ISC2 CC Business Continuity, DR & Incident Response Practice Test 2 — 15 Questions

Question 1

The exhibit shows a syslog-ng client configuration and a firewall rule on the central logging server (IP 10.0.0.10). The client (192.168.1.100) is not sending logs to the server. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The firewall rule restricts source port 6514, but the client uses a random ephemeral source port. The firewall rule on the central logging server (10.0.0.10) specifies a source port of 6514. However, syslog-ng clients, when sending over TCP or TLS, typically use a random ephemeral source port (e.g., above 1024) rather than a fixed source port. Since the firewall restricts the source port to exactly 6514, the client's packets are dropped, preventing logs from reaching the server.

Answer

The syslog-ng configuration uses TLS, but the firewall rule does not allow TLS traffic

Answer

The syslog-ng client uses UDP by default, but the firewall allows only TCP

Answer

The firewall rule does not include the client IP 192.168.1.100

Question 2

A mid-sized e-commerce company has a primary data center in New York and a disaster recovery site in Dallas. The application stack includes a web server, application server, and a PostgreSQL database. The database uses synchronous replication to the DR site. During a routine failover test, the IT team discovers that after failing over to Dallas, the web servers in New York continue to attempt connections to the original database IP, causing application errors. The DNS records have been updated to point to the DR database IP, but the web servers are not refreshing their DNS cache. The company uses a standard TTL of 300 seconds. The IT manager needs a solution that ensures minimal disruption during future failovers. Which action should be taken?

Accepted Answer

Implement a load balancer or proxy with a virtual IP that can be switched during failover, and update the web server configuration to connect to the virtual IP. It decouples the web servers from the database IP address by introducing a load balancer or proxy with a virtual IP (VIP). During failover, the VIP is simply moved to the DR database, and the web servers continue connecting to the same VIP without any DNS dependency or cache refresh issues. This eliminates the problem of stale DNS caches and ensures minimal disruption, as the connection endpoint remains constant.

Answer

Add a static host entry in the web servers' hosts file pointing to the DR database IP

Answer

Increase the DNS TTL to 86400 seconds to ensure all caches are updated quickly

Answer

Configure the web servers to use a different DNS resolver that does not cache

Question 3

A company's primary data center experiences a complete power failure, and operations are shifted to a secondary site. The failover process takes 4 hours, but the recovery point objective (RPO) is set to 1 hour. Which of the following is the most likely consequence of this incident?

Accepted Answer

Data loss of up to 3 hours occurred.. The RPO of 1 hour means the company can tolerate losing up to 1 hour of data. Since the failover took 4 hours, any data written in the 3 hours before the power failure that had not yet been replicated to the secondary site would be lost. This results in a data loss window of up to 3 hours, exceeding the RPO.

Answer

The failover process was unsuccessful.

Answer

No data loss occurred because the secondary site was available.

Answer

The recovery time objective (RTO) was not met.

Question 4

Which TWO of the following are primary objectives of an incident response plan? (Choose two.)

Accepted Answer

Return affected systems to normal operation. A primary objective of an incident response plan is to return affected systems to normal operation. This involves containment, eradication, and recovery steps to restore business functions after a security incident, ensuring the organization can resume operations securely.

Answer

Ensure business continuity during the incident

Answer

Collect evidence for legal proceedings

Answer

Identify the root cause of the incident

Question 5

Refer to the exhibit. A security analyst observes that users from the 192.168.1.0/24 network cannot access HTTPS websites, but HTTP access works fine. What is the most likely cause?

Accepted Answer

The ACL is applied to the wrong interface or direction.. The exhibit shows an ACL that permits both HTTP (TCP 80) and HTTPS (TCP 443) inbound on the outside interface. However, the issue is that internal users cannot initiate outbound HTTPS connections. Since the ACL is applied inbound on the outside interface, it only controls incoming traffic, not outgoing. Therefore, the most likely cause is that the ACL is applied to the wrong interface or direction. The implicit deny at the end of the ACL would block any traffic not explicitly permitted, but because the ACL correctly permits HTTPS inbound, the failure of outbound HTTPS suggests a placement error. This is a common scenario where an ACL that should be applied outbound on the inside interface is mistakenly applied inbound on the outside interface, resulting in asymmetric filtering.

Answer

The implicit deny at the end of the ACL blocks HTTPS traffic.

Answer

The ACL is missing a permit statement for TCP port 443 return traffic.

Answer

The ACL explicitly denies TCP port 443.

Question 6

Drag and drop the steps for the TCP three-way handshake into the correct order.

Accepted Answer

SYN, then SYN-ACK, then ACK. The TCP three-way handshake is a three-step process used to establish a reliable connection. The client initiates by sending a SYN (synchronize) packet to the server. The server responds with a SYN-ACK (synchronize-acknowledge) packet, acknowledging the client's request and indicating its own synchronization. Finally, the client sends an ACK (acknowledge) packet to confirm the connection establishment. This sequence ensures both sides agree on initial sequence numbers and that the connection is ready for data transfer.

Answer

SYN, then ACK, then SYN-ACK

Answer

SYN-ACK, then SYN, then ACK

Answer

ACK, then SYN, then SYN-ACK

Question 7

Drag and drop the steps for the proper disposal of a hard drive containing sensitive data into the correct order.

Accepted Answer

Identification, Backup, Sanitization, Verification, Documentation. Proper disposal includes identification, backup, sanitization, verification, and documentation.

Answer

Sanitization, Backup, Identification, Verification, Documentation

Answer

Identification, Sanitization, Verification, Backup, Documentation

Answer

Documentation, Identification, Backup, Sanitization, Verification

Question 8

Match each access control model to its key characteristic.

Accepted Answer

DAC: Access decisions are based on the identity of the user and are at the discretion of the resource owner.. In the ISC2 CC exam, the three main access control models are DAC, MAC, and RBAC. DAC allows resource owners to control access, MAC uses labels and clearances, and RBAC uses roles.

Answer

DAC: Access decisions are based on security labels and clearance levels.

Answer

MAC: Access decisions are based on the roles assigned to users.

Question 9

Match each cryptographic concept to its definition.

Accepted Answer

Symmetric encryption: Uses a single shared key for both encryption and decryption.. Symmetric encryption uses one shared key; asymmetric uses a public-private key pair; hashing is a one-way function; digital signatures use asymmetric cryptography for authentication, integrity, and non-repudiation. Common confusions include mixing up symmetric and asymmetric key usage, or thinking hashing is reversible.

Answer

Symmetric encryption: Uses a pair of keys (public and private) for encryption and decryption.

Answer

Hashing: A reversible process that transforms data into a fixed-size representation.

Question 10

A company's backup strategy involves daily full backups only. What is the primary risk associated with this approach?

Accepted Answer

Recovery Time Objective (RTO) may be exceeded due to long restore. With daily full backups only, the Recovery Point Objective (RPO) is effectively 24 hours, which may be acceptable depending on business requirements. However, the primary risk is that restoring from a single full backup can take a very long time, especially for large datasets, potentially exceeding the Recovery Time Objective (RTO). This is because full backups contain all data and must be restored entirely, unlike incremental or differential backups that allow faster recovery by restoring only changed blocks.

Answer

Recovery Point Objective (RPO) may be too long

Answer

High cost of backup storage

Answer

Data corruption could spread across backups

Question 11

An organization discovers a ransomware infection on a critical server. According to the incident response phases, what should be the first action after detection?

Accepted Answer

Contain the affected system. Immediately after detection, the priority is to contain the ransomware to prevent it from spreading laterally to other systems. According to NIST SP 800-61 and standard incident response frameworks, containment is the first step after detection and analysis, as it limits damage and preserves evidence for forensic investigation.

Answer

Notify law enforcement

Answer

Eradicate the malware from the server

Answer

Restore from backup

Question 12

Which metric defines the maximum acceptable amount of data loss measured in time?

Accepted Answer

Recovery Point Objective (RPO). The Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time, typically expressed in seconds, minutes, or hours. It represents the age of the most recent backup or replicated data that must be available to resume operations after a disaster, directly determining the frequency of backups or replication intervals.

Answer

Mean Time Between Failures (MTBF)

Answer

Mean Time to Repair (MTTR)

Answer

Recovery Time Objective (RTO)

Question 13

A primary data center is destroyed. The disaster recovery plan calls for activation of a hot standby site. If the RTO is 2 hours, what is the expected recovery time?

Accepted Answer

Less than 2 hours. The RTO (Recovery Time Objective) defines the maximum acceptable downtime, not the guaranteed recovery time. A hot standby site is fully operational and synchronized, so recovery can be completed in less than the RTO if the disaster does not cause additional complications. Option D is correct because the expected recovery time should be less than the 2-hour RTO, assuming the hot site functions as designed.

Answer

Exactly 2 hours

Answer

More than 2 hours

Answer

Unknown, depends on the disaster

Question 14

During a disaster recovery test, backup tapes fail to restore data due to format incompatibility. Which element of the Business Continuity Plan should be updated?

Accepted Answer

Plan testing and maintenance. The failure of backup tapes to restore data due to format incompatibility indicates that the recovery procedures and tools were not validated during testing. This directly points to a deficiency in the 'Plan testing and maintenance' element, which ensures that backup media formats, restoration tools, and procedures are regularly verified and updated to match the current production environment. Without scheduled testing and maintenance, format drift between backup software versions or hardware changes can render tapes unreadable.

Answer

Business Impact Analysis (BIA)

Answer

Recovery strategies

Answer

Communication plan

Question 15

Which is a key benefit of a cold site as a recovery location?

Accepted Answer

Low cost. A cold site is a backup facility that provides only the physical infrastructure (power, cooling, and space) but no pre-installed hardware or live data. Because it lacks equipment and requires manual setup before recovery can begin, it has the lowest capital and operational costs among recovery site options, making low cost its key benefit.

Answer

Real-time data synchronization

Answer

Reduced need for testing

Answer

Fast recovery time