ISC2 CC Practice Exam 58 — 20 Questions

Question 1

Which THREE of the following are important steps in the incident response process as defined by the NIST framework? (Choose three.)

Accepted Answer

Detection and Analysis. Preparation (D), Detection and Analysis (A), and Containment, Eradication, and Recovery (C) are the core phases. Vulnerability scanning (B) is part of ongoing security, not incident response. Post-incident auditing (E) is a compliance activity.

Answer

Vulnerability scanning

Answer

Post-incident auditing

Question 2

Which of the following is an example of a detective control?

Accepted Answer

Intrusion Detection System (IDS). An Intrusion Detection System (IDS) is a detective control because it monitors and analyzes network traffic to detect and alert on suspicious activity. Security awareness training is a preventive/deterrent control. A firewall is a preventive control. Encryption is a preventive control.

Answer

Security awareness training

Answer

Firewall

Answer

Encryption

Question 3

During a penetration test, an analyst discovers that a company's internal network has a switch configured with port security that allows only one MAC address per port. However, the analyst is able to plug a rogue device into a wall jack and successfully gain network access. What is the most likely weakness in this configuration?

Accepted Answer

The switchport uses sticky MAC learning, and the attacker used a MAC spoofing attack to mimic an authorized device.. Port security with sticky MAC learning records the first MAC address seen on a port and then restricts access to that address only. However, if an attacker spoofs the MAC address of an already-authorized device, the switch sees the spoofed MAC as valid and permits access, bypassing the one-MAC-per-port restriction. This is a common bypass when sticky MAC is used without additional protections like 802.1X or MAC authentication bypass (MAB).

Answer

The administrator configured 'port-security maximum 1' but forgot to enable 'port-security' globally.

Answer

The switchport security violation mode is set to 'shutdown' instead of 'restrict'.

Answer

The switchport is configured as an access port but the rogue device is using a VLAN trunk.

Question 4

After a security incident, the incident response team closes the case. What is the MOST important final step to improve future security posture?

Accepted Answer

Conduct a post-incident review and update policies. The post-incident review (often called a lessons-learned meeting) is the final step that analyzes root causes, identifies gaps in detection or response, and drives updates to policies, playbooks, and security controls. Without this review, the same vulnerability or misconfiguration could be exploited again, even if immediate containment steps like credential revocation or patching were performed. The goal is to close the incident with a feedback loop that improves the overall security posture, not just restore operations.

Answer

Revoke all compromised credentials

Answer

Patch all systems

Answer

Restore all systems from backup

Question 5

A security analyst detects unusual outbound network traffic from a server that typically only handles internal file sharing. The traffic appears to be exfiltrating sensitive data. Which phase of the incident response process should the analyst initiate next?

Accepted Answer

Analysis. After detection (phase 2), the next step is analysis to confirm the incident and understand its scope before containment.

Answer

Containment

Answer

Lessons learned

Answer

Eradication

Question 6

A financial institution is implementing a new transaction approval process. The process requires that for any transaction over $10,000, two managers must approve: one from the sales department and one from the finance department. However, due to a system configuration error, a single manager can approve the entire transaction if they are logged in from a specific IP address. This error is discovered during a routine audit. Which security principle has been circumvented, and what is the best remediation?

Accepted Answer

Separation of duties; fix the configuration to require approvals from two different managers. Correct: Separation of duties is circumvented because the system allowed a single manager to approve large transactions. The best remediation is to fix the configuration to require approvals from two different managers, as stated in option A. Option B (Defense in depth) is not the core principle violated, and adding a third approval does not fix the single-approval flaw. Option C (Accountability) is important but does not prevent the circumvention. Option D (Least privilege) is about reducing access, not about requiring dual approval.

Answer

Defense in depth; add a third approval for transactions over $50,000

Answer

Accountability; log all approvals and audit monthly

Answer

Least privilege; reduce the transaction limit to $5,000

Question 7

After a ransomware attack, the company wants to ensure that critical data can be restored. Which principle is being addressed?

Accepted Answer

Availability. Correct: C - Availability. Availability ensures data is accessible when needed, and backups are a key control. Option A is wrong because integrity ensures data accuracy. Option B is wrong because confidentiality prevents unauthorized disclosure. Option D is wrong because non-repudiation ensures actions cannot be denied.

Answer

Integrity

Answer

Confidentiality

Answer

Non-repudiation

Question 8

A security team configures a system to record all user activities for audit purposes. Which principle is being applied?

Accepted Answer

Accountability. Correct: A - Accountability. Accountability ensures actions can be traced to an individual through logging. Option B is wrong because integrity ensures data accuracy and prevents unauthorized modification. Option C is wrong because authentication verifies identity. Option D is wrong because confidentiality prevents unauthorized disclosure.

Answer

Integrity

Answer

Authentication

Answer

Confidentiality

Question 9

A security professional is evaluating a system that uses a trust model where every component authenticates to each other before communicating. Which security principle does this model exemplify?

Accepted Answer

Defense in depth. Defense in depth is the security principle of using multiple layers of defense to protect assets. In this scenario, requiring every component to authenticate to each other before communication adds a layer of verification, which is consistent with the defense in depth approach. Option A (Least privilege) is incorrect because it focuses on granting only necessary permissions, not on mutual authentication. Option B (Separation of duties) is incorrect as it involves splitting tasks among multiple people to prevent fraud, not authentication requirements. Option C (Non-repudiation) is incorrect because it ensures that an action cannot be denied, typically through logs or signatures, not mutual authentication.

Answer

Least privilege

Answer

Separation of duties

Answer

Non-repudiation

Question 10

A company uses encryption to protect data at rest and in transit. This primarily addresses which aspect of the CIA triad?

Accepted Answer

Confidentiality. Encryption prevents unauthorized access to data, thereby maintaining confidentiality. Option A (Integrity) is wrong because while encryption can support integrity through hashing, its primary role is confidentiality. Option B (Authentication) is wrong because encryption alone does not verify identity; authentication requires separate mechanisms like digital signatures. Option D (Availability) is wrong because encryption does not ensure data is accessible; it protects data from unauthorized access.

Answer

Integrity

Answer

Authentication

Answer

Availability

Question 11

A company implements two-factor authentication (2FA) for all remote access. Which primary security goal is this enhancing?

Accepted Answer

Confidentiality. 2FA strengthens authentication, ensuring only authorized users access data, thereby protecting confidentiality. Option A (Availability) is about system uptime and access. Option B (Integrity) is about data accuracy. Option D (Non-repudiation) is about proof of actions. Therefore, 2FA primarily enhances confidentiality.

Answer

Availability

Answer

Integrity

Answer

Non-repudiation

Question 12

Which TWO of the following are core components of the CIA triad?

Accepted Answer

Confidentiality. Confidentiality, Integrity, and Availability are the three core principles. Authentication and Non-repudiation are additional security goals.

Answer

Authentication

Answer

Non-repudiation

Answer

Authorization

Question 13

A company wants to allow remote employees to securely access internal resources over the internet. Which technology is most appropriate?

Accepted Answer

VPN. A VPN (Virtual Private Network) creates an encrypted tunnel over the internet, typically using protocols like IPsec or TLS, to securely connect remote users to internal resources. This ensures confidentiality, integrity, and authentication of data in transit, making it the standard solution for remote access security.

Answer

NAT

Answer

VLAN

Answer

DMZ

Question 14

An organization decides to implement an Intrusion Prevention System (IPS) to protect its network. Which statement about an IPS compared to an IDS is correct?

Accepted Answer

An IPS is placed inline and can automatically block malicious traffic.. An IPS is inline and can actively block traffic, while an IDS is passive and only alerts.

Answer

An IPS is placed out of band and monitors traffic.

Answer

An IPS generates alerts but does not block traffic.

Answer

An IPS operates only at the application layer.

Question 15

A company's IDS generates an alert for a potential SQL injection attack on a web application. The analyst reviews the log and sees the following: "SELECT * FROM users WHERE username = 'admin' OR 1=1 --'". Which action should the analyst take next?

Accepted Answer

Verify if the WAF blocked the attack. The analyst's first priority is to determine whether the attack was actually successful or was already mitigated. A Web Application Firewall (WAF) sits in front of the web application and can inspect and block SQL injection payloads before they reach the database. By verifying the WAF logs, the analyst can confirm if the attack was blocked, which dictates the next steps—if blocked, no immediate escalation is needed; if not blocked, further investigation is required.

Answer

Submit a change request to patch the application

Answer

Conduct a forensic analysis of the database

Answer

Block the source IP immediately

Question 16

A system administrator needs to grant a contractor temporary access to a server for patching. The contractor should only have access during the patching window. Which access control implementation method is most appropriate?

Accepted Answer

Time-based ACL (rule-based access control). Time-based ACLs (rule-based access control) allow the administrator to define a specific time range during which the contractor's access is permitted. This directly matches the requirement for temporary access only during the patching window, as the ACL can be configured with a time-range object that automatically enables and disables the permit statement without manual intervention.

Answer

Group-based permissions with a recurring schedule

Answer

Discretionary access control (DAC)

Answer

Mandatory access control (MAC)

Question 17

Which TWO of the following are examples of implementing the principle of least privilege?

Accepted Answer

Assigning a database administrator only the permissions required for their specific tasks. The correct answers are B and E. Option B assigns a database administrator only the permissions required for their tasks, directly applying least privilege. Option E grants a user only read-only access to a file they need to view, also minimizing privileges. Option A (security camera) is a physical security control, not least privilege. Option C (two-factor authentication) is an example of defense in depth. Option D (firewall rule) is a network security measure.

Answer

Installing a security camera at the data center entrance

Answer

Requiring two-factor authentication for system administrators

Answer

Implementing a firewall to block all incoming traffic except on port 443

Question 18

A system administrator must grant a help desk technician the ability to reset user passwords but not change user roles. Which security principle does this scenario enforce?

Accepted Answer

Principle of least privilege. Principle of least privilege. This principle ensures that users are granted only the permissions necessary to perform their job functions. Granting password reset but not role changes adheres to least privilege. Option A (accountability) involves tracking actions to specific users. Option C (need-to-know) restricts access to information based on necessity. Option D (non-repudiation) ensures actions cannot be denied.

Answer

Accountability

Answer

Need-to-know

Answer

Non-repudiation

Question 19

A company requires employees to use biometric authentication to access the data center. This is an example of which security principle?

Accepted Answer

Authentication. Correct: A - Authentication. Authentication is the process of verifying the identity of a user, and biometrics is one method. Option B is wrong because availability ensures systems are accessible. Option C is wrong because integrity ensures data accuracy. Option D is wrong because non-repudiation ensures actions cannot be denied, not identity verification.

Answer

Availability

Answer

Integrity

Answer

Non-repudiation

Question 20

A system administrator accidentally grants a user full administrative rights instead of read-only. Which control would best detect this error?

Accepted Answer

Detective control. Detective controls, such as audit logs and monitoring, identify misconfigurations after they occur. Option A (Preventive) blocks errors. Option B (Deterrent) discourages. Option C (Corrective) fixes issues. Option D (Detective) detects the error.

Answer

Preventive control

Answer

Deterrent control

Answer

Corrective control