ISC2 CC Practice Exam 60 — 20 Questions

Question 1

A hospital's IT team issues each nurse a unique smart card that is inserted into a workstation before the nurse types a password. The nurse then accesses patient records permitted for the assigned ward. Which combination of access control concepts is being demonstrated?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Identification by the smart card, authentication by the password, and authorization by the permitted records.. Identification is the act of claiming an identity, which the smart card performs by presenting a unique token. Authentication validates that claim, which the password accomplishes when it matches the stored credential. Authorization then determines which patient records the authenticated nurse may access. Keeping these three steps distinct is fundamental to the access control concepts domain.

Answer

Authentication by the smart card, authorization by the password, and identification by the permitted records.

Answer

Identification by the smart card, authorization by the password, and authentication by the permitted records.

Answer

Authorization by the smart card, identification by the password, and authentication by the permitted records.

Question 2

An organization's security policy requires that all employees use unique, complex passwords for their domain accounts. A security analyst is reviewing a list of common password mistakes. Which of the following best describes a practice that undermines this policy?

Accepted Answer

Reusing the same password across multiple systems and services.. The policy requires unique, complex passwords. Reusing the same password across multiple systems violates the uniqueness requirement and creates a cascading risk: compromise of one account can lead to compromise of others. This practice is a well-known security weakness. The other options either support the policy or are neutral, so password reuse is the clear answer.

Answer

Enabling multi-factor authentication on all domain accounts.

Answer

Using a password manager to generate and store unique passwords for each account.

Answer

Changing passwords only when prompted by the system at 90-day intervals.

Question 3

A small business wants to provide secure remote access to its internal file server for employees working from home. The company requires that all traffic between the employee's device and the file server be encrypted and that the internal network topology remain hidden. Which technology best meets these requirements?

Accepted Answer

VPN. A VPN is designed to provide encrypted, tunneled access to an entire network, making it ideal for remote employees who need to reach internal resources securely. It encapsulates traffic, encrypts it, and masks internal addresses, fulfilling both the encryption and topology-hiding requirements. Other options are protocol-specific and cannot deliver equivalent network-level access.

Answer

HTTPS

Answer

SSH

Answer

SFTP

Question 4

A defense contractor classifies documents as Confidential, Secret, or Top Secret and assigns each employee a clearance level. Access is permitted only when the employee's clearance meets or exceeds the document's classification, and users cannot change these labels. Which access control model is in use?

Accepted Answer

Mandatory access control (MAC). Mandatory access control enforces access decisions using labels assigned to objects and clearances assigned to subjects, with the labels controlled by policy rather than by users. The requirement that a clearance meet or exceed a document's classification, combined with users being unable to change labels, is the defining behavior of MAC, making it the correct model for this defense contractor.

Answer

Discretionary access control (DAC)

Answer

Role-based access control (RBAC)

Answer

Rule-based access control

Question 5

A retail chain wants to prevent customers on its guest wireless from reaching point-of-sale terminals on the corporate wired network, while still allowing guests to browse the internet. The chain already separates the two networks with a firewall. Which additional configuration most directly enforces this restriction?

Accepted Answer

Configure the firewall to deny traffic from the guest wireless subnet to the point-of-sale subnet while permitting outbound internet access. Because the networks are already separated by a firewall, the restriction is enforced by a rule that denies guest-subnet traffic destined for the point-of-sale subnet while still allowing internet access. This places the control at the routing boundary where it can be logged and audited, rather than relying on wireless-layer measures that only affect the radio link.

Answer

Enable WPA3 encryption on the guest wireless network

Answer

Change the guest wireless pre-shared key on a monthly schedule

Answer

Deploy a wireless intrusion prevention system to detect rogue access points

Question 6

A hospital's IT department is choosing a security control to protect patient records. The control must render data unreadable to anyone who does not hold the cryptographic key, even if the storage media is stolen. Which type of control BEST meets this requirement?

Accepted Answer

Encryption of the data at rest. The requirement is that stored records stay unreadable without the cryptographic key, which is precisely what encryption at rest delivers. Access control, monitoring, and backups all have security value, but none of them transform the data itself, so a thief holding the physical media could still read every record. Only encryption makes the stolen media useless to an attacker lacking the key.

Answer

Role-based access control on the records

Answer

Full database activity monitoring

Answer

Daily offsite backup of the database

Question 7

A network architect is designing a demilitarized zone (DMZ) for a company that hosts a public web server and a public DNS server. The requirement is to ensure that if either public server is compromised, it cannot initiate connections to the internal network. Which design approach best meets this requirement?

Accepted Answer

Create a DMZ on a separate subnet with firewall rules that allow inbound traffic to the servers but deny all outbound traffic from the DMZ to the internal network.. The most effective way to prevent a compromised DMZ host from reaching the internal network is to segment the DMZ on its own subnet and enforce firewall rules that deny outbound traffic from the DMZ to the internal network. This limits lateral movement and contains potential breaches. Other options either place servers on the internal network or allow unrestricted DMZ-to-internal traffic, failing the requirement.

Answer

Use a single firewall with three interfaces: internet, DMZ, and internal, with rules that allow any traffic from the DMZ to the internal network.

Answer

Place both servers on the internal network and use host-based firewalls to restrict outbound traffic.

Answer

Place the servers on the internal network and use a reverse proxy to handle all incoming requests.

Question 8

A security analyst is reviewing network flow logs and sees periodic outbound connections from an internal server to an external IP address on TCP port 443 every 30 minutes. The connections transfer small amounts of data and the external IP resolves to a newly registered domain. The server has no business need for internet access. Which type of malicious activity is most consistent with this pattern?

Accepted Answer

A beaconing implant maintaining command-and-control communication over HTTPS.. Evenly spaced, low-volume outbound sessions to a newly registered external domain on an encrypted port are a textbook beaconing pattern. Malware uses this to check in for instructions while blending with ordinary TLS traffic. Because the server has no legitimate internet requirement, the activity cannot be dismissed as normal business traffic. The right next step is to isolate the host, capture volatile data, and hunt for the implant and its persistence mechanism.

Answer

A denial-of-service attack launched from the server against the external address.

Answer

An internal vulnerability scan probing an external host for open ports.

Answer

A misconfigured software update service contacting its vendor repository.

Question 9

A software development company wants to ensure that only authorized code changes are deployed to production. They implement a process where developers submit code changes, and a separate team reviews and approves them before deployment. Which security principle is BEST demonstrated by this process?

Accepted Answer

Separation of duties. Separation of duties is a preventive control that requires more than one person to complete a task, reducing the risk of unauthorized actions. In this scenario, developers cannot deploy code without a separate team's approval, ensuring that no single person has end-to-end control over the deployment process. This aligns with the principle of separation of duties, which is fundamental in change management and fraud prevention.

Answer

Defense in depth

Answer

Least privilege

Answer

Non-repudiation

Question 10

A hospital's network team must allow external vendors to reach a specific internal patient-monitoring system without exposing the rest of the clinical VLAN. The solution must enforce least privilege and terminate vendor sessions at a hardened appliance before any internal resource is contacted. Which technology best meets these requirements?

Accepted Answer

A secure remote access gateway that brokers and inspects vendor sessions before forwarding them.. Brokering vendor access through a hardened gateway enforces least privilege because each session is authenticated, terminated, and inspected before any internal system is contacted. Direct VLAN placement, VPN-to-VLAN access, and site-to-site tunnels all create broader network reachability than necessary, allowing lateral movement if a vendor endpoint is compromised. Only the access gateway keeps the clinical VLAN hidden while permitting tightly scoped, auditable sessions.

Answer

A jump host placed directly on the clinical VLAN with local firewall rules.

Answer

A site-to-site IPsec tunnel built directly between each vendor and the monitoring system.

Answer

A remote access VPN that places vendors on the clinical VLAN after authentication.

Question 11

A security team is reviewing how access control is enforced across a corporate environment. Which two statements accurately describe the relationship between identification, authentication, and authorization? (Choose two.)

Accepted Answer

Authorization decisions are made after authentication succeeds, based on the verified identity's permissions.. Identification claims an identity, authentication verifies that claim, and authorization grants permissions based on the verified identity. The two correct statements capture these distinct roles and their proper sequence. The remaining statements incorrectly merge authentication with authorization, allow authorization without authentication, or treat identification as sufficient for access.

Answer

Identification alone is sufficient to grant access to protected resources in a secure system.

Answer

A user can be authorized for a resource without ever being authenticated to the system.

Answer

Authentication and authorization are the same process because both determine whether a user may access a resource.

Question 12

An employee reports that their laptop suddenly displays a message demanding payment in cryptocurrency to restore access to files, and the files now have an unfamiliar extension. The employee has not clicked any links recently. Which type of malware is MOST likely responsible?

Accepted Answer

Ransomware. The combination of encrypted files, altered extensions, and a cryptocurrency ransom demand is the classic signature of ransomware. Delivery does not require a recent link click, since exploits, malicious attachments, and exposed services are common vectors. Recognizing these indicators lets responders isolate the host quickly, preserve evidence, and avoid paying, while restoring from offline backups if available.

Answer

A logic bomb

Answer

A keylogger

Answer

A rootkit

Question 13

A retail company issues contract workers temporary accounts that automatically expire after 30 days, and it reviews all active accounts each quarter to remove those no longer needed. Which access control administration practice does the quarterly review represent?

Accepted Answer

Access review or recertification. Periodically reviewing active accounts to confirm each is still needed and removing those that are not is an access review, also known as recertification. It works alongside automated expiration of temporary accounts by catching entitlements that persist beyond their business justification, helping the company keep access aligned with current needs and supporting least privilege over time.

Answer

User provisioning

Answer

Separation of duties

Answer

Least privilege

Question 14

A security analyst reviewing web server logs sees repeated requests containing strings such as '../../etc/passwd' and '..%2f..%2fwindows%2fsystem32'. The requests originate from a single external address and target a file-download endpoint. Which type of attack is most likely occurring?

Accepted Answer

Directory traversal. The dot-dot-slash sequences, including the URL-encoded form, are attempts to climb out of the intended directory and read sensitive files such as the password file or Windows system binaries. This is textbook directory traversal against a file-download function. The attacker is not injecting script, SQL, or forging a session request, but manipulating the path the application resolves.

Answer

Cross-site request forgery

Answer

Cross-site scripting

Answer

SQL injection

Question 15

A small marketing firm wants to give each employee a single set of credentials that works for the corporate email system, the cloud CRM, and the internal file share. The IT manager proposes using a central identity store so users do not have to remember separate passwords. Which concept is the IT manager describing?

Accepted Answer

Single sign-on (SSO). The firm's goal is one credential set that unlocks several independent applications, which is the defining purpose of single sign-on. SSO relies on a central identity provider that authenticates the user once and then issues assertions or tokens to each connected application, removing repeated password prompts while still allowing each application to make its own authorization decisions.

Answer

Multifactor authentication (MFA)

Answer

Federated identity management

Answer

Role-based access control (RBAC)

Question 16

A financial services firm has a recovery time objective (RTO) of 2 hours for its trading platform and a recovery point objective (RPO) of 15 minutes. The disaster recovery team is evaluating whether a warm site can meet these requirements. Which statement best describes the limitation of a warm site in this scenario?

Accepted Answer

A warm site cannot meet the RTO because it requires manual data restoration and configuration, which typically takes longer than 2 hours.. A warm site provides pre-installed hardware and network connectivity but requires data restoration and system configuration before it can operate. For a trading platform with a 2-hour RTO, this manual effort typically exceeds the acceptable outage window. While the 15-minute RPO could be addressed with replication, the RTO is the binding constraint that makes a warm site a poor fit without substantial automation.

Answer

A warm site cannot meet the RPO because it does not support data replication from the primary site.

Answer

A warm site can meet the RTO because it only requires switching network routes to the standby environment.

Answer

A warm site is identical to a hot site and can meet both the RTO and RPO without any additional configuration.

Question 17

A security manager is mapping several controls to the categories of administrative, technical, and physical. Which TWO of the following are administrative controls? (Choose two.)

Accepted Answer

An acceptable use policy that employees must read and sign. Administrative controls govern people and processes through rules, policies, and training. The acceptable use policy and the recurring security awareness training both shape behavior through management action rather than through hardware or software. The bollard is a physical barrier, while the biometric reader and firewall enforce access through technology, so those three fall into the physical and technical categories instead.

Answer

A firewall rule set that blocks inbound traffic on unused ports

Answer

A biometric fingerprint reader controlling the data center door

Answer

A bollard installed at the entrance to the loading dock

Question 18

A security operations center (SOC) is reviewing its incident response plan and wants to improve detection of data exfiltration over encrypted channels. Which TWO monitoring approaches would BEST help identify potential exfiltration in this scenario? (Choose two.)

Accepted Answer

Analyzing network flow records for unusual volumes of outbound traffic to external IP addresses. Detecting encrypted exfiltration requires focusing on behavior and metadata rather than payload content. Network flow analysis identifies anomalous outbound volumes, while endpoint monitoring detects staging activities like archiving. Together, they provide complementary visibility without relying on decryption, making them effective for this scenario.

Answer

Enabling full packet capture and storing all network traffic for later analysis

Answer

Reviewing DNS query logs for lookups of known malicious domains

Answer

Deploying SSL/TLS inspection to decrypt and examine all outbound web traffic

Question 19

A retail company wants to reduce the risk of fraudulent online purchases. The security manager proposes requiring customers to enter a password plus a code sent to their registered mobile phone. Which security concept does this proposal best illustrate?

Accepted Answer

Multi-factor authentication. Multi-factor authentication combines factors from different categories, such as something you know and something you have. The password represents knowledge, while the code sent to a registered mobile phone represents possession of that device. This pairing raises the difficulty for an attacker who steals only the password, so the proposal is best described as multi-factor authentication.

Answer

Federated identity

Answer

Single sign-on

Answer

Single-factor authentication

Question 20

A financial services firm assigns permissions based on the department a user belongs to, such as 'Teller', 'Loan Officer', or 'Auditor'. When an employee transfers from Teller to Loan Officer, their Teller permissions are removed and Loan Officer permissions are added automatically. Which access control model is being used?

Accepted Answer

Role-based access control (RBAC). Assigning rights to roles and then placing users into those roles is the essence of role-based access control. The transfer scenario shows the key benefit: permissions follow the job function, so moving an employee between departments automatically strips old rights and applies new ones without editing each user's individual access list.

Answer

Discretionary access control (DAC)

Answer

Mandatory access control (MAC)

Answer

Rule-based access control