ISC2 CC Practice Test 6 — 10 Questions

Question 1

A small business with limited budget wants to ensure critical business functions can resume within 24 hours of a disaster. Their data changes infrequently. Which recovery solution is MOST cost-effective?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud backup with instant restore. Cloud backup with instant restore (Option B) is the most cost-effective solution because the business has a limited budget, data changes infrequently, and the RTO is 24 hours. Cloud backup eliminates the need for maintaining physical infrastructure, and instant restore from cloud snapshots can meet the 24-hour RTO without the high costs of a warm or hot site.

Answer

Warm site with daily backups

Answer

Cold site with monthly backups

Answer

Hot site with real-time replication

Question 2

Which security control would best mitigate the risk of network sniffing on a wired LAN segment?

Accepted Answer

Using encryption protocols (e.g., IPsec, TLS). Encrypting traffic (e.g., using HTTPS, VPN) makes sniffed data unreadable.

Answer

Implementing VLANs

Answer

Disabling unused ports on the switch

Answer

Deploying an intrusion detection system

Question 3

A user reports that they received a suspicious email with an attachment claiming to be an invoice. What should the user do?

Accepted Answer

Report the email to the security team without opening the attachment. The user should immediately report the suspicious email to the security team without opening the attachment. Opening the attachment could trigger a malicious payload, such as a macro-enabled document or executable, that exploits vulnerabilities in the email client or operating system. The security team can analyze the email headers, attachment hash, and sender domain using tools like sandboxing or threat intelligence feeds to determine if it is a phishing attempt or malware delivery.

Answer

Reply to the email and ask for confirmation

Answer

Delete the email immediately

Answer

Open the attachment to check what it contains

Question 4

A security analyst is reviewing data handling procedures. Which THREE of the following are considered sensitive PII?

Accepted Answer

Financial account numbers. Sensitive PII includes medical records, financial account numbers, and biometric data. Name and phone number are general PII.

Answer

Phone number

Answer

Name and email address

Question 5

What is the difference between due care and due diligence in security governance?

Accepted Answer

Due care refers to implementing security controls; due diligence refers to investigating risks and verifying controls. Due care is the minimum standard of care (implementing basic security), while due diligence is investigating before acting (e.g., vendor assessments).

Answer

Due care is proactive; due diligence is reactive

Answer

They are synonymous

Answer

Due diligence is required by law; due care is voluntary

Question 6

A network security team is implementing a defense-in-depth strategy. Which TWO of the following controls are examples of network segmentation? (Choose two.)

Accepted Answer

Implementing firewall rules between internal zones.. Implementing firewall rules between internal zones is a form of network segmentation. By creating distinct security zones (e.g., inside, outside, DMZ) and applying access control lists (ACLs) or stateful firewall policies between them, traffic is restricted to only what is explicitly permitted, thereby isolating network segments and limiting lateral movement.

Answer

Deploying an intrusion detection system (IDS) on the core switch.

Answer

Placing public-facing servers in a DMZ.

Answer

Using VPN for remote access.

Question 7

Which TWO of the following are common indicators of a phishing email? (Select TWO.)

Accepted Answer

The email contains a sense of urgency, such as 'Your account will be closed.'. Phishing emails commonly exploit urgency to bypass rational decision-making. Attackers use phrases like 'Your account will be closed' to pressure recipients into clicking malicious links or providing credentials without verifying the source. This social engineering tactic is a hallmark of phishing campaigns.

Answer

The email contains an attachment with a .txt extension

Answer

The email has a high-importance flag set by the sender

Answer

The email is sent to multiple recipients in the 'To' field

Question 8

An analyst reviews the exhibit. Which security principle is being violated by allowing root login via SSH?

Accepted Answer

Least privilege. Allowing root login via SSH violates the principle of least privilege because it grants unrestricted administrative access to the system, bypassing any need for privilege escalation. In a properly secured SSH configuration, root login should be disabled (e.g., `PermitRootLogin no` in `/etc/ssh/sshd_config`), forcing administrators to log in as a regular user and then use `sudo` or `su` to elevate privileges only when necessary. This minimizes the attack surface and ensures that actions are auditable and tied to a specific user account.

Answer

Fail-safe

Answer

Defense in depth

Answer

Separation of duties

Question 9

Refer to the exhibit. What is the effect of this ACL?

Accepted Answer

HTTPS traffic from 10.0.1.0/24 to 192.168.2.100 is permitted; all other HTTPS is denied. The ACL explicitly permits HTTPS (TCP port 443) traffic from source network 10.0.1.0/24 to destination host 192.168.2.100. Since ACLs have an implicit deny all at the end, any HTTPS traffic not matching this permit statement is denied. Option C correctly states that only this specific traffic is permitted and all other HTTPS is denied.

Answer

All HTTPS traffic is permitted

Answer

Only hosts from 10.0.1.0/24 can access HTTPS on 192.168.2.100

Answer

The ACL is invalid due to ordering

Question 10

Drag and drop the steps to configure a wireless access point with WPA2-PSK security into the correct order.

Accepted Answer

Set SSID, then select WPA2 security mode, then set PSK passphrase, then apply settings.. Configuring a wireless access point with WPA2-PSK requires a logical sequence: first set the SSID to identify the network, then choose WPA2 as the security mode, then define the pre-shared key (PSK) passphrase, and finally apply the settings. This order ensures all necessary parameters are in place before the configuration is activated, preventing the AP from broadcasting with incomplete security settings.

Answer

Set SSID, then set PSK passphrase, then select WPA2 security mode, then apply settings.

Answer

Select WPA2 security mode, then set SSID, then set PSK passphrase, then apply settings.

Answer

Set SSID, then select WPA2 security mode, then apply settings, then set PSK passphrase.