ISC2 CC Practice Exam 64 — 20 Questions

Question 1

A small accounting firm has a flat network where all employee workstations and a guest Wi-Fi access point connect to the same switch. The owner asks a security consultant to keep guests from reaching the payroll server, which resides on the same subnet as employee devices. Which control should the consultant implement to meet this requirement with the least disruption?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a separate VLAN for guests and apply an access control list that denies guest subnet traffic to the payroll server.. Segmenting guest traffic into its own VLAN removes it from the employee broadcast domain, and an ACL on the Layer 3 device enforces the rule that guests cannot reach the payroll server. This addresses the requirement directly without redesigning the employee network. Host firewalls, key rotation, and intrusion prevention do not provide the same deterministic isolation.

Answer

Deploy an IPS between the guest access point and the switch to block attacks aimed at the payroll server.

Answer

Enable a host-based firewall on the payroll server that permits only the payroll application's TCP port.

Answer

Change the guest Wi-Fi pre-shared key every 30 days and publish it only to visitors.

Question 2

A junior security administrator at a hospital is told that only nurses and physicians on the current shift should be able to view patient records, and that records must be protected from disclosure to anyone else. Which security principle is this requirement primarily enforcing?

Accepted Answer

Confidentiality. The requirement limits access to patient records so only authorized on-shift nurses and physicians can view them, which is a disclosure control. Confidentiality is the security principle that prevents information from being disclosed to unauthorized individuals. Integrity addresses unauthorized changes, availability addresses timely access, and non-repudiation addresses proof of actions, so confidentiality is the correct principle.

Answer

Non-repudiation

Answer

Integrity

Answer

Availability

Question 3

A financial institution wants to implement a control that verifies the identity of a user by requiring something the user knows and something the user has. Which of the following authentication mechanisms best meets this requirement?

Accepted Answer

Smart card and PIN. Multi-factor authentication requires combining two or more different types of factors: something you know, something you have, something you are, somewhere you are, or something you do. The scenario explicitly requires something the user knows and something the user has. A smart card (possession) and a PIN (knowledge) meet this requirement, while the other options use factors of the same type or do not include a possession factor.

Answer

Fingerprint and retina scan

Answer

Username and password

Answer

Password and security question

Question 4

A financial services company issues every employee a smart card that must be inserted into a reader before the employee can log in to a workstation. The card stores a private key that never leaves the card. Which authentication factor category does the smart card represent in this scenario?

Accepted Answer

Something you have. A smart card is a possession factor because the employee must physically hold and present the token, and the embedded private key enables cryptographic proof that the token is present. It is commonly combined with a PIN or password to achieve multifactor authentication, pairing what the user has with what the user knows.

Answer

Something you know

Answer

Something you are

Answer

Somewhere you are

Question 5

A security administrator must configure a system so that users prove their identity with something they have plus something they know, without deploying smart cards or hardware tokens. Which authentication approach best meets this requirement?

Accepted Answer

A password combined with a one-time code generated by a soft token app on the user's phone. Two-factor authentication requires factors from different categories. A password supplies the knowledge factor, and a one-time code from an app on the user's enrolled phone supplies the possession factor. Because the app is software rather than dedicated hardware, no smart card or physical token is needed, which satisfies the constraint while still delivering genuine two-factor protection.

Answer

A fingerprint scan used alone to unlock the workstation

Answer

A password combined with a security question about the user's first pet

Answer

A username and a strong password used together

Question 6

A company's security policy states that only staff in the finance department may access the general ledger, and that access must be reviewed every quarter. An auditor finds that two former finance employees still hold active accounts with ledger permissions. Which concept has the organization FAILED to apply?

Accepted Answer

Need to know. Need to know restricts access to information strictly to individuals whose duties require it. Former finance employees have no current business justification for ledger permissions, so their active accounts violate this principle regardless of whether they have logged in. The quarterly review requirement exists precisely to catch and remove such stale entitlements before they become an insider threat.

Answer

Non-repudiation

Answer

Integrity

Answer

Availability

Question 7

A security operations center wants to improve detection of malicious activity on endpoints. Which TWO data sources provide the most direct endpoint-level evidence for identifying suspicious process execution? (Choose two.)

Accepted Answer

Endpoint detection and response (EDR) telemetry. Detecting suspicious process execution requires host-based visibility into what actually ran. EDR telemetry provides rich process-level detail including command lines and parent-child relationships, while OS process accounting or audit logs offer a lighter but still direct record of executions. Network-oriented sources such as NetFlow, firewall deny logs, and DHCP lease logs describe traffic or addressing, not the processes on the endpoint, so they serve as supporting context rather than primary execution evidence.

Answer

Firewall deny logs

Answer

NetFlow records

Answer

DHCP lease logs

Question 8

An employee receives an email that appears to be from the IT department asking them to click a link and verify their password because of a mailbox upgrade. The link points to a domain that is misspelled but closely resembles the company's real domain. The employee reports it to the security team. What type of attack is this?

Accepted Answer

Phishing. The email impersonates IT, uses a deceptive domain, and requests credential verification, which are hallmarks of phishing. It is not targeted enough to be spear phishing or whaling, and it does not use voice communication. Phishing remains the most accurate classification for this generic credential-harvesting attempt.

Answer

Vishing

Answer

Spear phishing

Answer

Whaling

Question 9

A security manager is assessing the risk of a new web application. The manager identifies that the application has a known SQL injection vulnerability, and that attackers frequently scan for such flaws. Which term best describes the SQL injection flaw itself?

Accepted Answer

Vulnerability. The correct answer is vulnerability. A vulnerability is a weakness or flaw in a system that can be exploited by a threat. The SQL injection flaw is a specific weakness in the web application. Threat refers to the attacker or attack method, risk is the potential for loss, and impact is the resulting harm. Therefore, the flaw itself is a vulnerability.

Answer

Risk

Answer

Impact

Answer

Threat

Question 10

A new employee reports receiving an email that appears to come from the CEO, urgently requesting gift card purchases for a client. The email domain looks almost identical to the company's domain but uses a different top-level domain. Which type of social engineering attack is this?

Accepted Answer

Business email compromise (BEC) using a look-alike domain. The message impersonates an executive, uses a domain that closely resembles the real one, and pressures the recipient into an urgent financial action. That combination is the hallmark of business email compromise, specifically using a look-alike domain. Spear phishing, watering hole, and vishing describe different delivery methods or objectives and do not capture the executive impersonation and fraudulent payment request.

Answer

Vishing using caller ID spoofing

Answer

Watering hole attack

Answer

Spear phishing with a malicious attachment

Question 11

A multinational corporation is reviewing its incident response plan after a recent data breach. The security team wants to ensure that during future incidents, evidence is properly preserved for potential legal action. Which TWO actions should be included in the incident response plan to support forensic readiness? (Choose two.)

Accepted Answer

Establish a chain of custody for all collected evidence.. Forensic readiness requires that evidence be preserved in a way that is admissible in legal proceedings. Establishing a chain of custody ensures evidence integrity, and training responders on evidence handling ensures that procedures are followed correctly. Together, these actions help a multinational corporation maintain credible evidence for potential litigation or regulatory investigations.

Answer

Allow only senior management to access the incident response plan.

Answer

Immediately shut down all affected systems to prevent further data loss.

Answer

Delete all logs after 30 days to reduce storage costs.

Question 12

A security analyst notices that users on the corporate wireless network are occasionally redirected to a fraudulent login page when they browse to the company intranet. The analyst confirms the wireless access point is legitimate and that the rogue page presents a certificate issued by an unknown authority. Which attack is most likely occurring?

Accepted Answer

An on-path attacker intercepting and modifying traffic. The untrusted certificate and fraudulent login page indicate that traffic between wireless clients and the intranet is being intercepted and altered. An on-path attacker can redirect requests and present a fake page, especially if users ignore certificate warnings. The legitimate access point rules out a rogue AP, but other interception techniques such as ARP or DHCP manipulation remain plausible.

Answer

A cross-site scripting flaw in the intranet application

Answer

A denial-of-service flood against the intranet web server

Answer

A brute-force attack against the wireless authentication server

Question 13

A security manager is reviewing the organization's risk management approach. She wants to ensure that the team correctly distinguishes between threats, vulnerabilities, and risks. Which two of the following statements correctly describe these concepts? (Choose two.)

Accepted Answer

A threat is any potential cause of an unwanted incident that could harm assets.. The two correct statements accurately define a vulnerability as a weakness that can be exploited and a threat as a potential cause of an unwanted incident. These definitions are foundational in risk management: risk arises when a threat exploits a vulnerability, leading to potential impact. The other statements incorrectly equate risk with impact alone, confuse vulnerability with probability, or claim threats always create risk without considering vulnerabilities.

Answer

A vulnerability is the probability that a threat will occur.

Answer

A threat always results in a risk, regardless of whether a vulnerability exists.

Answer

Risk is the same as the impact of a threat event, regardless of likelihood.

Question 14

An employee receives a call from someone claiming to be from the IT help desk. The caller says there is a problem with the employee's email and asks for the employee's password to fix it. The employee refuses and reports the call. Which social engineering technique was attempted?

Accepted Answer

Vishing. Vishing uses voice communication, typically a phone call, to manipulate a target into revealing sensitive information or performing an action. The attacker posed as IT support and requested a password, which legitimate help desk personnel should never do. Recognizing the pretext and refusing to provide credentials is the correct response. Reporting the call also helps security teams warn others about the active campaign.

Answer

Smishing

Answer

Tailgating

Answer

Whaling

Question 15

A hospital's IT team assigns each doctor a unique smart card that must be inserted before the workstation unlocks, and the card's embedded certificate is validated against the hospital's internal certificate authority. Which access control process does the smart card insertion and certificate validation represent?

Accepted Answer

Authentication. The smart card provides a possession factor, and the certificate authority validates that the credential is genuine and trusted. This verification of a claimed identity is the definition of authentication. Authorization and accounting occur later in the process, while identification is only the initial claim of an identity without proof.

Answer

Accounting

Answer

Authorization

Answer

Identification

Question 16

A security engineer is deploying a new VPN solution for remote employees. The company requires that the VPN provide strong encryption, support for multiple users, and the ability to traverse NAT devices. Which VPN protocol should the engineer choose?

Accepted Answer

L2TP/IPsec. L2TP/IPsec provides strong encryption through IPsec, supports multiple users, and can traverse NAT with NAT-T. It is a widely supported standard for remote access VPNs. The other options either lack strong encryption (PPTP), are platform-specific (SSTP), or are not designed for remote access tunneling (IPsec transport mode).

Answer

PPTP

Answer

IPsec in transport mode

Answer

SSTP

Question 17

A regional hospital's emergency department relies on a patient tracking system. The BIA shows the system's maximum tolerable downtime (MTD) is 2 hours. The recovery time objective (RTO) is currently 6 hours, and the recovery point objective (RPO) is 24 hours. Which action best aligns the recovery capability with the business requirement?

Accepted Answer

Reduce the RTO to 2 hours or less and reduce the RPO to a level that meets clinical data loss tolerance.. The MTD is the maximum time a business process can be unavailable. For the patient tracking system, the MTD is 2 hours. The RTO, which is the target time to restore the system, must be less than or equal to the MTD. The current RTO of 6 hours exceeds the MTD, so it must be reduced. The RPO must also be evaluated to ensure data loss is acceptable. Reducing the RTO and reassessing the RPO ensures recovery aligns with the business requirement.

Answer

Increase the MTD to 6 hours so it matches the existing RTO.

Answer

Implement a hot site that can recover the system within 24 hours, matching the RPO.

Answer

Maintain the current RTO and RPO because the MTD is only a guideline and not a strict requirement.

Question 18

A security manager is training new employees on the concept of risk. She explains that risk is composed of several elements. Which TWO of the following are components that directly contribute to risk? (Choose two.)

Accepted Answer

Threat. Risk is commonly defined as the combination of the likelihood of a threat exploiting a vulnerability and the resulting impact. Threat and vulnerability are the two essential components that must be present for risk to exist. Policy, audit, and control are important security concepts, but they are not direct constituents of risk; rather, they are mechanisms used to govern, verify, or mitigate risk.

Answer

Policy

Answer

Control

Answer

Audit

Question 19

A payroll clerk changes roles within the same company, moving from the finance department to the human resources department. The security team discovers months later that the clerk still retains all the finance application permissions from the previous position in addition to the new HR permissions. Which access control weakness does this situation illustrate?

Accepted Answer

Privilege creep caused by failing to remove access rights when job responsibilities change.. When employees change roles, their previous entitlements must be revoked so that access always matches current duties. Retaining finance permissions after moving to HR creates privilege creep, a gradual accumulation of rights that violates least privilege and expands the attack surface. Periodic access reviews and prompt deprovisioning during transfers are the standard controls that prevent this situation.

Answer

A brute-force vulnerability, because the clerk's account retained credentials that could be attacked repeatedly.

Answer

An implicit deny failure, because the access control system did not block the finance permissions by default.

Answer

A separation of duties conflict, because one person now holds finance and HR access simultaneously.

Question 20

A company is deploying a new wireless network for guests and wants to ensure that guest traffic cannot reach internal corporate resources. The network team plans to use a separate SSID for guests. Which additional configuration is most important to enforce the isolation requirement?

Accepted Answer

Map the guest SSID to a dedicated VLAN with firewall rules that deny access to internal subnets. Guest isolation requires a logical network boundary, which is achieved by assigning the guest SSID to a dedicated VLAN and enforcing firewall rules that deny access to internal subnets. Wireless encryption, captive portals, and channel selection do not create that boundary. Without the VLAN and firewall policy, guest devices may reach corporate resources.

Answer

Configure the guest SSID to use a captive portal for user registration

Answer

Enable WPA3-Personal on the guest SSID with a strong pre-shared key

Answer

Set the guest SSID to broadcast on a different wireless channel than the corporate SSID