ISC2 CC Multiple Select — 10 Questions

Question 1

Which TWO are true about a differential backup? (Select two.)

Accepted Answer

It requires a full backup to be restored first. A differential backup copies all files that have changed since the last full backup. Because it does not contain the complete data set, you must first restore the most recent full backup and then apply the differential backup on top of it to recover the system. This makes option B correct.

Answer

It copies files changed since the last backup of any type

Answer

It resets the archive bit on backed-up files

Answer

It is faster to restore than a full backup

Question 2

A security administrator is implementing controls to protect a server room. Which TWO physical security layers should be included as part of a defense-in-depth strategy? (Select TWO.)

Accepted Answer

Fencing around the building. Defense in depth uses multiple layers. External perimeter (fencing) and internal server room (biometric) are distinct layers.

Answer

Complex password policy

Answer

Cable locks on individual servers

Answer

Session timeout settings

Question 3

Which THREE are differences between a hot site and a cold site? (Select three.)

Accepted Answer

Hot site is more expensive to maintain. A hot site is a fully operational, mirrored environment with real-time data synchronization, pre-installed hardware, and active network connectivity, making it significantly more expensive to maintain due to ongoing costs for power, cooling, bandwidth, and dedicated staff. In contrast, a cold site is a bare facility with no active infrastructure, requiring manual setup and provisioning before recovery can begin. The higher cost of a hot site is justified by its near-zero Recovery Time Objective (RTO), whereas a cold site's lower cost reflects its much longer RTO.

Answer

Cold site has pre-installed software and applications

Answer

Both have the same recovery time objective (RTO)

Question 4

Which TWO of the following are best practices for password management in a corporate environment?

Accepted Answer

Enforce password complexity requirements.. Enforcing password complexity requirements (e.g., minimum length, character types) reduces the risk of brute-force and dictionary attacks by increasing the effective keyspace. Option E is correct because multi-factor authentication (MFA) adds an additional layer of security beyond the password, mitigating credential theft or reuse. Together, they form a defense-in-depth approach to authentication security.

Answer

Store passwords in plaintext in a shared document.

Answer

Prohibit password changes more than once per year.

Answer

Share passwords among team members for shared accounts.

Question 5

A security operations center (SOC) analyst is investigating a potential data exfiltration. Which two indicators are most likely signs of data exfiltration?

Accepted Answer

Unexpected large file transfers via FTP. Unexpected large file transfers via FTP are a classic indicator of data exfiltration because FTP is a clear-text protocol often used to move bulk data out of a network. A sudden spike in outbound FTP traffic, especially to an unfamiliar external IP, suggests an attacker is compressing and uploading stolen files. This behavior directly matches the exfiltration phase of the Cyber Kill Chain.

Answer

Large number of failed login attempts

Answer

Frequent DNS queries to known malicious domains

Answer

Multiple antivirus alerts

Question 6

A security team is investigating a potential ARP spoofing attack on the local network. Which two measures can effectively detect or prevent such attacks? (Choose two.)

Accepted Answer

Enable DHCP snooping with Dynamic ARP Inspection.. Dynamic ARP Inspection (DAI) uses DHCP snooping binding tables to validate ARP packets, ensuring that only legitimate IP-to-MAC address mappings are accepted. This directly prevents ARP spoofing by dropping malicious ARP replies that do not match the binding table. Configuring static ARP entries on critical servers hardcodes the IP-to-MAC mapping, so the server will ignore any spoofed ARP replies attempting to redirect traffic.

Answer

Disable ICMP redirects on hosts.

Answer

Use MAC address filtering on switches.

Answer

Enable STP BPDU guard.

Question 7

Which THREE of the following are essential components of an incident response plan? (Select THREE.)

Accepted Answer

Preparation. Preparation is the foundational phase of the NIST SP 800-61 incident response lifecycle, ensuring policies, tools, and trained personnel are in place before an incident occurs. Without preparation, subsequent phases like detection and containment cannot be executed effectively. The CC exam emphasizes that preparation includes establishing communication plans, acquiring forensic tools, and conducting tabletop exercises.

Answer

Business continuity plan activation

Answer

Vulnerability scanning schedule

Question 8

Which TWO of the following are examples of sensitive PII? (Select TWO.)

Accepted Answer

Medical records. Sensitive PII includes medical records and biometrics. Name and email are general PII; IP address is not PII alone.

Answer

Name

Answer

Email address

Answer

IP address

Question 9

A financial services company is conducting a Business Impact Analysis (BIA) for its online banking platform. Which THREE of the following are correctly defined metrics used in BIA?

Accepted Answer

Recovery Time Objective (RTO) – the maximum amount of time to restore a business function after a disruption.. In BIA, Recovery Time Objective (RTO) is the maximum time allowed to recover systems after a disaster, Maximum Tolerable Downtime (MTD) is the total time a business function can be unavailable before causing irreparable harm, and Recovery Point Objective (RPO) is the maximum acceptable data loss measured in time. All three are correctly defined BIA metrics. Service Level Agreement (SLA) is a contractual term, not a BIA metric. Annualized Loss Expectancy (ALE) is a risk assessment metric, not specifically part of BIA.

Answer

Service Level Agreement (SLA) – the contractual uptime percentage guaranteed to customers.

Answer

Annualized Loss Expectancy (ALE) – the expected monetary loss per year from a risk.

Question 10

Which THREE of the following are considered risk management strategies? (Select THREE)

Accepted Answer

Risk acceptance. Risk management strategies include acceptance, mitigation, transfer, and avoidance. Acceptance, mitigation, and transfer are correct.

Answer

Risk assessment

Answer

Risk analysis