ISC2 CC Practice Exam 59 — 20 Questions

Question 1

You are implementing a security control to prevent unauthorized devices from connecting to the corporate wired network. Which network access control method should be used?

Accepted Answer

802.1X authentication. 802.1X authentication (D) is the correct network access control method for preventing unauthorized devices from connecting to the corporate wired network because it requires devices to authenticate at the port level before gaining network access, providing strong security. VLAN segmentation (A) separates traffic but does not authenticate devices. MAC address filtering (B) can be easily bypassed by spoofing. Network Access Control (C) is a broader concept that may include 802.1X, but 802.1X is the specific technology that provides the authentication mechanism.

Answer

VLAN segmentation

Answer

MAC address filtering

Answer

Network Access Control (NAC) only

Question 2

Which metric defines the maximum acceptable amount of data loss measured in time?

Accepted Answer

Recovery Point Objective (RPO). The Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time, typically expressed in seconds, minutes, or hours. It represents the age of the most recent backup or replicated data that must be available to resume operations after a disaster, directly determining the frequency of backups or replication intervals.

Answer

Mean Time Between Failures (MTBF)

Answer

Mean Time to Repair (MTTR)

Answer

Recovery Time Objective (RTO)

Question 3

Which TWO of the following are examples of detective security controls? (Choose two.)

Accepted Answer

Security logging and monitoring.. Security logging and monitoring (B) and intrusion detection system (IDS) alerts (C) are detective controls because they identify and record security events after they occur. Data backup and restoration (A) is corrective, encryption (D) is preventive, and firewall rules (E) are preventive.

Answer

Data backup and restoration procedures.

Answer

Encryption of sensitive data.

Answer

Firewall rules that block certain traffic.

Question 4

A SOC analyst notices that a large volume of outbound traffic is occurring from a single workstation to an external IP address known to be associated with a command-and-control server. What is the most likely conclusion?

Accepted Answer

The workstation is infected with malware that is beaconing to the attacker. The large volume of outbound traffic from a single workstation to a known command-and-control (C2) server is a classic indicator of malware beaconing. Beaconing involves the infected host periodically sending small packets or HTTP/HTTPS requests to the C2 server to receive instructions or exfiltrate data, which matches the observed behavior. This is distinct from legitimate traffic patterns because the destination IP is specifically associated with malicious activity.

Answer

The network is experiencing a denial of service attack

Answer

The user is streaming video from a blocked site

Answer

The workstation is performing a legitimate software update

Question 5

During an incident, a security analyst identifies a SQL injection attack. The team contains the threat by blocking the attacker's IP. Which step should be performed next in the incident response process?

Accepted Answer

Eradication. After containment, the next step is eradication to remove the root cause (e.g., fix the vulnerability) before recovery.

Answer

Detection

Answer

Lessons Learned

Answer

Recovery

Question 6

Which phase of the incident response process involves restoring systems to normal operation and applying patches to prevent recurrence?

Accepted Answer

Recovery. Eradication removes the cause, and recovery restores systems. The question describes both eradication (patches) and recovery (restore), but 'recovery' is the phase where normal operations resume after eradication.

Answer

Containment

Answer

Eradication

Answer

Detection

Question 7

An organization experiences a denial-of-service (DoS) attack. Which TWO actions should the incident response team take during the containment phase? (Select two.)

Accepted Answer

Disconnect affected servers from the network. Containment aims to limit damage. Filtering traffic and disconnecting affected systems are typical containment actions for a DoS attack.

Answer

Restore systems from backup

Answer

Notify law enforcement

Answer

Conduct a root cause analysis

Question 8

Which is a key benefit of a cold site as a recovery location?

Accepted Answer

Low cost. A cold site is a backup facility that provides only the physical infrastructure (power, cooling, and space) but no pre-installed hardware or live data. Because it lacks equipment and requires manual setup before recovery can begin, it has the lowest capital and operational costs among recovery site options, making low cost its key benefit.

Answer

Real-time data synchronization

Answer

Reduced need for testing

Answer

Fast recovery time

Question 9

A security administrator needs to ensure that only authorized personnel can access the server room. Which physical control is most appropriate?

Accepted Answer

Biometric access control system. A biometric access control system uses unique biological traits for authentication, providing strong physical security. Option A (Mantrap) is used for high-security areas but is more complex and expensive. Option B (Keypad lock) is less secure because codes can be shared. Option D (Video surveillance) is detective, not preventive. Biometric access (Option C) is the best fit for this requirement.

Answer

Mantrap with card reader

Answer

Keypad lock with a shared code

Answer

Video surveillance cameras

Question 10

A company's security policy requires that employees must change their passwords every 90 days and passwords must be at least 12 characters. Which security principle is being enforced?

Accepted Answer

Integrity. Password complexity and expiration policies enforce the integrity of authentication. By requiring strong, regularly changed passwords, the system ensures that only authorized users can access resources, protecting the integrity of the access control mechanism. Confidentiality (D) is about secrecy of data, but the primary goal here is to prevent unauthorized access, which upholds integrity. Availability (B) and non-repudiation (C) are not directly enforced by this policy.

Answer

Availability

Answer

Non-repudiation

Answer

Confidentiality

Question 11

An organization requires that two different administrators approve changes to firewall rules. This is an example of which security principle?

Accepted Answer

Separation of duties. Separation of duties requires multiple people to complete a sensitive task to reduce fraud and errors. Option C is correct. Option A (least privilege) limits permissions. Option B (defense in depth) uses layers. Option D (need-to-know) restricts data access.

Answer

Least privilege

Answer

Defense in depth

Answer

Need-to-know

Question 12

Which TWO of the following are best practices for implementing the principle of least privilege?

Accepted Answer

Assign permissions based on the minimum necessary to perform job functions. Options B and E are correct. The principle of least privilege dictates that users should be granted only the permissions necessary to perform their job functions (B), and those permissions should be regularly reviewed and revoked when no longer needed (E). Granting all users full administrative rights (A) violates least privilege. Using a single shared administrative account (C) removes accountability and is not a least privilege practice. Removing default accounts (D) is a security best practice but does not directly implement least privilege.

Answer

Grant all users full administrative rights to reduce support calls

Answer

Use a single shared administrative account for all IT staff

Answer

Remove all default accounts from systems

Question 13

When designing a secure network, which TWO of the following are fundamental security principles that should be applied?

Accepted Answer

Fail secure. Fail secure ensures the system remains secure on failure. Least privilege restricts access to the minimum. The other options are important but less fundamental in network design.

Answer

Complete mediation

Answer

Open design

Answer

Economy of mechanism

Question 14

Which TWO of the following are examples of preventive security controls?

Accepted Answer

Antivirus software. Firewalls and antivirus software are preventive controls that block or stop attacks. IDS is detective, encryption is protective but not primarily preventive, and backup is corrective.

Answer

Encryption

Answer

Backup

Answer

Intrusion detection system

Question 15

Which TWO of the following are examples of administrative security controls?

Accepted Answer

Security policies and procedures. Options D and E are correct because security policies and procedures (D) and security awareness training (E) are administrative controls. Firewall rule sets (A) are technical controls. Data encryption (B) is a technical control. Biometric access controls (C) are physical/technical controls.

Answer

Firewall rule sets

Answer

Data encryption

Answer

Biometric access controls

Question 16

Refer to the exhibit. An access control policy is shown. Which action is permitted by this policy?

Accepted Answer

Read objects from the container.. The policy grants the read permission, which allows reading objects from the specified container. This action corresponds to downloading or retrieving the content of an object, making option D correct.

Answer

Upload objects to the container.

Answer

List all objects in the container.

Answer

Delete objects from the container.

Question 17

A security analyst receives an alert from the SIEM indicating a potential data exfiltration event. The alert shows a large volume of data being transferred to an external IP address during non-business hours. What is the MOST appropriate immediate action?

Accepted Answer

Verify whether the transfer is authorized.. The most appropriate immediate action when a SIEM alert indicates potential data exfiltration is to first verify whether the transfer is authorized (Option A). This prevents unnecessary disruption of critical services and avoids false positives. Option B (calling the employee) is premature and may alert a malicious insider prematurely. Option C (disconnecting the server) could cause business impact and should only be done after confirmation of unauthorized activity. Option D (running an antivirus scan) does not address the exfiltration event and is not the first step in incident response.

Answer

Call the employee who owns the server.

Answer

Disconnect the affected server from the network.

Answer

Run an antivirus scan on the server.

Question 18

Which of the following is a best practice for securing physical access to a data center?

Accepted Answer

Implement mantrap entry with biometric verification.. A mantrap entry with biometric verification provides strong physical access control by preventing tailgating and requiring unique biometric credentials. Option A weakens security as personal badges can be shared or duplicated. Option C is insufficient because CCTV only at the main entrance leaves other areas unmonitored. Option D single-factor authentication is insufficient for high-security areas like data centers.

Answer

Allow employees to use personal badges for entry.

Answer

Install CCTV only at the main entrance.

Answer

Use a single-factor authentication for all doors.

Question 19

Refer to the exhibit. An analyst sees these logs. What type of attack is occurring?

Accepted Answer

Brute-force attack. The logs show repeated failed login attempts from the same IP address. This pattern is characteristic of a brute-force attack, where an attacker tries many password combinations to gain unauthorized access. Phishing involves tricking users into revealing credentials, SQL injection targets database queries, and port scans probe for open ports.

Answer

Phishing

Answer

SQL injection

Answer

Port scan

Question 20

According to the NIST incident response lifecycle, which three phases are considered the core phases?

Accepted Answer

Containment, Eradication, and Recovery. The NIST incident response lifecycle (SP 800-61) defines four phases: Preparation, Detection and Analysis, Containment Eradication and Recovery, and Post-Incident Activity. The core phases that form the active response cycle are Preparation (option E), Detection and Analysis (option D), and Containment Eradication and Recovery (option B). These three are the essential operational phases, while Post-Incident Activity is a follow-up phase. Options A and C are not separate phases but activities within other phases.

Answer

Root cause analysis

Answer

Incident declaration