ISC2 CC Practice Exam 55 — 20 Questions

Question 1

A security architect is designing controls to protect a data center. Which TWO of the following are examples of physical access controls? (Select TWO.)

Accepted Answer

Biometric reader on server room door. Option A (biometric reader on server room door) is correct because a biometric reader is a physical authentication mechanism that verifies a person's fingerprint, iris, or other biological trait before granting entry to the server room, making it a classic physical access control. Option B (cable locks on laptops) is correct because a cable lock is a physical restraint that tethers a laptop to a fixed object, deterring theft and unauthorized physical removal of the device. Option C (session timeout settings) is incorrect because it is a logical/technical control that terminates idle sessions, not a physical barrier. Option D (password complexity policy) is incorrect because it is an administrative/logical control governing credential strength. Option E (role-based access control) is incorrect because RBAC is a logical access control model that grants permissions based on job roles, not physical access.

Answer

Session timeout settings

Answer

Password complexity policy

Answer

Role-based access control (RBAC)

Question 2

A company's security policy requires that employees use only the minimum permissions needed to perform their job functions. This practice reduces the potential impact if an account is compromised. Which TWO access control principles are being applied?

Accepted Answer

Need-to-know. Option E, least privilege, is correct because the policy explicitly states that employees should be granted only the minimum permissions required to perform their job functions, which is the exact definition of the least privilege principle. Option D, need-to-know, is correct because it restricts access to information and resources only to those who require them for their job duties, complementing least privilege by limiting data exposure. Together, these principles reduce the attack surface and potential impact if an account is compromised. Option A, defense in depth, is not correct because it refers to layering multiple security controls rather than limiting permissions. Option B, separation of duties, is not correct because it involves dividing tasks among different individuals to prevent fraud or error, not minimizing permissions. Option C, privileged access management, is not correct because it focuses on managing and monitoring elevated accounts, not on the general principle of minimum permissions for all employees.

Answer

Defense in depth

Answer

Separation of duties

Answer

Privileged access management

Question 3

A network administrator is planning to segment the network. Which of the following are valid segmentation methods? (Choose TWO)

Accepted Answer

Subnetting. Subnetting (A) is a valid segmentation method because it divides a single IP address space into smaller logical networks using subnet masks, creating separate broadcast domains and controlling traffic flow between subnets via routing. VLANs (C) are also valid segmentation methods because they logically partition a physical switch into multiple isolated Layer 2 broadcast domains, typically defined by 802.1Q tagging, allowing separation of devices regardless of physical location. Firewalls (B) enforce security policy between zones but are access-control devices rather than a segmentation technique themselves. IDS (D) monitors and alerts on malicious traffic but does not segment the network, and honeypots (E) are decoy systems used for detection and research, not segmentation.

Answer

Firewalls

Answer

IDS

Answer

Honeypots

Question 4

An organization is implementing a visitor management policy. Which THREE should be included? (Select THREE.)

Accepted Answer

Issuance of temporary visitor badges. Option B (issuance of temporary visitor badges) is correct because a visitor management policy must provide a means of visually identifying non-employees, and temporary badges with expiration dates or distinct colors let staff distinguish visitors from employees and enforce access limits. Option C (visitor sign-in with host notification) is correct because logging each visitor's identity, time of entry, and purpose, then alerting the internal host, creates an audit trail and ensures visitors are expected and accounted for. Option D (escort policy requiring visitors to be accompanied) is correct because requiring visitors to remain with an authorized employee prevents unescorted access to sensitive areas and is a standard physical security control. Option A is not appropriate because background checks for all visitors are disproportionate and operationally impractical for routine guests such as delivery personnel or interview candidates. Option E is not appropriate because biometric authentication for visitors is costly, raises privacy and consent concerns, and is unnecessary when badges, sign-in, and escorts already provide adequate control.

Answer

Background checks for all visitors

Answer

Biometric authentication for visitors

Question 5

A security analyst is designing a multi-factor authentication system for remote access. Which TWO of the following combinations represent true multi-factor authentication? (Select TWO)

Accepted Answer

Fingerprint and password. Option B (fingerprint and password) is correct because it combines a biometric inherence factor (the fingerprint) with a knowledge factor (the password), satisfying true MFA by mixing two different factor categories. Option C (password and smart card) is correct because it pairs a knowledge factor (the password) with a possession factor (the smart card, something you have), which are distinct factor types. Option A (smart card and OTP token) is not true MFA because both are possession factors (something you have), even though they are different technologies. Option D (fingerprint and retina scan) is not true MFA because both are biometric inherence factors (something you are). Option E (password and PIN) is not true MFA because both are knowledge factors (something you know).

Answer

Smart card and OTP token

Answer

Fingerprint and retina scan

Answer

Password and PIN

Question 6

An employee claims to have accessed a confidential document that is not related to their job role. The security team investigates and finds that the employee's account had read access to the folder containing the document. Which TWO access control concepts were likely violated?

Accepted Answer

Need-to-know. The scenario describes an employee who could read a confidential document unrelated to their job role, which directly violates the need-to-know principle (B) because access to information should be granted only to those who require it to perform their duties. It also violates the principle of least privilege (D), since the account was granted read access to a folder beyond the minimum permissions necessary for the employee's role. Identification and authentication (A) is not violated because the employee's account was properly identified and authenticated; the issue is authorization, not proving identity. Separation of duties (C) is not implicated because no single individual was given control over multiple conflicting tasks or stages of a critical process. Defense in depth (E) is not violated because the scenario does not describe a failure of layered controls; it describes excessive permissions granted to an account.

Answer

Identification and authentication

Answer

Separation of duties

Answer

Defense in depth

Question 7

An organization experiences a data breach involving personally identifiable information (PII) of European Union residents. According to GDPR, which THREE of the following are required actions?

Accepted Answer

Document the breach, its effects, and the remedial actions taken.. Option A is correct because GDPR Article 33(5) requires the controller to document all personal data breaches, including the facts, effects, and remedial actions taken, so the supervisory authority can verify compliance. Option C is correct because GDPR Articles 33(1) and 34(1) require communication to affected data subjects without undue delay when the breach is likely to result in a high risk to their rights and freedoms. Option E is correct because GDPR Article 33(1) mandates notifying the relevant supervisory authority within 72 hours of becoming aware of the breach, unless it is unlikely to result in a risk. Option B is not a GDPR requirement; restoring from backup is a general recovery practice, not a breach-notification obligation. Option D is not required by GDPR; a BIA is a business continuity tool, whereas GDPR requires a Data Protection Impact Assessment (DPIA) in certain cases, not a BIA for breach response.

Answer

Restore all affected systems from the latest full backup.

Answer

Conduct a Business Impact Analysis (BIA) to determine the financial impact.

Question 8

A security auditor is reviewing access controls at a financial institution. The auditor identifies a scenario where one employee can initiate a payment transaction, and the same employee can also approve it. Which access control principle is being violated, and what is the primary risk?

Accepted Answer

Separation of duties; risk of fraud. Separation of duties requires that critical tasks be split among multiple people so no single individual can complete a sensitive transaction end-to-end. Here, one employee can both initiate and approve a payment, violating that principle and creating a direct fraud risk since they could authorize unauthorized payments. This is a classic internal-controls failure in financial environments.

Answer

Defense in depth; risk of single point of failure

Answer

Need-to-know; risk of data exposure

Answer

Least privilege; risk of excessive permissions

Answer

Privileged access management; risk of account compromise

Question 9

A security team is investigating a potential man-in-the-middle attack. Which TWO of the following are common techniques used in MITM attacks? (Select TWO.)

Accepted Answer

ARP poisoning. ARP poisoning (A) is a classic MITM technique: the attacker sends forged ARP replies to associate their MAC address with the IP of the default gateway (or another host), causing victim traffic to flow through the attacker, who can then intercept or modify it. Setting up a rogue Wi-Fi access point (D) is also a common MITM method, often called an evil twin attack, where victims connect to the attacker-controlled AP and all their traffic is relayed or captured by the attacker. The other options are denial-of-service or amplification attacks rather than interception techniques: a SYN flood (B) exhausts TCP connection state to deny service, DNS amplification (C) abuses open DNS resolvers to flood a target with large responses, and an ICMP flood (E) overwhelms a target with ping traffic — none of these position the attacker to intercept and relay traffic between two parties.

Answer

SYN flood

Answer

DNS amplification

Answer

ICMP flood

Question 10

A company is creating a backup strategy for its critical database. The database is updated continuously, and the company can tolerate up to 2 hours of data loss. Which TWO backup methods would best help achieve a recovery point objective (RPO) of 2 hours? (Select TWO.)

Accepted Answer

Hourly full backups. The RPO of 2 hours means backups must capture data at least every 2 hours, so option D (Hourly full backups) is correct because running a full backup every hour guarantees a maximum data loss of 1 hour, which is within the 2-hour RPO. Option E (Transaction log backups every 30 minutes) is also correct because transaction log backups capture all committed transactions since the last log backup, limiting potential data loss to 30 minutes, well inside the 2-hour RPO, and they are the standard method for continuous-update databases. Options A (Monthly full backups) and B (Weekly full backups) are far too infrequent, allowing up to a month or a week of data loss respectively, which violates the 2-hour RPO. Option C (Daily full backups) only captures data once every 24 hours, so up to 24 hours of updates could be lost, also exceeding the 2-hour RPO.

Answer

Monthly full backups

Answer

Weekly full backups

Answer

Daily full backups

Question 11

A security administrator is configuring a session timeout policy. Which of the following are valid reasons for implementing session timeouts? (Choose TWO.)

Accepted Answer

Limit the window for session hijacking attacks. Option B is correct because a session timeout limits the amount of time an attacker has to reuse a stolen session token or cookie, shrinking the window during which a session hijacking attack can succeed. Option E is correct because automatically terminating idle sessions locks out anyone who approaches an unattended workstation after the legitimate user has walked away, reducing the risk of unauthorized access. Option A is incorrect because password complexity is enforced by password policy settings, not by session timeouts. Option C is incorrect because single sign-on is provided by authentication federation technologies such as SAML, OAuth, or Kerberos, not by session expiration. Option D is incorrect because brute-force protection comes from account lockout thresholds, rate limiting, or CAPTCHA mechanisms, not from session timeouts.

Answer

Enforce password complexity requirements

Answer

Provide single sign-on functionality

Answer

Prevent brute-force attacks on passwords

Question 12

A company wants to implement defense in depth for its data center. Which THREE of the following controls should be included? (Select THREE.)

Accepted Answer

Requiring access badges to enter the building. Option A is correct because requiring access badges to enter the building is a physical (premises) access control that restricts who can reach the data center, forming the outermost layer of defense in depth. Option D is correct because encrypting data at rest protects stored data (e.g., AES-256 on disks or databases) so that even if physical or logical access is gained, the data remains unreadable. Option E is correct because fencing around the building is a perimeter physical control that deters and delays intrusion, complementing badge access as an additional defensive layer. Option B does not belong because SSO centralizes authentication and can actually reduce the number of independent barriers, and it is an identity convenience/control rather than a distinct defense-in-depth layer. Option C does not belong because a single firewall for all network traffic is a single point of failure and contradicts defense in depth, which requires multiple, diverse, and redundant controls.

Answer

Single sign-on (SSO) for all applications

Answer

Using a single firewall for all network traffic

Question 13

A security analyst is reviewing access control mechanisms. Which TWO of the following are examples of logical access controls? (Select two.)

Accepted Answer

Smart card authentication for system access. B is correct because smart card authentication is a logical (technical) access control that uses a credential and cryptographic verification to grant or deny access to systems and data. D is correct because a password policy enforcing complexity is a logical control that governs how users authenticate electronically, restricting access through technical rules. A is not correct because a security guard is a physical access control (personnel-based). C is not correct because bollards are physical barriers used to control vehicle access. E is not correct because a perimeter fence is a physical access control.

Answer

Security guard at entrance

Answer

Bollards at parking lot

Answer

Perimeter fence

Question 14

Which TWO of the following are recommended practices for managing privileged accounts? (Select TWO.)

Accepted Answer

Create a separate admin account for privileged tasks. Option A is correct because creating a separate admin account for privileged tasks enforces separation between a user's standard daily-use account and their elevated account, so routine activities like email and web browsing cannot be leveraged to compromise administrative rights, and it enables auditing of privileged actions to a distinct identity. Option D is correct because a Privileged Access Management (PAM) solution provides vaulting, credential rotation, session brokering, just-in-time elevation, and monitoring of privileged sessions, which are core controls for reducing standing administrative access and detecting misuse. Option B is not recommended because using one account for both daily work and administrative tasks grants excessive standing privilege and exposes admin credentials to everyday attack surfaces such as phishing and malicious websites. Option C is wrong because disabling logging for admin activities destroys the audit trail needed for accountability, incident response, and compliance, and the overhead is not a valid reason to eliminate it. Option E is wrong because sharing admin passwords among team members eliminates individual accountability, prevents effective credential rotation, and violates the principle of least privilege and non-repudiation.

Answer

Use the same account for daily work and administrative tasks

Answer

Disable logging for admin activities to reduce overhead

Answer

Share admin passwords among team members for convenience

Question 15

A network administrator is implementing a DMZ to host a web server and an email server. Which THREE security best practices should be followed? (Select THREE)

Accepted Answer

Place only public-facing servers (e.g., web, email) in the DMZ.. Option A is correct because a DMZ is specifically designed to host public-facing services such as web and email servers, isolating them from the trusted internal network so that a compromise of these exposed hosts does not directly expose internal assets. Option B is correct because a firewall (or multiple firewalls) must mediate and filter traffic among the internet, the DMZ, and the internal network, enforcing distinct security policies for each zone rather than allowing unrestricted flows. Option E is correct because inbound traffic to the DMZ should be limited to only the ports and protocols required by the hosted services — for example TCP 80/443 for HTTP/HTTPS and TCP 25 for SMTP — following the principle of least privilege to minimize the attack surface. Option C is incorrect because unrestricted DMZ-to-internal communication defeats the purpose of segmentation and would let a compromised DMZ host pivot directly into the internal network. Option D is incorrect because allowing all inbound internet traffic to the DMZ exposes unnecessary ports and services, greatly increasing the risk of exploitation.

Answer

Configure the DMZ to communicate directly with the internal network without restrictions.

Answer

Allow all inbound traffic to the DMZ from the internet for ease of access.

Question 16

Which TWO are examples of logical access controls? (Select TWO.)

Accepted Answer

Password complexity requirements. Password complexity requirements (B) are a logical access control because they are enforced in software by the operating system or directory service (e.g., via Group Policy password policy or /etc/security/pwquality.conf) to govern how a user authenticates, not to physically restrict movement. Account lockout policy (E) is likewise logical: it is a software-enforced setting that disables an account after a defined number of failed logon attempts within a set window, mitigating brute-force attacks against the authentication process. Both operate on the logical layer of identity and authentication rather than on physical barriers. By contrast, fencing around the property (A), a guard at the building entrance (C), and a biometric door lock (D) are physical access controls, since they restrict who can physically enter a location or structure.

Answer

Fencing around the property

Answer

Guard at building entrance

Answer

Biometric door lock

Question 17

An organization wants to implement layered physical security for its data center. Which THREE of the following controls would be considered part of a defense-in-depth physical security strategy?

Accepted Answer

Cable locks on laptop computers. Option A (cable locks on laptop computers) is correct because a cable lock is a physical deterrent that secures a portable asset to a fixed object, adding a layer of physical defense against theft. Option D (biometric reader at the server room door) is correct because it is a physical access control that authenticates identity via a biological characteristic before granting entry to a restricted area. Option E (fencing and bollards around the building) is correct because perimeter barriers such as fences and bollards are classic physical controls that deter, delay, and prevent unauthorized access or vehicle-borne threats. Option B (password complexity requirements) is not a physical control but a logical/administrative authentication control, and Option C (visitor sign-in log) is an administrative control that records entry rather than physically preventing or deterring access.

Answer

Password complexity requirements

Answer

Visitor sign-in log

Question 18

A security professional is advising a company on adherence to the (ISC)² Code of Ethics. Which two of the following actions align with the Code's canons? (Choose two.)

Accepted Answer

Reporting a discovered vulnerability to the software vendor promptly. Option C is correct because the (ISC)² Code of Ethics requires members to act honorably, honestly, justly, responsibly, and legally, and responsibly disclosing a discovered vulnerability to the software vendor reflects the canon to protect society and the infrastructure. Option D is correct because safeguarding confidential client information and refusing to release a password to an unauthorized third party upholds the canon to advance the profession and act responsibly toward clients and employers. Option A is wrong because using unlicensed software is illegal and unethical, violating the canon to act legally and avoid conflicts with laws. Option B is wrong because sharing a colleague's password without consent violates privacy, confidentiality, and the canon to act honorably and responsibly. Option E is wrong because concealing a breach is dishonest and harms stakeholders, contradicting the canons to act honestly and protect society.

Answer

Using a vendor's software without a license to test its security

Answer

Sharing a colleague's password with a manager without the colleague's consent to improve efficiency

Answer

Concealing a security breach to avoid negative publicity

Question 19

Which TWO of the following are valid types of disaster recovery tests?

Accepted Answer

Tabletop exercise.. A tabletop exercise (A) is a valid disaster recovery test in which the DR team walks through the plan in a discussion-based setting to validate roles, procedures, and decision-making without activating systems. A parallel test (E) is also valid: the backup site is brought online and run concurrently with the primary site to verify recovery capability while normal production continues, without a disruptive failover. The other options are not DR test types: a full-scale simulation without prior notification (B) is not a recognized test category (full-scale exercises are typically announced and planned), unit testing (C) verifies individual application components rather than end-to-end recovery, and a vulnerability scan (D) is a security assessment, not a DR test.

Answer

Full-scale simulation without prior notification.

Answer

Unit testing of individual applications.

Answer

Vulnerability scan.

Question 20

According to NIST SP 800-63 recommendations for password policies, which THREE practices are recommended? (Select THREE.)

Accepted Answer

Allow users to paste passwords to facilitate password manager use. Option A is correct because NIST SP 800-63B explicitly recommends permitting "paste" functionality in password fields so that users can employ password managers, which generate and store strong, unique credentials. Option B is correct because the guideline requires verifiers to compare prospective passwords against lists of commonly used, expected, or compromised passwords (e.g., breach corpora) and reject matches. Option E is correct because NIST sets a minimum password length of 8 characters for user-chosen secrets, while encouraging longer passphrases (up to at least 64 characters). Option C is not recommended because NIST advises against composition rules mandating mixed uppercase, lowercase, digits, and symbols, since they push users toward predictable patterns. Option D is not recommended because NIST discourages forced periodic rotation (e.g., every 30 days) absent evidence of compromise, as it weakens password quality.

Answer

Require complex combinations of uppercase, lowercase, numbers, and symbols

Answer

Require frequent password changes every 30 days