ISC2 CC Practice Exam 61 — 20 Questions

Question 1

A financial services firm is designing controls to enforce separation of duties in its payment approval process. Which two practices support this goal? (Choose two.)

Accepted Answer

Applying a system constraint that prevents the same user account from both entering and approving a payment. Separation of duties ensures no single person can complete a sensitive transaction end to end. Requiring different employees to initiate and approve payments, and enforcing that split with a system constraint that blocks one account from doing both, both create an independent check. The other practices concentrate or allow circumvention of those duties, which undermines the control.

Answer

Granting one senior manager both the ability to create vendors and the ability to approve payments to those vendors

Answer

Allowing any employee with payment approval rights to also modify the approval limits assigned to their own account

Answer

Assigning all payment-related duties to a single trusted administrator to simplify the process

Question 2

A security team is designing a physical access control system for a data center. They want to implement controls that verify a person's identity based on unique biological characteristics. Which two of the following are examples of biometric access controls? (Choose two.)

Accepted Answer

Retina scanner. Biometric access controls verify identity using unique biological traits. Retina scanners and fingerprint scanners both measure inherent physical characteristics, making them valid biometric controls for the data center. Smart cards, PIN pads, and proximity badges rely on possession or knowledge factors instead, so they do not satisfy the requirement for biological verification even though they may be used alongside biometrics in a layered design.

Answer

Smart card reader

Answer

Proximity badge

Answer

Personal identification number (PIN) pad

Question 3

A small business wants to prevent employees from visiting known malicious websites. The owner asks for a solution that can block requests based on a constantly updated list of harmful domains without requiring software on each employee device. Which technology should be recommended?

Accepted Answer

DNS filtering. DNS filtering blocks malicious domains by intercepting DNS queries and checking them against a threat intelligence feed. It requires no endpoint agent, applies network-wide, and updates centrally. Host-based antivirus needs per-device installation, stateful firewalls lack domain awareness, and NAC governs device admission rather than web content, so none satisfy the stated constraints.

Answer

Stateful packet inspection firewall

Answer

Network access control (NAC)

Answer

Host-based antivirus

Question 4

A small business wants to give employees secure access to internal file shares while they work from home. The company has no dedicated security operations staff and wants a solution that authenticates users and encrypts traffic without deploying agents on every personal device. Which technology is the most appropriate?

Accepted Answer

A remote access VPN using TLS or IPsec.. A remote access VPN is designed exactly for this need: it authenticates the user at a central gateway and encrypts traffic between the remote device and the corporate network. The other choices address endpoint protection, local network admission control, or web application defense, none of which establish an authenticated, encrypted path to internal file shares for off-site workers.

Answer

A web application firewall protecting the file server.

Answer

A host-based intrusion prevention system on each laptop.

Answer

A network access control solution enforcing 802.1X on the office switches.

Question 5

A retail company experiences a distributed denial-of-service (DDoS) attack that overwhelms its online store. The incident response team successfully mitigates the attack, and the store is back online. Which activity should the team perform as part of the post-incident activity phase?

Accepted Answer

Conduct a lessons-learned meeting to identify improvements in the DDoS response process.. After an incident is contained and systems are restored, the post-incident activity phase involves reviewing the event to improve future response. A lessons-learned meeting allows the team to document what happened, identify gaps, and update the incident response plan. This is the key activity that distinguishes post-incident work from ongoing operational tasks.

Answer

Notify law enforcement and press charges against the attackers.

Answer

Immediately reconfigure the firewall to block the attacking IP addresses.

Answer

Restore the online store from the most recent backup.

Question 6

A hospital's data center uses a mantrap at its main entrance. A nurse badges in at the outer door, steps into a small glass vestibule, and the outer door locks before the inner door unlocks. What security goal does this design primarily achieve?

Accepted Answer

Preventing tailgating by allowing only one person to pass at a time. The interlocked-door vestibule is a classic anti-tailgating control: it forces a one-person-at-a-time transition between security zones so an unauthorized individual cannot slip in behind an authorized badge holder. The nurse's badge handles identification and authentication; the mantrap's distinct contribution is preventing piggybacking through the doorway.

Answer

Establishing identification of the nurse to the access control system

Answer

Providing non-repudiation of the nurse's badge transaction

Answer

Enforcing least privilege for staff entering the data center

Question 7

A mid-sized hospital's disaster recovery team is reviewing its incident response plan after a ransomware attack encrypted the electronic health record (EHR) system. The team determines that the attack began 36 hours before it was detected. Which incident response phase was most directly compromised by this delay?

Accepted Answer

Detection and Analysis. The 36-hour gap between the onset of the ransomware attack and its discovery points directly to a failure in the Detection and Analysis phase, where monitoring and alerting should identify malicious activity quickly. While preparation, containment, and post-incident review all matter, the scenario describes a delay in recognizing the incident, which is the defining activity of detection and analysis. Improving detection capabilities would most directly address this gap.

Answer

Preparation

Answer

Post-Incident Activity

Answer

Containment, Eradication, and Recovery

Question 8

A security team is implementing a Security Information and Event Management (SIEM) system. Which TWO log sources are most critical for detecting unauthorized access attempts on a Linux server? (Choose two.)

Accepted Answer

/var/log/secure. On Linux systems, authentication events are logged in /var/log/auth.log (Debian-based) or /var/log/secure (Red Hat-based). These files record failed and successful login attempts, sudo usage, and SSH access, making them critical for detecting unauthorized access. Other logs like syslog, kern.log, or dpkg.log serve different purposes and are less directly relevant to access attempts.

Answer

/var/log/kern.log

Answer

/var/log/syslog

Answer

/var/log/dpkg.log

Question 9

A financial services firm has activated its disaster recovery plan after a ransomware attack encrypted its primary data center. The incident response team has contained the attack, but the recovery team must restore operations. Which action should the recovery team take FIRST to ensure a successful restoration?

Accepted Answer

Validate that the most recent backups are free from malware and can be restored.. In a ransomware recovery scenario, the first step is to ensure that backups are clean and restorable. Ransomware often targets backups, so validating their integrity prevents restoring malicious code. Once backups are verified, the team can proceed with restoration. This approach aligns with the incident response principle of containing and eradicating the threat before recovery. Skipping validation risks reinfection and further downtime.

Answer

Immediately restore the most recent full backup to the primary data center.

Answer

Rebuild the primary data center from scratch using the original installation media.

Answer

Notify all customers about the data breach and provide credit monitoring services.

Question 10

A financial services firm is classifying a risk by estimating how often a particular attack is likely to succeed in a given year. Which risk concept is the firm measuring?

Accepted Answer

Risk likelihood. Risk combines the likelihood that a threat exploits a vulnerability with the impact if it does. The firm is estimating how often an attack succeeds per year, which is precisely the likelihood dimension. Annualized loss expectancy and impact deal with cost or severity, while residual risk refers to what remains after controls are applied, so likelihood is the concept being quantified.

Answer

Residual risk

Answer

Annualized loss expectancy (ALE)

Answer

Risk impact

Question 11

A financial services firm conducts an annual test of its business continuity plan. Management wants to evaluate how well the team performs its roles and procedures during a simulated disruption without actually moving operations to alternate sites. Which type of exercise BEST meets this requirement?

Accepted Answer

A simulation exercise that tests the team's execution of procedures without activating alternate sites. A simulation or functional exercise tests the team's ability to execute procedures and fulfill roles in a realistic scenario without the expense and disruption of activating alternate sites. It bridges the gap between discussion-based tabletop exercises and full-scale exercises by focusing on operational performance. This matches management's requirement to evaluate team performance while keeping operations in place.

Answer

A tabletop exercise where participants discuss their roles and responses to a simulated scenario

Answer

A full-scale exercise that activates the alternate processing site and relocates critical staff

Answer

A structured walkthrough in which each team member reviews the plan document individually

Question 12

A mid-sized accounting firm is drafting its first information security policy. The partners want the policy to address governance responsibilities clearly so that security decisions are made consistently at the right levels. Which TWO of the following are governance responsibilities that the policy should assign? (Choose two.)

Accepted Answer

Defining the organization's risk appetite and approving the overall security strategy. Governance is about direction, accountability, and oversight rather than hands-on control operation. Senior leadership defines risk appetite and approves strategy, while specific roles are made accountable for security outcomes and monitored through reporting. Firewall tuning, vulnerability scanning, and password resets are operational activities that implement governance decisions but do not themselves constitute governance.

Answer

Performing vulnerability scans against internal servers each week

Answer

Resetting user passwords when employees call the service desk

Answer

Configuring firewall rules and tuning intrusion detection signatures daily

Question 13

A software vendor wants customers to verify that a downloadable patch truly came from the vendor and was not modified in transit. The vendor plans to publish a hash of the patch file on its website alongside the download. A security consultant warns that this approach alone is insufficient. Why is publishing only a hash inadequate for this goal?

Accepted Answer

If an attacker compromises the website, they can replace both the patch and the published hash. A hash verifies integrity only against a trusted reference value. When the hash is published on the same website that distributes the patch, an attacker who compromises that site can swap both files together, and verification will still pass. Authenticity requires a digital signature from a trusted certificate or an independent, trusted channel for the hash, because hashing alone cannot prove who created the file.

Answer

A hash cannot detect any changes to the file once it is downloaded

Answer

Publishing a hash violates the principle of least privilege for website visitors

Answer

Hashes are reversible, so an attacker can derive the original patch contents from the published value

Question 14

A hospital wants to ensure that patient records can only be viewed by authorized clinical staff, and that any modification to a record is traceable to the individual who made it. Which security principle directly supports both of these requirements?

Accepted Answer

Accountability. The hospital needs two things: only authorized clinical staff can view records, and every modification is attributable to a person. Accountability supplies both, because actions are bound to authenticated identities and recorded in logs. Availability concerns uptime, non-repudiation concerns denying actions, and least privilege concerns permission scope, so none of them covers traceability as directly as accountability does.

Answer

Non-repudiation

Answer

Least privilege

Answer

Availability

Question 15

A hospital's security team wants to detect when an attacker is probing its internal network for open ports, but the team must not block legitimate clinical traffic because doing so could interrupt patient care. The team decides to deploy a solution that only alerts on suspicious activity. Which type of solution best matches this requirement?

Accepted Answer

A network-based intrusion detection system (NIDS). The requirement is detection without disruption, which points to a passive monitoring technology. A network-based intrusion detection system observes copies of traffic and raises alerts on suspicious activity such as port scanning, but it does not sit inline to block. Prevention systems, web application firewalls, and stateful firewalls either block traffic or focus on the wrong layer for this internal reconnaissance scenario.

Answer

A network-based intrusion prevention system (NIPS)

Answer

A stateful packet-filtering firewall

Answer

A web application firewall (WAF)

Question 16

A financial services firm classifies documents as Public, Internal, Confidential, and Restricted. Access to Restricted documents is determined solely by the document's classification label and the user's clearance level, and users cannot change either value. Which statement best describes this arrangement?

Accepted Answer

It is mandatory access control because labels and clearances are enforced by the system and cannot be changed by users.. Access decisions driven by immutable system labels compared against a subject's clearance define mandatory access control. Because users cannot alter the classification of a document or their own clearance, the system, not the owner, dictates access. Role-based and rule-based models instead key on job function or global conditions, and discretionary models allow owner control.

Answer

It is role-based access control because clearance levels map to job roles.

Answer

It is rule-based access control because classification follows written policy.

Answer

It is discretionary access control because document owners set the labels.

Question 17

A cloud-hosted retailer's disaster recovery plan relies on backups stored in the same cloud region as production. A regional outage takes the production environment offline. Which weakness does this scenario PRIMARILY expose in the disaster recovery strategy?

Accepted Answer

Production and backups share a single geographic failure domain, so a regional outage affects both. Disaster recovery requires that backups be isolated from the failure domain that affects production. Keeping backups in the same cloud region means a regional outage disables both production and the recovery data, leaving no viable restore path. Geographic separation, such as cross-region or cross-provider replication, ensures backups remain accessible when the primary region fails.

Answer

The backup schedule is too infrequent to meet the stated recovery point objective

Answer

The backups lack encryption at rest, exposing customer payment data to unauthorized access

Answer

The recovery time objective is not documented in the business continuity plan

Question 18

A security team wants to detect when an attacker is using a compromised account to move laterally between servers inside the network. Which monitoring approach would best surface this activity?

Accepted Answer

Analyzing internal authentication and remote-access logs for unusual source-destination pairs. Lateral movement uses stolen credentials to reach systems the account would not normally access, so the strongest signal is internal authentication and remote-access activity showing unusual source-destination pairs, off-hours logins, or one account touching many hosts. Perimeter, email, and backup monitoring address different threats and would not reveal an attacker pivoting inside the network.

Answer

Tracking the number of failed disk backups on storage systems

Answer

Monitoring outbound email volume for spikes in messages sent by users

Answer

Reviewing only the perimeter firewall's inbound connection logs

Question 19

A security analyst is reviewing network logs to detect potential intrusions. Which TWO of the following are examples of network-based indicators of compromise? (Choose two.)

Accepted Answer

Multiple connections to a command-and-control server. Network-based indicators of compromise are observable in network traffic, such as unusual outbound connections to malicious IPs or multiple connections to command-and-control servers. These suggest active communication with attacker infrastructure. Host-based indicators, like failed logins or new accounts, are found on individual systems and are not network-based.

Answer

A file with a suspicious hash value found in a user's download folder

Answer

A new local administrator account created on a workstation

Answer

A sudden increase in failed login attempts on a user account

Question 20

An online retailer stores customer credit card numbers. Management decides to retain only the last four digits and delete the full numbers after payment authorization. Which security principle does this decision best illustrate?

Accepted Answer

Data minimization. The retailer chooses to store only the last four digits and remove the full card number once authorization completes. That reduces the amount of sensitive data held, which is data minimization. Separation of duties concerns dividing tasks, defense in depth concerns layered controls, and least privilege concerns limiting user access, so none of them captures the decision to collect and keep less information.

Answer

Defense in depth

Answer

Least privilege

Answer

Separation of duties