ISC2 CC Practice Exam 60 — 20 Questions

Question 1

Which TWO of the following are recognized as benefits of network segmentation?

Accepted Answer

Reduced attack surface. Network segmentation reduces the attack surface by isolating network segments, limiting the exposure of critical systems. It also contains breaches by restricting lateral movement, preventing an attacker from spreading across the entire network. Option B (Easier monitoring) is not a primary benefit; segmentation can actually increase monitoring complexity. Option C (Increased broadcast domains) is typically a disadvantage, as it can cause performance issues. Option D (Simplified IP address management) is not a security benefit; segmentation often requires more complex IP addressing.

Answer

Easier monitoring

Answer

Increased broadcast domains

Answer

Simplified IP address management

Question 2

Which TWO are examples of technical access controls?

Accepted Answer

Encryption. Encryption (C) is a technical access control because it uses cryptographic algorithms (e.g., AES-256, RSA) to transform data into an unreadable format, ensuring that only authorized entities with the correct decryption key can access the original information. This enforces confidentiality and access restrictions at the data level, independent of user behavior or administrative policies.

Answer

Security awareness training

Answer

Security policies

Answer

ID badges

Question 3

A security analyst notices that a user's account has been used to access sensitive files outside of normal working hours from an unknown IP address. Which security principle is most directly violated?

Accepted Answer

Confidentiality. The scenario describes unauthorized access to sensitive files from an unknown IP address outside normal hours, which directly violates the principle of confidentiality. Confidentiality ensures that data is accessible only to authorized users and systems, and this breach indicates that sensitive information may have been exposed to an unauthorized party.

Answer

Availability

Answer

Non-repudiation

Answer

Integrity

Question 4

An organization implements a policy where users must swipe their ID card and enter a PIN to access a secure room. This is an example of which access control principle?

Accepted Answer

Multifactor authentication. The policy requires two distinct factors: something you have (the ID card) and something you know (the PIN). This combination of multiple authentication factors from different categories is the defining characteristic of multifactor authentication (MFA).

Answer

Biometric authentication

Answer

Single-factor authentication

Answer

Role-based access control

Question 5

Which THREE of the following are best practices for securing a remote access VPN?

Accepted Answer

Enable multi-factor authentication.. Multi-factor authentication (MFA) adds an additional layer of security beyond just a password, requiring a second factor such as a one-time code from a token or biometric. For a remote access VPN, this mitigates the risk of credential theft or brute-force attacks against the VPN gateway. Even if an attacker obtains a user's password, they cannot authenticate without the second factor, significantly reducing the likelihood of unauthorized access.

Answer

Use pre-shared keys for authentication.

Answer

Implement split tunneling by default.

Question 6

A security analyst observes the log entries on an SSH server as shown. What is the most likely type of attack in progress?

Accepted Answer

Brute-force attack. The log shows repeated failed password attempts for the root account from the same IP address in rapid succession. This pattern is characteristic of a brute-force attack, where an attacker tries many passwords systematically to gain access. Option C is therefore correct. Dictionary attack (A) is a subtype but the log does not indicate use of a dictionary list specifically; brute-force is the broader, correct classification. Privilege escalation (B) typically involves exploiting vulnerabilities after gaining initial access, not repeated login attempts. Denial-of-service (D) would involve overwhelming the service, not attempting authentication.

Answer

Dictionary attack

Answer

Privilege escalation

Answer

Denial-of-service (DoS) attack

Question 7

A company wants to ensure that if a server fails, it does not cause a security breach. Which principle should guide the design?

Accepted Answer

Fail-safe. Fail-safe ensures that when a server fails, it defaults to a secure state (e.g., closed ports, denied access) rather than an insecure one. This prevents a security breach by guaranteeing that failure does not inadvertently expose data or allow unauthorized access. In the CC exam, this principle is directly tied to designing systems that remain secure even under fault conditions.

Answer

Defense in depth

Answer

Default deny

Answer

Least privilege

Question 8

Drag and drop the steps for the proper disposal of a hard drive containing sensitive data into the correct order.

Accepted Answer

Identification, Backup, Sanitization, Verification, Documentation. Proper disposal includes identification, backup, sanitization, verification, and documentation.

Answer

Sanitization, Backup, Identification, Verification, Documentation

Answer

Identification, Sanitization, Verification, Backup, Documentation

Answer

Documentation, Identification, Backup, Sanitization, Verification

Question 9

Drag and drop the steps to create a new VLAN on a managed switch into the correct order.

Accepted Answer

Enter configuration mode, then create VLAN, then name VLAN, then assign ports to VLAN. The correct sequence for creating a new VLAN on a managed switch is to first enter global configuration mode, then create the VLAN with its ID, then assign a name for identification, and finally assign the appropriate ports to the VLAN. This order ensures all necessary parameters are in place before ports are configured.

Answer

Create VLAN, then enter configuration mode, then name VLAN, then assign ports to VLAN

Answer

Enter configuration mode, then name VLAN, then create VLAN, then assign ports to VLAN

Answer

Enter configuration mode, then create VLAN, then assign ports to VLAN, then name VLAN

Question 10

You are the security administrator for a mid-sized e-commerce company. The company uses a Linux-based web server running Apache, with a MySQL database backend. User authentication is handled via LDAP. Recently, the security team discovered that a former employee's account was used to access the customer database two weeks after the employee was terminated. The account had not been disabled. The database contains personally identifiable information (PII). The incident was traced to an internal IP address from the marketing department. The marketing department's network segment is not segregated from the database server. Additionally, the database server's firewall rules allow any internal IP to connect to the MySQL port (3306). The company has a written policy that accounts must be disabled within 24 hours of termination, but the HR department did not notify IT in a timely manner. Which combination of controls would BEST prevent a recurrence of this incident?

Accepted Answer

Integrate HR system with identity management to automatically disable accounts upon termination, and implement network segmentation with a firewall that restricts database access to only authorized application servers.. The best combination because it addresses both root causes: the account not being disabled (by integrating HR with identity management for automatic deprovisioning) and the lack of network segmentation (by restricting database access to only authorized application servers via firewall). Option B only addresses network issues, not account management. Option A is monitoring, not prevention. Option D adds complexity but does not directly fix the broken termination process or network segregation.

Answer

Deploy a database activity monitoring (DAM) solution that alerts on unusual queries, and require strong passwords for all database accounts.

Answer

Implement a firewall rule to block all traffic from the marketing network to the database server, and require all database access to go through a bastion host.

Answer

Implement two-factor authentication for all database access, and conduct quarterly access reviews.

Question 11

A company's business continuity plan requires a maximum tolerable downtime of 2 hours for the ERP system. The current backup process takes 3 hours to restore. Which of the following is the BEST corrective action?

Accepted Answer

Implement synchronous replication. The maximum tolerable downtime (MTD) is 2 hours, but the current restore process takes 3 hours, which exceeds the MTD. Synchronous replication writes data to both primary and secondary storage simultaneously, ensuring that the secondary copy is always current and can be failed over to in seconds or minutes, not hours. This reduces the recovery time objective (RTO) to well under the required 2 hours, directly addressing the gap.

Answer

Reduce RTO to 1 hour

Answer

Increase backup frequency

Answer

Perform restoration testing quarterly

Question 12

An employee uses a password and a one-time code from a mobile authenticator app to log in. Which authentication type is being used?

Accepted Answer

Multi-factor. Combining password (Type 1) and OTP (Type 2) is multi-factor authentication.

Answer

Possession-based

Answer

Biometric

Answer

Single-factor

Question 13

A security analyst notices repeated failed login attempts from a single IP address targeting multiple user accounts. Which security control should be implemented to mitigate this attack?

Accepted Answer

Implement account lockout after a threshold of failed attempts.. Implementing an account lockout policy after a defined threshold of failed attempts (e.g., 5 failed attempts within 15 minutes) directly mitigates brute-force password guessing attacks from a single source. This control prevents an attacker from continuously trying different passwords across multiple accounts, effectively rate-limiting the attack at the authentication layer.

Answer

Enable single sign-on (SSO).

Answer

Require complex passwords.

Answer

Disable the accounts after one failed attempt.

Question 14

Which of the following is a primary benefit of implementing network segmentation?

Accepted Answer

Reduced attack surface. Network segmentation divides a network into smaller, isolated segments, which limits an attacker's ability to move laterally after compromising a single host. By restricting traffic between segments using VLANs, ACLs, or firewall rules, the attack surface is reduced because fewer systems are exposed to potential threats. This is a primary security benefit, as it contains breaches and minimizes the impact of malware or unauthorized access.

Answer

Eliminates the need for firewalls

Answer

Increased bandwidth

Answer

Simplified IP address management

Question 15

Which of the following ports is used by HTTPS for secure web traffic?

Accepted Answer

443. HTTPS uses port 443 by default.

Answer

80

Answer

22

Answer

53

Question 16

Which of the following protocols operates at the Transport layer and provides reliable, connection-oriented communication?

Accepted Answer

TCP. TCP provides reliable delivery via acknowledgments and retransmissions, and uses a three-way handshake to establish a connection. UDP is connectionless and unreliable.

Answer

HTTP

Answer

IP

Answer

UDP

Question 17

A security analyst detects an ARP spoofing attack on the local network. What is the primary goal of an ARP spoofing attack?

Accepted Answer

To redirect traffic to the attacker's machine for eavesdropping or modification. ARP spoofing allows an attacker to intercept traffic by associating their MAC address with the IP address of a legitimate host.

Answer

To disable the switch by sending fake VLAN tags

Answer

To overwhelm the network with broadcast traffic

Answer

To corrupt the DNS cache

Question 18

A security analyst is evaluating a new vendor for cloud services. The analyst reviews the vendor's security certifications, conducts background checks, and visits the data center. This process is an example of:

Accepted Answer

Due diligence. Due diligence involves investigating and verifying before making a decision, such as vendor risk assessment.

Answer

Due care

Answer

Governance

Answer

Risk acceptance

Question 19

According to the NIST 800-61 incident response lifecycle, after containment and eradication have been performed, what is the next phase?

Accepted Answer

Recovery. According to the NIST 800-61 incident response lifecycle, the phases are Preparation, Detection & Analysis, Containment/Eradication, and Recovery. After containment (isolating the threat) and eradication (removing malware, patching vulnerabilities), the next phase is Recovery, where systems are carefully restored to normal operations, often using clean backups and verifying system integrity before reconnecting to the network.

Answer

Post-incident activity

Answer

Detection and analysis

Answer

Preparation

Question 20

Which of the following is a connectionless, unreliable transport protocol?

Accepted Answer

UDP. UDP is connectionless and does not guarantee delivery.

Answer

IP

Answer

TCP

Answer

ICMP