ISC2 CC Practice Test 7 — 10 Questions

Question 1

Refer to the exhibit. A security engineer applies this storage access policy to restrict access. Users outside the 10.0.0.0/16 network report being denied access, which is expected. However, users inside that network also report access denied. What is the likely issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The policy only allows read access; users likely need list or other actions.. The storage policy only grants the read action, but users inside the 10.0.0.0/16 network are likely performing other actions such as list or write. Even though the source IP condition allows access from the trusted network, the explicit Allow statement is scoped solely to read. Any request for a different action (like list) will be implicitly denied by default, as IAM and storage policies are deny-by-default unless an explicit Allow exists for that specific action.

Answer

The condition syntax is incorrect and causes all requests to be evaluated incorrectly.

Answer

The Deny statement overrides the Allow statement for all requests.

Answer

The resource identifier includes a wildcard, causing a mismatch.

Question 2

An attacker sends forged ARP messages to associate their MAC address with the IP address of a legitimate server. This allows the attacker to intercept traffic intended for that server. What is this attack?

Accepted Answer

ARP spoofing. ARP spoofing (or ARP poisoning) involves sending fake ARP replies to associate the attacker's MAC with a victim's IP, enabling man-in-the-middle attacks.

Answer

DNS poisoning

Answer

MAC flooding

Answer

IP spoofing

Question 3

Match each security control type to its description.

Accepted Answer

Preventive: Controls that prevent security incidents from occurring. Security controls are categorized by their primary function. Preventive controls stop incidents, detective controls identify them, and corrective controls restore operations. Common confusions involve swapping preventive and detective roles.

Answer

Preventive: Controls that identify security incidents

Answer

Detective: Controls that prevent security incidents

Question 4

Match each risk management term to its meaning.

Accepted Answer

Risk: The potential for loss or harm when a threat exploits a vulnerability.. Risk is the potential for loss when a threat exploits a vulnerability. A threat is a potential cause of harm. A vulnerability is a weakness. Controls are measures to reduce risk.

Answer

Risk: A weakness in a system or its design.

Answer

Threat: The potential for loss or harm.

Answer

Vulnerability: A measure that modifies or reduces risk.

Question 5

A security analyst receives an alert indicating multiple failed login attempts from a single IP address targeting a user account. Which action should the analyst take FIRST?

Accepted Answer

Verify the alert and check if the account is compromised. The first step in incident response is to validate the alert. The analyst must verify that the failed login attempts are not a false positive (e.g., a user mistyping their password) and then check if the account has been compromised by reviewing logs for successful logins from the same IP or anomalous behavior. Prematurely disabling the account or blocking the IP could disrupt legitimate access or alert an attacker, while escalation to law enforcement is premature without confirmation of a breach.

Answer

Disable the user account immediately

Answer

Escalate the alert to law enforcement

Answer

Block the IP address at the firewall

Question 6

A security analyst recommends implementing digital signatures to ensure that a software update has not been altered during distribution. Which aspect of the CIA triad is primarily being addressed?

Accepted Answer

Integrity. Digital signatures use cryptographic hashing and asymmetric encryption to verify that data has not been altered in transit or at rest, which directly addresses the Integrity pillar of the CIA triad. If even a single bit of the software update changes, the signature verification fails, proving tampering. While signatures also provide authentication and non-repudiation, the question specifically asks which CIA triad aspect is primarily addressed, and integrity is the correct mapping.

Answer

Availability

Answer

Confidentiality

Answer

Non-repudiation

Question 7

During a security incident, the incident response team needs to preserve evidence for potential legal action. Which of the following is the most important action to take when collecting volatile data from a compromised server?

Accepted Answer

Capture the contents of RAM.. Volatile data in RAM is lost when power is removed. Capturing RAM preserves evidence that might contain running processes, network connections, and encryption keys. Disk images are non-volatile and can be collected later.

Answer

Make a bit-for-bit copy of all storage.

Answer

Create a forensic image of the hard drive.

Answer

Review system logs.

Question 8

What is the primary purpose of a digital signature?

Accepted Answer

Provide data integrity and non-repudiation. Digital signatures provide integrity (detect tampering) and non-repudiation (proof of origin).

Answer

Ensure data confidentiality

Answer

Control access to resources

Answer

Encrypt data at rest

Question 9

A security operations center (SOC) analyst notices unusual outbound network traffic from a server that typically only receives connections. The traffic is encrypted and goes to an unknown external IP. Which step should the analyst perform FIRST?

Accepted Answer

Check the server's running processes and connections. The first step in incident response is to gather evidence and understand the scope without altering the system. Checking the server's running processes and connections (A) allows the analyst to identify the malicious process, its parent, and the remote endpoint, which informs containment and eradication. This aligns with the 'identification' phase of incident response.

Answer

Power off the server

Answer

Block the outbound traffic at the firewall

Answer

Notify the system owner

Question 10

An attacker intercepts communications between a client and server by establishing independent connections with each. The client believes it is talking to the server, but the attacker relays messages. What is this attack?

Accepted Answer

Man-in-the-middle. A man-in-the-middle (MITM) attack occurs when an adversary positions themselves between two communicating parties, establishing separate connections with each and relaying (or altering) traffic while both sides believe they are communicating directly. The scenario describes exactly this relay behavior. The attacker can eavesdrop, modify, or inject data because neither endpoint detects the intermediary.

Answer

Phishing

Answer

Replay attack

Answer

DoS