ISC2 CC Practice Exam 58 — 20 Questions

Question 1

A security analyst is reviewing a log that shows an unauthorized user attempted to modify a payroll database. Which security principle is most directly threatened?

Accepted Answer

Integrity. Integrity ensures that data remains accurate, complete, and unaltered unless modified by authorized parties. The unauthorized attempt to modify the payroll database directly threatens this principle because it aims to change data without permission, compromising its trustworthiness. Confidentiality, non-repudiation, and availability are not the primary concerns here, as the focus is on unauthorized modification, not disclosure, proof of origin, or access disruption.

Answer

Confidentiality

Answer

Non-repudiation

Answer

Availability

Question 2

A retail chain wants to reduce the chance that a former employee can still access the point-of-sale system weeks after leaving the company. The security manager proposes a control that automatically disables accounts on the employee's last working day. Which type of control is this?

Accepted Answer

Preventive. Automated account deactivation on the last working day stops unauthorized access before it can happen, which defines a preventive control. Detective controls would only reveal misuse after the fact, corrective controls would remediate damage already done, and compensating controls are alternate measures when a primary control is not feasible. Since the control blocks the event itself, preventive is the correct classification.

Answer

Detective

Answer

Compensating

Answer

Corrective

Question 3

A security analyst is reviewing endpoint logs and sees repeated entries showing that a process attempted to modify the Windows registry key HKLM\SYSTEM\CurrentControlSet\Control\Lsa and then attempted to read the SAM database file. The process is not a known administrative tool and was launched from a user's temporary folder. Which type of activity is MOST likely occurring?

Accepted Answer

Privilege escalation and credential dumping attempts. The combination of modifying the LSA registry key and reading the SAM database from an unknown process in a user temp folder is a strong indicator of credential dumping and privilege escalation. These actions are commonly performed by tools like Mimikatz or custom malware to extract password hashes. Recognizing this pattern helps analysts quickly identify a potential compromise.

Answer

Routine operating system patch installation

Answer

Normal user profile creation by the operating system

Answer

Antivirus signature update process

Question 4

A retail chain is redesigning its network security and wants to reduce the attack surface on its point-of-sale (POS) systems. The company asks a security architect to identify two controls that directly limit what a compromised POS system can reach on the corporate network. (Choose two.)

Accepted Answer

Deploy a host-based firewall on each POS system with rules that allow only the payment application and management agent.. A dedicated POS VLAN with a restrictive ACL and a host-based firewall on each terminal both enforce least privilege on network reachability. The VLAN and ACL stop lateral movement at the network layer, while the host firewall restricts the endpoint's own traffic to only necessary services. Antivirus, password complexity, and full-disk encryption improve other areas but do not limit what a compromised POS system can reach.

Answer

Require a complex password on the local administrator account of each POS system.

Answer

Enable full-disk encryption on the POS system drives to protect data at rest.

Answer

Install an antivirus agent on each POS system and schedule a full scan every night.

Question 5

A security analyst is reviewing email gateway logs and notices a message that passed authentication checks but contains a URL pointing to a look-alike domain registered three days ago. The message appears to come from the organization's CEO and requests an urgent wire transfer. Which type of attack is MOST likely being attempted?

Accepted Answer

Business email compromise (BEC). Business email compromise (BEC) is a social engineering attack where cybercriminals impersonate executives or trusted partners to trick employees into transferring funds or sharing sensitive information. The combination of an urgent wire transfer request, a spoofed CEO identity, and a newly registered look-alike domain strongly indicates BEC. Other attack types do not align with the described email-based deception and financial motive.

Answer

Cross-site scripting (XSS)

Answer

SQL injection

Answer

Distributed denial-of-service (DDoS) attack

Question 6

A security analyst at a mid-sized company is reviewing network traffic logs and notices that an internal host is repeatedly sending TCP SYN packets to many different external IP addresses on port 443, but never completing the three-way handshake. The analyst suspects a malware infection. Which type of attack is most likely occurring?

Accepted Answer

SYN flood. The host is sending numerous TCP SYN packets to various external IP addresses on port 443 without completing the three-way handshake. This pattern indicates a SYN flood attack, where the attacker attempts to exhaust connection resources on targets. The host is likely part of a botnet. The other options describe different attack types that do not match the observed traffic pattern.

Answer

MAC flooding

Answer

Smurf attack

Answer

Ping flood

Question 7

A payroll clerk can view and edit employee salary records but cannot approve her own expense reimbursements, even though she processes reimbursements for other staff. Which access control principle does the restriction on approving her own reimbursements best illustrate?

Accepted Answer

Separation of duties. Separation of duties ensures that a single person cannot complete a sensitive transaction alone, reducing the risk of fraud or undetected error. Since the clerk can process reimbursements but is barred from approving her own, the organization has split control of the payment process across multiple people, which is exactly what separation of duties accomplishes.

Answer

Least privilege

Answer

Mandatory access control

Answer

Need to know

Question 8

A healthcare provider's incident response team is handling a breach of patient records. The team has contained the breach and is now eradicating the threat. Which of the following activities is MOST appropriate during the eradication phase?

Accepted Answer

Applying security patches to the vulnerable server. During eradication, the incident response team focuses on eliminating the root cause of the incident, such as patching vulnerabilities, removing malware, and disabling compromised accounts. Applying security patches to the vulnerable server directly addresses the flaw that enabled the breach. Notification, restoration, and lessons-learned are activities for later phases.

Answer

Restoring patient records from a clean backup

Answer

Conducting a lessons-learned meeting with the incident response team

Answer

Notifying affected patients about the data breach

Question 9

A security analyst is reviewing access control models. Which two of the following are characteristics of the principle of least privilege? (Choose two.)

Accepted Answer

Users are granted only the minimum access rights necessary to perform their job functions.. The correct answers are granting only minimum necessary access and limiting access duration to when needed. These directly reflect the principle of least privilege, which aims to restrict user rights to the bare minimum required for their duties and only for as long as necessary. Role-based access, default read-only access, and permanent admin rights do not embody least privilege.

Answer

Administrative privileges are permanently assigned to senior management.

Answer

All users are granted read-only access to all resources by default.

Answer

Access rights are based on the user's role within the organization.

Question 10

A security manager is conducting a risk assessment for a new cloud-based customer relationship management (CRM) system. The manager needs to identify which of the following are considered threats rather than vulnerabilities or risks. (Choose two.)

Accepted Answer

A hacker group known for targeting SaaS providers. In risk management, a threat is any actor or event with the potential to cause harm, such as a hacker group or a natural disaster. Vulnerabilities are weaknesses that can be exploited, like unpatched software or weak password policies. Risk is the potential for loss when a threat exploits a vulnerability. The question asks for threats, so the hacker group and natural disaster are correct.

Answer

Weak password policy allowing easy guessing

Answer

The potential financial loss from a data breach

Answer

Unpatched software in the CRM application

Question 11

A small clinic stores patient records on a server. The IT administrator ensures that only authorized staff can view these records, and that the records remain accurate and available when needed. Which security principle is best illustrated by restricting access to the records?

Accepted Answer

Confidentiality. The correct answer is confidentiality. Restricting access to patient records ensures that only authorized individuals can view them, directly supporting the confidentiality principle. Integrity, availability, and non-repudiation address different aspects of information security and are not the primary focus of the described action. Confidentiality is a foundational concept in the CIA triad and is specifically about preventing unauthorized disclosure.

Answer

Non-repudiation

Answer

Integrity

Answer

Availability

Question 12

A financial services firm grants tellers access to the transaction system only between 8:00 a.m. and 6:00 p.m. on business days, regardless of the teller's role. Access requests outside that window are automatically denied, and the restriction is enforced by a centrally managed policy that tellers cannot modify. Which access control approach is being applied?

Accepted Answer

Rule-based access control, because access is granted or denied according to a defined condition rather than individual identity.. Rule-based access control makes decisions from objective, administrator-defined conditions rather than from individual identity or job role. Restricting transaction access to a fixed time window on business days is a textbook condition, and it applies to every teller identically while remaining outside user control. The uniformity and condition-driven nature distinguish it from role-based, discretionary, and mandatory approaches.

Answer

Mandatory access control, because the system enforces the restriction without user involvement.

Answer

Role-based access control, because tellers form a job role that shares the same permissions.

Answer

Discretionary access control, because a manager decides which tellers receive transaction access.

Question 13

A security analyst is evaluating the risk of a ransomware attack on a company's file server. The analyst determines that the likelihood of an attack is high and the potential impact is severe. However, the company has a reliable offline backup that can restore all data within four hours. How should the analyst classify the risk?

Accepted Answer

The risk is moderate because the backup reduces the impact, but likelihood remains high.. The analyst should classify the risk as moderate. Although the likelihood of a ransomware attack is high, the reliable offline backup significantly reduces the potential impact by enabling rapid restoration. Risk is the combination of likelihood and impact; with high likelihood but reduced impact, the overall risk is moderate. This reflects the residual risk after considering the mitigating control.

Answer

The risk is low because the backup can restore data quickly.

Answer

The risk is eliminated because the backup ensures full recovery.

Answer

The risk is high because the likelihood and impact are both high.

Question 14

A software vendor wants customers to verify that a downloadable patch truly came from the vendor and was not modified in transit. The vendor signs the patch with its private key. Which security property does this provide to customers who verify the signature with the vendor's public key?

Accepted Answer

Non-repudiation and integrity. A digital signature created with a private key and verified with the corresponding public key provides authenticity, integrity, and non-repudiation. Customers can confirm the patch came from the vendor and was not modified, and the vendor cannot later deny signing it. Confidentiality, availability, and authorization are separate properties not delivered by this signing and verification process.

Answer

Confidentiality of the patch contents

Answer

Authorization of the customer

Answer

Availability of the download server

Question 15

A network administrator is configuring a new wireless network for a small office. The office has sensitive data and wants to ensure that all wireless traffic is encrypted and that users authenticate with unique credentials. Which security protocol should the administrator implement?

Accepted Answer

WPA2-Enterprise. WPA2-Enterprise provides both strong encryption and unique user authentication via 802.1X and a RADIUS server. This ensures that each user has distinct credentials and that wireless traffic is encrypted. The other options either lack unique authentication (WPA2-Personal, Open) or are insecure (WEP, Open).

Answer

Open authentication

Answer

WEP

Answer

WPA2-Personal

Question 16

A financial services firm is designing a network that must allow inbound HTTPS from the internet to a public web application while preventing any direct inbound connections to its internal database servers. The security architect proposes placing the web application in a screened subnet and configuring rules so the database can be reached only from the web application. Which design element is the architect primarily relying on?

Accepted Answer

A demilitarized zone (DMZ) with controlled access between zones. The architect needs a screened subnet for the public web application plus enforced rules controlling traffic between the internet, the DMZ, and internal systems. A DMZ with controlled access accomplishes this by allowing inbound HTTPS to the web tier while denying direct inbound access to database servers. A flat network, NAT alone, or a hub topology lacks the required separation and rule enforcement.

Answer

A hub-based network topology

Answer

A flat network with a single perimeter firewall

Answer

Network address translation (NAT) alone

Question 17

A security operations center (SOC) receives an alert about a possible insider threat. An employee in the finance department has been accessing large amounts of sensitive data outside of normal working hours and emailing it to a personal external email address. The SOC manager asks the analyst to preserve evidence for a potential legal case. Which of the following should the analyst do FIRST to ensure the evidence is admissible?

Accepted Answer

Document the chain of custody for all evidence collected.. For evidence to be admissible in a legal case, a proper chain of custody must be established and documented from the outset. This ensures that the evidence has not been tampered with and can be traced from collection to presentation. While imaging and containment are important, they come after initiating the chain of custody to maintain integrity.

Answer

Create a forensic image of the employee's workstation hard drive.

Answer

Confront the employee and ask for an explanation.

Answer

Disable the employee's network access immediately.

Question 18

A security administrator is configuring a firewall rule to allow only HTTP and HTTPS traffic from the internal network to the internet. Which port numbers should be permitted?

Accepted Answer

TCP 80 and TCP 443. HTTP operates on TCP port 80, and HTTPS operates on TCP port 443. To allow only web traffic, the firewall must permit these ports. Other ports correspond to different services such as FTP, SSH, SMTP, POP3, or DNS, which are not required for web browsing. Therefore, the correct ports are 80 and 443.

Answer

TCP 53 and UDP 53

Answer

TCP 21 and TCP 22

Answer

TCP 25 and TCP 110

Question 19

A company's security policy requires that all outbound web traffic be inspected for malware and that users be prevented from accessing known malicious domains. The security team wants a single appliance that can decrypt TLS sessions, apply content filters, and block threats inline. Which solution best meets these requirements?

Accepted Answer

A next-generation firewall with TLS inspection and threat prevention. The policy requires inline inspection of encrypted outbound traffic, content filtering, and malware blocking in one appliance. A next-generation firewall with TLS inspection and threat prevention provides all of these capabilities. Stateful firewalls lack content inspection, IDS is passive, and WAFs focus on inbound application attacks rather than outbound browsing.

Answer

A stateful packet-filtering firewall

Answer

A web application firewall (WAF) protecting internal servers

Answer

A standalone intrusion detection system (IDS)

Question 20

A junior administrator at a healthcare company receives a call from someone claiming to be from the IT help desk. The caller says there is a critical server issue and asks the administrator to read back the six-digit code just sent to their phone. The administrator has not requested any password reset or MFA challenge. Which social engineering principle is the caller most likely exploiting?

Accepted Answer

Authority combined with urgency, because the caller impersonates support staff and pressures the administrator to act immediately.. The caller fabricates a critical server problem while posing as help desk personnel, which combines impersonated authority with manufactured urgency. Because the administrator never initiated an MFA challenge, no legitimate support process would require the code to be read aloud. The correct response is to refuse, hang up, and verify through a known internal channel. This scenario tests recognition of pretexting and MFA code theft.

Answer

Reciprocity, because the caller previously helped the administrator with a ticket and now expects a favor in return.

Answer

Consensus, because the caller claims that other administrators have already shared their codes to fix the same problem.

Answer

Scarcity, because the caller implies that only a limited number of support slots are available for the server repair.