ISC2 CC Practice Exam 63 — 20 Questions

Question 1

An organization wants to ensure that only authorized devices can connect to its corporate Wi-Fi network. The security team decides to implement a solution that requires devices to authenticate before being granted network access. Which technology should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

802.1X with a RADIUS server. 802.1X with a RADIUS server provides port-based network access control, requiring each device to authenticate before being granted access. It supports various authentication methods such as certificates or credentials, making it ideal for ensuring only authorized devices connect to corporate Wi-Fi. Other options like pre-shared keys or MAC filtering are weaker and not scalable for enterprise use.

Answer

MAC address filtering

Answer

WPA3-SAE with a shared password

Answer

WPA2-Personal with a pre-shared key

Question 2

A user logs into a corporate portal by entering a username and password. The system then prompts for a one-time code from a mobile authenticator app. Which two factors of authentication are being combined in this scenario?

Accepted Answer

Something you know and something you have. Multi-factor authentication requires combining factors from different categories. The password is a knowledge factor, and the one-time code from a registered mobile app is a possession factor. Together they form something you know plus something you have. The other pairings involve biometrics or location, neither of which appears in the described login sequence, so they do not accurately describe the factors in use.

Answer

Something you know and something you are

Answer

Something you have and something you are

Answer

Something you know and somewhere you are

Question 3

A new employee logs in to the corporate network for the first time by entering a username and password. The system checks the credentials against the directory and grants access. Which security concept does entering the username and password represent?

Accepted Answer

Authentication. When a user supplies a username and password and the system validates them against stored credentials, the system is verifying the claimed identity. That verification step is authentication. Identification alone is just the claim of an identity, and authorization and accounting happen after authentication succeeds, so authentication is the concept being exercised here.

Answer

Authorization

Answer

Accounting

Answer

Identification

Question 4

A security analyst is reviewing the organization's risk management process. The analyst must identify which items are examples of risk treatment options. (Choose two.)

Accepted Answer

Accepting the risk and documenting the decision. Risk treatment options include avoiding, mitigating, transferring, and accepting risk. Purchasing cyber insurance transfers financial risk to an insurer, while accepting and documenting risk is a conscious decision to tolerate it. Identifying vulnerabilities and calculating loss expectancy are assessment activities, and monitoring traffic is a control, so they are not treatment options themselves.

Answer

Calculating the annualized loss expectancy

Answer

Identifying a vulnerability in a web application

Answer

Monitoring network traffic for anomalies

Question 5

A security analyst is investigating a suspected data exfiltration incident. The analyst observes that outbound DNS queries from an internal host contain long, random-looking subdomains and occur at a regular interval. The volume of these queries is unusually high. Which technique is most likely being used?

Accepted Answer

DNS tunneling for command and control or data exfiltration. The high volume of DNS queries with long, random subdomains sent at regular intervals is a classic indicator of DNS tunneling, where data is encoded in DNS queries to bypass network controls. This technique is commonly used for command and control and data exfiltration. Other DNS-based attacks like amplification or cache poisoning do not produce this pattern.

Answer

A cache poisoning attack against the internal DNS resolver

Answer

A distributed denial-of-service attack using DNS amplification

Answer

A zone transfer attempt from an internal host

Question 6

A security analyst is reviewing an access control list on a file server and notices that a former employee's account still has read and write permissions, even though the account was disabled three months ago. Which access control practice failed in this situation?

Accepted Answer

Access revocation during offboarding. Offboarding should include disabling the account and removing or transferring all associated permissions. The scenario shows that the account was disabled but its read and write permissions on the file server remained, indicating that access revocation was incomplete. Least privilege, separation of duties, and account recertification are valuable controls, but they do not directly describe the failure to strip permissions when the employee departed.

Answer

Account recertification

Answer

Least privilege

Answer

Separation of duties

Question 7

A security analyst is reviewing access logs and notices that a former employee's account was used to access a sensitive file share three days after the employee's termination. The account should have been disabled on the termination date. Which of the following is the MOST likely explanation for this security gap?

Accepted Answer

The account was not disabled in the directory service after termination.. The access logs show the former employee's account was used after termination. The most direct explanation is that the account was not disabled in the directory service, allowing authentication. While file share permissions and password changes are part of offboarding, the failure to disable the account is the root cause that enabled the access.

Answer

The file share permissions were not updated to remove the former employee's access.

Answer

The file share was configured to allow anonymous access.

Answer

The former employee's password was not changed before termination.

Question 8

An organization's data center experiences a power outage. The uninterruptible power supply (UPS) maintains power long enough for the backup generator to start, but the generator fails to start due to a fuel line blockage. The servers shut down, and critical data is lost. Which security principle was MOST directly compromised?

Accepted Answer

Availability. The power outage and subsequent generator failure led to servers shutting down and data becoming inaccessible. Availability ensures that systems and data are accessible to authorized users when needed. The failure of backup power directly compromised availability, as the organization could not access its critical data. Confidentiality and integrity are not primarily affected because there is no unauthorized disclosure or modification, and non-repudiation is irrelevant to this physical infrastructure failure.

Answer

Confidentiality

Answer

Integrity

Answer

Non-repudiation

Question 9

A mid-sized law firm experiences a ransomware attack that encrypts its document management system. The IT director wants to ensure the firm can resume operations quickly. Which of the following BEST describes the primary purpose of a disaster recovery plan in this scenario?

Accepted Answer

To restore IT infrastructure and critical data after a disruption. A disaster recovery plan is specifically designed to restore IT infrastructure, applications, and data after a disruption. In a ransomware scenario, the plan details how to recover encrypted systems from backups, rebuild servers, and verify data integrity. The other options describe asset classification, HR discipline, and media communication, which are not the primary focus of disaster recovery.

Answer

To define penalties for employees who violate security policies

Answer

To identify and classify information assets by their sensitivity

Answer

To outline steps for communicating with the media during a crisis

Question 10

A small accounting firm wants to grant access to its tax software based on the department a user belongs to, rather than assigning permissions to each person individually. Which access control model should the firm implement to meet this requirement?

Accepted Answer

Role-based access control (RBAC). Role-based access control grants permissions to roles and then assigns users to those roles, so access follows a person's function rather than being set individually. Because the firm wants tax software access determined by department membership, defining roles and assigning users to them delivers the required consistency and reduces administrative effort when staff change positions.

Answer

Rule-based access control

Answer

Mandatory access control (MAC)

Answer

Discretionary access control (DAC)

Question 11

A financial services firm grants a contractor temporary access to a trading application for a 90-day engagement. The security team wants the access to expire automatically without manual intervention, and also wants the contractor's manager to periodically confirm the access is still required. Which combination of access control practices best satisfies both requirements?

Accepted Answer

Time-based account expiration combined with periodic access reviews. Temporary access should be bounded in time and periodically justified. An account expiration date guarantees the access ends automatically at the close of the engagement, while periodic access reviews force the manager to reconfirm that the contractor still needs the trading application. The other combinations improve authentication strength or permission structure but do not provide automatic expiry or ongoing attestation.

Answer

Role-based access control combined with discretionary access control

Answer

Account lockout thresholds combined with password complexity requirements

Answer

Single sign-on combined with multifactor authentication

Question 12

A junior analyst reports that an attacker exploited an unpatched web server to steal customer data. The analyst labels the missing patch the 'risk'. According to standard risk terminology, how should the missing patch be classified?

Accepted Answer

As the vulnerability, because it is a weakness an attacker can exploit. In standard risk terminology, a vulnerability is a weakness that a threat can exploit, and the unpatched web server fits that definition precisely. Risk is the combination of the likelihood that a threat exploits a vulnerability and the resulting impact, while the threat is the actor or circumstance capable of causing harm. Naming the missing patch the vulnerability keeps cause, actor, and consequence distinct for remediation.

Answer

As the impact, because data was stolen from the server

Answer

As the risk, because it is the condition that led to the loss

Answer

As the threat, because it enabled the compromise

Question 13

A security operations center receives an alert that a workstation is communicating with a known command-and-control (C2) IP address every 60 seconds at consistent intervals. The endpoint detection and response (EDR) agent has not flagged any malicious files on the host. Which type of malware behavior BEST describes this activity?

Accepted Answer

Beaconing. Regular, fixed-interval outbound connections to a known malicious address indicate beaconing, the heartbeat malware uses to maintain C2 communications. Because EDR found no malicious files, the network timing pattern becomes the key detection signal. Recognizing beaconing helps analysts identify stealthy implants that have evaded file-based detection and initiate containment before data theft or lateral movement occurs.

Answer

Ransomware encryption

Answer

Privilege escalation

Answer

SQL injection

Question 14

A company's security policy states that employees must wear identification badges visibly at all times while on premises. A security guard checks badges at the entrance. Which type of control is the badge check?

Accepted Answer

Preventive control. The badge check by a security guard is a preventive control because it stops unauthorized individuals from entering the premises. Preventive controls are designed to avoid incidents before they happen, and this is a classic example of a physical preventive control. Other control types like detective, corrective, or compensating do not fit the scenario.

Answer

Compensating control

Answer

Detective control

Answer

Corrective control

Question 15

A financial services firm assigns permissions based on each employee's role in the HR system. When an employee transfers from accounting to marketing, the HR record changes and the employee's access is automatically updated to match the marketing role. Which access control model is the firm using?

Accepted Answer

Role-based access control (RBAC). Role-based access control centralizes permissions in roles and assigns users to those roles. When an employee's job function changes, updating the role assignment automatically adjusts access, which reduces administrative overhead and errors. The scenario's automatic permission change driven by HR role data is the defining characteristic of RBAC in enterprise environments.

Answer

Discretionary access control (DAC)

Answer

Mandatory access control (MAC)

Answer

Rule-based access control

Question 16

A small accounting firm wants to let guests connect to the internet in its lobby without exposing the internal file server or the payroll system. The network administrator is told to add a separate wireless network that uses different IP addressing and cannot route to internal resources. Which security principle is the administrator primarily applying?

Accepted Answer

Network segmentation. Separating guest wireless onto distinct IP addressing and preventing routes to internal systems is a segmentation control. Segmentation confines untrusted devices to a limited network zone, so a compromised guest endpoint cannot directly reach the payroll system or file server. The other concepts address data remnants, proof of actions, or user permissions, none of which create the required network boundary.

Answer

Data remanence

Answer

Non-repudiation

Answer

Least privilege

Question 17

A security manager is reviewing the organization's approach to risk. The manager decides to purchase cyber insurance to transfer some of the financial risk associated with a data breach. Which risk management strategy is being used?

Accepted Answer

Risk transference. Risk transference involves shifting the financial impact of a risk to another party, often through insurance or contracts. Cyber insurance is a common method of transferring the financial consequences of a data breach. The organization still owns the risk of the breach occurring, but the financial loss is partially borne by the insurer. This strategy is distinct from avoidance, mitigation, and acceptance.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Risk mitigation

Question 18

A software development company wants to prevent a dismissed contractor from using credentials that were issued during the contract period to access internal code repositories. Which administrative control should the company apply?

Accepted Answer

Revoke the contractor's access rights during offboarding. The scenario's core problem is that a former contractor retains valid credentials after the contract ends. Administrative controls govern people and processes, and timely revocation of access rights during offboarding removes the account's authority entirely. Monitoring detects but does not prevent, password complexity does not invalidate a known password, and MFA still lets the former contractor log in, so revocation is the correct control.

Answer

Deploy file integrity monitoring on the repositories

Answer

Enforce a password complexity policy for all accounts

Answer

Require multi-factor authentication for repository access

Question 19

A financial services company wants to allow employees to use personal laptops on the corporate wireless network without installing company-managed certificates on those devices. The company still needs to authenticate each user and apply role-based access to internal applications. Which approach best meets these requirements?

Accepted Answer

WPA2-Enterprise with PEAP-MSCHAPv2 using corporate directory credentials, plus a NAC or RADIUS authorization policy for role mapping.. PEAP-MSCHAPv2 authenticates users against the corporate directory using usernames and passwords, so no client certificate is needed on personal laptops. A RADIUS or NAC authorization policy then maps the authenticated identity to a role that governs access to internal applications. EAP-TLS requires certificates, WPA2-Personal has no per-user identity, and a captive portal lacks strong authentication and authorization.

Answer

WPA2-Personal with a strong pre-shared key and MAC address filtering for known laptops.

Answer

An open wireless network with a captive portal that asks users to type their employee ID.

Answer

WPA2-Enterprise with EAP-TLS using a client certificate issued by the corporate PKI.

Question 20

A company uses a SIEM to monitor network security events. The security analyst notices a high volume of alerts about suspicious outbound traffic to a known command-and-control server. The traffic is encrypted and uses non-standard ports. Which security control would best detect this activity if the SIEM relies only on network flow data?

Accepted Answer

Network flow analysis with anomaly detection. Since the SIEM only has network flow data and the traffic is encrypted, payload inspection is impossible. Network flow analysis with anomaly detection uses metadata like IP, port, and timing to identify beaconing patterns to known C2 servers. Signature IDS, host antivirus, and WAFs either need payload visibility or do not monitor outbound flows.

Answer

Web application firewall (WAF) in reverse proxy mode

Answer

Host-based antivirus with heuristic scanning

Answer

Signature-based intrusion detection system (IDS)