ISC2 CC Practice Test 9 — 10 Questions

Question 1

An organization wants to implement defense in depth for its web application. Which combination of controls best illustrates this principle?

Accepted Answer

A firewall, intrusion detection system, and regular security awareness training.. Defense in depth involves multiple layers of security controls so that if one fails, others still protect the asset. A firewall, IDS, and security awareness training represent network, host, and human layers, respectively, illustrating the principle.

Answer

A strict perimeter firewall without internal controls.

Answer

Encryption at rest only.

Answer

A single strong password policy.

Question 2

A security team identifies that a server has a known vulnerability. A threat actor could exploit it to gain unauthorized access. The combination of these factors represents:

Accepted Answer

Risk. Risk is the combination of a threat exploiting a vulnerability, potentially leading to harm. Here, a threat actor could exploit a known vulnerability to gain unauthorized access, which represents a risk.

Answer

Threat

Answer

Control

Answer

Vulnerability

Question 3

Which of the following is the most effective way to prevent tailgating in a secured facility?

Accepted Answer

Training employees to not hold doors open for unknown individuals.. Tailgating exploits social trust — an attacker follows an authorized person through a door. Training employees to challenge and not hold doors for unknown individuals directly addresses the human behavior that enables tailgating, making it the most effective preventive control. Technical controls alone cannot stop a person who is willingly allowed through.

Answer

Installing security cameras at all entrances.

Answer

Using keycard access for all doors.

Answer

Hiring security guards to monitor entrances.

Question 4

A small accounting firm's staff connect to the corporate wireless network using a shared passphrase that every employee knows, and the same passphrase has not been changed in two years. A security consultant recommends moving to a deployment where each user authenticates with their own domain credentials and a RADIUS server validates the logon before network access is granted. Which technology should the consultant recommend?

Accepted Answer

WPA2-Enterprise with 802.1X authentication. Enterprise-mode wireless security couples the 802.1X framework with a RADIUS server so each user presents unique credentials, commonly their domain logon, before access is granted. This eliminates the shared-secret weakness, enables per-user revocation, and produces authentication logs tied to individuals, which is exactly what the consultant was asked to deliver for the accounting firm.

Answer

A captive portal that displays an acceptable-use policy before granting access

Answer

WPA2-Personal with a longer and more complex pre-shared key

Answer

MAC address filtering on the wireless access points

Question 5

The exhibit shows recent authentication logs. What type of attack is most likely indicated?

Accepted Answer

Brute-force attack. The exhibit shows repeated authentication attempts with different passwords for the same username, which is the hallmark of a brute-force attack. In authentication logs, a high frequency of failed login attempts (e.g., multiple 'Failed password' entries in quick succession) indicates an attacker systematically guessing credentials. This aligns with the CC domain of Access Controls, where brute-force attacks target weak password policies.

Answer

Man-in-the-middle attack

Answer

Phishing attack

Answer

Privilege escalation

Question 6

An IT administrator wants to inspect HTTP traffic for malicious payloads such as SQL injection. Which network security device is most appropriate?

Accepted Answer

WAF. A Web Application Firewall (WAF) is specifically designed to inspect HTTP/HTTPS traffic and block malicious payloads such as SQL injection, cross-site scripting (XSS), and other OWASP Top 10 attacks. It operates at the application layer (Layer 7) and can enforce custom rules based on HTTP request contents. An IDS or IPS may detect or block some attacks but is not purpose-built for web application protection.

Answer

IDS

Answer

Honeypot

Answer

IPS

Question 7

Which of the following ports is used by HTTPS?

Accepted Answer

443. HTTPS (Hypertext Transfer Protocol Secure) operates over TCP port 443 by default, using TLS to encrypt HTTP traffic between client and server. This is the IANA-assigned well-known port for HTTPS, so any browser request to https:// implicitly targets port 443 unless overridden. Port 80 is the counterpart for unencrypted HTTP, which is why the two are so often confused.

Answer

80

Answer

21

Answer

25

Question 8

A security analyst notices unusual traffic on the network. Using Wireshark, they capture packets and see that an attacker is reading all unencrypted data from the network segment. Which type of attack is most likely being performed?

Accepted Answer

Sniffing / Eavesdropping. Sniffing or eavesdropping involves capturing network traffic to read data. In this scenario, unencrypted data is being read, which is characteristic of sniffing.

Answer

Spoofing

Answer

DoS

Answer

Man-in-the-middle

Question 9

Which of the following ports is commonly used for secure web traffic (HTTPS)?

Accepted Answer

443. HTTPS uses TCP port 443 by default, wrapping HTTP inside a TLS tunnel so credentials, cookies, and page content are encrypted in transit. Port 443 is the IANA-registered well-known port for HTTPS and is what browsers assume when no port is specified in an https:// URL. This is why secure web traffic is universally associated with 443.

Answer

53

Answer

80

Answer

22

Question 10

An organization wants to segment its network so that public-facing servers are isolated from internal users. Which network design component should be used?

Accepted Answer

DMZ. A DMZ (demilitarized zone) is a perimeter subnetwork that hosts public-facing services such as web, mail, and DNS servers while keeping them separated from the internal trusted network. Traffic from the internet reaches the DMZ, but the DMZ is firewalled off from the internal LAN, so a compromised public server cannot pivot directly into internal systems. This is the standard architecture for isolating externally accessible servers.

Answer

Honeypot

Answer

Subnet

Answer

VLAN