ISC2 CC Security Operations Practice Test 4 — 15 Questions

Question 1

An organization has a legacy system that cannot be patched due to vendor end-of-life. The system is critical for operations. Which compensating control is most appropriate to reduce the risk of exploitation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Isolate the system on a separate network segment with strict access controls. Isolating the legacy system on a separate network segment with strict access controls (firewalls, ACLs, micro-segmentation) is a compensating control that reduces the attack surface and limits lateral movement even though the system itself cannot be patched. It directly addresses the risk of exploitation by containing the system.

Answer

Increase logging and monitoring without any network changes

Answer

Apply a virtual patch using a web application firewall

Answer

Remove the system from the network entirely

Question 2

An organization is planning to implement a security awareness program. Which TWO topics should be included to address common social engineering attacks?

Accepted Answer

Recognizing phishing emails. Option A (Recognizing phishing emails) is correct because phishing is one of the most common social engineering attacks, and training users to identify suspicious senders, spoofed domains, urgent language, and malicious links or attachments directly reduces the risk of credential theft and malware infection. Option B (Awareness of tailgating and piggybacking) is correct because these are physical social engineering techniques in which an attacker follows an authorized person into a restricted area, so awareness training helps employees enforce badge checks and challenge unknown individuals. Option C is not a social engineering topic; understanding encryption algorithms is a technical cryptographic concept rather than a human-focused attack vector. Option D is also technical rather than social engineering, since configuring firewall rules is an administrative network security task performed by IT staff. Option E, while valuable for overall security, addresses credential hygiene rather than the manipulation tactics that define social engineering attacks.

Answer

Understanding encryption algorithms

Answer

Configuring firewall rules

Answer

Proper password management using a password manager

Question 3

After a security incident, an investigator needs to analyze logs to determine the timeline of events. Which TWO types of logs are most likely to provide evidence of lateral movement within the network?

Accepted Answer

Authentication logs. Authentication logs (B) are correct because they record logon events such as successful and failed authentications, Kerberos ticket requests, and remote logon types (e.g., Type 3 network logons in Windows Security event 4624), which directly reveal an attacker moving from one host to another using compromised credentials. Firewall logs (C) are correct because they capture allowed and denied connections between internal hosts and across network segments, letting an investigator trace internal-to-internal traffic and identify the source and destination of lateral movement. DNS logs (A) can show name resolution but do not by themselves prove a session or movement between hosts. System logs (D) and application logs (E) may contain related events, but they are less directly indicative of network-based lateral movement than authentication and firewall records.

Answer

DNS logs

Answer

System logs

Answer

Application logs

Question 4

Which TWO of the following are common indicators of a phishing email?

Accepted Answer

Unexpected sender or email address. Option D is correct because phishing emails frequently originate from spoofed or look-alike domains that the recipient does not recognize, so an unexpected sender or mismatched email address is a classic red flag. Option E is correct because attackers rely on social engineering that creates urgency—phrases like "act now" or "your account will be closed"—to pressure victims into clicking links or disclosing credentials before they scrutinize the message. In contrast, option A is not an indicator since professional formatting and correct grammar are typical of legitimate email and, if anything, poor grammar is the more common phishing clue. Option B is not reliable because legitimate business email routinely carries attachments, so an attachment alone proves nothing. Option C is likewise not an indicator, as using the recipient's full name is normal, personalized behavior in genuine correspondence and does not by itself signal phishing.

Answer

Professional formatting with correct grammar

Answer

Presence of a file attachment

Answer

Use of the recipient's full name in the greeting

Question 5

A security analyst is reviewing email gateway logs and notices a message that passed authentication checks but contains a URL pointing to a look-alike domain registered three days ago. The message appears to come from the organization's CEO and requests an urgent wire transfer. Which type of attack is MOST likely being attempted?

Accepted Answer

Business email compromise (BEC). Business email compromise (BEC) is a social engineering attack where cybercriminals impersonate executives or trusted partners to trick employees into transferring funds or sharing sensitive information. The combination of an urgent wire transfer request, a spoofed CEO identity, and a newly registered look-alike domain strongly indicates BEC. Other attack types do not align with the described email-based deception and financial motive.

Answer

Cross-site scripting (XSS)

Answer

SQL injection

Answer

Distributed denial-of-service (DDoS) attack

Question 6

A security analyst is reviewing endpoint logs and sees repeated entries showing that a process attempted to modify the Windows registry key HKLM\SYSTEM\CurrentControlSet\Control\Lsa and then attempted to read the SAM database file. The process is not a known administrative tool and was launched from a user's temporary folder. Which type of activity is MOST likely occurring?

Accepted Answer

Privilege escalation and credential dumping attempts. The combination of modifying the LSA registry key and reading the SAM database from an unknown process in a user temp folder is a strong indicator of credential dumping and privilege escalation. These actions are commonly performed by tools like Mimikatz or custom malware to extract password hashes. Recognizing this pattern helps analysts quickly identify a potential compromise.

Answer

Routine operating system patch installation

Answer

Normal user profile creation by the operating system

Answer

Antivirus signature update process

Question 7

A security administrator is configuring a firewall rule to allow only HTTP and HTTPS traffic from the internal network to the internet. Which port numbers should be permitted?

Accepted Answer

TCP 80 and TCP 443. HTTP operates on TCP port 80, and HTTPS operates on TCP port 443. To allow only web traffic, the firewall must permit these ports. Other ports correspond to different services such as FTP, SSH, SMTP, POP3, or DNS, which are not required for web browsing. Therefore, the correct ports are 80 and 443.

Answer

TCP 53 and UDP 53

Answer

TCP 21 and TCP 22

Answer

TCP 25 and TCP 110

Question 8

A security administrator receives an alert that a user's laptop has been infected with ransomware. The user reports that all files on the laptop are encrypted and a ransom note is displayed. The administrator immediately disconnects the laptop from the network. Which of the following should be the NEXT step in the incident response process?

Accepted Answer

Identify the scope of the incident and preserve evidence.. Once an infected system is isolated, the next critical step is to determine the full scope of the compromise and preserve evidence. This allows the organization to understand how the ransomware entered, what else may be affected, and how to eradicate it properly. Recovery actions such as restoring backups or rebuilding systems should come after containment and scoping are complete.

Answer

Restore the encrypted files from the most recent backup.

Answer

Pay the ransom to obtain the decryption key and recover the files quickly.

Answer

Rebuild the laptop from scratch and return it to the user.

Question 9

A security administrator is configuring a Linux web server and wants to ensure that only encrypted administrative sessions are allowed, while also preventing direct root logins over the network. Which of the following should the administrator implement?

Accepted Answer

Enable SSH with PermitRootLogin set to no and restrict access to the management subnet.. The requirement is to allow only encrypted administrative sessions and prevent direct root logins. SSH is the standard encrypted remote administration protocol on Linux. Setting PermitRootLogin to no blocks direct root access over SSH, and restricting access to a management subnet adds defense in depth. Together, these measures meet both conditions without disrupting necessary administration.

Answer

Enable Telnet with strong password policies and disable the root account.

Answer

Implement a VPN for all server traffic and allow root logins only from the local console.

Answer

Configure a host-based firewall to allow only HTTP and HTTPS traffic and disable SSH.

Question 10

An employee receives an email that appears to be from the IT department asking them to click a link and verify their password because of a mailbox upgrade. The link points to a domain that is misspelled but closely resembles the company's real domain. The employee reports it to the security team. What type of attack is this?

Accepted Answer

Phishing. The email impersonates IT, uses a deceptive domain, and requests credential verification, which are hallmarks of phishing. It is not targeted enough to be spear phishing or whaling, and it does not use voice communication. Phishing remains the most accurate classification for this generic credential-harvesting attempt.

Answer

Vishing

Answer

Spear phishing

Answer

Whaling

Question 11

An organization wants to ensure that only authorized devices can connect to its corporate Wi-Fi network. The security team decides to implement a solution that requires devices to authenticate before being granted network access. Which technology should they use?

Accepted Answer

802.1X with a RADIUS server. 802.1X with a RADIUS server provides port-based network access control, requiring each device to authenticate before being granted access. It supports various authentication methods such as certificates or credentials, making it ideal for ensuring only authorized devices connect to corporate Wi-Fi. Other options like pre-shared keys or MAC filtering are weaker and not scalable for enterprise use.

Answer

MAC address filtering

Answer

WPA3-SAE with a shared password

Answer

WPA2-Personal with a pre-shared key

Question 12

A security team is implementing a Security Information and Event Management (SIEM) system. Which TWO log sources are most critical for detecting unauthorized access attempts on a Linux server? (Choose two.)

Accepted Answer

/var/log/secure. On Linux systems, authentication events are logged in /var/log/auth.log (Debian-based) or /var/log/secure (Red Hat-based). These files record failed and successful login attempts, sudo usage, and SSH access, making them critical for detecting unauthorized access. Other logs like syslog, kern.log, or dpkg.log serve different purposes and are less directly relevant to access attempts.

Answer

/var/log/kern.log

Answer

/var/log/syslog

Answer

/var/log/dpkg.log

Question 13

A security administrator discovers that a former employee's user account still exists and remains enabled three weeks after their termination. The account has valid credentials and no recent logins. Which access control principle has been violated?

Accepted Answer

Account lifecycle management. Proper account lifecycle management ensures accounts are created, reviewed, and removed in step with a person's employment status. A terminated employee retaining an enabled account violates the deprovisioning requirement. Even though the account shows no recent logins, the credential remains a live risk because it could be used by the former employee or anyone who obtained the password. Timely disablement closes that exposure.

Answer

Separation of duties

Answer

Defense in depth

Answer

Least privilege

Question 14

An organization's security policy requires that all employees use unique, complex passwords for their domain accounts. A security analyst is reviewing a list of common password mistakes. Which of the following best describes a practice that undermines this policy?

Accepted Answer

Reusing the same password across multiple systems and services.. The policy requires unique, complex passwords. Reusing the same password across multiple systems violates the uniqueness requirement and creates a cascading risk: compromise of one account can lead to compromise of others. This practice is a well-known security weakness. The other options either support the policy or are neutral, so password reuse is the clear answer.

Answer

Enabling multi-factor authentication on all domain accounts.

Answer

Using a password manager to generate and store unique passwords for each account.

Answer

Changing passwords only when prompted by the system at 90-day intervals.

Question 15

A security operations center (SOC) is reviewing its incident response plan and wants to improve detection of data exfiltration over encrypted channels. Which TWO monitoring approaches would BEST help identify potential exfiltration in this scenario? (Choose two.)

Accepted Answer

Analyzing network flow records for unusual volumes of outbound traffic to external IP addresses. Detecting encrypted exfiltration requires focusing on behavior and metadata rather than payload content. Network flow analysis identifies anomalous outbound volumes, while endpoint monitoring detects staging activities like archiving. Together, they provide complementary visibility without relying on decryption, making them effective for this scenario.

Answer

Enabling full packet capture and storing all network traffic for later analysis

Answer

Reviewing DNS query logs for lookups of known malicious domains

Answer

Deploying SSL/TLS inspection to decrypt and examine all outbound web traffic