ISC2 CC Practice Exam 62 — 20 Questions

Question 1

Which protocol operates at the Transport layer and provides reliable, connection-oriented data delivery?

Accepted Answer

TCP. TCP (Transmission Control Protocol) uses a three-way handshake, sequencing, and acknowledgments to ensure reliable delivery.

Answer

UDP

Answer

IP

Answer

HTTP

Question 2

A security analyst notices an unusually high number of incomplete TCP connection requests. Which type of attack is most likely occurring?

Accepted Answer

SYN flood. SYN flood attacks exploit the TCP three-way handshake by sending many SYN packets without completing the handshake, exhausting server resources.

Answer

Smurf attack

Answer

ARP spoofing

Answer

DNS amplification

Question 3

A security analyst notices unusual traffic on the network. Using Wireshark, they capture packets and see that an attacker is reading all unencrypted data from the network segment. Which type of attack is most likely being performed?

Accepted Answer

Sniffing / Eavesdropping. Sniffing or eavesdropping involves capturing network traffic to read data. In this scenario, unencrypted data is being read, which is characteristic of sniffing.

Answer

Spoofing

Answer

DoS

Answer

Man-in-the-middle

Question 4

Refer to the exhibit. What is the first action the incident responder should take?

Accepted Answer

Investigate the web server at 192.168.1.10. The incident responder must first investigate the web server at 192.168.1.10 to confirm whether the alert is a true positive or a false positive. Jumping to containment actions like disabling the application or blocking the IP without verification could disrupt legitimate services or overlook the root cause. The initial step in any incident response process (as per NIST SP 800-61) is to validate the alert through analysis of logs, processes, and system state.

Answer

Disable the web application

Answer

Block the source IP in firewall

Answer

Ignore the alert as false positive

Question 5

Which TWO are principles of access control?

Accepted Answer

Separation of duties. Separation of duties is a principle of access control that prevents any single individual from having excessive control over critical processes by dividing tasks and privileges among multiple people. This reduces the risk of fraud or error, as collusion is required to bypass controls. It is a foundational concept in security frameworks like NIST SP 800-53 and is often enforced through role-based access control (RBAC) policies.

Answer

Security through obscurity

Answer

Multifactor authentication

Answer

Single sign-on (SSO)

Question 6

An organization wants to ensure that its backup strategy can recover data within 2 hours after a system failure. Which metric should be defined in the disaster recovery plan?

Accepted Answer

Recovery Time Objective (RTO). The Recovery Time Objective (RTO) defines the maximum acceptable time to restore systems and data after a disaster, directly addressing the 2-hour recovery requirement. In the context of backup strategy, RTO drives decisions on failover mechanisms, replication speed, and restoration procedures to meet the specified downtime limit.

Answer

Mean Time Between Failures (MTBF)

Answer

Recovery Point Objective (RPO)

Answer

Service Level Agreement (SLA)

Question 7

A security architect is evaluating a biometric authentication system. The system's false positive rate is 0.1%, and the false negative rate is 2%. Which security principle is most compromised if the organization prioritizes user convenience over security?

Accepted Answer

Confidentiality. When the organization prioritizes user convenience over security, they may lower the biometric system's threshold to reduce false negatives (improving availability by letting more legitimate users in). However, this increases the false positive rate, allowing unauthorized users to be authenticated. This directly compromises confidentiality, as unauthorized access to systems and data can occur. Availability is initially improved (not compromised) by this action, so it is not the principle most compromised. Therefore, the correct answer is A (Confidentiality).

Answer

Non-repudiation

Answer

Availability

Answer

Integrity

Question 8

In a MAC environment implementing Bell-LaPadula, a subject with Secret clearance attempts to read an object classified as Confidential and write to an object classified as Top Secret. Which operations are permitted?

Accepted Answer

Both read and write allowed. In Bell-LaPadula, the Simple Security Property (no read up) prevents a subject from reading an object at a higher classification, but reading down is allowed. The *-Property (no write down) prevents writing to a lower classification, but writing up is allowed. Since the subject has Secret clearance, reading Confidential (lower) is permitted, and writing to Top Secret (higher) is permitted, so both operations are allowed.

Answer

Read denied, write allowed

Answer

Read allowed, write denied

Answer

Both read and write denied

Question 9

An organization is experiencing network attacks where the attacker forges the source IP address. Which two types of attacks commonly use IP spoofing? (Choose TWO.)

Accepted Answer

SYN flood. SYN floods often spoof source IPs to hide the attacker, and DNS amplification attacks use spoofed source IPs to direct responses to the victim. ARP spoofing is local and does not involve IP spoofing in the same way, while MAC flooding and ping of death are different.

Answer

ARP spoofing

Answer

MAC flooding

Answer

Ping of death

Question 10

A network engineer is designing a DMZ. Which three servers should typically be placed in the DMZ? (Choose THREE.)

Accepted Answer

Web server. Public-facing servers like web, mail, and DNS servers are typically placed in a DMZ to isolate them from the internal network. DHCP servers are usually internal, and database servers are kept internal for security.

Answer

DHCP server

Answer

Database server

Question 11

A company's security policy requires that all sensitive data be encrypted during transfer. A security administrator discovers that an internal web application is using a self-signed TLS certificate. What vulnerability does this introduce?

Accepted Answer

Man-in-the-middle attacks because the certificate cannot be verified. A self-signed TLS certificate is not signed by a trusted Certificate Authority (CA), so clients cannot verify the certificate's authenticity. This allows an attacker to intercept the TLS handshake, present their own self-signed certificate, and perform a man-in-the-middle (MITM) attack, decrypting and reading or modifying the data in transit.

Answer

Data corruption

Answer

Increased latency

Answer

Replay attacks because TLS is not used

Question 12

A security analyst wants to detect and analyze attacker behavior by deploying a decoy system. Which three characteristics apply to a honeypot? (Choose THREE.)

Accepted Answer

It is a decoy system to attract attackers. Honeypots are decoy systems designed to attract attackers, provide early warning, and allow analysis of attacker techniques. They do not contain real production data and are not used for legitimate traffic.

Answer

It contains sensitive production data

Answer

It is used for legitimate network traffic

Question 13

A security analyst discovers that an organization's firewall rule set allows all inbound traffic on TCP port 443 from any source to a single web server. Additionally, the server has a known critical vulnerability in its TLS implementation. Which principle of security architecture is most directly violated by this configuration?

Accepted Answer

Least privilege. Least privilege is the principle that users and systems should be granted only the minimum necessary permissions to perform their functions. In this scenario, allowing all inbound traffic on TCP 443 from any source to a single web server violates least privilege because it permits access from any IP address worldwide, when only specific sources (e.g., the organization's IP ranges) are needed. The additional vulnerability in TLS is irrelevant to the principle itself; the core issue is the overly permissive firewall rule. Options B, C, and D describe different principles that are not the most directly violated. Defense in depth would be about having multiple layers of security, separation of duties is about dividing responsibilities, and fail-safe defaults is about default-deny posture. Therefore, the most direct violation is least privilege.

Answer

Defense in depth

Answer

Separation of duties

Answer

Fail-safe defaults

Question 14

Refer to the exhibit. What type of event is this?

Accepted Answer

Failed network login. The event shows a failed network logon (Logon Type 3) with a failure status code. Option A is incorrect because an account lockout event would have a different event ID (e.g., 4740), not a Logon Type 3 failure. Option B is incorrect because the event indicates a failure (e.g., status 0xC000006D), not a successful login. Option D is incorrect because Logon Type 3 indicates a network logon, whereas a local logon would be Type 2 or 10.

Answer

Account lockout

Answer

Successful remote login

Answer

Failed local login

Question 15

Refer to the exhibit. A security engineer reviews this firewall ACL. Which of the following best describes the security posture?

Accepted Answer

The ACL correctly allows HTTPS and denies SSH, blocking other traffic. Standard ACLs have an implicit deny all at the end. In this ACL, the explicit deny for SSH (port 22) is reachable because there is no earlier permit rule that matches SSH. The permit for HTTPS (port 443) allows that traffic, and the implicit deny blocks all other traffic. Therefore, the ACL correctly allows HTTPS, denies SSH, and denies everything else, providing a specific security posture.

Answer

The ACL is misconfigured because the deny for SSH is never reached

Answer

The ACL is properly ordered with most specific rules first

Answer

The ACL should have a deny any any at the end to be secure

Question 16

An analyst reviews the exhibit. What security principle is best demonstrated by this policy?

Accepted Answer

Least privilege. The policy grants users only the permissions necessary to perform their job functions, which is the core definition of least privilege. By restricting access to only required resources, the policy minimizes the attack surface and limits potential damage from compromised accounts.

Answer

Separation of duties

Answer

Defense in depth

Answer

Non-repudiation

Question 17

What is the primary purpose of identification in the context of access control?

Accepted Answer

To claim an identity. In access control, identification is the process by which a user claims an identity (e.g., by providing a username or account name). It is distinct from authentication, which verifies that claim. The primary purpose of identification is to assert who you are, not to prove it.

Answer

To grant permissions to resources

Answer

To verify the identity of the user

Answer

To record user activities

Question 18

An organization has implemented a SIEM solution. The security team wants to detect when a user attempts to access a file they do not have permission to read. Which log source is most important for this detection?

Accepted Answer

Windows security event logs. Windows security event logs (specifically Event ID 4663) record every attempt to access an object, including files, and include the user's security identifier (SID) and the requested access mask. This allows the SIEM to correlate the user's identity with the file's discretionary access control list (DACL) to detect an 'Access Denied' result, making it the definitive source for detecting unauthorized file access attempts.

Answer

Web server access logs

Answer

DNS logs

Answer

Firewall logs

Question 19

Which of the following is a characteristic of a stateful firewall that distinguishes it from a stateless firewall?

Accepted Answer

It uses a state table to track connections. A stateful firewall maintains a state table to track active connections, allowing it to make decisions based on the context of the traffic.

Answer

It can decrypt SSL traffic

Answer

It examines each packet in isolation

Answer

It can filter based on application-layer data

Question 20

Refer to the exhibit. Based on the JSON policy, what access does the SecurityAuditor role have?

Accepted Answer

Read-only access to all objects in the critical-data bucket.. The JSON policy grants the SecurityAuditor role the `s3:GetObject` action on the `arn:aws:s3:::critical-data/*` resource, which provides read-only access to all objects in the critical-data bucket. The `Effect` is set to `Allow`, and no other actions like `s3:PutObject` or `s3:DeleteObject` are included, so the role cannot write or delete objects. This matches the correct answer B.

Answer

No access to any S3 resources.

Answer

Write access to the critical-data bucket.

Answer

Full access to the S3 bucket critical-data.