (IDS)?

Accepted Answer

Operates in passive mode by monitoring a copy of traffic. Option B is correct because an IDS is fundamentally a passive monitoring technology: it receives a copy of the traffic (typically via a SPAN/mirror port or a network TAP) and analyzes it without sitting in the forwarding path, so it cannot drop packets. Option E is correct because the core function of an IDS is to detect suspicious or malicious activity and generate alerts (e.g., via signatures or anomaly detection) for analysts to investigate. Option A is wrong because inline blocking is characteristic of an IPS, not an IDS. Option C is wrong because an IDS does not automatically modify firewall rules; that would require integration with a firewall or an IPS/automated response system. Option D is wrong because no detection system guarantees zero false positives; IDS products inherently produce some false positives and false negatives.

Answer

Can be placed inline to block malicious traffic

Answer

Can automatically reconfigure firewall rules

Answer

Ensures zero false positives

Question 14

Which TWO of the following are examples of preventive security controls?

Accepted Answer

Antivirus software. Antivirus software (C) is a preventive control because it actively blocks, quarantines, or removes malicious code before it can execute or spread, stopping an incident from occurring. A firewall (D) is likewise preventive: it enforces ACL rules on ports, protocols, and IP addresses to deny unauthorized traffic at the network perimeter before it reaches protected hosts. By contrast, encryption (A) is primarily a protective/confidentiality mechanism that renders data unreadable rather than stopping an event, backup (B) is a corrective/recovery control used after data loss, and an intrusion detection system (E) is a detective control that only alerts on suspicious activity rather than blocking it.

Answer

Encryption

Answer

Backup

Answer

Intrusion detection system

Question 15

An organization classifies data as 'Confidential' and requires encryption both at rest and in transit. Which data classification level best fits this requirement?

Accepted Answer

Confidential. Confidential data typically requires strong protection like encryption; restricted/top secret may require even higher controls.

Answer

Restricted/Top Secret

Answer

Internal/Private

Answer

Public

Question 16

Which TWO of the following are core components of the CIA triad?

Accepted Answer

Confidentiality. The CIA triad is the foundational information security model consisting of Confidentiality, Integrity, and Availability, so option C (Confidentiality) is correct because it ensures data is disclosed only to authorized parties through mechanisms such as encryption, access controls, and classification. Option E (Availability) is also correct because it ensures systems and data are accessible to authorized users when needed, supported by controls like redundancy, backups, and DDoS mitigation. The unmarked options do not belong because Authentication (A), Authorization (D), and Non-repudiation (B) are distinct security services and principles that support or extend beyond the CIA triad rather than being its core components.

Answer

Authentication

Answer

Non-repudiation

Answer

Authorization

Question 17

An organization experiences a denial-of-service (DoS) attack. Which TWO actions should the incident response team take during the containment phase? (Select two.)

Accepted Answer

Disconnect affected servers from the network. Option A is correct because disconnecting the affected servers from the network immediately stops the flood of attack traffic from reaching those hosts, preventing further resource exhaustion and limiting the blast radius during containment. Option B is correct because filtering malicious traffic at the firewall (e.g., blocking offending source IPs, rate-limiting, or applying ACLs) mitigates the DoS at the network perimeter while keeping legitimate services reachable, which is a standard containment technique. Option C is not a containment action; restoring from backup is part of eradication and recovery, performed after the threat is removed. Option D is not a containment step; notifying law enforcement is an external communication/coordination activity that may occur later. Option E is not containment; root cause analysis is a post-incident activity conducted after the incident is resolved.

Answer

Restore systems from backup

Answer

Notify law enforcement

Answer

Conduct a root cause analysis

Question 18

An organization is implementing a security baseline for new servers. Which THREE components are typically included in a hardened baseline configuration? (Choose three.)

Accepted Answer

Disabling unnecessary services and ports.. Option B is correct because a hardened baseline minimizes the attack surface by disabling unnecessary services and closing unused ports, reducing the number of exploitable entry points on a new server. Option D is correct because enforcing strong password policies (for example, minimum length, complexity, and expiration requirements) strengthens authentication and mitigates brute-force and credential-guessing attacks. Option E is correct because installing all available security patches ensures known vulnerabilities in the OS and applications are remediated before the server is placed into production. Option A does not belong because allowing RDP from any IP address exposes the server to unauthorized remote access and should instead be restricted to trusted management networks. Option C does not belong because automatic login for administrators bypasses authentication entirely, directly undermining the purpose of a security baseline.

Answer

Allowing remote desktop access from any IP address.

Answer

Enabling automatic login for administrators.

Question 19

An organization wants to implement defense in depth for its server room. Which THREE controls should be included?

Accepted Answer

Cable locks on all servers. A is correct because cable locks are a physical (environmental) control that deters and prevents theft or removal of server hardware, directly supporting defense in depth at the server-room layer. D is correct because CCTV monitoring provides detective and deterrent physical security, recording activity inside the server room so incidents can be identified and investigated. E is correct because biometric access control on the server room door enforces strong, identity-based physical access control (something you are), restricting entry to authorized personnel. B does not belong because Group Policy password complexity is a logical/technical control for user authentication, not a server-room physical control. C does not belong because a visitor sign-in log at the front desk is an administrative control for the building entrance, not a control protecting the server room itself.

Answer

Group Policy to enforce password complexity

Answer

Visitor sign-in log at the front desk

Question 20

A security architect is designing an access control policy based on the principle of need-to-know. Which TWO practices support this principle? (Select TWO.)

Accepted Answer

Implementing data classification labels. Option A is correct because implementing data classification labels (e.g., Public, Internal, Confidential, Restricted) tags information with its sensitivity level, which is the foundation for need-to-know decisions—users are only granted access to data whose classification matches their role and clearance. Option E is correct because restricting customer data access to only customer support staff is a direct application of need-to-know: access is limited to those whose job function requires that data, excluding other employees. Option B (single sign-on) is an authentication convenience that centralizes login but does not by itself limit access to only what a user needs. Option C (two-factor authentication) strengthens identity verification but addresses authentication assurance, not authorization scope. Option D (granting all employees access to the company directory) violates need-to-know by giving broad access regardless of job requirement.

Answer

Using a single sign-on solution

Answer

Requiring two-factor authentication

Answer

Granting all employees access to the company directory