ISC2 CC Practice Exam 61 — 20 Questions

Question 1

An attacker sends a forged ARP response to a switch, associating the attacker's MAC address with the IP address of the default gateway. The switch updates its ARP cache accordingly. This is an example of which attack?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ARP spoofing. ARP spoofing (or ARP poisoning) involves sending fake ARP messages to associate the attacker's MAC with a legitimate IP, enabling man-in-the-middle attacks.

Answer

MAC flooding

Answer

DNS spoofing

Answer

IP spoofing

Question 2

Which document outlines the procedures for maintaining critical business functions during a disruption?

Accepted Answer

Business Continuity Plan. The Business Continuity Plan (BCP) is the correct answer because it specifically outlines the procedures and strategies to maintain critical business functions during a disruption. Unlike other plans that focus on IT recovery or incident response, the BCP ensures that essential business operations continue, often by leveraging alternate work sites, manual workarounds, or scaled-down processes, until normal operations can be restored.

Answer

Continuity of Operations Plan

Answer

Incident Response Plan

Answer

Disaster Recovery Plan

Question 3

An attacker sends forged ARP messages to associate their MAC address with the IP address of a legitimate server. This allows the attacker to intercept traffic intended for that server. What is this attack?

Accepted Answer

ARP spoofing. ARP spoofing (or ARP poisoning) involves sending fake ARP replies to associate the attacker's MAC with a victim's IP, enabling man-in-the-middle attacks.

Answer

DNS poisoning

Answer

MAC flooding

Answer

IP spoofing

Question 4

Which THREE of the following are common mitigation techniques against Denial of Service (DoS) attacks?

Accepted Answer

Implementing rate limiting on servers. DoS mitigation includes using DDoS protection services, rate limiting, and filtering traffic based on IP reputation.

Answer

Disabling all firewall rules

Answer

Allowing all inbound traffic to avoid blocking legitimate users

Question 5

A company is designing a new authentication system for remote employees. They want to ensure that if one authentication factor is compromised, the system remains secure. Which security principle should they apply?

Accepted Answer

Defense in depth. Defense in depth is the correct principle because it involves implementing multiple layers of security controls so that if one authentication factor is compromised, other layers still protect the system. In this scenario, requiring multiple authentication factors (e.g., password plus biometric or token) ensures that a single compromised factor does not grant full access, maintaining overall system security.

Answer

Fail-safe

Answer

Least privilege

Answer

Need to know

Question 6

A medium-sized company uses a SIEM solution to collect logs from firewalls, servers, and endpoints. The security team receives an alert indicating a possible data exfiltration: an employee's workstation is sending large amounts of data to an external IP address outside business hours. The employee works in the finance department and has access to sensitive financial records. The SIEM shows the connection is ongoing. The security team must respond immediately to contain the incident while preserving evidence. The company's incident response plan designates the security team as first responders. Which of the following is the BEST first action?

Accepted Answer

Block the external IP address at the firewall and disconnect the workstation from the network.. The best first action because it immediately stops the ongoing data exfiltration and isolates the system, containing the incident and preserving evidence. Option B delays containment, Option C may alert a potential insider threat, and Option D should be performed after containment to avoid further data loss.

Answer

Notify the employee's manager and wait for further instructions.

Answer

Call the employee to ask if they are transferring files for a legitimate business purpose.

Answer

Take a forensic image of the workstation's hard drive before anything else.

Question 7

A company is experiencing a distributed denial-of-service (DDoS) attack that is overwhelming the network bandwidth. Which THREE mitigation techniques are most effective?

Accepted Answer

Enable rate limiting on network devices. Traffic filtering, rate limiting, and using a CDN can help absorb DDoS traffic. Changing IP addresses is reactive and not a standard mitigation; disabling ICMP may help against some attacks but is not a primary mitigation.

Answer

Disable ICMP on all devices

Answer

Change the public IP address of the server

Question 8

A security administrator is reviewing the principles of access control. Which TWO of the following are core components of the AAA framework? (Select TWO.)

Accepted Answer

Authorization. The AAA framework consists of Authentication, Authorization, and Accounting. Authentication verifies the identity of a user or device (e.g., via RADIUS or TACACS+). Authorization determines what resources or actions the authenticated entity is permitted to access (e.g., via privilege levels or ACLs). Accounting tracks and logs user activities for auditing and billing purposes. Therefore, Authorization (A) and Authentication (D) are two of the three core components of AAA.

Answer

Identification

Answer

Non-repudiation

Answer

Auditing

Question 9

A company's business continuity plan includes an alternate work site with full IT capabilities. Which type of recovery site does this describe?

Accepted Answer

Hot site. A hot site is a fully equipped alternate work site with all necessary IT infrastructure—servers, networking, telecommunications, and power—ready to take over operations immediately. The question specifies 'full IT capabilities,' which aligns with the hot site's purpose of enabling rapid failover with minimal downtime, typically within hours.

Answer

Mobile site

Answer

Cold site

Answer

Warm site

Question 10

A security professional is implementing a file integrity monitoring (FIM) system on critical servers. Which element of the CIA triad does this primarily address?

Accepted Answer

Integrity. File integrity monitoring detects unauthorized changes to files, ensuring data accuracy and completeness, which is the integrity element.

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 11

A security analyst is reviewing firewall logs and notices an unusually high number of blocked outbound connections to a single external IP address. Which TWO actions should the analyst take to investigate this potential security incident? (Choose two.)

Accepted Answer

Check threat intelligence feeds for the external IP address.. Investigating the source system helps determine if it is compromised; checking threat intelligence can reveal if the IP is known malicious.

Answer

Increase logging for all traffic to that IP.

Answer

Disable the firewall rule that is blocking the connections.

Answer

Block all outbound traffic from the source system.

Question 12

A security team is developing an incident response plan. Which THREE of the following are essential components of crisis communications during a data breach? (Choose three.)

Accepted Answer

Notifying affected customers. Crisis communications should include notifying affected customers, informing management, and complying with legal/regulatory notification requirements. Public relations is also involved, but the options focus on key stakeholders.

Answer

Revealing technical details of the attack to the public

Answer

Deleting all logs to prevent evidence leakage

Question 13

You are the incident response lead for a financial services company. At 09:00, the SOC detects unusual outbound traffic from a server in the DMZ to an external IP known to be a command-and-control (C2) server. The server runs a legacy application that cannot be patched. The server is critical for customer transactions, but an alternate manual process can sustain operations for up to 4 hours. The CTO wants to keep the server online to avoid customer impact. The CEO is concerned about data exfiltration. The compliance officer reminds you of regulatory requirements to report breaches within 72 hours. Which action should you take FIRST?

Accepted Answer

Disconnect the server from the network and activate the manual process.. The correct first action is to disconnect the server from the network and activate the manual process. This immediately stops potential data exfiltration to the C2 server and contains the incident, aligning with the NIST incident response lifecycle's containment phase. Since the server runs a legacy application that cannot be patched and the manual process can sustain operations for up to 4 hours, isolation is both feasible and necessary to prevent further compromise while maintaining business continuity.

Answer

Report the incident to the regulatory authority immediately.

Answer

Perform a forensic analysis of the server to determine the scope of compromise.

Answer

Keep the server online under close monitoring to minimize customer disruption.

Question 14

During a disaster recovery test, the recovery time objective (RTO) for a critical application is 4 hours, but the actual recovery takes 6 hours. Which of the following best describes the impact?

Accepted Answer

The application is unavailable for 2 hours longer than acceptable.. The recovery time objective (RTO) defines the maximum acceptable downtime for an application. Since the RTO is 4 hours but the actual recovery took 6 hours, the application was unavailable for 2 hours beyond the acceptable threshold, directly impacting business continuity. This is a failure to meet the RTO, not the RPO, which concerns data loss.

Answer

Data loss beyond the recovery point objective (RPO).

Answer

The recovery point objective (RPO) is not met.

Answer

No impact because RTO is only a guideline.

Question 15

Refer to the exhibit. A security analyst runs the above iptables command on a Linux server. The server is configured with a default policy of DROP on the INPUT chain. Users report they can SSH to the server but cannot ping it. What is the most likely reason?

Accepted Answer

The ICMP rule only allows incoming echo requests; outgoing echo replies are not covered by the displayed rules and must be allowed by the OUTPUT chain.. The displayed iptables rules only govern the INPUT chain, which controls incoming packets. While the rule allows incoming ICMP echo requests (type 8), the server's response—an ICMP echo reply (type 0)—is an outgoing packet that must traverse the OUTPUT chain. If the OUTPUT chain has a default policy of DROP or lacks an explicit ACCEPT rule for ICMP echo replies, the replies are dropped, preventing ping from working even though SSH succeeds (since SSH uses TCP, which is handled differently).

Answer

The default policy DROP on the INPUT chain drops echo replies, but they should be matched by the ESTABLISHED,RELATED rule.

Answer

The ICMP rule is placed after the ESTABLISHED,RELATED rule, so it is never evaluated for new ICMP packets.

Answer

The ACCEPT rule for ICMP only permits echo request (type 8), but ping requires echo reply (type 0) which is not allowed.

Question 16

Which THREE of the following are recognized security control types according to ISC2? (Choose three.)

Accepted Answer

Technical. (Technical) is correct because ISC2 recognizes technical controls as a primary security control type, encompassing mechanisms like firewalls, encryption, and intrusion detection systems that enforce security policies through technology. These controls operate at the system or network level to protect assets directly.

Answer

Deterrent

Answer

Operational

Question 17

An organization wants to protect its internal network from unsolicited inbound traffic while allowing responses to outbound connections. Which TWO firewall features or types are best suited for this? (Select TWO)

Accepted Answer

NGFW. Stateful inspection tracks connection state to allow return traffic. NGFW includes stateful inspection plus advanced features. Packet filtering alone is stateless; proxy and IDS are not optimal.

Answer

Packet filtering (stateless)

Answer

Application proxy

Answer

IDS

Question 18

A financial firm has a data center with strict access controls. Employees must use smart cards and PINs to enter a mantrapped entrance. Recently, an unauthorized person gained access by following an employee through the mantrapped door (tailgating). The security team reviews logs and finds that the door was opened twice in quick succession, indicating tailgating occurred. The firm wants to implement a solution that prevents tailgating without slowing down authorized access. Which action should they take?

Accepted Answer

Implement a turnstile that allows only one person per smart card authentication. A turnstile physically enforces one-person-per-authentication by rotating only after a valid smart card read and allowing a single passage, then locking until the next authentication. This directly prevents tailgating without adding delay, as each authorized user passes through at their own pace without needing additional steps like biometric scans or pre-approval.

Answer

Require employees to log access requests in advance

Answer

Install a biometric scanner that requires fingerprint and retina scan

Answer

Increase the number of security guards at the entrance

Question 19

Which OSI layer is responsible for logical addressing, routing, and forwarding of packets, and where does an IP address operate?

Accepted Answer

Layer 3 – Network. Layer 3 (Network) handles IP addresses, routing, and packet forwarding.

Answer

Layer 2 – Data Link

Answer

Layer 1 – Physical

Answer

Layer 4 – Transport

Question 20

Which THREE of the following are best practices for securing a wireless network?

Accepted Answer

Disable SSID broadcast. WPA2 encryption, disabling SSID broadcast (though not strong, often considered best practice in older materials), and using a strong passphrase are commonly recommended. MAC filtering and captive portals are not primary security controls.

Answer

Enable MAC address filtering

Answer

Implement a captive portal