ISC2 CC Practice Exam 55 — 20 Questions

Question 1

An organization wants to implement multi-factor authentication for remote access. Which TWO of the following would provide multi-factor authentication? (Select TWO)

Accepted Answer

Password and SMS one-time code. Multi-factor authentication requires combining at least two different factors: something you know (knowledge), something you have (possession), or something you are (inherence). Option C (Password + SMS one-time code) combines knowledge (password) and possession (SMS code sent to a device). Option D (Smart card + PIN) combines possession (smart card) and knowledge (PIN). Option A (Fingerprint + iris scan) is two inherence factors, not multi-factor. Option B (Password + security questions) is two knowledge factors. Option E (Two different passwords) is also two knowledge factors.

Answer

Fingerprint and iris scan

Answer

Password and security questions

Answer

Two different passwords

Question 2

Which TWO of the following are common methods to authenticate users on a wireless network? (Select TWO)

Accepted Answer

WPA3-SAE. WPA3-SAE (Simultaneous Authentication of Equals) is a common method to authenticate users on a wireless network because it replaces the pre-shared key (PSK) exchange with a secure password-based authentication protocol that is resistant to offline dictionary attacks. It uses a Diffie-Hellman key exchange combined with a shared password to derive a Pairwise Master Key (PMK), ensuring forward secrecy and mutual authentication.

Answer

WEP

Answer

WPA2-PSK

Answer

MAC address filtering

Question 3

A system administrator notices that a user has been granted read and write permissions to a folder but should only have read access. Which type of access control issue does this represent?

Accepted Answer

Excessive permissions. Excessive permissions occur when a user or group is granted more privileges than necessary for their role. In this scenario, the user has read and write access to a folder but should only have read access, meaning the write permission is unnecessary and violates the principle of least privilege. This is a classic example of excessive permissions, as the user has been over-provisioned beyond their job requirements.

Answer

Segregation of duties conflict

Answer

Authorization creep

Answer

Incomplete revocation

Question 4

Refer to the exhibit. An administrator needs to restore a database file from two weeks ago, but the backup log shows success. What is the most likely reason the file cannot be restored?

Accepted Answer

The backup source did not include that file. The backup log only records the success or failure of the backup job as a whole, not the inclusion of every individual file. If the database file was not selected in the backup source configuration (e.g., a file-level backup job that excluded the database directory or a volume shadow copy that did not include the file), the backup would complete successfully without backing up that file. When the administrator attempts to restore, the file is missing from the backup set, even though the job log shows success.

Answer

The retention policy deleted it

Answer

The schedule was incorrect

Answer

The encryption key changed

Question 5

During an incident response, a forensics analyst captures a memory dump from a compromised server. The analyst needs to ensure the dump is not altered during analysis. Which practice best maintains integrity?

Accepted Answer

Generate a cryptographic hash of the dump before analysis. Creating a cryptographic hash (e.g., SHA-256) of the original dump and verifying it before and after analysis ensures integrity. Option D is correct. Option A (encryption) protects confidentiality, not integrity. Option B (chain of custody) documents handling but doesn't prevent alteration by itself. Option C (restrict access) is about access control, not integrity verification.

Answer

Encrypt the memory dump file

Answer

Maintain a chain of custody log

Answer

Restrict access to the dump to authorized personnel only

Question 6

Which THREE of the following are essential components of a security baseline configuration for a server?

Accepted Answer

Disable unnecessary services.. Disabling unnecessary services reduces the attack surface by removing potential entry points for exploitation. Services like Telnet, FTP, or unused web servers should be disabled via systemctl or service managers to prevent unauthorized access or privilege escalation.

Answer

Install all optional software for functionality.

Answer

Grant administrative rights to all users.

Question 7

A small manufacturing company's IT infrastructure consists of a single server running ERP and file services, with a nightly backup to an external hard drive. The server fails due to hardware failure. The company's BCP states that the ERP system must be restored within 8 hours. The backup is 12 hours old. The IT administrator has a spare server of similar configuration. What is the BEST course of action?

Accepted Answer

Install the backup onto the spare server and restore the data from the external hard drive.. The spare server has a similar configuration, allowing the IT administrator to install the backup software and restore the ERP system and file data from the external hard drive. This approach meets the 8-hour RTO by leveraging the existing backup, even though it is 12 hours old, as the restore process is straightforward and does not require ordering new hardware or migrating to a cloud platform.

Answer

Use cloud-based ERP temporarily.

Answer

Perform a bare-metal restore using the backup.

Answer

Order a new server from the vendor (lead time 3 days).

Question 8

A primary data center is destroyed. The disaster recovery plan calls for activation of a hot standby site. If the RTO is 2 hours, what is the expected recovery time?

Accepted Answer

Less than 2 hours. The RTO (Recovery Time Objective) defines the maximum acceptable downtime, not the guaranteed recovery time. A hot standby site is fully operational and synchronized, so recovery can be completed in less than the RTO if the disaster does not cause additional complications. Option D is correct because the expected recovery time should be less than the 2-hour RTO, assuming the hot site functions as designed.

Answer

Exactly 2 hours

Answer

More than 2 hours

Answer

Unknown, depends on the disaster

Question 9

Refer to the exhibit. What action did the firewall take on the traffic from 10.0.1.15 to 10.0.2.10?

Accepted Answer

Denied the traffic. The firewall denied the traffic from 10.0.1.15 to 10.0.2.10 because the access control list (ACL) or security policy explicitly denies the source IP 10.0.1.15, as shown in the exhibit. The firewall processes rules sequentially, and the first matching rule for this traffic is a deny entry, so the packet is dropped without further inspection or logging unless specified.

Answer

Logged and permitted

Answer

Permitted the traffic

Answer

Translated the source address

Question 10

Which TWO are key outputs of a Business Impact Analysis (BIA)?

Accepted Answer

List of critical business processes. BIA identifies critical business processes and determines their recovery requirements, such as Recovery Time Objectives (RTO).

Answer

Password policy

Answer

Network diagram

Answer

Risk register

Question 11

Which TWO actions are appropriate during the identification phase of incident response?

Accepted Answer

Correlate alerts from multiple sources.. During the identification phase of incident response, the goal is to detect and confirm that an incident is occurring. Correlating alerts from multiple sources (e.g., IDS/IPS logs, firewall logs, and endpoint detection) helps reduce false positives and provides a clearer picture of the attack chain. Reviewing system logs for anomalies is a core detection technique that can reveal indicators of compromise (IoCs) such as unusual process execution or failed login bursts.

Answer

Conduct a post-mortem analysis.

Answer

Restore data from backups.

Answer

Disconnect affected systems from the network.

Question 12

An organization experiences a ransomware attack that encrypts critical file servers. The backups are stored on a separate network segment but are also encrypted. The incident response team suspects the attacker compromised the backup system using stored credentials. Which best practice should have been implemented to prevent this?

Accepted Answer

Enable multi-factor authentication (MFA) on backup system access. Enabling multi-factor authentication (MFA) on backup system access would have prevented the attacker from using stored credentials to compromise the backup system. MFA requires an additional authentication factor beyond just a password or stored token, making credential theft or reuse insufficient for access. This directly addresses the attack vector described—stolen credentials—rather than relying solely on network segmentation or encryption.

Answer

Implement air-gapped backups stored offline

Answer

Encrypt backup data at rest and in transit

Answer

Use a separate VLAN for backup traffic

Question 13

An organization wants to ensure that all workstations are configured according to a hardened baseline. Which process detects when a workstation deviates from this baseline?

Accepted Answer

Automated configuration scanning. Configuration drift detection involves automated scanning that compares current configurations to the approved baseline and reports discrepancies.

Answer

Patch management

Answer

Change control

Answer

Security awareness training

Question 14

An organization is implementing a new identity management system. They want to ensure that users can only access resources necessary for their job roles. Which principle should guide the access control design?

Accepted Answer

Least privilege. The principle of least privilege dictates that users should be granted only the permissions necessary to perform their job functions and nothing more. In an identity management system, this is implemented by assigning minimal access rights to resources, reducing the attack surface and limiting potential damage from compromised accounts. This directly aligns with the scenario of ensuring users can only access resources essential for their roles.

Answer

Separation of duties

Answer

Need to know

Answer

Defense in depth

Question 15

A company is developing a business continuity plan (BCP). Which TWO of the following are essential components that must be included in a BCP?

Accepted Answer

Business Impact Analysis (BIA). A Business Impact Analysis (BIA) is essential in a BCP because it identifies critical business functions, their dependencies, and the impact of disruptions. It quantifies the financial and operational consequences of downtime, directly informing the selection of recovery strategies and resource allocation. Without a BIA, the BCP lacks a data-driven foundation for prioritizing recovery efforts.

Answer

Asset inventory

Answer

Vulnerability assessment

Answer

Network diagram

Question 16

Refer to the exhibit. Which statement best describes compliance with the recovery objectives?

Accepted Answer

Compliant with RTO but not RPO. The exhibit shows the required RTO is 4 hours and the actual RTO is 4 hours, meaning the system recovers within the allowed downtime, so it is compliant with RTO. However, the backup interval is 4 hours, so the actual RPO is 4 hours, which exceeds the required RPO of 1 hour. This means up to 4 hours of data could be lost, failing RPO compliance. Therefore, the correct answer is B.

Answer

Compliant with both RTO and RPO

Answer

Compliant with neither

Answer

Compliant with RPO but not RTO

Question 17

A company implements role-based access control (RBAC) to ensure users have only the permissions necessary for their job roles. This is an example of:

Accepted Answer

Least privilege. RBAC enforces least privilege by granting users only the permissions necessary for their roles. Option A is Least privilege, which limits permissions to the minimum required. Option B (Defense in depth) involves multiple layers of security. Option C (Separation of duties) divides critical tasks among different individuals. Option D (Need-to-know) restricts access to data based on necessity.

Answer

Defense in depth

Answer

Separation of duties

Answer

Need-to-know

Question 18

A system administrator needs to grant a user the ability to read files in a specific folder but not modify them. Which access control principle should be applied?

Accepted Answer

Least Privilege. The principle of Least Privilege dictates that a user should be granted only the minimum permissions necessary to perform their job functions. In this scenario, granting read-only access to a specific folder (e.g., using NTFS 'Read' permission or Linux 'r--' on the directory) ensures the user cannot modify files, directly applying Least Privilege. This prevents accidental or intentional data alteration while still allowing necessary access.

Answer

Role-Based Access Control (RBAC)

Answer

Separation of Duties (SoD)

Answer

Mandatory Access Control (MAC)

Question 19

Refer to the exhibit. A user from the Auditors group is unable to access the folder. What is the most likely cause?

Accepted Answer

A deny entry for Auditors overrides the allow. In NTFS permissions, a Deny entry explicitly blocks access and takes precedence over any Allow entries, regardless of the order in which they are applied. Since the user is a member of the Auditors group, the Deny entry for that group overrides any Allow permissions the user might have individually or through other group memberships. This is the most likely cause of the access failure.

Answer

The user is not a member of the Auditors group

Answer

The Auditors group has only read permission, which is insufficient

Answer

The folder is encrypted

Question 20

Refer to the exhibit. An analyst sees many alerts from this IDS rule. What is a likely cause?

Accepted Answer

The rule is poorly written generating false positives. The IDS rule is likely generating excessive alerts due to poor signature design, such as using overly broad content matches or lacking proper contextual filters. Without the 'flow' keyword to establish session state (e.g., 'to_server, established'), the rule may trigger on any packet containing the SQL pattern, including non-exploit traffic like error messages or benign queries, resulting in false positives.

Answer

A web application is vulnerable to SQL injection

Answer

An attacker is scanning for SQL injection

Answer

The rule is missing the "flow" keyword