ISC2 CC Practice Exam 59 — 20 Questions

Question 1

An organization implements a defense-in-depth strategy by deploying firewalls, intrusion detection systems, and endpoint protection. Which security principle does this approach primarily demonstrate?

Accepted Answer

Defense in depth. The correct answer is defense in depth. This principle involves implementing multiple layers of security controls so that if one fails, others still provide protection. Firewalls, intrusion detection systems, and endpoint protection are classic examples of layered defenses. Least privilege, separation of duties, and zero trust are related but distinct concepts that do not directly describe the scenario.

Answer

Least privilege

Answer

Separation of duties

Answer

Zero trust

Question 2

A hospital's radiology department transmits large medical images to a remote clinic over a public network. The security team must ensure that the images cannot be read or modified in transit, and that the remote clinic can verify the images came from the hospital. Which combination of controls should the team use?

Accepted Answer

IPsec in tunnel mode with confidentiality and data origin authentication enabled.. IPsec in tunnel mode with ESP confidentiality and authentication provides encryption for the images and cryptographically verifies the hospital as the origin. The remote clinic can validate the sender and detect any modification in transit. TLS with a certificate issued to the wrong party, shared SFTP credentials, and unencrypted GRE do not meet both requirements.

Answer

SFTP with a shared username and password for the radiology and clinic staff.

Answer

A site-to-site VPN using GRE without encryption or authentication.

Answer

TLS 1.3 with a server certificate issued to the remote clinic.

Question 3

A small retail company is developing its first incident response plan. The owner asks which phase of the incident response lifecycle involves developing policies, assigning roles, and acquiring tools. Which phase should be recommended?

Accepted Answer

Preparation. The preparation phase is where organizations develop incident response policies, define team roles, and acquire tools and resources. It is the foundation of the incident response lifecycle. Detection and analysis, containment/eradication/recovery, and post-incident activity are subsequent phases that depend on preparation. For a small retail company starting from scratch, preparation is the essential first step.

Answer

Containment, eradication, and recovery

Answer

Post-incident activity

Answer

Detection and analysis

Question 4

A defense contractor classifies documents as Public, Internal, Secret, and Top Secret. A user with Secret clearance attempts to open a Top Secret document and is denied, while a user with Top Secret clearance can open both Top Secret and Secret documents. Which access control model does this behavior describe?

Accepted Answer

Mandatory access control, because access is determined by comparing the subject's clearance to the object's classification label.. Mandatory access control relies on sensitivity labels attached to objects and clearances assigned to subjects, with the system enforcing the relationship. A subject may read an object only when their clearance dominates the object's classification, which is exactly why Secret cannot reach Top Secret and Top Secret can reach Secret. Users cannot alter these labels, making enforcement mandatory rather than discretionary.

Answer

Rule-based access control, because a fixed rule set decides every access request.

Answer

Role-based access control, because permissions follow the user's assigned job role.

Answer

Discretionary access control, because the document owner decides who may read each file.

Question 5

An analyst reviewing traffic captures sees a workstation repeatedly sending TCP packets with the SYN flag set to many different destination ports on a single server, but the workstation never completes the three-way handshake. The server's connection table is becoming exhausted. Which type of activity is most likely occurring?

Accepted Answer

A SYN flood denial-of-service attack. The repeated SYN packets without completed handshakes indicate a SYN flood, a denial-of-service technique that exhausts a server's pending connection queue. The server cannot complete legitimate connections because its backlog is full. Other attacks would involve different protocols or completed sessions, so the half-open TCP pattern is the key differentiator.

Answer

A man-in-the-middle attack intercepting session traffic

Answer

A smurf amplification attack using ICMP

Answer

A brute-force password attack against the server

Question 6

A security administrator discovers that a former employee's user account still exists and remains enabled three weeks after their termination. The account has valid credentials and no recent logins. Which access control principle has been violated?

Accepted Answer

Account lifecycle management. Proper account lifecycle management ensures accounts are created, reviewed, and removed in step with a person's employment status. A terminated employee retaining an enabled account violates the deprovisioning requirement. Even though the account shows no recent logins, the credential remains a live risk because it could be used by the former employee or anyone who obtained the password. Timely disablement closes that exposure.

Answer

Separation of duties

Answer

Defense in depth

Answer

Least privilege

Question 7

A company's security policy requires that all remote employees use a technology that creates an encrypted tunnel over the public internet so their traffic appears to originate from the corporate network. The solution must authenticate users before granting access to internal applications. Which technology should the company deploy?

Accepted Answer

A virtual private network (VPN). The policy requires an encrypted tunnel over the public internet plus user authentication for internal application access. A VPN provides exactly that by encapsulating traffic and terminating at the corporate edge after verifying credentials. DMZs isolate public services, VLANs segment local networks, and proxies forward specific requests, but none deliver the encrypted authenticated remote-access tunnel described.

Answer

A demilitarized zone (DMZ)

Answer

A proxy server

Answer

A virtual local area network (VLAN)

Question 8

A hospital's IT team wants to ensure that nurses can access patient records only during their assigned 12-hour shifts, even if their credentials are valid around the clock. Which access control model should the team implement to enforce this time-based restriction?

Accepted Answer

Attribute-Based Access Control (ABAC). Attribute-Based Access Control evaluates environmental attributes such as current time and shift assignment alongside subject and object attributes. This allows the hospital to enforce a policy that grants patient-record access only during a nurse's scheduled shift, even when credentials remain valid. Role-Based Access Control, Mandatory Access Control, and Discretionary Access Control do not natively enforce time-of-day conditions, so they fail to meet the requirement.

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Answer

Role-Based Access Control (RBAC)

Question 9

A financial institution wants to ensure that a wire transfer request cannot be denied by the sender later. The security team implements a mechanism where the sender's private key is used to sign the transaction. Which security principle does this primarily support?

Accepted Answer

Non-repudiation. The correct answer is non-repudiation. Using a private key to sign a wire transfer provides proof of origin and prevents the sender from denying the transaction. While digital signatures also support integrity, the specific requirement to prevent denial makes non-repudiation the primary principle. Confidentiality and availability are unrelated to this scenario's goal.

Answer

Availability

Answer

Integrity

Answer

Confidentiality

Question 10

A retail company is designing access controls for its point-of-sale systems. The security architect proposes controls that restrict what authenticated cashiers can do after they log in, such as preventing voids above a threshold and limiting access to inventory adjustments. Which TWO statements correctly describe access control concepts relevant to this design? (Choose two.)

Accepted Answer

Authorization determines what an authenticated cashier is permitted to do within the point-of-sale application.. Authorization defines what an authenticated identity may do, and least privilege limits that access to what the job requires. Together they support the proposed point-of-sale restrictions on voids and inventory adjustments. Authentication merely establishes identity, while role-based access control assigns permissions through roles rather than individual assignments, and password complexity addresses authentication strength only.

Answer

Authentication alone ensures that a cashier cannot perform unauthorized transactions.

Answer

Access control decisions should be based solely on the cashier's password complexity.

Answer

Role-based access control requires each cashier to be assigned permissions individually rather than through a shared role.

Question 11

A hospital's compliance officer must decide how to protect patient records. The records must remain readable only to authorized clinicians while in storage and in transit. Which security principle is the compliance officer primarily applying?

Accepted Answer

Confidentiality. Confidentiality is the security principle that prevents unauthorized disclosure of information. The scenario requires that patient records remain readable only to authorized clinicians, both at rest and in transit, which is exactly what confidentiality controls such as encryption and access control provide. The other principles address availability, proof of origin, or protection from modification, none of which is the primary requirement described.

Answer

Non-repudiation

Answer

Availability

Answer

Integrity

Question 12

A security administrator is hardening a new Linux web server before it is placed into production. Which TWO practices reduce the attack surface of the operating system itself? (Choose two.)

Accepted Answer

Enforce least privilege by removing unnecessary administrative rights and using dedicated service accounts with minimal permissions.. Reducing the operating system's attack surface means removing or disabling anything not required for the server's role and limiting the privileges available to users and services. Eliminating unnecessary daemons and ports removes entry points, while least privilege and dedicated service accounts constrain what an attacker can do if one is reached. Encryption, alert-only intrusion prevention, and backups address confidentiality, detection, or recovery rather than shrinking the exploitable surface.

Answer

Install a host-based intrusion prevention system and configure it to alert only.

Answer

Enable full-disk encryption on the server's data volumes.

Answer

Schedule weekly full backups of the server to a remote location.

Question 13

A hospital's IT department is designing a new electronic health record system. The security architect proposes that all patient records be encrypted both at rest and in transit, and that access be restricted based on job roles. Which security principle is the architect primarily addressing?

Accepted Answer

Confidentiality. The architect's measures—encrypting patient records at rest and in transit and restricting access by job roles—are classic controls for protecting confidentiality. Confidentiality focuses on preventing unauthorized disclosure of information. While integrity and availability are also part of the CIA triad, the scenario's emphasis on encryption and access restrictions points specifically to confidentiality.

Answer

Availability

Answer

Integrity

Answer

Non-repudiation

Question 14

A hospital's IT department issues every nurse a unique smart card that must be inserted into a workstation before the nurse types a password. The smart card alone does not grant access to patient records. Which access control concept does the smart card insertion represent?

Accepted Answer

Identification. The smart card presents a unique token that asserts who the nurse claims to be, which is the definition of identification. Because the card alone does not grant access and a password must still be supplied, verification of that claim is handled separately by authentication. Authorization and accounting occur only after identity is established and verified.

Answer

Authentication

Answer

Accounting

Answer

Authorization

Question 15

A security administrator is configuring a new Windows server and wants to ensure that only necessary services and ports are enabled. After installation, the administrator runs a port scan and finds that port 3389 is open. Which action should the administrator take FIRST to reduce the attack surface?

Accepted Answer

Disable the Remote Desktop Protocol service if it is not required for administration. The first step in reducing attack surface is to remove unnecessary services. Since port 3389 is open due to RDP, and if RDP is not required, disabling it eliminates the exposure entirely. Other measures like firewall restrictions or authentication enhancements are useful but secondary to removing the service.

Answer

Enable Network Level Authentication for RDP connections

Answer

Configure the firewall to allow RDP only from specific IP addresses

Answer

Change the RDP listening port to a non-standard number

Question 16

A healthcare organization wants to ensure that only authorized clinicians can view patient records, while also maintaining a detailed log of every access for compliance audits. Which security principle is primarily being addressed by restricting access and recording all access attempts?

Accepted Answer

Confidentiality. Confidentiality is the principle that ensures information is not disclosed to unauthorized individuals. Restricting access to authorized clinicians directly supports confidentiality by preventing unauthorized viewing of patient records. Logging access attempts supports accountability and auditability, but the core security objective here is to protect the confidentiality of sensitive health information.

Answer

Integrity

Answer

Accountability

Answer

Availability

Question 17

A retail company's security policy states that no single employee should be able to both create a vendor payment and approve it. The company assigns these duties to two different people. Which security principle is the policy enforcing?

Accepted Answer

Separation of duties. The policy prevents any single employee from completing a sensitive transaction end to end by requiring two different people to create and approve a vendor payment. That is separation of duties, an administrative control that limits the opportunity for fraud and error. Least privilege limits what each user can access, defense in depth layers controls, and job rotation changes assignments over time; none of those captures the requirement that two distinct people must be involved in one process.

Answer

Least privilege

Answer

Job rotation

Answer

Defense in depth

Question 18

A government contractor stores documents with classification labels, and users receive clearances that determine which labels they may access. No user, including administrators, can change a document's label or bypass the label checks. Which access control model does this describe?

Accepted Answer

Mandatory access control (MAC). Mandatory access control bases decisions on labels attached to objects and clearances assigned to subjects, with enforcement handled by the system rather than by user discretion. The scenario's classification labels, clearance levels, and prohibition on bypassing checks all align with MAC. This model is typical in government and military settings where data sensitivity demands strict, non-discretionary control.

Answer

Role-based access control (RBAC)

Answer

Discretionary access control (DAC)

Answer

Attribute-based access control (ABAC)

Question 19

A university wants to provide guests with internet access through the same physical wireless infrastructure used by staff, but guests must not reach internal research servers. Staff must authenticate with institutional credentials. Which combination of controls best achieves this separation?

Accepted Answer

Separate SSIDs mapped to different VLANs, with 802.1X for staff and a guest portal for visitors.. Separate SSIDs tied to separate VLANs provide the isolation, and using 802.1X for staff plus a guest portal for visitors supplies the differentiated authentication the university needs. Shared keys, MAC filtering, and a single personal-network SSID all fail to distinguish populations or to prevent guests from reaching internal research servers, so they cannot meet the stated requirements.

Answer

A single pre-shared key for all users plus a captive portal.

Answer

MAC address filtering that allows only registered devices on the wireless network.

Answer

WPA3-Personal on a single SSID with a rotating password posted at reception.

Question 20

A security administrator is configuring a wireless network for a small office. The requirement is to use a protocol that provides strong encryption and authentication, and that is resistant to offline dictionary attacks on captured handshakes. Which protocol should be selected?

Accepted Answer

Wi-Fi Protected Access 3 (WPA3) with Simultaneous Authentication of Equals (SAE). WPA3 with SAE is designed to replace WPA2-PSK's vulnerable four-way handshake with a mutually authenticated exchange that resists offline dictionary attacks. It also provides stronger encryption through the use of SAE and, in WPA3-Personal, forward secrecy. The other options either lack strong encryption or remain susceptible to offline attacks.

Answer

Open authentication with Captive Portal

Answer

Wi-Fi Protected Access 2 (WPA2) with Pre-Shared Key (PSK)

Answer

Wired Equivalent Privacy (WEP)