ISC2 CC Practice Exam 62 — 20 Questions

Question 1

A security administrator is reviewing firewall logs and notices repeated inbound connection attempts to TCP port 3389 from multiple external IP addresses. Which type of attack is MOST likely occurring?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Remote Desktop Protocol (RDP) brute force. TCP port 3389 is the default port for Remote Desktop Protocol (RDP). Repeated inbound connection attempts from multiple external IP addresses indicate an RDP brute-force attack, where attackers try to guess credentials to gain remote access. This is a common and dangerous attack, as successful compromise can lead to full system control. Other attack types do not match the described network behavior.

Answer

Denial-of-service (DoS) attack

Answer

SQL injection

Answer

Ransomware encryption

Question 2

A retail company is designing its access control program and wants to rely on attributes such as the user's department, the sensitivity label of the data, and the current time of day to make access decisions. Which TWO of the following statements accurately describe attribute-based access control (ABAC)? (Choose two.)

Accepted Answer

ABAC can enforce rules such as permitting access only during business hours from a corporate network.. ABAC makes decisions by evaluating attributes of the subject, resource, action, and environment, which enables granular rules such as time-limited and location-aware access. It does not depend on a single job title, does not require one fixed role per user, and can absolutely incorporate data sensitivity labels as resource attributes. The two accurate statements describe multi-attribute evaluation and environmental conditions.

Answer

ABAC requires that every user be assigned exactly one static role that never changes.

Answer

ABAC policies cannot incorporate data sensitivity labels because labels are a form of mandatory access control.

Answer

ABAC decisions are made solely from the user's job title stored in the human resources system.

Question 3

A security team is designing a network segmentation strategy to protect a database server that contains sensitive customer information. The database server should only be accessible by the application server, and no other systems should be able to initiate connections to it. Which two controls should the team implement to achieve this? (Choose two.)

Accepted Answer

Place the database server in a separate VLAN and configure firewall rules to allow traffic only from the application server's IP address.. Combining network segmentation with firewall rules and a host-based firewall provides defense in depth. The VLAN and network firewall restrict access at the network perimeter, while the host firewall adds protection directly on the server. Together, they ensure only the application server can connect, aligning with least privilege.

Answer

Use network address translation (NAT) to hide the database server's IP address from other internal systems.

Answer

Enable port security on the switch port connected to the database server to restrict MAC addresses.

Answer

Deploy an intrusion detection system (IDS) to monitor traffic to the database server and alert on suspicious connections.

Question 4

A company stores backup tapes containing customer data in an offsite vault. The security policy requires that if the tapes are lost or stolen, the data cannot be read by unauthorized parties. Which control should the company implement to meet this requirement?

Accepted Answer

Encrypt the backup tapes. Encryption protects data confidentiality even when physical media is lost or stolen. By encrypting backup tapes, the company ensures that unauthorized parties cannot read customer data without the decryption keys. Checksums, labels, and locked cabinets may support handling or integrity, but none prevents a thief from reading the tape contents, so encryption is the required control.

Answer

Label the tapes with a classification marking

Answer

Store the tapes in a locked cabinet

Answer

Apply a checksum to each tape

Question 5

A security analyst reviewing network logs notices that an internal workstation is resolving a well-known banking domain to an IP address that belongs to an unknown external host. The workstation's configured DNS server is the corporate resolver, and no changes were made to it. Which type of attack is most likely occurring?

Accepted Answer

DNS cache poisoning. When a workstation uses the corporate resolver and suddenly receives an attacker-controlled IP for a legitimate banking domain, the most likely cause is that the resolver's cache has been poisoned with a forged record. DNS cache poisoning redirects users to malicious destinations without changing endpoint configuration. Tunneling, domain hijacking, and amplification do not match the observed symptom of a wrong but locally scoped resolution.

Answer

DNS tunneling

Answer

Domain hijacking

Answer

DNS amplification

Question 6

A hospital IT team is reviewing how staff access patient records. A nurse logs in with a unique employee ID, then enters a password plus a one-time code from a hardware token. The team wants to document which access control category this login process represents. Which category BEST describes this approach?

Accepted Answer

Something you know combined with something you have. Authentication factors fall into categories such as knowledge, possession, inherence, and location. The nurse's password represents knowledge, while the hardware token one-time code represents possession. Pairing factors from two different categories achieves multi-factor authentication, which is stronger than using two factors from the same category. This combination directly matches the described login process.

Answer

Two separate instances of something you know

Answer

Something you are combined with something you have

Answer

Something you have combined with somewhere you are

Question 7

A defense contractor runs a facility where entry to the secure lab requires a fingerprint scan, and entry to the adjacent server cage additionally requires a retina scan. A security analyst is documenting the access control design for an audit. Which two statements accurately describe these controls? (Choose two.)

Accepted Answer

The fingerprint scan at the lab door is a biometric control that verifies a physiological characteristic of the individual.. Fingerprint and retina scans both measure physical characteristics of a person, so each is a biometric and an inherence factor. Pairing them strengthens verification but does not create multifactor authentication, because multifactor requires factors from separate categories such as knowledge, possession, and inherence. Least privilege concerns granted permissions, not the credentials presented at a door.

Answer

The fingerprint and retina scans together demonstrate the principle of least privilege.

Answer

Requiring both the fingerprint and retina scans for the server cage is an example of multifactor authentication.

Answer

Because both doors use biometrics, the facility has satisfied the requirement for two-factor authentication.

Question 8

A security analyst is reviewing how a centralized authentication protocol validates user credentials before granting access to network resources. Which two characteristics correctly describe Kerberos authentication as used in a Windows domain environment? (Choose two.)

Accepted Answer

It provides mutual authentication, allowing both the client and the service to verify each other's identity.. Kerberos uses a trusted Key Distribution Center to issue ticket-granting and service tickets, and it supports mutual authentication because the service ticket is encrypted with the service key while the client's authenticator proves possession of the session key. Passwords are never sent to services or embedded in tickets, which is why the two selected characteristics accurately describe the protocol.

Answer

It requires every service to maintain a local copy of all domain user passwords.

Answer

It stores user passwords in a reversible encrypted format inside each service ticket.

Answer

It transmits the user's password to each service in plaintext during authentication.

Question 9

A cloud administrator notices that several engineers share one privileged account with a single set of credentials for managing production databases. An audit finds no way to attribute a specific change to a specific engineer. Which access control weakness does this represent?

Accepted Answer

Lack of accountability because shared credentials prevent tracing actions to an individual. Accountability depends on unique identities so that logs can tie each action to one person. Sharing a single privileged credential collapses multiple engineers into one identity, making attribution impossible and undermining nonrepudiation. The remedy is individual named accounts with privileged access management, not merely stronger authentication or additional approvals.

Answer

Excessive privilege because engineers can manage production databases

Answer

Missing authorization because the account was never formally approved

Answer

Weak authentication because the shared account uses only a single password

Question 10

A security architect is designing defenses against on-path attacks on a corporate wireless network where employees connect to internal applications. Which two controls most directly protect the confidentiality and integrity of employee traffic against an attacker who can observe or modify wireless frames? (Choose two.)

Accepted Answer

Requiring TLS for all internal application traffic between clients and servers.. Protecting against an on-path attacker requires cryptography at both the wireless link and the application layer. WPA3-Enterprise with protected management frames secures the radio hop and prevents management-frame manipulation, while TLS secures application data end to end. Monitoring, SSID hiding, and MAC filtering may add visibility or friction but do not encrypt or integrity-protect the traffic itself, so they do not directly meet the stated goal.

Answer

Deploying a wireless intrusion detection system to alert on rogue access points.

Answer

Implementing MAC address filtering to admit only known corporate devices.

Answer

Disabling SSID broadcast to make the corporate network harder to find.

Question 11

A software company uses a central identity provider so employees can sign in once and access email, the code repository, and the expense system without entering credentials again during the workday. The security team wants to describe the mechanism that lets the identity provider assert the user's identity to each application. Which technology is being used?

Accepted Answer

Security Assertion Markup Language (SAML). Federation allows one trusted identity provider to authenticate a user and send signed assertions to multiple service providers, delivering single sign-on across separate systems. SAML is the standard that defines these assertions and the request-response flow. The described environment, where one login grants access to email, code repository, and expense applications, is a textbook SAML federation deployment.

Answer

Kerberos ticket granting

Answer

Remote Authentication Dial-In User Service (RADIUS)

Answer

Lightweight Directory Access Protocol (LDAP) bind

Question 12

A company experiences a ransomware attack that encrypts its file servers. The security team restores operations from offline backups taken the previous night. Which security principle does the restoration from backups primarily support?

Accepted Answer

Availability. Ransomware encryption makes the file servers unavailable, and restoring from an offline backup taken the previous night brings the data and services back online with minimal loss. That is the availability objective of the CIA triad. Confidentiality protects against disclosure, integrity protects against unauthorized alteration, and non-repudiation proves actions; the recovery activity here is specifically about regaining access to systems and data.

Answer

Integrity

Answer

Confidentiality

Answer

Non-repudiation

Question 13

During an incident, an analyst collects a forensic image of a compromised server's disk. The organization's policy requires preserving evidence for potential legal proceedings. Which action best maintains the integrity of the collected evidence?

Accepted Answer

Compute and document a cryptographic hash of the image immediately after acquisition.. Cryptographic hashing at the time of acquisition establishes a verifiable baseline for the forensic image. Any later modification changes the hash, so a match confirms integrity. This practice, combined with documented chain of custody, supports the reliability of evidence in legal contexts. Working from a verified copy rather than the original also protects the source media, and preserving the full image without deletions ensures nothing is lost.

Answer

Analyze the original disk in place to avoid copying errors.

Answer

Delete non-relevant files from the image to reduce size before storage.

Answer

Compress the image with a password to prevent tampering.

Question 14

A financial services firm must enforce access decisions based on data sensitivity labels assigned by a central authority, and users cannot change these labels or grant access to others. Which access control model is the firm implementing?

Accepted Answer

Mandatory Access Control (MAC). Mandatory Access Control relies on security labels assigned by a central authority and compares them with user clearances. Users cannot alter labels or delegate access, which matches the firm's requirement to enforce decisions based on data sensitivity. Discretionary Access Control and Role-Based Access Control allow owner or role-based discretion, and Attribute-Based Access Control is broader and policy-driven, so none of them captures the centralized, non-discretionary label enforcement described.

Answer

Attribute-Based Access Control (ABAC)

Answer

Role-Based Access Control (RBAC)

Answer

Discretionary Access Control (DAC)

Question 15

A hospital's network team notices that a radiology workstation is receiving a duplicate IP address error. The DHCP server logs show the workstation was assigned 10.10.20.45, but the workstation is manually configured with that same address. Which DHCP feature should have been configured to prevent this conflict?

Accepted Answer

DHCP exclusion range. The conflict occurs because the DHCP server dynamically leases an address that is already statically assigned to another device. To prevent this, the address must be removed from the assignable pool using an exclusion range. This ensures the server never offers that address, eliminating the duplicate IP conflict without changing the workstation's static configuration.

Answer

DHCP snooping

Answer

DHCP relay agent

Answer

DHCP reservation

Question 16

Maya is a security administrator at a healthcare company. She discovers that nurses can view patient billing records even though their job duties only require access to clinical treatment notes. She wants to apply the security principle that restricts users to only the data they need to perform their assigned tasks. Which principle should she implement?

Accepted Answer

Least privilege. Least privilege is the security principle that requires giving users only the access needed for their specific job tasks. Because the nurses only need clinical notes, removing their billing access aligns directly with that principle. Separation of duties, defense in depth, and non-repudiation address different concerns and would not correct the excessive permissions described.

Answer

Defense in depth

Answer

Non-repudiation

Answer

Separation of duties

Question 17

A payroll administrator can view salary records for all employees during normal business hours, but only after her manager approves each access request and the system logs the action. Which security principle is BEST illustrated by limiting her access to what her job requires and only when needed?

Accepted Answer

Least privilege. Least privilege means granting only the access required to perform a job and only when it is required. The payroll administrator sees salary data tied to her role, must obtain approval for each request, and works within defined hours, all of which narrow access to the minimum necessary. Approval and logging reinforce accountability but do not change the underlying principle being demonstrated.

Answer

Non-repudiation

Answer

Defense in depth

Answer

Separation of duties

Question 18

A hospital's incident response team is drafting the post-incident activity phase of its plan after a recent malware outbreak. Which two activities belong in this phase? (Choose two.)

Accepted Answer

Update the incident response plan and detection signatures based on findings from the investigation. Post-incident activity focuses on learning from the event and improving future response. Conducting a lessons-learned review identifies root cause and gaps, while updating the incident response plan and detection signatures institutionalizes those findings. Containment, eradication, and recovery actions occur earlier in the lifecycle, so isolating hosts, removing malware, or activating a recovery site do not belong in the post-incident phase.

Answer

Eradicate the malware by removing malicious files and disabling the persistence mechanism

Answer

Activate the disaster recovery site so clinical applications continue to run during the outage

Answer

Isolate infected workstations from the network to prevent the malware from reaching other systems

Question 19

A security administrator is configuring a Linux web server and wants to ensure that only encrypted administrative sessions are allowed, while also preventing direct root logins over the network. Which of the following should the administrator implement?

Accepted Answer

Enable SSH with PermitRootLogin set to no and restrict access to the management subnet.. The requirement is to allow only encrypted administrative sessions and prevent direct root logins. SSH is the standard encrypted remote administration protocol on Linux. Setting PermitRootLogin to no blocks direct root access over SSH, and restricting access to a management subnet adds defense in depth. Together, these measures meet both conditions without disrupting necessary administration.

Answer

Enable Telnet with strong password policies and disable the root account.

Answer

Implement a VPN for all server traffic and allow root logins only from the local console.

Answer

Configure a host-based firewall to allow only HTTP and HTTPS traffic and disable SSH.

Question 20

A hospital issues each nurse a unique username and a badge that is scanned at a workstation to prove the nurse's identity before any patient records can be opened. Which access control concept does scanning the badge to prove identity represent?

Accepted Answer

Authentication. Authentication is the verification of a claimed identity, and the badge scan validates that the nurse is the person associated with the enrolled credential. Identification only asserts who someone claims to be, while authorization decides what that verified identity may do. Because the scenario emphasizes proving identity before opening records, the scan is the authentication step.

Answer

Identification

Answer

Authorization

Answer

Accounting