ISC2 CC Practice Exam 54 — 20 Questions

Question 1

Refer to the exhibit. A network administrator configured the following firewall rules. After implementation, users from the internal network cannot browse the internet. Which element is causing the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The rule order. The issue is the rule order. Firewall rules are processed sequentially from top to bottom. Rule id=20 denies all traffic from the internal network, and it appears before rule id=30 which permits HTTP/HTTPS. Because rules are evaluated in order, the deny rule (id=20) matches first and blocks all internet-bound traffic before the permit rule (id=30) is reached. Therefore, the correct answer is D: the rule order is causing the problem.

Answer

Rule id=30

Answer

Rule id=10

Answer

Rule id=20

Question 2

Which THREE are recommended practices for password policies according to current guidelines?

Accepted Answer

Check passwords against lists of known breached passwords. Current guidelines recommend long passwords, breach checking, and avoiding frequent changes.

Answer

Require at least one uppercase letter, one number, and one special character

Answer

Force password changes every 30 days

Question 3

A company's backup strategy requires daily full backups of all servers. The backup window is 4 hours. What is the primary risk if backups consistently take longer than the window?

Accepted Answer

Backups may interfere with production operations. When backups consistently exceed the 4-hour window, they overlap with production hours, causing resource contention (CPU, I/O, network bandwidth) that degrades application performance and user experience. This directly risks production operations, as backup jobs compete with live workloads for system resources.

Answer

Compliance requirements may be violated

Answer

Backup media may fill up

Answer

Backups may be corrupted

Question 4

A company implements a policy that after an employee leaves, their account must be disabled within 24 hours. Which principle is this policy primarily intended to support?

Accepted Answer

Accountability. Correct: D - Accountability. Disabling accounts ensures that actions are traceable to active employees, preventing unauthorized use and maintaining accountability. Option A (Availability) is about ensuring systems are accessible; Option B (Integrity) is about data accuracy; Option C (Confidentiality) is about data secrecy.

Answer

Availability

Answer

Integrity

Answer

Confidentiality

Question 5

A company's security policy requires that all data at rest be encrypted. Which of the following is the BEST approach to ensure compliance while maintaining performance?

Accepted Answer

Deploy full disk encryption on all endpoints and servers.. Full disk encryption (FDE) encrypts the entire storage volume, including the operating system, applications, and all data at rest, ensuring compliance with a policy requiring all data at rest to be encrypted. FDE operates at the block level, typically using AES-256, with minimal performance overhead because encryption and decryption are handled by the disk controller or CPU with hardware acceleration (e.g., AES-NI), making it the best approach for maintaining performance while meeting the broad requirement.

Answer

Use database encryption to protect sensitive data.

Answer

Apply network encryption using TLS for all data transfers.

Answer

Implement file-level encryption for sensitive files only.

Question 6

A company's primary data center experiences a complete power failure, and operations are shifted to a secondary site. The failover process takes 4 hours, but the recovery point objective (RPO) is set to 1 hour. Which of the following is the most likely consequence of this incident?

Accepted Answer

Data loss of up to 3 hours occurred.. The RPO of 1 hour means the company can tolerate losing up to 1 hour of data. Since the failover took 4 hours, any data written in the 3 hours before the power failure that had not yet been replicated to the secondary site would be lost. This results in a data loss window of up to 3 hours, exceeding the RPO.

Answer

The failover process was unsuccessful.

Answer

No data loss occurred because the secondary site was available.

Answer

The recovery time objective (RTO) was not met.

Question 7

A system administrator is configuring account lockout policies to mitigate brute-force attacks. Which TWO settings are most critical for this purpose?

Accepted Answer

Account lockout threshold (e.g., 5 failed attempts). Account lockout policies typically include an attempt threshold (e.g., 3-10 failed attempts) and a lockout duration or manual unlock requirement to prevent continuous brute-force attempts. These settings directly limit an attacker's ability to guess passwords.

Answer

Requiring password changes every 90 days

Answer

Password history of 10 remembered passwords

Answer

Password minimum length of 8 characters

Question 8

After a ransomware attack, which team is primarily responsible for coordinating the response?

Accepted Answer

Incident Response Team. The Incident Response Team (IRT) is primarily responsible for coordinating the response to a ransomware attack because it follows a predefined incident response plan (IRP) that includes containment, eradication, and recovery procedures. The IRT typically includes security analysts, forensic experts, and system administrators who execute technical steps such as isolating affected systems, analyzing the ransomware strain, and restoring from backups. This team operates under the NIST SP 800-61 framework, ensuring a structured and rapid response to minimize damage.

Answer

Executive Management

Answer

IT Support

Answer

Legal Department

Question 9

An organization requires that two separate administrators approve and implement changes to firewall rules. This practice enforces which security principle?

Accepted Answer

Separation of duties. Requiring two separate administrators to approve and implement firewall rule changes enforces separation of duties. This principle ensures that no single individual has the authority to both authorize and execute a change, reducing the risk of unauthorized modifications or errors. In firewall management, this prevents a single admin from introducing malicious or misconfigured rules without oversight.

Answer

Least privilege

Answer

Defense in depth

Answer

Need to know

Question 10

A security analyst is reviewing logs and finds that a user accessed files outside of their department. The user claims it was necessary for a project. Which principle should the analyst use to assess whether this was appropriate?

Accepted Answer

Need to know. The 'need to know' principle restricts access to information based on the specific requirements of a user's role or project. In this scenario, the analyst must verify if the user's project actually required access to those specific files, not just if the user had the technical ability to access them. This principle is a subset of least privilege, focusing on data access rather than system permissions.

Answer

Accountability

Answer

Separation of duties

Answer

Least privilege

Question 11

Your organization runs a critical e-commerce platform on a private cloud. The database server is located in a data center in a seismic zone. The current DR plan uses a warm site with daily differential backups and a 12-hour RTO. A recent earthquake caused a power outage but no physical damage. The database corruption was discovered after 6 hours. The backups from last night are intact but restoring involves applying transaction logs. The RTO is now at risk. What should be done FIRST?

Accepted Answer

Initiate the warm site recovery by restoring the latest differential backup onto standby servers.. The immediate priority is to restore the latest differential backup onto the warm site's standby servers. This approach minimizes recovery time by applying only the changes since the last full backup, directly addressing the RTO risk. The warm site is already prepared, and restoring the differential backup is the fastest path to operational readiness without the overhead of full backup restoration or log replay.

Answer

Fail over to the warm site immediately without data restoration.

Answer

Perform a point-in-time recovery using the last full backup and all transaction logs.

Answer

Restore the last full backup and then apply all subsequent differential and log backups.

Question 12

A security professional is asked to ensure that a document has not been altered since it was signed. Which technology best supports this requirement?

Accepted Answer

Digital signature. Digital signatures provide integrity and non-repudiation.

Answer

Symmetric encryption

Answer

Access control list

Answer

Hashing

Question 13

An organization wants to implement network segmentation to improve security. Which three methods are commonly used for network segmentation? (Select THREE.)

Accepted Answer

Subnetting. VLANs, subnets, and DMZs are common segmentation methods. Firewalls enforce rules but are not segmentation methods themselves; IDS is a monitoring tool.

Answer

Firewalls

Answer

Intrusion Detection Systems

Question 14

A system administrator configured the sudoers file as shown. What is the primary security risk of this configuration?

Accepted Answer

It removes the password requirement for sudo, weakening authentication for privileged access. The '!authenticate' directive in the sudoers file removes the password requirement for members of the admin group when executing sudo commands. This weakens authentication for privileged access, making it the primary security risk. Option A is incorrect because the configuration only affects the admin group, not all users. Option B is incorrect because the configuration does not enable logging; rather it disables authentication. Option D, while factually describing the configuration, does not directly address the primary security risk of weakened authentication; the core issue is the removal of password verification, which is exactly what option C states.

Answer

It enables privilege escalation for all users on the system

Answer

It logs all commands run by admin users, creating a privacy risk

Answer

It allows any user in the admin group to run commands as any user without a password

Question 15

Refer to the exhibit. Based on the backup log, what is the most likely corrective action?

Accepted Answer

Add more storage space to the backup target. The final error indicates insufficient storage space. Adding more storage space to the backup target would resolve the issue. The earlier tape error may be a symptom of full storage.

Answer

Reschedule the backup for a later time

Answer

Check network connectivity

Answer

Replace the tape drive

Question 16

A healthcare organization experiences a ransomware attack that encrypts all files on file servers and workstations. The incident response team has isolated the infected systems. The backup policy includes daily incremental backups and weekly full backups stored on a separate network segment. The most recent full backup is 5 days old. The incremental backups from the past 4 days are available but are stored on the same backup server that might be compromised. To restore data with minimal loss, what should the team do?

Accepted Answer

First verify the integrity of the backups by scanning them on an isolated system, then restore the full backup and apply the most recent clean incremental backups.. The first step should be to verify the integrity of the backups by scanning them on an isolated system, because the backup server might be compromised. If the backups are clean, restore the full backup (5 days old) and then apply the most recent clean incremental backups from the past 4 days. This minimizes data loss while ensuring no ransomware is reintroduced. Option A is risky because if the incremental backup contains ransomware, restoring it directly would reinfect systems. Option B rebuilds from scratch and would lose all data changes from the past 5 days, which is more drastic than necessary. Option D assumes all incremental backups are safe without verification and incorrectly includes 5 days of increments when only 4 are available (the most recent full backup is 5 days old, so increments cover days 1-4).

Answer

Use the most recent incremental backup to restore files directly.

Answer

Assume all backups are compromised and rebuild systems from scratch.

Answer

Restore the weekly full backup and then apply all incremental backups from the past 5 days.

Question 17

An organization stores backup data on a tape drive (onsite) and also replicates critical data to a cloud storage service. This practice best exemplifies which backup rule?

Accepted Answer

3-2-1 backup rule. The 3-2-1 rule requires at least three copies of data (the original plus two backups), stored on two different media types, with one copy kept offsite. In this scenario, the original live data serves as the first copy, the tape backup (onsite) is the second copy on a different medium, and the cloud backup (offsite) is the third copy on another medium, satisfying the rule.

Answer

Incremental backup strategy

Answer

Differential backup strategy

Answer

Full backup strategy

Question 18

A network technician is setting up a remote access VPN for employees using IPsec. The company's firewall is configured to allow IPsec traffic. Employees report that they can successfully establish the VPN connection (tunnel appears up), but they cannot ping or access any internal resources (e.g., file servers). The firewall logs show that packets from the VPN client IP addresses are being dropped at the firewall interface. Which of the following is the MOST likely cause of this issue?

Accepted Answer

The firewall's access control list does not permit traffic from the VPN subnet to the internal network.. The VPN tunnel is established, meaning Phase 1 and Phase 2 of IPsec are complete and the client has a valid IP from the pool. However, packets from the VPN subnet are being dropped at the firewall interface, which indicates that the firewall's access control list (ACL) does not include a permit statement for traffic sourced from the VPN client subnet destined to the internal network. Without this ACL entry, the firewall will drop the traffic even though the tunnel is up.

Answer

The VPN client is not assigned a correct IP address from the pool.

Answer

The firewall's intrusion prevention system is blocking the traffic.

Answer

The IPsec encryption algorithm is incompatible between client and firewall.

Question 19

A security analyst reviews this firewall log entry. What type of activity is most likely being attempted?

Accepted Answer

A potential SMB exploitation attempt from an external host.. The log shows a TCP SYN packet from a high source port to destination port 445 (SMB), commonly used in ransomware attacks like EternalBlue.

Answer

A legitimate SMB file sharing connection from an internal client.

Answer

A port scan attempt on port 445.

Answer

An outbound connection to an SMB server.

Question 20

An organization adopts the 3-2-1 backup rule. Which combination of backups satisfies this rule?

Accepted Answer

Primary storage, backup server (disk), and cloud storage. 3-2-1 rule: 3 copies of data, on 2 different media types, 1 offsite. Option D meets all: 3 copies (primary, backup server disk, cloud), 2 media (disk and cloud), 1 offsite (cloud).

Answer

Primary storage and one tape backup stored offsite

Answer

Primary storage and two tape backups in the same room

Answer

Primary storage, backup server (disk), and a second backup server (disk) in the same building