ISC2 CC Practice Test 9 — 10 Questions

Question 1

Which of the following is the primary purpose of a security information and event management (SIEM) system?

Accepted Answer

Correlate and analyze log data to detect incidents.. The primary purpose of a SIEM system is to aggregate, correlate, and analyze log data from multiple sources (e.g., firewalls, servers, IDS/IPS) in real time to detect security incidents. By applying correlation rules and analytics, SIEM identifies patterns or anomalies that indicate malicious activity, enabling security teams to respond promptly.

Answer

Enforce access control policies.

Answer

Replace the need for manual log review.

Answer

Prevent malware infections.

Question 2

A security consultant is evaluating a vendor's security practices before signing a contract. The consultant reviews the vendor's security policies, incident response plans, and conducts background checks on key personnel. This activity is an example of:

Accepted Answer

Due diligence. Due diligence involves investigating and verifying security practices before making a decision, such as vendor risk assessment.

Answer

Risk avoidance

Answer

Due care

Answer

Risk mitigation

Question 3

Which of the following is a key function of a Security Information and Event Management (SIEM) system?

Accepted Answer

Correlating log data from multiple sources to identify security incidents. SIEM aggregates and correlates logs from various sources to detect patterns and generate alerts.

Answer

Blocking malicious network traffic

Answer

Enforcing password complexity requirements

Answer

Patching vulnerabilities in operating systems

Question 4

Which TWO of the following are commonly used techniques to detect phishing emails? (Choose two.)

Accepted Answer

Sandboxing email attachments in a secure environment.. Sandboxing email attachments in a secure environment (Option C) is a common technique to detect phishing emails because it allows suspicious attachments to be executed and analyzed in an isolated virtual machine. This process observes the attachment's behavior for malicious activities, such as attempting to connect to a command-and-control server or dropping malware, without risking the actual endpoint. It is a core technology used in advanced email security gateways and threat intelligence platforms.

Answer

Scanning for specific file extensions.

Answer

Disabling automatic image loading.

Answer

Implementing DKIM and DMARC records.

Question 5

Which TWO of the following are examples of integrity controls? (Select TWO)

Accepted Answer

Digital signatures. Hashing and digital signatures are integrity controls that verify data has not been altered.

Answer

Redundancy

Answer

Firewalls

Answer

Encryption

Question 6

A security manager is advised to implement 'due care' in their organization. Which action best exemplifies due care?

Accepted Answer

Regularly updating antivirus software. Due care means taking reasonable steps to protect assets, such as implementing basic security controls like patch management.

Answer

Purchasing cyber insurance

Answer

Performing a background check on a new vendor

Answer

Accepting the risk of a legacy system

Question 7

Which of the following best describes the purpose of due care in information security?

Accepted Answer

Implementing reasonable security measures to protect data. Due care means exercising a minimum standard of care to protect information assets, such as implementing basic security controls.

Answer

Prioritizing security incidents based on impact

Answer

Transferring risk to a third party

Answer

Investigating a vendor's background before contracting

Question 8

After a security breach, the organization conducts a background check on a new vendor before signing a contract. This practice is known as:

Accepted Answer

Due diligence. Due diligence involves investigating and verifying before acting.

Answer

Risk acceptance

Answer

Risk avoidance

Answer

Due care

Question 9

A multinational corporation deploys redundant servers in geographically diverse data centers and uses a load balancer to distribute traffic. This setup primarily addresses which security concern?

Accepted Answer

Availability. Redundancy and load balancing ensure that systems remain accessible, supporting availability.

Answer

Confidentiality

Answer

Integrity

Answer

Non-repudiation

Question 10

Which of the following is an example of a physical control that supports the availability principle of the CIA triad?

Accepted Answer

Redundant servers. Availability ensures systems are accessible when needed. Redundant servers provide failover capability, minimizing downtime.

Answer

Data encryption

Answer

Biometric authentication

Answer

Digital signatures