ISC2 CC Multiple Select — 10 Questions

Question 1

Which THREE are essential elements of a disaster recovery plan? (Select THREE.)

Accepted Answer

Recovery time objectives (RTOs). Recovery time objectives (RTOs) define the maximum acceptable downtime for a system or application after a disaster. They are essential because they directly drive the design of the recovery strategy, including resource allocation and technology choices, ensuring that critical services are restored within the business's tolerance for interruption.

Answer

Communication plan for employees

Answer

Business impact analysis results

Question 2

A company is developing a business continuity plan (BCP). Which TWO of the following are essential components that must be included in a BCP?

Accepted Answer

Business Impact Analysis (BIA). Option C, Business Impact Analysis (BIA), is essential because it identifies critical business functions, quantifies the operational and financial impact of their disruption, and establishes the priorities and dependencies that drive the entire BCP strategy. Option D, Recovery Time Objective (RTO), is essential because it defines the maximum acceptable downtime for each critical process, directly shaping the recovery strategies, resource allocation, and backup/replication design documented in the BCP. Options A, B, and E are supporting inputs rather than mandatory BCP components: an asset inventory and network diagram are useful technical references, and a vulnerability assessment belongs to risk assessment activities that inform, but are not part of, the core BCP structure.

Answer

Asset inventory

Answer

Vulnerability assessment

Answer

Network diagram

Question 3

Which two of the following are common methods to secure a virtual private network (VPN) connection? (Choose two.)

Accepted Answer

SSL/TLS. SSL/TLS is a common method to secure VPN connections, typically used in SSL VPNs. It operates at the transport layer (Layer 4) and provides encryption, authentication, and integrity for data transmitted over the internet, often using port 443 to bypass firewalls. This makes it ideal for remote access VPNs where clients connect via a web browser or a lightweight client.

Answer

ICMP

Answer

LDAP

Answer

SNMP

Question 4

A security team is investigating a potential ARP spoofing attack on the local network. Which two measures can effectively detect or prevent such attacks? (Choose two.)

Accepted Answer

Enable DHCP snooping with Dynamic ARP Inspection.. Option B is correct because Dynamic ARP Inspection (DAI), working together with DHCP snooping, validates ARP packets against the trusted DHCP snooping binding table and drops ARP packets with spoofed IP-to-MAC mappings, directly detecting and preventing ARP spoofing on the local network. Option E is correct because configuring static ARP entries on critical servers hard-codes the legitimate IP-to-MAC mappings, so the servers ignore forged ARP replies and cannot be poisoned by an attacker on the same segment. Option A does not belong because disabling ICMP redirects only prevents hosts from accepting forged redirect messages for routing manipulation, not ARP cache poisoning. Option C does not belong because MAC address filtering on switches only restricts which MAC addresses may appear on a port and does not validate ARP payloads, so an attacker can still spoof ARP for an allowed MAC. Option D does not belong because STP BPDU guard protects against rogue switches sending spanning-tree BPDUs and has no role in detecting or preventing ARP spoofing.

Answer

Disable ICMP redirects on hosts.

Answer

Use MAC address filtering on switches.

Answer

Enable STP BPDU guard.

Question 5

Which TWO of the following are common indicators of a phishing email? (Select TWO.)

Accepted Answer

The email contains a sense of urgency, such as 'Your account will be closed.'. Phishing emails commonly exploit urgency to bypass rational decision-making. Attackers use phrases like 'Your account will be closed' to pressure recipients into clicking malicious links or providing credentials without verifying the source. This social engineering tactic is a hallmark of phishing campaigns.

Answer

The email contains an attachment with a .txt extension

Answer

The email has a high-importance flag set by the sender

Answer

The email is sent to multiple recipients in the 'To' field

Question 6

A SOC analyst is investigating an incident where an employee's workstation was compromised via a phishing email. The analyst has captured the following indicators: the email originated from a known malicious domain, the attachment was a macro-enabled document, and the macro executed a PowerShell command that downloaded a payload from a remote server. Which TWO actions should the analyst take immediately as part of the incident response process? (Choose two.)

Accepted Answer

Isolate the workstation from the network.. Option B is correct because isolating the compromised workstation from the network immediately contains the incident, preventing the PowerShell-downloaded payload from establishing C2 communication or lateral movement to other hosts. Option D is correct because blocking the known malicious domain at the email gateway stops further phishing emails from that domain reaching other employees, addressing the initial infection vector. Option A is not an immediate containment step; law enforcement notification typically occurs later per legal/organizational policy. Option C, sandboxing the macro, is useful for deeper analysis but is not an immediate containment action and can be done after isolation. Option E, deleting the email from all mailboxes, is a remediation step that may follow, but blocking the domain at the gateway is the more immediate preventive action.

Answer

Contact law enforcement immediately.

Answer

Analyze the macro code in a sandbox.

Answer

Delete the phishing email from all mailboxes.

Question 7

An organization wants to implement network segmentation to improve security. Which three methods are commonly used for network segmentation? (Select THREE.)

Accepted Answer

Subnetting. Subnetting (A) is correct because dividing a larger IP network into smaller logical subnets using CIDR and subnet masks creates distinct broadcast domains and limits lateral movement between segments. DMZs (B) are correct because a demilitarized zone places internet-facing services such as web, mail, or DNS servers in a separate screened segment, isolating them from the internal trusted network. VLANs (D) are correct because IEEE 802.1Q VLANs logically segment a switched network at Layer 2, allowing departments or device groups to be separated without physical rewiring and enforcing traffic isolation via trunk and access port configuration. Firewalls (C) are not a segmentation method themselves; they are policy enforcement devices that control traffic between segments, so they are typically deployed to secure segmentation rather than create it. Intrusion Detection Systems (E) are monitoring tools that detect malicious activity and generate alerts, but they do not divide or isolate network segments.

Answer

Firewalls

Answer

Intrusion Detection Systems

Question 8

Which THREE security mechanisms should be implemented to secure a network against ARP spoofing attacks? (Choose three.)

Accepted Answer

IP Source Guard. IP Source Guard (A) is correct because it uses DHCP snooping binding table entries to filter traffic on a per-port basis, dropping packets where the source IP address does not match the binding. This prevents an attacker from spoofing a legitimate host's IP address in ARP spoofing attacks by ensuring only valid IP-to-MAC mappings are allowed on the port.

Answer

Port security

Answer

MAC address filtering

Question 9

A security team is developing an incident response plan. Which THREE of the following are essential components of crisis communications during a data breach? (Choose three.)

Accepted Answer

Notifying affected customers. Option A (Notifying affected customers) is correct because crisis communications during a data breach must include timely, clear notification to the individuals whose personal data was compromised, enabling them to take protective steps such as changing passwords or monitoring accounts. Option C (Complying with regulatory notification requirements) is correct because laws and regulations such as GDPR, HIPAA, and state breach-notification statutes mandate specific disclosures to regulators and affected parties within defined timeframes, making compliance a core communications obligation. Option D (Informing the organization's executive management) is correct because executives need accurate, prompt situational awareness to authorize response actions, allocate resources, and serve as the organization's authoritative voice internally and externally. Option B is not correct because publicly revealing technical attack details can expose unpatched vulnerabilities, aid attackers, and jeopardize ongoing forensic investigations. Option E is not correct because deleting logs destroys evidence, violates legal hold and retention obligations, and would obstruct incident response and regulatory compliance.

Answer

Revealing technical details of the attack to the public

Answer

Deleting all logs to prevent evidence leakage

Question 10

Which of the following are core principles of information security?

Accepted Answer

Integrity. The CIA triad is the foundational model of information security, and its three core principles are Confidentiality, Integrity, and Availability. Option C (Confidentiality) is correct because it ensures data is disclosed only to authorized parties, typically enforced through encryption, access controls, and classification. Option B (Integrity) is correct because it guarantees data remains accurate, complete, and unaltered, protected via hashing, checksums, and digital signatures. Option E (Availability) is correct because it ensures systems and data are accessible to authorized users when needed, supported by redundancy, backups, and DDoS mitigation. Options A (Authentication) and D (Non-repudiation) are not core principles of the CIA triad; authentication is an access-control mechanism that verifies identity, and non-repudiation is a security service that prevents denial of an action, often achieved with digital signatures.

Answer

Authentication

Answer

Non-repudiation