ISC2 CC Security Operations Practice Test 5 — 15 Questions

Question 1

An employee receives a call from someone claiming to be from the IT help desk. The caller says there is a problem with the employee's email and asks for the employee's password to fix it. The employee refuses and reports the call. Which social engineering technique was attempted?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Vishing. Vishing uses voice communication, typically a phone call, to manipulate a target into revealing sensitive information or performing an action. The attacker posed as IT support and requested a password, which legitimate help desk personnel should never do. Recognizing the pretext and refusing to provide credentials is the correct response. Reporting the call also helps security teams warn others about the active campaign.

Answer

Smishing

Answer

Tailgating

Answer

Whaling

Question 2

A security analyst is reviewing network logs to detect potential intrusions. Which TWO of the following are examples of network-based indicators of compromise? (Choose two.)

Accepted Answer

Multiple connections to a command-and-control server. Network-based indicators of compromise are observable in network traffic, such as unusual outbound connections to malicious IPs or multiple connections to command-and-control servers. These suggest active communication with attacker infrastructure. Host-based indicators, like failed logins or new accounts, are found on individual systems and are not network-based.

Answer

A file with a suspicious hash value found in a user's download folder

Answer

A new local administrator account created on a workstation

Answer

A sudden increase in failed login attempts on a user account

Question 3

A security operations center receives an alert that a workstation is communicating with a known command-and-control (C2) IP address every 60 seconds at consistent intervals. The endpoint detection and response (EDR) agent has not flagged any malicious files on the host. Which type of malware behavior BEST describes this activity?

Accepted Answer

Beaconing. Regular, fixed-interval outbound connections to a known malicious address indicate beaconing, the heartbeat malware uses to maintain C2 communications. Because EDR found no malicious files, the network timing pattern becomes the key detection signal. Recognizing beaconing helps analysts identify stealthy implants that have evaded file-based detection and initiate containment before data theft or lateral movement occurs.

Answer

Ransomware encryption

Answer

Privilege escalation

Answer

SQL injection

Question 4

A security operations center (SOC) analyst is reviewing network traffic logs and notices a series of connections to an unfamiliar external IP address on port 443. The analyst suspects a command-and-control (C2) channel. Which TWO characteristics would most likely indicate that this traffic is malicious C2 activity? (Choose two.)

Accepted Answer

The traffic uses domain fronting to hide the true destination.. Beaconing behavior, such as regular intervals with consistent packet sizes, is a hallmark of automated C2 communication. Domain fronting, which disguises the true destination by manipulating SNI and Host headers, is another technique frequently used by malware to evade network defenses. Both are strong indicators of malicious C2 activity, whereas cloud-hosted IPs, service-initiated connections, and self-signed certificates can also be legitimate.

Answer

The connections are initiated by a server process running as a system service.

Answer

The traffic is encrypted and uses a self-signed certificate.

Answer

The external IP address is associated with a known cloud service provider.

Question 5

A security administrator is configuring a new Windows server and wants to ensure that only necessary services and ports are enabled. After installation, the administrator runs a port scan and finds that port 3389 is open. Which action should the administrator take FIRST to reduce the attack surface?

Accepted Answer

Disable the Remote Desktop Protocol service if it is not required for administration. The first step in reducing attack surface is to remove unnecessary services. Since port 3389 is open due to RDP, and if RDP is not required, disabling it eliminates the exposure entirely. Other measures like firewall restrictions or authentication enhancements are useful but secondary to removing the service.

Answer

Enable Network Level Authentication for RDP connections

Answer

Configure the firewall to allow RDP only from specific IP addresses

Answer

Change the RDP listening port to a non-standard number

Question 6

A security operations center (SOC) receives an alert about a possible insider threat. An employee in the finance department has been accessing large amounts of sensitive data outside of normal working hours and emailing it to a personal external email address. The SOC manager asks the analyst to preserve evidence for a potential legal case. Which of the following should the analyst do FIRST to ensure the evidence is admissible?

Accepted Answer

Document the chain of custody for all evidence collected.. For evidence to be admissible in a legal case, a proper chain of custody must be established and documented from the outset. This ensures that the evidence has not been tampered with and can be traced from collection to presentation. While imaging and containment are important, they come after initiating the chain of custody to maintain integrity.

Answer

Create a forensic image of the employee's workstation hard drive.

Answer

Confront the employee and ask for an explanation.

Answer

Disable the employee's network access immediately.

Question 7

A security operations center wants to improve detection of malicious activity on endpoints. Which TWO data sources provide the most direct endpoint-level evidence for identifying suspicious process execution? (Choose two.)

Accepted Answer

Endpoint detection and response (EDR) telemetry. Detecting suspicious process execution requires host-based visibility into what actually ran. EDR telemetry provides rich process-level detail including command lines and parent-child relationships, while OS process accounting or audit logs offer a lighter but still direct record of executions. Network-oriented sources such as NetFlow, firewall deny logs, and DHCP lease logs describe traffic or addressing, not the processes on the endpoint, so they serve as supporting context rather than primary execution evidence.

Answer

Firewall deny logs

Answer

NetFlow records

Answer

DHCP lease logs

Question 8

An employee reports that their laptop suddenly displays a message demanding payment in cryptocurrency to restore access to files, and the files now have an unfamiliar extension. The employee has not clicked any links recently. Which type of malware is MOST likely responsible?

Accepted Answer

Ransomware. The combination of encrypted files, altered extensions, and a cryptocurrency ransom demand is the classic signature of ransomware. Delivery does not require a recent link click, since exploits, malicious attachments, and exposed services are common vectors. Recognizing these indicators lets responders isolate the host quickly, preserve evidence, and avoid paying, while restoring from offline backups if available.

Answer

A logic bomb

Answer

A keylogger

Answer

A rootkit

Question 9

An attacker used stolen credentials from a phishing campaign to authenticate to a cloud email account. The organization's incident response team wants to immediately stop the attacker from continuing to access the mailbox while preserving evidence for investigation. Which action best meets both goals?

Accepted Answer

Disable the account in the identity provider, then export the mailbox audit log and sign-in logs to a secure evidence repository.. The most effective containment combines immediate revocation of access with preservation of forensic data. Disabling the account in the identity provider stops the attacker from authenticating again, while exporting audit and sign-in logs captures evidence before it rotates or is lost. Destructive actions like deleting the mailbox, or partial measures like a password change or IP block, either harm the investigation or fail to reliably stop the attacker.

Answer

Delete the mailbox and recreate it for the legitimate user, then reset the user's password.

Answer

Change the user's password and enable self-service password reset so the user can regain access quickly.

Answer

Add the attacker's IP address to the firewall block list and continue monitoring the mailbox for suspicious activity.

Question 10

A security analyst is reviewing logs from a Linux web server and notices the following entries: multiple failed SSH login attempts for user 'root' from various IP addresses, followed by a successful login from an IP address in a different country. Shortly after, a new user account 'backup' is created and added to the sudoers file. Which type of attack is MOST likely represented?

Accepted Answer

Brute force attack leading to privilege escalation. The sequence of multiple failed SSH logins followed by a successful login from a foreign IP and the creation of a sudo-enabled account strongly indicates a brute force attack that succeeded, leading to privilege escalation. This is a common attack chain where initial access is gained through weak credentials, and persistence is established via a new privileged user.

Answer

Distributed denial of service (DDoS)

Answer

SQL injection

Answer

Cross-site scripting (XSS)

Question 11

A security analyst is reviewing access logs and notices that a former employee's account was used to access a sensitive file share three days after the employee's termination. The account should have been disabled on the termination date. Which of the following is the MOST likely explanation for this security gap?

Accepted Answer

The account was not disabled in the directory service after termination.. The access logs show the former employee's account was used after termination. The most direct explanation is that the account was not disabled in the directory service, allowing authentication. While file share permissions and password changes are part of offboarding, the failure to disable the account is the root cause that enabled the access.

Answer

The file share permissions were not updated to remove the former employee's access.

Answer

The file share was configured to allow anonymous access.

Answer

The former employee's password was not changed before termination.

Question 12

A security administrator is configuring a firewall to protect an internal network. The administrator needs to allow only HTTP and HTTPS traffic from the internal network to the internet, while blocking all other outbound traffic. Which of the following should the administrator implement?

Accepted Answer

Explicit allow rules for HTTP and HTTPS, followed by an implicit deny. Firewall rule sets are processed in order. To allow only HTTP and HTTPS outbound, explicit allow rules for TCP 80 and 443 must be created first. Then, a final rule (often implicit) denies all other traffic. This ensures that only the desired traffic is permitted and everything else is blocked, meeting the requirement.

Answer

A deny rule for all traffic except HTTP and HTTPS

Answer

An implicit deny rule at the end of the rule set

Answer

A stateful inspection rule that allows all outbound traffic

Question 13

A junior administrator at a healthcare company receives a call from someone claiming to be from the IT help desk. The caller says there is a critical server issue and asks the administrator to read back the six-digit code just sent to their phone. The administrator has not requested any password reset or MFA challenge. Which social engineering principle is the caller most likely exploiting?

Accepted Answer

Authority combined with urgency, because the caller impersonates support staff and pressures the administrator to act immediately.. The caller fabricates a critical server problem while posing as help desk personnel, which combines impersonated authority with manufactured urgency. Because the administrator never initiated an MFA challenge, no legitimate support process would require the code to be read aloud. The correct response is to refuse, hang up, and verify through a known internal channel. This scenario tests recognition of pretexting and MFA code theft.

Answer

Reciprocity, because the caller previously helped the administrator with a ticket and now expects a favor in return.

Answer

Consensus, because the caller claims that other administrators have already shared their codes to fix the same problem.

Answer

Scarcity, because the caller implies that only a limited number of support slots are available for the server repair.

Question 14

During an incident, an analyst collects a forensic image of a compromised server's disk. The organization's policy requires preserving evidence for potential legal proceedings. Which action best maintains the integrity of the collected evidence?

Accepted Answer

Compute and document a cryptographic hash of the image immediately after acquisition.. Cryptographic hashing at the time of acquisition establishes a verifiable baseline for the forensic image. Any later modification changes the hash, so a match confirms integrity. This practice, combined with documented chain of custody, supports the reliability of evidence in legal contexts. Working from a verified copy rather than the original also protects the source media, and preserving the full image without deletions ensures nothing is lost.

Answer

Analyze the original disk in place to avoid copying errors.

Answer

Delete non-relevant files from the image to reduce size before storage.

Answer

Compress the image with a password to prevent tampering.

Question 15

During an incident, a responder needs to capture the contents of volatile memory on a running Linux server before shutting it down, because encryption keys and running processes may only exist in RAM. Which action BEST preserves this volatile evidence?

Accepted Answer

Capture a memory image using a tool such as LiME or AVML before any shutdown. Order of volatility requires collecting the most perishable evidence first, and RAM contents disappear the moment a system loses power or restarts. Memory acquisition tools such as LiME or AVML capture encryption keys, active network connections, and running processes that disk images cannot recover. Capturing memory before shutdown or disk imaging preserves the ephemeral evidence needed to understand attacker activity and credentials in use.

Answer

Pull the power cord immediately, then remove and image the hard drive

Answer

Restart the server and enable verbose logging for future collection

Answer

Run the dd command to image the primary disk to an external drive