ISC2 CC Security Operations Practice Test 6 — 15 Questions

Question 1

A new employee reports receiving an email that appears to come from the CEO, urgently requesting gift card purchases for a client. The email domain looks almost identical to the company's domain but uses a different top-level domain. Which type of social engineering attack is this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Business email compromise (BEC) using a look-alike domain. The message impersonates an executive, uses a domain that closely resembles the real one, and pressures the recipient into an urgent financial action. That combination is the hallmark of business email compromise, specifically using a look-alike domain. Spear phishing, watering hole, and vishing describe different delivery methods or objectives and do not capture the executive impersonation and fraudulent payment request.

Answer

Vishing using caller ID spoofing

Answer

Watering hole attack

Answer

Spear phishing with a malicious attachment

Question 2

A security administrator is reviewing firewall logs and notices repeated inbound connection attempts to TCP port 3389 from multiple external IP addresses. Which type of attack is MOST likely occurring?

Accepted Answer

Remote Desktop Protocol (RDP) brute force. TCP port 3389 is the default port for Remote Desktop Protocol (RDP). Repeated inbound connection attempts from multiple external IP addresses indicate an RDP brute-force attack, where attackers try to guess credentials to gain remote access. This is a common and dangerous attack, as successful compromise can lead to full system control. Other attack types do not match the described network behavior.

Answer

Denial-of-service (DoS) attack

Answer

SQL injection

Answer

Ransomware encryption

Question 3

An organization wants to ensure that only authorized software can execute on its endpoints. A security administrator is evaluating application control methods. Which of the following is the BEST approach to meet this requirement?

Accepted Answer

Implement a whitelist of approved applications and block all others.. The requirement is to allow only authorized software to execute. An application whitelist (allowlist) enforces this by permitting only explicitly approved applications and blocking all others. This deny-by-default approach is the most effective way to prevent unauthorized or malicious software from running, unlike blacklisting or antivirus, which rely on known signatures.

Answer

Enable full disk encryption on all endpoints.

Answer

Deploy antivirus software with signature-based detection.

Answer

Use a blacklist of known malicious applications and allow all others.

Question 4

A security analyst reviewing web server logs sees repeated requests containing strings such as '../../etc/passwd' and '..%2f..%2fwindows%2fsystem32'. The requests originate from a single external address and target a file-download endpoint. Which type of attack is most likely occurring?

Accepted Answer

Directory traversal. The dot-dot-slash sequences, including the URL-encoded form, are attempts to climb out of the intended directory and read sensitive files such as the password file or Windows system binaries. This is textbook directory traversal against a file-download function. The attacker is not injecting script, SQL, or forging a session request, but manipulating the path the application resolves.

Answer

Cross-site request forgery

Answer

Cross-site scripting

Answer

SQL injection

Question 5

An organization is building a log management capability so its security team can detect and investigate incidents across many systems. Which TWO practices BEST support effective centralized log collection and analysis? (Choose two.)

Accepted Answer

Forward logs to a central repository with integrity protection and controlled access. Effective centralized logging depends on trustworthy, correlated data. Synchronized clocks make cross-source timelines reliable, while forwarding logs to a protected central repository preserves evidence even if a source host is compromised. Together these practices enable detection and investigation. Local-only storage, disabled logging, and ungoverned configuration changes all create blind spots or permit tampering, defeating the purpose of centralization.

Answer

Disable logging on high-traffic servers to reduce storage costs

Answer

Store all logs only on the local systems that generate them

Answer

Allow every administrator to modify log settings without change control

Question 6

A company wants to reduce the risk of malware spreading from employee workstations to critical servers. The security team proposes placing firewalls between network segments and restricting traffic to only required ports and protocols. Which security control category does this approach primarily represent?

Accepted Answer

Technical control. Network segmentation enforced by firewalls and port restrictions is implemented through technology, making it a technical control. It limits how malware can move laterally from workstations to critical servers by permitting only required traffic. Unlike administrative controls that depend on policies and training, or physical controls that restrict access to facilities, this approach enforces boundaries automatically. Segmenting systems and minimizing allowed protocols reduces the attack surface and contains incidents.

Answer

Administrative control

Answer

Physical control

Answer

Compensating control

Question 7

A security operations center receives an alert that a workstation is communicating with a known command-and-control IP address over HTTPS on port 443. The endpoint agent shows no malware signature match. Which containment action should the analyst take first to limit damage while preserving the ability to investigate?

Accepted Answer

Isolate the workstation from the network using the endpoint agent's network containment feature.. When an endpoint shows beaconing to known command-and-control infrastructure but no signature match, the priority is to sever the attacker's channel without destroying evidence. Endpoint network containment isolates the host while keeping memory and running processes available for forensic capture. Powering off, deleting files, or blocking a single external IP either destroys evidence or leaves the compromised host free to communicate and move laterally.

Answer

Immediately power off the workstation to stop any malicious activity.

Answer

Block the destination IP address at the perimeter firewall and continue monitoring the workstation.

Answer

Delete the suspicious files identified by the endpoint agent and run a full antivirus scan.

Question 8

A company is building an incident response capability and wants to ensure the containment phase is effective. Which TWO activities are appropriate during containment? (Choose two.)

Accepted Answer

Applying temporary firewall or access-control rules to block the attacker's known infrastructure. Containment stops the spread and limits damage while keeping evidence intact for analysis. Isolating affected hosts and blocking the attacker's known infrastructure both reduce ongoing impact and are reversible, temporary measures. Rebuilding everything, closing the incident, or deleting logs are recovery or destructive actions that either destroy evidence or prematurely end the response, so they do not belong in containment.

Answer

Deleting all logs from affected systems to prevent the attacker from covering their tracks

Answer

Closing the incident ticket and notifying customers that service has resumed

Answer

Rebuilding every server in the data center from scratch immediately

Question 9

A security analyst receives an alert that a user account successfully authenticated to the corporate VPN from two geographically distant countries within a five-minute window. The user is currently traveling and confirms only one login. Which conclusion is MOST appropriate for the analyst to draw at this stage?

Accepted Answer

The account is likely compromised and the impossible-travel indicator warrants immediate investigation. Successful authentications from two distant countries within five minutes, combined with the user confirming a single session, form a classic impossible-travel indicator of credential compromise. The analyst should treat the account as potentially compromised and act quickly to contain it, rather than dismissing the alert, assuming benign credential sharing, or blaming infrastructure. Prompt investigation limits any attacker's access.

Answer

The VPN concentrator has failed and the logs are unreliable, so the account is safe

Answer

The alert is a false positive caused by NTP drift and should be closed immediately

Answer

The user must be sharing credentials with a colleague and should only be reminded of policy

Question 10

A security administrator is hardening a new Linux web server before it is placed into production. Which TWO practices reduce the attack surface of the operating system itself? (Choose two.)

Accepted Answer

Enforce least privilege by removing unnecessary administrative rights and using dedicated service accounts with minimal permissions.. Reducing the operating system's attack surface means removing or disabling anything not required for the server's role and limiting the privileges available to users and services. Eliminating unnecessary daemons and ports removes entry points, while least privilege and dedicated service accounts constrain what an attacker can do if one is reached. Encryption, alert-only intrusion prevention, and backups address confidentiality, detection, or recovery rather than shrinking the exploitable surface.

Answer

Install a host-based intrusion prevention system and configure it to alert only.

Answer

Enable full-disk encryption on the server's data volumes.

Answer

Schedule weekly full backups of the server to a remote location.

Question 11

A security administrator must configure a system so that users prove their identity with something they have plus something they know, without deploying smart cards or hardware tokens. Which authentication approach best meets this requirement?

Accepted Answer

A password combined with a one-time code generated by a soft token app on the user's phone. Two-factor authentication requires factors from different categories. A password supplies the knowledge factor, and a one-time code from an app on the user's enrolled phone supplies the possession factor. Because the app is software rather than dedicated hardware, no smart card or physical token is needed, which satisfies the constraint while still delivering genuine two-factor protection.

Answer

A fingerprint scan used alone to unlock the workstation

Answer

A password combined with a security question about the user's first pet

Answer

A username and a strong password used together

Question 12

During an incident, an analyst needs to determine whether a compromised account was used to access a sensitive file share. The file server runs Windows and the organization uses centralized authentication. Which log source should the analyst review first to identify the account's access to the share?

Accepted Answer

Windows Security event logs on the file server, filtered for object access auditing events.. To establish whether a specific account accessed a sensitive file share on Windows, the file server's Security log with object access auditing enabled is the authoritative source. Event 4663 and related object access events capture the account, object path, and access type. Domain controller Kerberos events, firewall SMB logs, and antivirus logs provide authentication or network context but cannot prove file-level access by the compromised account.

Answer

Antivirus console logs showing scan results on the file server.

Answer

Domain controller Security logs filtered for Kerberos ticket-granting service events.

Answer

Firewall logs showing SMB traffic between the workstation and the file server.

Question 13

A security team wants to detect when an attacker is using a compromised account to move laterally between servers inside the network. Which monitoring approach would best surface this activity?

Accepted Answer

Analyzing internal authentication and remote-access logs for unusual source-destination pairs. Lateral movement uses stolen credentials to reach systems the account would not normally access, so the strongest signal is internal authentication and remote-access activity showing unusual source-destination pairs, off-hours logins, or one account touching many hosts. Perimeter, email, and backup monitoring address different threats and would not reveal an attacker pivoting inside the network.

Answer

Tracking the number of failed disk backups on storage systems

Answer

Monitoring outbound email volume for spikes in messages sent by users

Answer

Reviewing only the perimeter firewall's inbound connection logs

Question 14

A security analyst is reviewing network flow logs and sees periodic outbound connections from an internal server to an external IP address on TCP port 443 every 30 minutes. The connections transfer small amounts of data and the external IP resolves to a newly registered domain. The server has no business need for internet access. Which type of malicious activity is most consistent with this pattern?

Accepted Answer

A beaconing implant maintaining command-and-control communication over HTTPS.. Evenly spaced, low-volume outbound sessions to a newly registered external domain on an encrypted port are a textbook beaconing pattern. Malware uses this to check in for instructions while blending with ordinary TLS traffic. Because the server has no legitimate internet requirement, the activity cannot be dismissed as normal business traffic. The right next step is to isolate the host, capture volatile data, and hunt for the implant and its persistence mechanism.

Answer

A denial-of-service attack launched from the server against the external address.

Answer

An internal vulnerability scan probing an external host for open ports.

Answer

A misconfigured software update service contacting its vendor repository.

Question 15

During an incident investigation, an analyst needs to determine which user account created a specific file on a shared drive at a particular time. The organization enables auditing on the file server. Which Windows event log should the analyst review?

Accepted Answer

The Security log, because object access auditing records file creation events there.. Attribution of file activity requires object access auditing, which writes events to the Security log when enabled through audit policy. Those events include the account, object name, and access type, which directly answers who created the file and when. The System, Application, and Setup logs serve other purposes and do not capture user file operations, so they cannot provide the needed evidence.

Answer

The Application log, because file operations are generated by applications writing to disk.

Answer

The Setup log, because it tracks changes to files installed by administrators.

Answer

The System log, because it records all file system changes performed by services and users.