ISC2 CC Practice Exam 57 — 20 Questions

Question 1

A security administrator is reviewing network security controls. Which TWO of the following are examples of network segmentation technologies? (Select TWO)

Accepted Answer

Subnetting. Subnetting divides a larger network into smaller, logical subnetworks by manipulating the subnet mask (e.g., using VLSM or CIDR). This creates separate broadcast domains at Layer 3, allowing administrators to isolate traffic and apply distinct security policies between subnets, which is a core function of network segmentation.

Answer

Proxy servers

Answer

Honeypots

Answer

Firewalls

Question 2

An organization has implemented a SIEM solution. The security team wants to detect when a user attempts to access a file they do not have permission to read. Which log source is most important for this detection?

Accepted Answer

Windows security event logs. Windows security event logs (specifically Event ID 4663) record every attempt to access an object, including files, and include the user's security identifier (SID) and the requested access mask. This allows the SIEM to correlate the user's identity with the file's discretionary access control list (DACL) to detect an 'Access Denied' result, making it the definitive source for detecting unauthorized file access attempts.

Answer

Web server access logs

Answer

DNS logs

Answer

Firewall logs

Question 3

Which backup strategy offers the fastest restore time but requires the most storage space?

Accepted Answer

Full backup. A full backup copies all selected data every time, so restoring requires only the latest full backup, resulting in the fastest restore time. However, because it duplicates all data with each backup, it requires the most storage space compared to incremental or differential backups.

Answer

Incremental backup

Answer

Differential backup

Answer

Snapshot backup

Question 4

A company is evaluating a new cloud service provider. As part of due diligence, they review the provider's security certifications, conduct a site visit, and check references. This process is an example of which risk management strategy?

Accepted Answer

Due diligence. Reviewing a provider's security certifications, conducting a site visit, and checking references are all investigative activities performed before committing to a relationship — this is the definition of due diligence. Due diligence is the assessment phase of risk management that gathers evidence to inform a risk decision. It is distinct from mitigation (implementing controls), transfer (shifting risk via insurance/contracts), and acceptance (acknowledging risk without action).

Answer

Risk acceptance

Answer

Risk mitigation

Answer

Risk transfer

Question 5

Which TWO are examples of technical access controls?

Accepted Answer

Encryption. Encryption (C) is a technical access control because it uses cryptographic algorithms and keys to render data unreadable to unauthorized parties, directly enforcing confidentiality at the system level. Access control lists (E) are technical access controls because they are software/hardware-enforced rules (e.g., on routers, firewalls, or file systems) that specify which subjects may access which objects and with what permissions. The other options are not technical controls: security awareness training (A) is an administrative/educational control that changes user behavior, security policies (B) are administrative controls that define rules and expectations in writing, and ID badges (D) are physical controls used to restrict physical entry to facilities.

Answer

Security awareness training

Answer

Security policies

Answer

ID badges

Question 6

A company uses a reciprocal agreement for disaster recovery. What is a primary risk of this strategy?

Accepted Answer

Both organizations may be impacted by the same disaster. A reciprocal agreement is an arrangement where two organizations agree to host each other's workloads in the event of a disaster. The primary risk is geographic and correlated failure: if both organizations are in the same disaster zone (flood, hurricane, regional power outage), the same event can disable both sites simultaneously, leaving neither able to host the other.

Answer

Data confidentiality issues

Answer

Slow recovery due to lack of equipment

Answer

High cost of maintaining the agreement

Question 7

An organization uses a 3-2-1 backup strategy. They have a primary full backup on a local NAS, a second copy on tape stored offsite, and a third copy in the cloud. During a ransomware attack, the local NAS and the tape library are both encrypted. Which copy should be used for recovery?

Accepted Answer

The cloud backup. The cloud backup is the only copy that was not compromised by the ransomware attack, since both the local NAS and the offsite tape library were encrypted. In a 3-2-1 strategy, the offsite copy is specifically intended to survive local disasters, but here the attacker reached both on-premises copies. The cloud copy, being isolated and typically immutable or versioned, is the correct recovery source.

Answer

The tape backup

Answer

The local NAS backup

Answer

A new full backup from production data

Question 8

During a tabletop exercise, the IT team realizes that the backup tapes are stored in the same building as the servers. Which risk does this highlight?

Accepted Answer

Insufficient off-site storage. Storing backup tapes in the same building as the primary servers violates the fundamental principle of geographic separation for disaster recovery. If a fire, flood, or physical security breach destroys the building, both the primary data and the backup tapes are lost simultaneously, rendering the backups useless. This directly indicates a lack of off-site storage, which is a core requirement for a viable backup strategy.

Answer

Single point of failure

Answer

Lack of redundancy

Answer

Inadequate segregation of duties

Question 9

Which TWO of the following are examples of Type 3 (inherence) authentication factors?

Accepted Answer

Retina scan. Type 3 (inherence) authentication factors are based on something the user is — a physical or behavioral biometric characteristic of the individual. Option C, retina scan, is correct because it measures the unique pattern of blood vessels in the user's retina, an inherent physiological trait that cannot be transferred or forgotten. Option E, fingerprint scan, is correct because it reads the distinct ridge and minutiae pattern of the user's finger, another inborn biometric attribute. The remaining options do not belong: A (OTP token) and B (smart card) are Type 2 (possession) factors — something the user has — while D (password) is a Type 1 (knowledge) factor — something the user knows.

Answer

OTP token

Answer

Smart card

Answer

Password

Question 10

Which recovery site strategy provides the fastest Recovery Time Objective (RTO), typically within hours, by maintaining a fully operational mirrored environment?

Accepted Answer

Hot site. A hot site is a fully operational duplicate of the primary data center with mirrored hardware, data replication, and network connectivity, enabling failover typically within minutes to hours. Because it maintains real-time or near-real-time synchronization, it delivers the fastest Recovery Time Objective (RTO) among the traditional site strategies. This makes it the correct choice when the business cannot tolerate extended downtime.

Answer

Cold site

Answer

Warm site

Answer

Cloud-based recovery

Question 11

Refer to the exhibit. An administrator needs to restore a database file from two weeks ago, but the backup log shows success. What is the most likely reason the file cannot be restored?

Accepted Answer

The backup source did not include that file. The backup log only records the success or failure of the backup job as a whole, not the inclusion of every individual file. If the database file was not selected in the backup source configuration (e.g., a file-level backup job that excluded the database directory or a volume shadow copy that did not include the file), the backup would complete successfully without backing up that file. When the administrator attempts to restore, the file is missing from the backup set, even though the job log shows success.

Answer

The retention policy deleted it

Answer

The schedule was incorrect

Answer

The encryption key changed

Question 12

A security analyst detects unusual outbound network traffic from a server that normally does not communicate externally. After confirming a malware infection, the analyst isolates the server from the network. Which incident response phase is the analyst performing?

Accepted Answer

Containment. Isolating the server is a containment action to prevent spread.

Answer

Recovery

Answer

Detection

Answer

Eradication

Question 13

What is the primary purpose of a Security Information and Event Management (SIEM) system?

Accepted Answer

Aggregate and correlate logs to generate alerts. A SIEM's core function is to aggregate log and event data from many sources, normalize it, and correlate events across systems to detect and alert on security incidents. Correlation is what distinguishes a SIEM from simple log collection — it identifies patterns spanning multiple events that individually look benign.

Answer

Encrypt sensitive data at rest

Answer

Manage user passwords and access controls

Answer

Block malicious network traffic in real time

Question 14

After a reorganization, a company using RBAC finds that many users have accumulated permissions that no longer align with their job functions. What is the best practice to address this?

Accepted Answer

Conduct a quarterly review and recertification of role memberships and permissions. Conducting a quarterly review and recertification of role memberships and permissions is the industry-standard practice for maintaining the principle of least privilege in an RBAC system. This process ensures that role assignments are periodically validated against current job functions, removing accumulated permissions that no longer align with user responsibilities. It directly addresses permission creep by enforcing a formal, auditable lifecycle for role membership.

Answer

Assign permissions directly to each user based on their manager's request

Answer

Create new roles for each new position and assign users to them

Answer

Delete all existing permissions and re-add them based on current job descriptions

Question 15

After a security breach, the organization conducts a background check on a new vendor before signing a contract. This practice is known as:

Accepted Answer

Due diligence. Due diligence involves investigating and verifying before acting.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Due care

Question 16

A company performs background checks on potential employees before hiring. This action demonstrates which concept?

Accepted Answer

Due diligence. Due diligence is the investigation and verification process an organization performs before entering a relationship or making a decision — background checks on potential employees are a textbook example. It is the assessment step that informs risk decisions. Due care, by contrast, is the ongoing implementation of controls once a risk is identified.

Answer

Risk avoidance

Answer

Due care

Answer

Risk transfer

Question 17

When implementing multi-factor authentication, which combination of factors is considered strongest?

Accepted Answer

Smart card and biometric. Multi-factor authentication (MFA) requires combining factors from different categories: something you know (password, PIN), something you have (smart card, token), and something you are (biometric). The strongest combination uses factors from separate categories, such as a smart card (something you have) and a biometric (something you are). This provides defense in depth because compromising one factor does not compromise the other.

Answer

Password and PIN

Answer

Password and security question

Answer

Biometric and fingerprint

Question 18

A security analyst detects a large volume of small ICMP echo request packets from multiple external sources targeting a single internal server, causing the server to become unresponsive. Which type of attack is this?

Accepted Answer

ICMP flood (DDoS). A DDoS attack using ICMP flood overwhelms the target with echo requests, consuming bandwidth and resources.

Answer

ARP spoofing

Answer

Man-in-the-middle

Answer

SYN flood

Question 19

Which THREE of the following are considered risk management strategies? (Select THREE)

Accepted Answer

Risk acceptance. Risk acceptance (A) is a valid risk management strategy because the organization consciously decides to tolerate the identified risk without taking action, often when the cost of mitigation exceeds the potential impact. Risk transfer (D) is a strategy that shifts the financial impact of a risk to a third party, typically through insurance or outsourcing contracts. Risk mitigation (E) is a strategy that reduces the probability or impact of a risk by implementing controls, making it a core risk-handling approach. Risk assessment (B) and risk analysis (C) are not strategies themselves; they are earlier processes used to identify, evaluate, and prioritize risks before a response strategy is selected.

Answer

Risk assessment

Answer

Risk analysis

Question 20

A security consultant is evaluating a vendor's security practices before signing a contract. The consultant reviews the vendor's security policies, incident response plans, and conducts background checks on key personnel. This activity is an example of:

Accepted Answer

Due diligence. Due diligence involves investigating and verifying security practices before making a decision, such as vendor risk assessment.

Answer

Risk avoidance

Answer

Due care

Answer

Risk mitigation