ISC2 CC Hard Questions — 25 Difficult Questions

Question 1

A security auditor discovers that a user has been granted read and write access to a sensitive file, but the user's job only requires read access. Which access control principle has been violated?

Accepted Answer

Least privilege. The principle of least privilege dictates that users should be granted only the minimum permissions necessary to perform their job functions. Granting write access when only read access is required violates this principle by providing unnecessary and potentially harmful capabilities. This is a core access control concept in the CC exam.

Answer

Job rotation

Answer

Need-to-know

Answer

Separation of duties

Question 2

A company's network uses 802.1X authentication with PEAP-MSCHAPv2 on wired ports. Users report that after a recent switch firmware update, some workstations fail to authenticate intermittently, while others work fine. The authentication server logs show 'Authentication failed: Unknown CA certificate' for affected workstations. What is the most likely cause?

Accepted Answer

The switch is now using a different certificate that is not trusted by the clients. The error 'Unknown CA certificate' indicates that the client does not trust the certificate presented by the RADIUS server during PEAP-MSCHAPv2 authentication. After a switch firmware update, the switch may have been reconfigured to use a different server certificate (e.g., a self-signed or internally issued certificate) that is not in the trusted root store of the affected workstations. Since PEAP requires the client to validate the server certificate, a mismatch causes intermittent authentication failures.

Answer

The switch is not forwarding EAP packets properly due to a firmware bug

Answer

The RADIUS shared secret was changed during the firmware update

Answer

The authentication server (NPS) is overloaded and dropping requests

Question 3

During a security audit, a penetration tester captures network traffic and finds that some packets have the IP ID field set to 0 and the DF (Don't Fragment) flag set. What is this technique attempting to do?

Accepted Answer

Perform a stealth scan using a zombie host to hide the attacker's identity. Setting the IP ID field to 0 and the DF flag in packets is characteristic of an idle scan (also known as a stealth scan). This technique uses a zombie host (with an incremental IP ID) to probe a target; by sending packets with DF set and IP ID 0 to the zombie, the attacker can observe changes in the zombie's IP ID to infer open ports on the target, thereby hiding the attacker's true IP address.

Answer

Spoof the source IP address of the attacker's machine

Answer

Launch a denial-of-service attack against the target

Answer

Evade a firewall by fragmenting packets

Question 4

A SOC analyst is investigating a potential data exfiltration incident. The logs show that an internal user transferred a large volume of data to a cloud storage service using HTTPS. The analyst finds that the user's workstation has BitLocker Drive Encryption enabled, and the user has administrative privileges. Which of the following best describes the PRIMARY challenge in investigating this incident?

Accepted Answer

The user has administrative privileges, which could allow them to cover their tracks. The primary challenge is that administrative privileges allow the user to tamper with logs, disable security monitoring, or use tools to cover their tracks, making forensic reconstruction difficult. Even with BitLocker and HTTPS, the SOC can still analyze network logs and endpoint telemetry, but admin rights directly undermine the integrity of evidence on the workstation.

Answer

The volume of data transferred makes it difficult to determine what was exfiltrated

Answer

The data was transferred over HTTPS, which cannot be decrypted by the SOC

Answer

BitLocker encryption prevents access to the hard drive for forensic analysis

Question 5

A security administrator is reviewing the principles of access control. Which TWO of the following are core components of the AAA framework? (Select TWO.)

Accepted Answer

Authorization. The AAA framework consists of Authentication, Authorization, and Accounting. Authentication verifies the identity of a user or device (e.g., via RADIUS or TACACS+). Authorization determines what resources or actions the authenticated entity is permitted to access (e.g., via privilege levels or ACLs). Accounting tracks and logs user activities for auditing and billing purposes. Therefore, Authorization (A) and Authentication (D) are two of the three core components of AAA.

Answer

Identification

Answer

Non-repudiation

Answer

Auditing

Question 6

Which TWO of the following are primary objectives of an incident response plan? (Choose two.)

Accepted Answer

Return affected systems to normal operation. Option B is correct because a primary objective of an incident response plan is to return affected systems to normal operation. This involves containment, eradication, and recovery steps to restore business functions after a security incident, ensuring the organization can resume operations securely.

Answer

Ensure business continuity during the incident

Answer

Collect evidence for legal proceedings

Answer

Identify the root cause of the incident

Question 7

A SOC analyst is investigating an incident where an employee's workstation was compromised via a phishing email. The analyst has captured the following indicators: the email originated from a known malicious domain, the attachment was a macro-enabled document, and the macro executed a PowerShell command that downloaded a payload from a remote server. Which TWO actions should the analyst take immediately as part of the incident response process? (Choose two.)

Accepted Answer

Isolate the workstation from the network.. Option B is correct because isolating the workstation from the network is a critical containment step in incident response. It immediately stops the compromised system from communicating with the attacker's command-and-control server, preventing further data exfiltration or lateral movement. This aligns with the NIST SP 800-61 containment strategy, which prioritizes stopping the spread of an incident before deeper analysis.

Answer

Contact law enforcement immediately.

Answer

Analyze the macro code in a sandbox.

Answer

Delete the phishing email from all mailboxes.

Question 8

An organization is implementing a new identity management system. They want to ensure that users can only access resources necessary for their job roles. Which principle should guide the access control design?

Accepted Answer

Least privilege. The principle of least privilege dictates that users should be granted only the permissions necessary to perform their job functions and nothing more. In an identity management system, this is implemented by assigning minimal access rights to resources, reducing the attack surface and limiting potential damage from compromised accounts. This directly aligns with the scenario of ensuring users can only access resources essential for their roles.

Answer

Separation of duties

Answer

Need to know

Answer

Defense in depth

Question 9

A company is designing a new application that processes credit card payments. They want to ensure that no single administrator can bypass security controls to approve a fraudulent transaction. Which principle should be implemented?

Accepted Answer

Separation of duties. Separation of duties ensures that no single administrator has the authority to both initiate and approve a credit card transaction. By dividing critical functions among multiple individuals, the company prevents a single compromised account from authorizing fraudulent payments. This principle directly addresses the risk of insider threats or credential misuse in payment processing systems.

Answer

Defense in depth

Answer

Least privilege

Answer

Need to know

Question 10

Which THREE of the following are recognized security control types according to ISC2? (Choose three.)

Accepted Answer

Technical. Option B (Technical) is correct because ISC2 recognizes technical controls as a primary security control type, encompassing mechanisms like firewalls, encryption, and intrusion detection systems that enforce security policies through technology. These controls operate at the system or network level to protect assets directly.

Answer

Deterrent

Answer

Operational

Question 11

Refer to the exhibit. An IDS generates this alert for traffic from an internal server (10.1.1.50) to an external IP on port 443. The security team investigates and finds that the server is a web application that normally uses TLS 1.2. What does this alert most likely indicate?

Accepted Answer

An attacker is performing an SSL stripping attack, downgrading the connection to SSLv3. The alert indicates a downgrade from TLS 1.2 to SSLv3, which is the hallmark of an SSL stripping attack. In this attack, an adversary intercepts the client's TLS handshake request and forces the connection to use the weaker SSLv3 protocol, often by manipulating the ClientHello message to remove TLS options. This allows the attacker to exploit known vulnerabilities in SSLv3, such as POODLE, to decrypt or hijack the session.

Answer

The server is experiencing a buffer overflow attack

Answer

The server's certificate has expired and the client is falling back to SSLv3

Answer

The server has been misconfigured to use SSLv3 instead of TLS

Question 12

Which THREE are valid methods for authenticating a user in an access control system?

Accepted Answer

Fingerprint scan. A fingerprint scan is a valid authentication method because it falls under 'something you are' (biometric authentication). In access control systems, biometrics like fingerprint scans provide a high level of assurance by verifying a unique physical characteristic of the user, making it a strong factor for authentication.

Answer

User ID

Answer

Access control list

Question 13

Which THREE of the following are characteristics of a stateful firewall? (Select exactly three.)

Accepted Answer

It can automatically allow return traffic for outbound connections. A stateful firewall automatically allows return traffic for outbound connections because it tracks the state of each connection in a state table. When a packet from an internal host initiates an outbound TCP connection (e.g., SYN), the firewall creates an entry in the state table. When the corresponding return packet (e.g., SYN-ACK) arrives, the firewall checks the state table and permits it without needing an explicit inbound rule, as it recognizes the packet as part of an established session.

Answer

It inspects application-layer payloads

Answer

It filters packets based solely on source/destination IP and port

Question 14

An organization uses Active Directory and wants to grant a group of temporary interns access to a shared folder for exactly 30 days. Which access control approach is most efficient?

Accepted Answer

Create a security group with a time-based membership that expires automatically after 30 days.. Option B is correct because Active Directory supports time-based group membership via the `memberTimeToLive` attribute (introduced in Windows Server 2016 and later), which allows a security group to be configured so that members are automatically removed after a specified duration. This eliminates manual intervention and ensures the interns lose access exactly after 30 days without requiring password changes or calendar reminders.

Answer

Use a group managed service account with a 30-day password expiration.

Answer

Assign each intern directly to the folder permissions and set a calendar reminder to revoke.

Answer

Create a security group, add interns, and manually remove them after 30 days.

Question 15

During a security audit, it is found that a database administrator can access payroll data. The company policy states that administrators should not have access to sensitive HR data. Which security principle is being violated?

Accepted Answer

Separation of duties. The scenario describes a single database administrator having both the ability to access and modify payroll data, which combines operational and oversight roles. Separation of duties (SoD) is the principle that requires splitting critical tasks and privileges among multiple individuals to prevent fraud or error. Here, the administrator's access violates SoD because they can both manage the database and view sensitive HR data, which should require separate authorization.

Answer

Accountability

Answer

Least privilege

Answer

Privacy

Question 16

An organization is implementing a new system that processes financial transactions. To reduce the risk of fraud, they ensure that no single individual can both initiate and approve a transaction. Which security principle is this?

Accepted Answer

Separation of duties. Separation of duties (SoD) is the security principle that prevents a single individual from having conflicting responsibilities, such as both initiating and approving a financial transaction. By splitting these tasks across different roles, the organization reduces the risk of fraud or error because collusion would be required to bypass controls. This is a core internal control mechanism in financial systems and aligns with the principle of dual control.

Answer

Need to know

Answer

Accountability

Answer

Least privilege

Question 17

An analyst reviews the exhibit. What security principle is best demonstrated by this policy?

Accepted Answer

Least privilege. The policy grants users only the permissions necessary to perform their job functions, which is the core definition of least privilege. By restricting access to only required resources, the policy minimizes the attack surface and limits potential damage from compromised accounts.

Answer

Separation of duties

Answer

Defense in depth

Answer

Non-repudiation

Question 18

A SOC analyst receives an alert indicating a user executed a PowerShell script that initiated outbound connections to an external IP. The script was delivered via email attachment. Which incident response phase is MOST appropriate for containing this threat?

Accepted Answer

Eradication phase. Option B (Eradication phase) is correct because containment actions such as removing the malicious PowerShell script, terminating the outbound connections, and cleaning the affected system are part of the eradication phase. The incident response lifecycle (NIST SP 800-61) places containment, eradication, and recovery as sequential steps after identification; here, the alert has already been identified, so the most appropriate next step is to eradicate the threat by removing the script and blocking the external IP.

Answer

Identification phase

Answer

Recovery phase

Answer

Preparation phase

Question 19

Which TWO actions are appropriate during the identification phase of incident response?

Accepted Answer

Correlate alerts from multiple sources.. During the identification phase of incident response, the goal is to detect and confirm that an incident is occurring. Correlating alerts from multiple sources (e.g., IDS/IPS logs, firewall logs, and endpoint detection) helps reduce false positives and provides a clearer picture of the attack chain. Reviewing system logs for anomalies is a core detection technique that can reveal indicators of compromise (IoCs) such as unusual process execution or failed login bursts.

Answer

Conduct a post-mortem analysis.

Answer

Restore data from backups.

Answer

Disconnect affected systems from the network.

Question 20

A company's security policy requires that all incident response activities be logged and that evidence be preserved for potential legal action. During an incident, a responder mistakenly uses a personal USB drive to copy log files. Which principle of forensic evidence handling has been violated?

Accepted Answer

Chain of custody. The chain of custody is a documented record that tracks the seizure, control, transfer, analysis, and disposition of evidence. By using a personal USB drive to copy log files, the responder introduces an unverified and uncontrolled storage medium, breaking the documented chain and making it impossible to prove that the evidence was not tampered with or contaminated. This directly violates the requirement to preserve evidence for potential legal action.

Answer

Integrity

Answer

Availability

Answer

Confidentiality