ISC2 CC Practice Test 9 — 10 Questions

Question 1

During an incident, the incident response team discovers that an attacker has exfiltrated sensitive customer data. According to incident response best practices, whose approval is REQUIRED before contacting law enforcement?

Accepted Answer

Legal counsel. Legal counsel approval is required before contacting law enforcement because they ensure that the disclosure complies with data privacy laws (e.g., GDPR, CCPA) and does not violate chain-of-custody requirements or expose the organization to liability. The incident response team must coordinate with legal to determine the appropriate timing and scope of law enforcement involvement, as premature contact can compromise ongoing forensic investigations or breach legal agreements.

Answer

CISO

Answer

CEO

Answer

Public relations

Question 2

Refer to the exhibit. The network administrator configured NAT as shown. Internal hosts can access the internet, but no external hosts can access the company's web server (192.168.1.10). What is the issue?

Accepted Answer

The pool includes the static IP causing conflict. The correct answer is D because the dynamic NAT pool includes the IP address 192.168.1.10, which is also used for the static NAT mapping to the web server. When a packet arrives from the internet destined for the static NAT address, the router first checks dynamic NAT entries and may assign that address from the pool to an internal host, causing a conflict and preventing the static translation from being applied. This is a classic IP address overlap issue where the pool should exclude the static NAT address.

Answer

The static NAT is being overridden by the dynamic NAT

Answer

The outside interface should be the inside interface

Answer

The web server is not in the access-list

Question 3

A security analyst reviews firewall logs and notices a large number of outbound connections from a single internal IP to a known malicious IP on port 445. The analyst quarantines the workstation and runs an antivirus scan, which finds no malware. What should the analyst do next?

Accepted Answer

Analyze network traffic to identify the process responsible for the connections.. Option D is correct because the absence of malware detection does not rule out malicious activity; the connections could be caused by a legitimate process that has been abused (e.g., a vulnerable service or script) or by fileless malware that evades signature-based scans. Analyzing network traffic with tools like Wireshark or NetFlow can identify the source process (e.g., via Windows Event Logs or Sysmon), the exact data being sent, and whether the traffic is encrypted or uses SMB protocol specifics on port 445. This forensic step is essential before taking irreversible actions like reimaging or broad blocking.

Answer

Conclude that the scan is clean and remove the quarantine.

Answer

Reimage the workstation immediately.

Answer

Block all outbound traffic on port 445 from the internal network.

Question 4

A company's network uses 802.1X authentication for wired and wireless access. Which component authenticates the user credentials against an identity store?

Accepted Answer

Authentication server (RADIUS). In 802.1X, the authentication server (typically a RADIUS server) is the component that validates user credentials against an identity store such as LDAP, Active Directory, or a local database. The supplicant (client) provides credentials, the authenticator (switch or access point) relays EAP frames, but only the RADIUS server performs the actual authentication decision.

Answer

Supplicant

Answer

Authenticator

Answer

Access point

Question 5

Which of the following is an example of a detective control in a security operations context?

Accepted Answer

Reviewing audit logs for suspicious activity.. Detective controls are designed to identify and alert on security incidents after they have occurred. Reviewing audit logs for suspicious activity is a classic detective control because it involves examining historical records to detect unauthorized access or anomalies. In contrast, preventive controls like patching, MFA, and firewall rules aim to stop incidents before they happen.

Answer

Installing a security patch to fix a vulnerability.

Answer

Requiring multi-factor authentication for remote access.

Answer

Firewall rules blocking unauthorized traffic.

Question 6

A security engineer is designing a network for a small business that needs to segregate guest Wi-Fi from the internal corporate network. The guest network should have internet access only, with no access to internal resources. Which of the following is the BEST design approach?

Accepted Answer

Place the guest Wi-Fi on a separate VLAN with a firewall rule blocking traffic to internal subnets.. Option D is the best approach because placing the guest Wi-Fi on a separate VLAN and applying a firewall rule to block traffic to internal subnets provides both logical segmentation and access control. This ensures that guest traffic is isolated at Layer 2 (VLAN) and Layer 3/4 (firewall), preventing any unauthorized access to the corporate network while still allowing internet connectivity through a default route.

Answer

Implement MAC address filtering on the access point to allow only known devices.

Answer

Connect the guest Wi-Fi to the internet through a separate router that does not have routes to the internal network.

Answer

Use a single VLAN with a DHCP server that assigns different IP ranges to guests and employees.

Question 7

Which TWO are key components of an effective incident response plan? (Select TWO.)

Accepted Answer

Communication plan for stakeholders. Option D is correct because an incident response plan must include a communication plan for stakeholders to ensure timely and accurate information sharing during a security incident. This includes predefined escalation paths, contact lists, and communication channels (e.g., email, phone, secure messaging) to coordinate response efforts and manage external notifications (e.g., legal, PR, customers). Without a communication plan, response teams risk confusion, delays, and inconsistent messaging, which can exacerbate the incident's impact.

Answer

Business continuity procedures

Answer

List of forensic tools

Answer

Backup verification schedule

Question 8

An organization implements a bring-your-own-device (BYOD) policy. Which security control is most important to enforce in the BYOD policy?

Accepted Answer

Implement mobile device management (MDM) for remote wipe and policy enforcement. Mobile device management (MDM) is the most important control for a BYOD policy because it provides centralized policy enforcement, remote wipe capabilities, and device compliance monitoring. Unlike isolated controls like passwords or encryption, MDM allows the organization to enforce security policies dynamically and revoke access or wipe corporate data if a device is lost, stolen, or non-compliant.

Answer

Require complex passwords

Answer

Install a firewall on each device

Answer

Enable full disk encryption

Question 9

A security analyst investigates a possible data exfiltration. The analyst sees a large amount of data being sent to an external IP address at regular intervals. Which of the following is the most likely technique being used?

Accepted Answer

DNS tunneling. DNS tunneling encodes data within DNS queries and responses, allowing attackers to bypass network security controls by exfiltrating data through UDP port 53, which is often allowed through firewalls. The regular intervals of large data transfers to an external IP address are characteristic of a DNS tunnel, as the attacker segments data into multiple DNS queries to avoid detection.

Answer

SQL injection

Answer

Phishing

Answer

Man-in-the-middle

Question 10

An organization has a policy that all servers must have security patches applied within 30 days of release. Which of the following is the best practice for patching?

Accepted Answer

Test patches in a non-production environment before deploying to production. Option C is correct because testing patches in a non-production environment first allows the organization to identify compatibility issues, performance regressions, or conflicts with existing software before risking production systems. This aligns with the change management principle of validating changes in a controlled setting, ensuring that the 30-day patching deadline can be met without introducing instability. Skipping testing (A) or applying patches simultaneously (B) could lead to widespread outages, while only applying critical patches (D) would leave the organization exposed to non-critical vulnerabilities that could be chained in an attack.

Answer

Skip patches that have not been widely tested

Answer

Apply patches to all servers simultaneously

Answer

Only apply critical patches