ISC2 CC Practice Test 7 — 10 Questions

Question 1

During a DDoS attack, a company's web server is overwhelmed with a high volume of SYN packets from spoofed IP addresses, never completing the TCP handshake. Which type of attack is this?

Accepted Answer

SYN flood. A SYN flood sends many SYN packets to exhaust server resources by leaving half-open connections.

Answer

ICMP flood

Answer

UDP flood

Answer

Amplification attack

Question 2

A network administrator is troubleshooting a connectivity issue between two segments separated by a firewall. The firewall rule allows traffic from 10.1.1.0/24 to 10.2.2.0/24 on TCP 443. Users in 10.1.1.0/24 can access the web server at 10.2.2.10, but users in 10.2.2.0/24 cannot access a web server in 10.1.1.0/24. What is the most likely cause?

Accepted Answer

The firewall is not stateful and does not automatically allow return traffic; a separate rule is needed.. The firewall rule only permits traffic from 10.1.1.0/24 to 10.2.2.0/24 on TCP 443. When users in 10.2.2.0/24 initiate a connection to the web server in 10.1.1.0/24, the firewall sees a new session that does not match the existing rule (source/destination reversed). If the firewall is not stateful, it will not automatically allow the return traffic for the reverse direction, and no separate rule exists to permit that traffic, causing the connectivity failure.

Answer

The web server in 10.1.1.0 is blocking the IP range of 10.2.2.0/24.

Answer

The firewall rule is incorrectly applied to the wrong interface.

Answer

The subnet masks are misconfigured, causing routing issues.

Question 3

A security team discovers that an internal database server is sending large amounts of data to an unknown external IP address. The server is not supposed to communicate externally. Which security control should be implemented to prevent such data exfiltration?

Accepted Answer

Configure a firewall to deny all outbound traffic from the database server except to specific authorized destinations. A firewall with restrictive egress rules blocks unauthorized outbound traffic, preventing data exfiltration. Option A (VPN) would not stop the traffic; it could even encrypt and tunnel it. Option B (IDS) can detect but not block. Option D (DLP) monitors content but may not effectively block at the network level.

Answer

Implement a VPN for all external communications

Answer

Install an intrusion detection system (IDS) on the network segment

Answer

Deploy a data loss prevention (DLP) system on the server

Question 4

A security team implements a policy that requires all access to sensitive data to be logged and audited. Which principle is being enforced?

Accepted Answer

Accountability. Accountability is enforced because logging and auditing create a traceable record of who accessed sensitive data and what actions they performed. This allows security teams to hold individuals responsible for their actions by correlating log entries with specific user identities, typically via authentication systems like LDAP or SAML. The policy directly supports the principle that users must be answerable for their access to protected resources.

Answer

Non-repudiation

Answer

Integrity

Answer

Least privilege

Question 5

An administrator reviews the exhibit. Which security principle is being violated?

Accepted Answer

Least privilege. The user has write access to HR documents, which may not be necessary for their role, violating least privilege.

Answer

Non-repudiation

Answer

Separation of duties

Answer

Accountability

Question 6

A company's security policy requires that all privileged access to critical servers be logged and monitored. The IT team has implemented a jump server (bastion host) for administrators to connect to critical servers. All SSH connections to the jump server are logged, and from there, administrators connect to target servers. The security team notices that some administrators are bypassing the jump server and connecting directly to critical servers from their workstations. The direct connections are not logged. The security team needs to enforce the policy without disrupting operations. Which of the following is the BEST solution?

Accepted Answer

Implement a host-based firewall on each critical server to block direct connections.. A host-based firewall on each critical server can enforce the security policy by blocking direct SSH connections (TCP port 22) from any source other than the jump server's IP address. This ensures that all administrative access must go through the jump server, where logging is already in place, without disrupting legitimate operations through the authorized path.

Answer

Send a warning email to all administrators reminding them of the policy.

Answer

Disable direct SSH access to critical servers at the network firewall level.

Answer

Revoke local administrator rights on workstations.

Question 7

According to modern password guidance from NIST SP 800-63, which of the following is the most important factor when setting password requirements?

Accepted Answer

Enforcing a minimum length of at least 8 characters. NIST SP 800-63 recommends favoring password length over complexity, with a minimum of 8 characters (or 15+ for high assurance) and avoiding frequent forced changes unless compromised.

Answer

Requiring a mix of uppercase, lowercase, numbers, and special characters

Answer

Using randomly generated passwords

Answer

Changing passwords every 30 days

Question 8

Which THREE elements are essential components of a business continuity plan (BCP)?

Accepted Answer

Data backup schedules and procedures. Data backup schedules and procedures are essential because they ensure that critical data can be restored after a disruption. A BCP must specify the frequency of backups (e.g., daily incremental, weekly full), the retention policy, and the recovery point objective (RPO) to meet business requirements. Without defined schedules and procedures, data loss or corruption could render the recovery process ineffective.

Answer

Incident response team roster

Answer

Detailed network topology diagrams

Question 9

Which metric is used to define the maximum amount of data loss an organization can tolerate during a disaster?

Accepted Answer

RPO. RPO (Recovery Point Objective) defines the maximum acceptable amount of data loss measured in time, such as seconds, minutes, or hours. It determines the age of the backup or replication data that must be restored to resume normal operations after a disaster. For example, an RPO of 1 hour means the organization can tolerate losing up to 1 hour's worth of data.

Answer

RTO

Answer

SLA

Answer

MTBF

Question 10

A security team is analyzing network segmentation strategies. Which THREE of the following are benefits of using VLANs for network segmentation?

Accepted Answer

They allow logical grouping of users regardless of physical location. VLANs provide logical separation, improve security, reduce broadcast domain size, and allow flexible grouping without physical rewiring.

Answer

They eliminate the need for IP addressing

Answer

They increase the collision domain size