ISC2 CC Practice Exam 63 — 20 Questions

Question 1

Which backup strategy offers the fastest restore time but requires the most storage space?

Accepted Answer

Full backup. A full backup copies all data, making restore fastest (only one set needed), but it consumes the most storage and time to perform.

Answer

Incremental backup

Answer

Differential backup

Answer

Snapshot backup

Question 2

A financial institution's incident response team is handling a denial-of-service (DoS) attack that is affecting customer access. The team has identified the attack source IPs and implemented filtering rules on the perimeter firewall. Which phase of incident response is being performed?

Accepted Answer

Containment. Implementing filtering rules to stop the attack is containment, as it prevents the attack from affecting systems further.

Answer

Detection

Answer

Recovery

Answer

Eradication

Question 3

A company experiences a ransomware attack that encrypts all files on a file server. The IT team decides to restore the server from the most recent full backup taken 24 hours ago, followed by all differential backups taken since then. If the last full backup was on Sunday at midnight, and the attack occurs on Wednesday at 6:00 AM, with differential backups taken daily at noon, how many differential backups must be restored?

Accepted Answer

2. Differential backups contain changes since the last full backup. The last full backup was Sunday midnight. Differential backups were taken Monday noon, Tuesday noon, and Wednesday noon (but the attack was at 6 AM Wednesday, so Wednesday's backup hadn't occurred yet). So differential backups available: Monday and Tuesday. That's 2 differential backups to restore.

Answer

3

Answer

4

Answer

1

Question 4

An organization's business continuity plan designates a maximum tolerable downtime (MTD) of 8 hours for its order processing system. The system's recovery time objective (RTO) is set at 4 hours, and work recovery time (WRT) is estimated at 2 hours. If a disaster occurs at 10:00 AM and the system is restored at 2:00 PM, but additional configuration and data validation take until 3:30 PM to complete, what is the total downtime and is the MTD met?

Accepted Answer

5.5 hours, MTD met. Total downtime is from 10:00 AM to 3:30 PM = 5.5 hours. MTD is 8 hours, so 5.5 hours is within MTD. However, note that RTO (4 hours) was exceeded because system restoration at 2:00 PM is 4 hours after 10:00 AM (exactly 4 hours? Actually 10 AM to 2 PM is 4 hours, so RTO exactly met. WRT is separate. MTD is met.

Answer

4 hours, MTD exceeded

Answer

4 hours, MTD met

Answer

5.5 hours, MTD exceeded

Question 5

During a security incident, the crisis communication team must notify stakeholders. According to best practices, which THREE groups should always be included in initial notifications? (Select THREE.)

Accepted Answer

Legal department. Initial notifications should include internal management (for decision-making), legal (to address liability and regulatory requirements), and public relations (to manage external messaging). Affected customers may be notified later, and law enforcement is notified if required, but not always initially.

Answer

Affected customers

Answer

Law enforcement

Question 6

Which of the following best describes a Disaster Recovery Plan (DRP)?

Accepted Answer

A plan to restore IT systems after a disruption. A DRP focuses specifically on restoring IT systems and infrastructure after a disruption.

Answer

A plan to evacuate personnel during an emergency

Answer

A plan to identify critical business functions

Answer

A plan to keep the business running during a disruption

Question 7

You are a forensic analyst responding to a reported compromise of a Linux web server. The server hosts a public-facing web application and is part of a DMZ. The initial investigation shows that unauthorized outbound connections were made to a known malicious IP address during the previous night. The server is still running and connected to the network, but the web application has been taken offline for maintenance. The incident response team wants to preserve evidence for potential legal action. You have a forensic workstation with tools like dd, netcat, and memory acquisition tools. Which of the following should be your FIRST step in the forensic acquisition process?

Accepted Answer

Capture the contents of volatile memory (RAM) using a memory acquisition tool.. Volatile memory (RAM) contains critical evidence such as running processes, network connections, encryption keys, and in-memory malware that would be lost when the system is powered off. In a forensic response, the order of volatility dictates that RAM must be captured first before any non-volatile data. Option D is correct because it follows the established forensic principle of preserving the most volatile data first.

Answer

Create a bit-for-bit copy of the hard drive using dd and a write blocker.

Answer

Capture network traffic from the server for analysis.

Answer

Run a full antivirus scan to identify malware.

Question 8

A company is implementing a backup strategy. Which TWO of the following are characteristics of incremental backups? (Choose two.)

Accepted Answer

Fast backup process. Incremental backups back up data changed since the last backup (of any type), making them fast to perform but slow to restore because multiple backup sets may be needed.

Answer

Backs up data changed since the last full backup

Answer

Fast restore process

Answer

Requires the least storage space of all backup types

Question 9

An organization is developing an incident response plan. Which TWO phases are part of the incident response lifecycle according to the NIST framework? (Select two.)

Accepted Answer

Preparation. The NIST incident response lifecycle includes: Preparation, Detection & Analysis, Containment/Eradication/Recovery, and Post-Incident Activity (lessons learned). The correct two from options are Preparation and Recovery.

Answer

Business impact analysis

Answer

Risk assessment

Answer

Vulnerability scanning

Question 10

A security engineer is configuring a firewall to allow web traffic but block all other inbound connections. The firewall is set to deny all traffic by default and only allow specific ports. Which security principle is being applied?

Accepted Answer

Default deny. Default deny. The scenario describes a firewall configured to deny all traffic by default and then explicitly allow only specific ports (e.g., TCP 80/443 for web traffic). This directly implements the default deny security principle, where any traffic not explicitly permitted is blocked. This contrasts with a default allow posture, which would permit all traffic unless explicitly denied.

Answer

Defense in depth

Answer

Fail-safe

Answer

Least privilege

Question 11

A security analyst notices repeated failed login attempts from a single IP address. The account is locked after 10 failed attempts. This is an example of which type of control?

Accepted Answer

Logical access control. Account lockout is a logical access control that detects and mitigates brute-force attacks.

Answer

Compensating control

Answer

Physical access control

Answer

Administrative control

Question 12

Which type of incident involves an attacker attempting to make a system or network resource unavailable to legitimate users?

Accepted Answer

Denial of service. A denial of service (DoS) attack aims to disrupt services by overwhelming resources.

Answer

Social engineering

Answer

Malware

Answer

Data breach

Question 13

An organization uses a 3-2-1 backup strategy. They have a primary full backup on a local NAS, a second copy on tape stored offsite, and a third copy in the cloud. During a ransomware attack, the local NAS and the tape library are both encrypted. Which copy should be used for recovery?

Accepted Answer

The cloud backup. The 3-2-1 rule ensures one copy is offsite and isolated. The cloud copy is likely immutable or separate, so it can be used for recovery.

Answer

The tape backup

Answer

The local NAS backup

Answer

A new full backup from production data

Question 14

An organization has an RTO of 4 hours and an RPO of 1 hour for its customer database. After a disaster, the IT team restores the database from backups that are 2 hours old, and the system becomes operational in 3 hours. Which of the following is true?

Accepted Answer

The RTO was met, but the RPO was not.. The system was restored in 3 hours, which is within the 4-hour RTO. However, data loss is 2 hours, exceeding the 1-hour RPO.

Answer

Neither the RTO nor RPO was met.

Answer

The RPO was met, but the RTO was not.

Answer

Both the RTO and RPO were met.

Question 15

In an LDAP directory, an entry is represented as 'CN=John Smith,OU=Sales,DC=company,DC=com'. What does 'CN' stand for?

Accepted Answer

Common Name. In LDAP, CN stands for Common Name, which is a component of the distinguished name.

Answer

Container Name

Answer

Country Name

Answer

Context Name

Question 16

Which THREE are best practices for password management according to modern guidelines? (Select THREE.)

Accepted Answer

Enforce a minimum password length of 8 characters. Modern guidelines (NIST SP 800-63) recommend length over complexity, no frequent changes, and checking against breach lists.

Answer

Require at least one uppercase, one lowercase, one digit, and one special character

Answer

Require passwords to be changed every 30 days

Question 17

A company implements a policy where no single employee can approve a purchase order over $10,000. Instead, two managers must jointly approve it. Which security principle does this practice exemplify?

Accepted Answer

Separation of duties. Separation of duties ensures that no single individual has control over all critical functions, reducing the risk of fraud or error.

Answer

Need-to-know

Answer

Defense in depth

Answer

Least privilege

Question 18

A user reports that they are unable to access a shared network drive that they previously could access. The administrator checks permissions and finds the user's account is still a member of the correct group. What should the administrator check next?

Accepted Answer

Check for explicit deny permissions on the folder. Even if group membership is correct, explicit deny permissions can override allow permissions. Checking for deny entries on the folder is a logical next step. User lockout would affect all accesses. Effective permissions would show the combined result but checking for denies is more direct. Password expiration is a login issue, not a permissions issue.

Answer

Group membership inheritance

Answer

User account lockout status

Answer

Effective permissions

Question 19

Refer to the exhibit. Based on the exhibit, why was the packet denied?

Accepted Answer

The packet was blocked by an inbound access list. The exhibit shows an inbound access list applied to the interface, and the packet is denied because its source IP matches a deny entry in that inbound ACL. Inbound access lists filter traffic before it is processed by the router, so the packet is dropped upon arrival. The correct answer is D because the packet was blocked by an inbound access list, as indicated by the ACL configuration and the deny action.

Answer

Source IP is internal

Answer

The packet was blocked by an outbound access list

Answer

Destination IP is external

Question 20

Drag and drop the steps to configure a basic VPN (site-to-site) between two routers into the correct order.

Accepted Answer

Configure IKE policy and pre-shared key, then configure IPsec transform set, then define interesting traffic with crypto ACL, then create and apply crypto map to the interface, then verify the VPN tunnel.. Configuring a site-to-site VPN between two routers requires a specific sequence: first establish IKE policy and pre-shared keys for authentication, then define the IPsec transform set for encryption and integrity, then specify interesting traffic via a crypto ACL, then create and apply the crypto map to the outgoing interface, and finally verify the tunnel. This order ensures all security parameters are correctly bound and operational.

Answer

Define interesting traffic with crypto ACL, then configure IPsec transform set, then configure IKE policy and pre-shared key, then create and apply crypto map, then verify.

Answer

Configure IKE policy and pre-shared key, then define interesting traffic with crypto ACL, then configure IPsec transform set, then create and apply crypto map, then verify.

Answer

Verify the VPN tunnel, then configure IKE policy, then configure IPsec transform set, then define ACL, then create crypto map.