ISC2 CC Practice Exam 56 — 20 Questions

Question 1

A security analyst is reviewing physical security controls. Which TWO are considered layered physical security measures for external perimeter protection?

Accepted Answer

Fencing around the property. Fencing around the property (A) is a correct answer because it is a perimeter-layer physical control that establishes a physical boundary and delays or deters intruders before they reach the facility. Lighting in parking lots (B) is also correct because exterior lighting is a classic layered perimeter control that deters intruders, removes concealment, and supports CCTV or guard surveillance. Together, fencing and lighting represent complementary external perimeter defenses that support defense in depth. The unmarked options do not belong because a biometric reader on a server room door (C) is an interior access control for a specific high-security room, not an external perimeter measure, while cable locks on laptops (D) and chassis locks on servers (E) are asset-level physical controls that protect individual devices rather than the external perimeter.

Answer

Biometric reader on server room door

Answer

Cable locks on laptops

Answer

Chassis locks on servers

Question 2

Which THREE of the following are best practices for privileged account management? (Select THREE.)

Accepted Answer

Use a Privileged Access Management (PAM) solution to monitor and control admin access. Option A is correct because a Privileged Access Management (PAM) solution provides vaulting, session monitoring, recording, and just-in-time elevation of administrative credentials, which are core best practices for controlling and auditing privileged access. Option C is correct because separating administrative accounts from everyday user accounts prevents credential theft from routine activities like email and web browsing from directly yielding privileged access, and it supports non-repudiation of admin actions. Option E is correct because applying the principle of least privilege ensures administrators receive only the rights required for their specific role, reducing the attack surface and limiting lateral movement if an admin account is compromised. Option B is not a best practice because reusing a single admin account for daily tasks exposes high-privilege credentials to phishing, malware, and credential-dumping attacks. Option D is not a best practice because granting permanent full access to all systems violates least privilege and removes accountability, making misuse or compromise far more damaging.

Answer

Use the same admin account for daily tasks to simplify management

Answer

Grant administrators full access to all systems at all times for convenience

Question 3

Which THREE are key components of Active Directory? (Select THREE.)

Accepted Answer

Users. Users (A) are a core Active Directory object class representing security principals that authenticate and receive permissions, so they are a key component. Groups (C) are also essential AD objects used to aggregate users and other principals for efficient permission assignment and role-based access control. Organizational Units (E) are container objects that provide the hierarchical structure for organizing users, groups, computers, and other objects, and for delegating administration and applying Group Policy. Firewalls (B) are network security devices, not AD components, and LDAP (D) is a directory access protocol that AD supports and uses, but it is not itself a component of Active Directory.

Answer

Firewalls

Answer

LDAP

Question 4

Which TWO of the following are components of the identification and authentication process? (Select TWO.)

Accepted Answer

Password. The identification and authentication process consists of two distinct steps: identification, where a subject claims an identity, and authentication, where that claim is verified. Option B (Username) is correct because the username is the identifier — the claim of identity presented during the identification step. Option A (Password) is correct because the password is the authenticator — the secret credential verified against the stored value during the authentication step. Option C (Group policy) is incorrect because it is a management mechanism for enforcing configuration and security settings, not a component of identification or authentication. Option D (Access control list, ACL) is incorrect because an ACL is an authorization mechanism that specifies which subjects may access which objects, operating after authentication completes. Option E (Role-based access control, RBAC) is incorrect because RBAC is an authorization model that grants permissions based on roles, not part of proving identity.

Answer

Group policy

Answer

Access control list (ACL)

Answer

Role-based access control (RBAC)

Question 5

Which THREE are recommended practices for password policies according to current guidelines?

Accepted Answer

Check passwords against lists of known breached passwords. Option A is correct because current NIST SP 800-63B guidance requires screening new passwords against lists of known compromised or breached passwords (such as those from Have I Been Pwned) and rejecting any that match. Option B is correct because NIST sets the minimum password length at 8 characters when a password is used as a single-factor authenticator. Option D is correct because NIST recommends permitting passwords up to at least 64 characters, allowing the use of long passphrases and password managers. Option C is not recommended because composition rules (mixing uppercase, numbers, and special characters) are now discouraged as they push users toward predictable patterns. Option E is not recommended because arbitrary periodic rotation (for example, every 30 days) is discouraged; changes should only be forced when there is evidence of compromise.

Answer

Require at least one uppercase letter, one number, and one special character

Answer

Force password changes every 30 days

Question 6

A system administrator is configuring account lockout policies to mitigate brute-force attacks. Which TWO settings are most critical for this purpose?

Accepted Answer

Account lockout threshold (e.g., 5 failed attempts). Option B, the account lockout threshold (e.g., 5 failed attempts), is correct because it directly limits how many incorrect password guesses an attacker can make before the account is disabled, which is the core mechanism that stops brute-force attempts. Option C, lockout duration (e.g., 30 minutes) or administrator unlock, is correct because it determines how long the account stays locked; without a duration or manual unlock requirement, the lockout either never ends or can be trivially bypassed, so it works together with the threshold to make brute-forcing impractical. The unmarked options do not belong because A (90-day password changes), D (password history of 10), and E (minimum length of 8) are password policy settings that improve password strength and prevent reuse, but they do not detect or block repeated failed authentication attempts, which is what account lockout specifically addresses.

Answer

Requiring password changes every 90 days

Answer

Password history of 10 remembered passwords

Answer

Password minimum length of 8 characters

Question 7

An organization is implementing a security awareness program. Which THREE topics should be included to address common social engineering attacks? (Select THREE)

Accepted Answer

Tailgating awareness. Tailgating awareness (A) is correct because tailgating is a physical social engineering attack where an unauthorized person follows an authorized individual through a secure door, so awareness training must teach employees to challenge strangers and enforce badge/access controls. USB drop attack risks (C) are correct because attackers leave infected USB drives in parking lots or common areas hoping victims plug them in, and awareness training should instruct users never to connect found media. Recognizing phishing emails (D) is correct because phishing is the most common social engineering vector, and training should cover suspicious senders, urgent language, mismatched URLs, and malicious attachments/links. Secure coding practices (B) are not a social engineering topic; they belong to developer security training such as OWASP Top 10 and input validation. Password complexity requirements (E) are a technical authentication control, not a social engineering awareness topic, since social engineering targets human trust rather than password strength rules.

Answer

Secure coding practices

Answer

Password complexity requirements

Question 8

A security analyst detects unusual outbound traffic from a server that suggests a data breach. According to GDPR, within what timeframe must the organization notify the supervisory authority?

Accepted Answer

72 hours. GDPR mandates notification within 72 hours of awareness of a breach.

Answer

48 hours

Answer

7 days

Answer

24 hours

Question 9

A security administrator is reviewing the principles of access control. Which TWO of the following are core components of the AAA framework? (Select TWO.)

Accepted Answer

Authorization. Authorization (A) is a core AAA component because it determines what resources and actions an authenticated identity is permitted to access, typically enforced through policies, roles, or permissions. Authentication (D) is also a core AAA component because it verifies the identity of a subject, usually via credentials such as passwords, tokens, or certificates, before access is granted. Together with Accounting, these form the AAA framework. Identification (B) is a prerequisite step where a subject claims an identity, but it is not one of the three AAA components. Non-repudiation (C) is a security property often supported by auditing and digital signatures, not a core AAA component. Auditing (E) is related to accounting/logging but is not itself one of the AAA framework components.

Answer

Identification

Answer

Non-repudiation

Answer

Auditing

Question 10

Which TWO actions are most effective in reducing the mean time to detect (MTTD) a security incident?

Accepted Answer

Implementing a SIEM with centralized logging from critical systems. A SIEM with centralized logging aggregates and correlates logs from critical systems, enabling real-time analysis and automated alerting. This drastically reduces MTTD by surfacing indicators of compromise (IoCs) within minutes rather than hours or days, as manual log review would require.

Answer

Requiring multi-factor authentication for all remote access

Answer

Conducting annual security awareness training for all employees

Answer

Standardizing firewall rules across all network segments

Question 11

Refer to the exhibit. An administrator notices that external access to the MySQL database (port 3306) is blocked, but internal access should be allowed. What change should be made?

Accepted Answer

Create a rule to allow traffic from internal IP range to port 3306. The exhibit shows a DROP rule for port 3306 in the INPUT chain, which blocks all incoming traffic to the MySQL database. To allow internal access while keeping external access blocked, a specific rule must be added to ACCEPT traffic from the internal IP range to port 3306, placed before the DROP rule. This ensures that internal packets are matched first and permitted, while external packets hit the DROP rule and are rejected. Simply modifying or removing the DROP rule would allow all traffic, violating the requirement to block external access.

Answer

Change the DROP rule to ACCEPT for port 3306

Answer

Allow port 3306 in the FORWARD chain

Answer

Remove the DROP rule for port 3306

Question 12

You are a forensic analyst responding to a reported compromise of a Linux web server. The server hosts a public-facing web application and is part of a DMZ. The initial investigation shows that unauthorized outbound connections were made to a known malicious IP address during the previous night. The server is still running and connected to the network, but the web application has been taken offline for maintenance. The incident response team wants to preserve evidence for potential legal action. You have a forensic workstation with tools like dd, netcat, and memory acquisition tools. Which of the following should be your FIRST step in the forensic acquisition process?

Accepted Answer

Capture the contents of volatile memory (RAM) using a memory acquisition tool.. Volatile memory (RAM) contains critical evidence such as running processes, network connections, encryption keys, and in-memory malware that would be lost when the system is powered off. In a forensic response, the order of volatility dictates that RAM must be captured first before any non-volatile data. Option D is correct because it follows the established forensic principle of preserving the most volatile data first.

Answer

Create a bit-for-bit copy of the hard drive using dd and a write blocker.

Answer

Capture network traffic from the server for analysis.

Answer

Run a full antivirus scan to identify malware.

Question 13

Which metric defines the maximum acceptable amount of data loss measured in time?

Accepted Answer

Recovery Point Objective (RPO). The Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time, typically expressed in seconds, minutes, or hours. It represents the age of the most recent backup or replicated data that must be available to resume operations after a disaster, directly determining the frequency of backups or replication intervals.

Answer

Mean Time Between Failures (MTBF)

Answer

Mean Time to Repair (MTTR)

Answer

Recovery Time Objective (RTO)

Question 14

Which of the following is a potential security issue commonly found in firewall configurations?

Accepted Answer

Outbound traffic is not inspected for malicious content. A common firewall misconfiguration is to inspect only inbound traffic while allowing outbound traffic without inspection. This can allow malicious content such as command-and-control traffic or data exfiltration to leave the network undetected. Outbound traffic inspection is often overlooked, making it a potential security issue.

Answer

Logging is not enabled at session start

Answer

The source is too restrictive

Answer

The policy does not specify a destination

Question 15

A security analyst is reviewing firewall logs and notices an unusually high number of blocked outbound connections to a single external IP address. Which TWO actions should the analyst take to investigate this potential security incident? (Choose two.)

Accepted Answer

Check threat intelligence feeds for the external IP address.. Investigating the source system helps determine if it is compromised; checking threat intelligence can reveal if the IP is known malicious.

Answer

Increase logging for all traffic to that IP.

Answer

Disable the firewall rule that is blocking the connections.

Answer

Block all outbound traffic from the source system.

Question 16

Which TWO of the following are common indicators of a ransomware attack?

Accepted Answer

Files with .encrypted extension.. Option D is correct because ransomware typically encrypts victim files and appends a distinctive extension such as .encrypted (or .locked, .crypto, etc.) to each affected file, making it one of the most reliable file-system indicators of an active infection. Option E is correct because most ransomware families drop a ransom note — often in the form of a text file, HTML page, or a full-screen desktop wallpaper/message — demanding payment in cryptocurrency in exchange for the decryption key. Option A is not a typical ransomware indicator; new user accounts are more commonly associated with persistence or privilege-escalation techniques used by other malware or intruders. Option B is incorrect because ransomware encryption and file I/O typically cause elevated CPU/disk usage and degraded performance, not improved system performance. Option C is incorrect because ransomware often increases network traffic (e.g., C2 communication, key exchange, exfiltration) rather than causing a sudden decrease.

Answer

New user accounts created.

Answer

Elevated system performance.

Answer

Sudden decrease in network traffic.

Question 17

Which THREE of the following are recognized security control types according to ISC2? (Choose three.)

Accepted Answer

Technical. (Technical) is correct because ISC2 recognizes technical controls as a primary security control type, encompassing mechanisms like firewalls, encryption, and intrusion detection systems that enforce security policies through technology. These controls operate at the system or network level to protect assets directly.

Answer

Deterrent

Answer

Operational

Question 18

Refer to the exhibit. What is the first action the incident responder should take?

Accepted Answer

Investigate the web server at 192.168.1.10. The incident responder must first investigate the web server at 192.168.1.10 to confirm whether the alert is a true positive or a false positive. Jumping to containment actions like disabling the application or blocking the IP without verification could disrupt legitimate services or overlook the root cause. The initial step in any incident response process (as per NIST SP 800-61) is to validate the alert through analysis of logs, processes, and system state.

Answer

Disable the web application

Answer

Block the source IP in firewall

Answer

Ignore the alert as false positive

Question 19

A company's security policy requires that all sensitive data be encrypted during transfer. A security administrator discovers that an internal web application is using a self-signed TLS certificate. What vulnerability does this introduce?

Accepted Answer

Man-in-the-middle attacks because the certificate cannot be verified. A self-signed TLS certificate is not signed by a trusted Certificate Authority (CA), so clients cannot verify the certificate's authenticity. This allows an attacker to intercept the TLS handshake, present their own self-signed certificate, and perform a man-in-the-middle (MITM) attack, decrypting and reading or modifying the data in transit.

Answer

Data corruption

Answer

Increased latency

Answer

Replay attacks because TLS is not used

Question 20

A security analyst wants to detect and analyze attacker behavior by deploying a decoy system. Which three characteristics apply to a honeypot? (Choose THREE.)

Accepted Answer

It is a decoy system to attract attackers. Honeypots are decoy systems designed to attract attackers, provide early warning, and allow analysis of attacker techniques. They do not contain real production data and are not used for legitimate traffic.

Answer

It contains sensitive production data

Answer

It is used for legitimate network traffic