ISC2 CC Practice Exam 57 — 20 Questions

Question 1

During a disaster recovery test, the team discovers that the backup generator fails to start. What is the BEST immediate action?

Accepted Answer

Document the issue and proceed. The immediate priority during a disaster recovery test is to document the failure and continue the test to evaluate the remaining components of the DR plan. The backup generator failure is a specific issue that should be logged for post-test remediation, but aborting the test prematurely would lose valuable data on other failover mechanisms, such as UPS runtime, network redundancy, or application recovery. Proceeding with documentation ensures the test's integrity while capturing the incident for root cause analysis.

Answer

Continue the test with manual procedures

Answer

Cancel the test

Answer

Shut down the data center

Question 2

A security professional is advising a company on adherence to the (ISC)² Code of Ethics. Which two of the following actions align with the Code's canons? (Choose two.)

Accepted Answer

Reporting a discovered vulnerability to the software vendor promptly. The (ISC)² Code of Ethics includes four canons: Protect society, the common good, necessary public trust and confidence, and the infrastructure; Act honorably, honestly, justly, responsibly, and legally; Provide diligent and competent service to principals; and Advance and protect the profession. Reporting vulnerabilities to the vendor protects society. Refusing to share confidential credentials demonstrates honorable behavior.

Answer

Using a vendor's software without a license to test its security

Answer

Sharing a colleague's password with a manager without the colleague's consent to improve efficiency

Answer

Concealing a security breach to avoid negative publicity

Question 3

A SOC analyst detects a series of failed login attempts from a single external IP address targeting multiple user accounts within a short time. Which action should the analyst take FIRST?

Accepted Answer

Verify if any accounts were successfully compromised.. The correct first step is to verify if any accounts were successfully compromised (Option B). In security operations, the priority is to assess the impact of an incident before taking containment actions. If an account was breached, immediate password resets and session invalidation are needed; blocking the IP prematurely could destroy forensic evidence and alert the attacker, while disabling all accounts causes unnecessary business disruption. The analyst must confirm compromise via log review (e.g., checking for successful authentication events after the failed attempts) to guide the appropriate response.

Answer

Block the IP address at the firewall immediately.

Answer

Disable all user accounts that were targeted.

Answer

Notify law enforcement about the attempted breach.

Question 4

A security analyst detects a large number of half-open TCP connections targeting a web server. This is most likely indicative of what type of attack?

Accepted Answer

SYN flood. A SYN flood attack exploits the TCP three-way handshake by sending many SYN packets without completing the handshake, exhausting server resources. This is a type of DoS attack.

Answer

Smurf attack

Answer

ARP spoofing

Answer

DNS amplification

Question 5

Which of the following protocols provides secure remote administration of a network device over an untrusted network?

Accepted Answer

SSH. SSH (Secure Shell) is correct because it encrypts all traffic, including authentication credentials and commands, using strong cryptographic algorithms, making it safe for remote administration over untrusted networks. It operates on TCP port 22 and provides confidentiality, integrity, and authentication, unlike cleartext protocols. SSH is the standard for secure CLI access to network devices such as routers and switches.

Answer

SNMPv1

Answer

Telnet

Answer

HTTP

Question 6

A company follows the 3-2-1 backup rule. It has two full backups: one on an external hard drive in the server room and one on tape in a safe on-site. Which step should be taken to fully comply with the rule?

Accepted Answer

Store the tape copy in a secure offsite location. The 3-2-1 rule requires three copies of data (including the original), stored on at least two different media types, with at least one copy stored offsite. Currently, the company has the original data plus two backups (external HDD and tape) — three copies total — but both backups are on-site. To fully comply, one of the backup copies must be moved to an offsite location. Option B, storing the tape copy offsite, satisfies the '1 offsite' requirement.

Answer

No action needed; the rule is satisfied

Answer

Use cloud storage as an additional copy

Answer

Add a third copy to the external hard drive

Question 7

A security manager is designing a policy to prevent one person from both approving and disbursing payments. Which principle is being applied?

Accepted Answer

Separation of duties. Separation of duties ensures that no single individual has control over two or more phases of a critical transaction, such as both approving and disbursing payments. By splitting these responsibilities, the organization reduces the risk of fraud or error because collusion between two or more people would be required to bypass controls. In payment systems, this is often enforced through dual-authorization workflows in ERP or financial management software.

Answer

Need to know

Answer

Least privilege

Answer

Defense in depth

Question 8

A security team identifies a vulnerability in a web application that could allow attackers to steal customer data. The team decides to accept the risk because the cost to fix exceeds the potential loss. This is an example of:

Accepted Answer

Risk acceptance. Risk acceptance means acknowledging the risk and choosing not to mitigate it, often due to cost-benefit analysis.

Answer

Risk transfer

Answer

Risk avoidance

Answer

Risk mitigation

Question 9

A medium-sized e-commerce company operates a web application on three virtual servers behind a load balancer. The application handles credit card payments and stores customer data in a database server. The company has a security operations team that monitors logs from firewalls, IDS, and servers. One morning, the IDS generates a critical alert indicating a SQL injection attempt from an external IP to the web application. The alert shows that the injection string was ' OR '1'='1' -- . The web server logs confirm that the request returned a 200 OK status and a large response size. The database logs show a query that returned multiple rows. The security analyst needs to determine the best immediate course of action. The company has a documented incident response plan that includes containment, eradication, and recovery phases. Which action should the analyst take first?

Accepted Answer

Take the web server offline and initiate the containment phase of the incident response plan. The correct first action is to take the web server offline and initiate the containment phase. The IDS alert confirms a successful SQL injection (200 OK, large response, multiple rows returned), indicating a data breach is in progress. Containment must precede any other step to stop further data exfiltration, as per the incident response plan's phases.

Answer

Apply a virtual patch using a web application firewall (WAF) rule to block similar injection attempts

Answer

Notify the web development team to fix the SQL injection vulnerability in the code

Answer

Run a full database backup to preserve evidence

Question 10

Refer to the exhibit. The file is readable and writable by everyone. A user from the marketing team, user2, needs to be able to read the file but not write to it. Which command should the administrator use to achieve this?

Accepted Answer

chmod 644 project_data.txt. `chmod 644` sets the file permissions to `rw-r--r--`, which grants read and write to the owner, read-only to the group, and read-only to others. Since the file is initially readable and writable by everyone (likely `666`), changing to `644` removes write access for the group and others while preserving read access for all, meeting the requirement that user2 (a marketing team member, presumably in the group or others category) can read but not write.

Answer

chmod 664 project_data.txt

Answer

chmod 755 project_data.txt

Answer

chmod 600 project_data.txt

Question 11

A company's network uses 802.1X authentication with PEAP-MSCHAPv2 on wired ports. Users report that after a recent switch firmware update, some workstations fail to authenticate intermittently, while others work fine. The authentication server logs show 'Authentication failed: Unknown CA certificate' for affected workstations. What is the most likely cause?

Accepted Answer

The switch is now using a different certificate that is not trusted by the clients. The error 'Unknown CA certificate' indicates that the client does not trust the certificate presented by the RADIUS server during PEAP-MSCHAPv2 authentication. After a switch firmware update, the switch may have been reconfigured to use a different server certificate (e.g., a self-signed or internally issued certificate) that is not in the trusted root store of the affected workstations. Since PEAP requires the client to validate the server certificate, a mismatch causes intermittent authentication failures.

Answer

The switch is not forwarding EAP packets properly due to a firmware bug

Answer

The RADIUS shared secret was changed during the firmware update

Answer

The authentication server (NPS) is overloaded and dropping requests

Question 12

A company is creating a business continuity plan. Which analysis should be performed first to identify critical business functions and their dependencies?

Accepted Answer

Business Impact Analysis (BIA). A Business Impact Analysis (BIA) is the first step in BCP to identify critical functions, dependencies, and recovery requirements.

Answer

Vulnerability assessment

Answer

Risk assessment

Answer

Gap analysis

Question 13

Which two of the following are characteristics of a stateful firewall? (Choose TWO.)

Accepted Answer

Tracks connection state. A stateful firewall tracks the state of active connections and can block unsolicited inbound traffic. Packet filtering is stateless, and application inspection is typical of proxy firewalls.

Answer

Inspects application-layer data

Answer

Operates only at Layer 3

Answer

Filters packets based on static rules only

Question 14

Match each network security concept to its purpose.

Accepted Answer

Firewall: Filters network traffic based on a set of security rules.. The correct matches are: Firewall filters traffic, IDS monitors and alerts, IPS blocks threats, VPN encrypts connections. Common confusions include swapping firewall and IPS functions, or confusing IDS with firewall capabilities.

Answer

Firewall: Detects and blocks suspicious activity.

Answer

IDS: Filters traffic based on rules.

Question 15

Based on the incident log, at which step did the incident response team contain the threat?

Accepted Answer

14:25 - Isolated WKS-045 from network. Containment is the immediate step to prevent the threat from spreading, and isolating WKS-045 from the network at 14:25 achieves this by cutting off its network connectivity. This aligns with the NIST SP 800-61 incident response lifecycle, where containment is prioritized before eradication or recovery. The log shows isolation occurred before scanning or removal, making it the correct containment action.

Answer

14:30 - Scanned system, detected Trojan.Downloader

Answer

14:45 - Removed malware via AV

Answer

14:35 - Escalated to incident handler

Question 16

An organization is implementing a new system that processes financial transactions. To reduce the risk of fraud, they ensure that no single individual can both initiate and approve a transaction. Which security principle is this?

Accepted Answer

Separation of duties. Separation of duties (SoD) is the security principle that prevents a single individual from having conflicting responsibilities, such as both initiating and approving a financial transaction. By splitting these tasks across different roles, the organization reduces the risk of fraud or error because collusion would be required to bypass controls. This is a core internal control mechanism in financial systems and aligns with the principle of dual control.

Answer

Need to know

Answer

Accountability

Answer

Least privilege

Question 17

Which of the following is an example of Type 2 (possession) authentication?

Accepted Answer

Smart card. A smart card is a physical item you possess, making it Type 2.

Answer

Answer

Password

Answer

Fingerprint scan

Question 18

Which THREE are valid methods for authenticating a user in an access control system?

Accepted Answer

Fingerprint scan. A fingerprint scan is a valid authentication method because it falls under 'something you are' (biometric authentication). In access control systems, biometrics like fingerprint scans provide a high level of assurance by verifying a unique physical characteristic of the user, making it a strong factor for authentication.

Answer

User ID

Answer

Access control list

Question 19

A company's primary data center is located in a region prone to hurricanes. The IT team is designing a disaster recovery plan to ensure critical applications resume within 4 hours of a declared disaster. Which of the following is the MOST appropriate recovery strategy?

Accepted Answer

Hot site with synchronous replication (RTO 1 hour, RPO near zero). A hot site with synchronous replication is the most appropriate strategy because it provides an RTO of 1 hour (well within the 4-hour requirement) and an RPO near zero, ensuring critical applications resume quickly with minimal data loss. Synchronous replication writes data to both primary and replica storage simultaneously, so in a hurricane scenario, the hot site is fully operational and ready to take over immediately.

Answer

Colocation with tape backups shipped offsite (RTO 24 hours, RPO 24 hours)

Answer

Cold site with weekly full backups (RTO 48 hours, RPO 7 days)

Answer

Warm site with daily incremental backups (RTO 6 hours, RPO 4 hours)

Question 20

A security analyst is reviewing event logs and notices multiple failed login attempts from a single IP address followed by a successful login. Which TWO actions should the analyst take next?

Accepted Answer

Escalate to the incident response team.. Options B and C are correct. Investigating the source IP address for malicious activity (C) helps determine if there is a broader threat, and escalating to the incident response team (B) ensures proper handling. The other options—disabling the account, blocking the IP at the firewall, or resetting the password—may be necessary later but should not be performed without further investigation.

Answer

Disable the user account immediately.

Answer

Block the IP address at the firewall.

Answer

Reset the password for the affected account.