ISC2 CC Practice Exam 56 — 20 Questions

Question 1

Match each cryptographic concept to its definition.

Accepted Answer

Symmetric encryption: Uses a single shared key for both encryption and decryption.. Symmetric encryption uses one shared key; asymmetric uses a public-private key pair; hashing is a one-way function; digital signatures use asymmetric cryptography for authentication, integrity, and non-repudiation. Common confusions include mixing up symmetric and asymmetric key usage, or thinking hashing is reversible.

Answer

Symmetric encryption: Uses a pair of keys (public and private) for encryption and decryption.

Answer

Hashing: A reversible process that transforms data into a fixed-size representation.

Question 2

Match each OSI layer to its function.

Accepted Answer

Physical layer: Transmits raw bit stream over physical medium. Correct matches: Physical layer transmits raw bits; Data Link layer provides node-to-node transfer with error control; Network layer routes packets; Transport layer ensures reliable end-to-end delivery. Common confusions include mixing up Data Link and Physical layer functions, or attributing routing to the Data Link layer.

Answer

Physical layer: Provides error detection and correction

Answer

Data Link layer: Routes packets across networks

Question 3

Which of the following are examples of sensitive PII? (Select all that apply.)

Accepted Answer

Medical records. Sensitive PII includes information that, if disclosed, could cause significant harm. Medical records and Social Security numbers are both considered sensitive PII because their exposure can lead to identity theft, discrimination, or other serious consequences. Phone numbers and name/email combinations are typically not classified as sensitive PII on their own.

Answer

Phone number

Answer

Name and email address

Question 4

A company wants to mitigate the risk of a man-in-the-middle (MITM) attack. Which three measures are effective? (Choose THREE.)

Accepted Answer

Deploy a VPN for remote connections. VPNs create an encrypted tunnel for remote connections, securing data in transit and preventing interception. Mutual authentication ensures both client and server verify each other's identities, thwarting impersonation. ARP spoofing protection prevents attackers from intercepting local network traffic by spoofing MAC addresses. While HTTPS with proper certificate validation is effective for web traffic, it does not protect against all types of MITM attacks. WPA2 only encrypts Wi-Fi traffic and does not prevent MITM at higher layers. Therefore, the most effective measures are A, B, and C.

Answer

Use HTTPS with proper certificate validation

Answer

Use WPA2 encryption on the Wi-Fi network

Question 5

An organization decides to implement a security control that can detect and block attacks in real-time by sitting inline in the network. Which of the following should be chosen to meet these requirements?

Accepted Answer

Intrusion Prevention System (IPS). An IPS (Intrusion Prevention System) is inline and can block attacks. IDS is passive.

Answer

Intrusion Detection System (IDS)

Answer

Packet filtering firewall

Answer

Honeypot

Question 6

A company's remote access VPN uses IPsec with pre-shared keys. Employees report that they cannot connect from home. The VPN server logs show 'IKE authentication failed.' The help desk confirms the pre-shared keys are correct. Which of the following is the most likely cause?

Accepted Answer

The IKE phase 1 parameters (encryption, hash, DH group) do not match. 'IKE authentication failed' specifically indicates a failure during IKE phase 1, where the peers negotiate security parameters. Even if the pre-shared key is correct, mismatched encryption (e.g., AES vs. 3DES), hash (e.g., SHA-1 vs. SHA-256), or Diffie-Hellman group (e.g., group 2 vs. group 14) will cause the IKE SA to fail, preventing phase 1 authentication from completing.

Answer

The client is behind a NAT device that blocks IPsec traffic

Answer

The VPN server is not responding to IKE requests

Answer

The client's certificate has expired

Question 7

A company's primary data center is destroyed by a natural disaster. The backup site has been fully synchronized but needs to be activated. Which process addresses the activation of the backup site?

Accepted Answer

Disaster Recovery Plan (DRP). The Disaster Recovery Plan (DRP) specifically outlines the procedures for activating a backup site after a primary data center failure. In this scenario, the backup site is fully synchronized but requires activation, which involves steps like DNS changes, storage array failover (e.g., using synchronous replication with a quorum witness), and network reconfiguration. The DRP is the document that contains these technical recovery steps, distinguishing it from broader continuity or incident response plans.

Answer

Risk Management Plan

Answer

Incident Response Plan (IRP)

Answer

Business Continuity Plan (BCP)

Question 8

An organization implements a bring-your-own-device (BYOD) policy. Which security control is most important to enforce in the BYOD policy?

Accepted Answer

Implement mobile device management (MDM) for remote wipe and policy enforcement. Mobile device management (MDM) is the most important control for a BYOD policy because it provides centralized policy enforcement, remote wipe capabilities, and device compliance monitoring. Unlike isolated controls like passwords or encryption, MDM allows the organization to enforce security policies dynamically and revoke access or wipe corporate data if a device is lost, stolen, or non-compliant.

Answer

Require complex passwords

Answer

Install a firewall on each device

Answer

Enable full disk encryption

Question 9

A company has implemented a security information and event management (SIEM) system. The SOC team notices that the SIEM is generating a high volume of false positive alerts from a specific web application firewall (WAF). The WAF logs show many requests with SQL injection patterns, but the application is not vulnerable. Which of the following actions would BEST reduce false positives without compromising security?

Accepted Answer

Tune the WAF's detection rules based on the application's normal traffic profile. Tuning the WAF's detection rules to match the application's normal traffic profile reduces false positives by filtering out benign requests that resemble SQL injection patterns. This approach maintains security by still detecting actual attacks, unlike simply suppressing alerts or disabling detection. The SIEM should correlate WAF alerts with application context, but the root cause is the WAF's overly broad rules, which need refinement.

Answer

Create a SIEM rule to suppress alerts from that WAF

Answer

Increase the alert threshold in the WAF to reduce sensitivity

Answer

Disable SQL injection detection in the WAF for that application

Question 10

A security auditor discovers that during a VLAN hopping attack, a threat actor was able to send frames from a workstation on VLAN 10 to a target on VLAN 20. Which configuration flaw is most likely responsible?

Accepted Answer

Dynamic Trunking Protocol (DTP) is enabled on access ports. A VLAN hopping attack exploits the Dynamic Trunking Protocol (DTP) to negotiate a trunk link between the attacker's workstation and the switch. If DTP is enabled on an access port, the attacker can send DTP frames to form a trunk, allowing frames from VLAN 10 to be tagged and forwarded to VLAN 20. Disabling DTP on all access ports with the 'switchport nonegotiate' command prevents this attack.

Answer

The trunk port is set to native VLAN 1

Answer

The switch is using default VLAN 1 for management

Answer

Port security is not configured

Question 11

During a ransomware incident, the incident response team isolates affected systems. Which of the following is the NEXT best step?

Accepted Answer

Preserve forensic evidence from the isolated systems.. After isolating affected systems during a ransomware incident, the next best step is to preserve forensic evidence from those systems. This ensures that data such as memory dumps, logs, and encrypted files are captured intact for analysis, which is critical for understanding the attack vector, identifying the ransomware variant, and potentially recovering data without paying the ransom. Forensic preservation must occur before any remediation steps like wiping or rebuilding, as those actions would destroy the evidence needed for investigation and legal proceedings.

Answer

Wipe and rebuild all affected systems.

Answer

Notify law enforcement immediately.

Answer

Pay the ransom to restore operations quickly.

Question 12

Which TWO technologies provide network segmentation? (Choose two.)

Accepted Answer

Routers with ACLs. Routers with ACLs (Access Control Lists) provide network segmentation by filtering traffic based on Layer 3 (IP addresses) and Layer 4 (port numbers) criteria, effectively dividing a network into separate security zones or subnets. VLANs (Virtual Local Area Networks) segment a network at Layer 2 by logically grouping devices into separate broadcast domains, even if they share the same physical switch. Both technologies isolate traffic to enforce security policies and reduce attack surfaces.

Answer

Firewalls

Answer

Hubs

Answer

Switches

Question 13

A security analyst is reviewing network traffic and notices that some devices are using a protocol that does not guarantee delivery and has no error recovery. Which ONE transport layer protocol fits this description? (Select ONE)

Accepted Answer

UDP. UDP (User Datagram Protocol) is a transport layer protocol that does not guarantee delivery and has no error recovery. TCP is connection-oriented and provides reliability. HTTP and ARP are not transport layer protocols. ICMP operates at the network layer, not the transport layer. Therefore, UDP correctly fits the description.

Answer

TCP

Answer

HTTP

Answer

ICMP

Answer

ARP

Question 14

When implementing a role-based access control (RBAC) system, what is the primary challenge organizations face?

Accepted Answer

Role explosion. Role explosion is the primary challenge in RBAC because as organizations grow, the number of distinct roles can proliferate rapidly, leading to administrative overhead, complexity in role management, and potential security gaps. This occurs when roles are defined too granularly or for every unique combination of permissions, making it difficult to maintain least privilege and audit access. Proper RBAC design requires careful role engineering to minimize the number of roles while still mapping to job functions.

Answer

Managing password complexity

Answer

Ensuring users do not share passwords

Answer

Defining roles that align with job functions

Question 15

A company is evaluating backup strategies for its critical database. Which TWO of the following are correct statements about backup types?

Accepted Answer

A full backup copies all data regardless of change status.. Full backup copies all data regardless of change status, so A is correct. Differential backup copies data changed since the last full backup, so C is correct. Incremental backup copies data changed since the last backup of any type, making D incorrect. While incremental backups are often smaller than differential backups, this is not always true and the statement in E is too absolute; incremental backups can require more storage if many are taken. Restoring from a full backup is slower than from a differential backup because differential restore only needs the last full plus one differential, so B is wrong. Therefore, exactly two statements, A and C, are correct.

Answer

Restoring from a full backup is faster than restoring from a differential backup.

Answer

An incremental backup only copies data that has changed since the last full backup.

Answer

Incremental backups require less storage space than differential backups.

Question 16

An organization decides to implement multiple security controls, including firewalls, intrusion detection systems, and antivirus software. Which security principle does this represent?

Accepted Answer

Defense in depth. Defense in depth uses multiple layers of security controls to protect assets. Option A (Least privilege) is about granting only necessary permissions. Option B (Defense in depth) is the correct answer as it employs multiple security layers such as firewalls, IDS, and antivirus. Option C (Risk avoidance) involves eliminating risk by avoiding risky activities. Option D (Separation of duties) divides critical tasks among multiple individuals to prevent fraud.

Answer

Least privilege

Answer

Risk avoidance

Answer

Separation of duties

Question 17

A company uses WPA2-Enterprise for wireless authentication. What additional security measure should be implemented to protect against rogue access points?

Accepted Answer

Deploy a wireless intrusion prevention system (WIPS). WPA2-Enterprise uses 802.1X for authentication, but it does not inherently detect or block rogue access points (APs) that mimic legitimate SSIDs. A Wireless Intrusion Prevention System (WIPS) continuously monitors the RF spectrum, identifies unauthorized APs by analyzing beacon frames, probe responses, and MAC addresses, and can automatically contain them by sending deauthentication frames or alerting administrators. This is the most direct and effective measure to protect against rogue APs in an enterprise WLAN.

Answer

Enable MAC filtering

Answer

Implement 802.1X with mutual authentication

Answer

Use WPA3

Question 18

A financial institution is implementing data classification to protect customer information. They have identified data that includes medical records and financial account numbers. Which three labels are most appropriate for this data? (Choose three.)

Accepted Answer

Restricted. Medical records and financial account numbers are considered sensitive PII and should be classified as confidential or restricted. Common classification labels include 'Confidential', 'Restricted', and 'Sensitive'. In many frameworks, 'Confidential' and 'Restricted' are used for highly sensitive data. 'Sensitive' is also a common label. 'Public' and 'Internal' are not appropriate for this level of sensitivity.

Answer

Internal

Answer

Public

Question 19

Which TCP segment is sent to initiate the three-way handshake?

Accepted Answer

SYN. The three-way handshake starts with a SYN (synchronize) packet from the client.

Answer

ACK

Answer

SYN-ACK

Answer

FIN

Question 20

A company implements redundant servers to ensure that if one server fails, another can take over immediately. Which security principle is primarily being addressed?

Accepted Answer

Availability. Redundancy supports availability by minimizing downtime.

Answer

Authentication

Answer

Integrity

Answer

Confidentiality