ISC2 CC Practice Test 8 — 10 Questions

Question 1

During a disaster recovery test, backup tapes fail to restore data due to format incompatibility. Which element of the Business Continuity Plan should be updated?

Accepted Answer

Plan testing and maintenance. The failure of backup tapes to restore data due to format incompatibility indicates that the recovery procedures and tools were not validated during testing. This directly points to a deficiency in the 'Plan testing and maintenance' element, which ensures that backup media formats, restoration tools, and procedures are regularly verified and updated to match the current production environment. Without scheduled testing and maintenance, format drift between backup software versions or hardware changes can render tapes unreadable.

Answer

Business Impact Analysis (BIA)

Answer

Recovery strategies

Answer

Communication plan

Question 2

An organization wants to ensure that critical security events are not missed during off-hours. What is the best practice?

Accepted Answer

Configure a central SIEM with 24/7 monitoring. A central SIEM with 24/7 monitoring ensures that security events are continuously analyzed and alerted upon, even during off-hours. This is the best practice because it provides real-time correlation and escalation of critical events, preventing them from being missed. Relying on automatic responses or periodic scans lacks the human oversight needed for complex threat validation.

Answer

Rely on automatic responses

Answer

Assign on-call duties only to senior analysts

Answer

Schedule nightly scans

Question 3

A help desk technician receives a report that a user cannot access a shared network drive. The technician checks the file server and sees that the disk is full. What is the most immediate action the technician should take?

Accepted Answer

Free up space by deleting unnecessary files or moving data. Freeing up space restores access. The other options are either not immediate or do not directly address the disk full issue.

Answer

Reboot the file server

Answer

Run antivirus scan

Answer

Increase disk quota

Question 4

A company's security operations center (SOC) receives an alert about suspicious outbound traffic from a server in the DMZ to an external IP address known for command-and-control activity. The SOC analyst reviews the logs and sees that the source port is 443 and the destination port is 8080. Which of the following actions should the analyst take FIRST?

Accepted Answer

Isolate the server from the network and investigate further. The SOC analyst should first isolate the server from the network because the outbound traffic from a DMZ server to a known C2 IP address, using source port 443 (HTTPS) to destination port 8080 (HTTP alternate), indicates a potential compromise. Isolating the server stops the data exfiltration and prevents further C2 communication, allowing for a controlled forensic investigation without alerting the attacker. This aligns with the NIST SP 800-61 incident response process, where containment is prioritized before eradication or recovery.

Answer

Notify the incident response team and management immediately

Answer

Block the external IP address at the firewall

Answer

Modify the firewall rule to deny all outbound traffic from the DMZ

Question 5

Which THREE security mechanisms should be implemented to secure a network against ARP spoofing attacks? (Choose three.)

Accepted Answer

IP Source Guard. IP Source Guard (A) is correct because it uses DHCP snooping binding table entries to filter traffic on a per-port basis, dropping packets where the source IP address does not match the binding. This prevents an attacker from spoofing a legitimate host's IP address in ARP spoofing attacks by ensuring only valid IP-to-MAC mappings are allowed on the port.

Answer

Port security

Answer

MAC address filtering

Question 6

A security analyst is configuring an intrusion detection system (IDS) to detect SQL injection attacks. Which method is most effective?

Accepted Answer

Examine HTTP request parameters for SQL commands. Examining HTTP request parameters for SQL commands directly detects SQL injection attempts. The other options are unrelated or less effective.

Answer

Analyze DNS query patterns

Answer

Detect port scans from external IPs

Answer

Monitor bandwidth usage for spikes

Question 7

A security administrator notices that a user's account has been used to access sensitive files at unusual hours. Which security principle would most effectively help detect this type of activity?

Accepted Answer

Accountability. Accountability enables tracking of user actions through logs and monitoring. Option A (Non-repudiation) prevents denial of actions but does not focus on detection. Option B (Availability) ensures data is accessible. Option C (Integrity) ensures data accuracy.

Answer

Non-repudiation

Answer

Availability

Answer

Integrity

Question 8

A company deploys a firewall that inspects packet headers and maintains a state table to track active connections. It drops any incoming packets that do not match an established connection. What type of firewall is this?

Accepted Answer

Stateful inspection firewall. A stateful inspection firewall tracks connections and blocks unsolicited inbound traffic.

Answer

Application proxy firewall

Answer

Next-generation firewall

Answer

Packet filtering firewall

Question 9

Which of the following is considered sensitive Personally Identifiable Information (PII)?

Accepted Answer

Medical records. Medical records are sensitive PII because they can cause significant harm if disclosed.

Answer

Email address

Answer

Date of birth

Answer

Phone number

Question 10

A medium-sized enterprise uses a Cisco ASA firewall configured with multiple security zones (Inside, Outside, DMZ). The DMZ hosts a web server that must be accessible from the Internet on TCP 443. The Inside network (10.0.0.0/24) hosts internal clients. The web server has IP 172.16.0.10. The firewall's current rules: allow any from Outside to DMZ on TCP 443; allow any from Inside to Outside; deny all else. Recently, the security team noticed that an attacker compromised the web server and used it to launch an attack against an internal database server at 10.0.0.50. The attack was successful because the firewall allowed traffic from the DMZ to the Inside. The firewall's default behavior is to deny traffic from lower security zones to higher security zones (DMZ is lower than Inside). What is the MOST likely reason this traffic was allowed?

Accepted Answer

The firewall has an explicit permit rule for traffic from DMZ to Inside on any destination.. The firewall's default behavior is to deny traffic from a lower security zone (DMZ) to a higher security zone (Inside). For the attack to succeed, an explicit permit rule must have been configured to allow traffic from DMZ to Inside. The existing rules only permit Outside to DMZ on TCP 443 and Inside to Outside; without an explicit DMZ-to-Inside rule, the default deny would have blocked the attack. Thus, the most likely reason is that an administrator inadvertently or intentionally added such a permit rule.

Answer

The firewall was configured in transparent mode, allowing all traffic.

Answer

The attacker used a VPN connection that bypassed the firewall.

Answer

The firewall's default behavior permits traffic from lower security level to higher if the connection is initiated from the higher level.