ISC2 CC Multiple Select — 50 Questions

Question 1

Which THREE are essential elements of a disaster recovery plan? (Select THREE.)

Accepted Answer

Recovery time objectives (RTOs). Recovery time objectives (RTOs) define the maximum acceptable downtime for a system or application after a disaster. They are essential because they directly drive the design of the recovery strategy, including resource allocation and technology choices, ensuring that critical services are restored within the business's tolerance for interruption.

Answer

Communication plan for employees

Answer

Business impact analysis results

Question 2

A company is developing a business continuity plan (BCP). Which TWO of the following are essential components that must be included in a BCP?

Accepted Answer

Business Impact Analysis (BIA). Option C, Business Impact Analysis (BIA), is essential because it identifies critical business functions, quantifies the operational and financial impact of their disruption, and establishes the priorities and dependencies that drive the entire BCP strategy. Option D, Recovery Time Objective (RTO), is essential because it defines the maximum acceptable downtime for each critical process, directly shaping the recovery strategies, resource allocation, and backup/replication design documented in the BCP. Options A, B, and E are supporting inputs rather than mandatory BCP components: an asset inventory and network diagram are useful technical references, and a vulnerability assessment belongs to risk assessment activities that inform, but are not part of, the core BCP structure.

Answer

Asset inventory

Answer

Vulnerability assessment

Answer

Network diagram

Question 3

Which two of the following are common methods to secure a virtual private network (VPN) connection? (Choose two.)

Accepted Answer

SSL/TLS. SSL/TLS is a common method to secure VPN connections, typically used in SSL VPNs. It operates at the transport layer (Layer 4) and provides encryption, authentication, and integrity for data transmitted over the internet, often using port 443 to bypass firewalls. This makes it ideal for remote access VPNs where clients connect via a web browser or a lightweight client.

Answer

ICMP

Answer

LDAP

Answer

SNMP

Question 4

A security team is investigating a potential ARP spoofing attack on the local network. Which two measures can effectively detect or prevent such attacks? (Choose two.)

Accepted Answer

Enable DHCP snooping with Dynamic ARP Inspection.. Option B is correct because Dynamic ARP Inspection (DAI), working together with DHCP snooping, validates ARP packets against the trusted DHCP snooping binding table and drops ARP packets with spoofed IP-to-MAC mappings, directly detecting and preventing ARP spoofing on the local network. Option E is correct because configuring static ARP entries on critical servers hard-codes the legitimate IP-to-MAC mappings, so the servers ignore forged ARP replies and cannot be poisoned by an attacker on the same segment. Option A does not belong because disabling ICMP redirects only prevents hosts from accepting forged redirect messages for routing manipulation, not ARP cache poisoning. Option C does not belong because MAC address filtering on switches only restricts which MAC addresses may appear on a port and does not validate ARP payloads, so an attacker can still spoof ARP for an allowed MAC. Option D does not belong because STP BPDU guard protects against rogue switches sending spanning-tree BPDUs and has no role in detecting or preventing ARP spoofing.

Answer

Disable ICMP redirects on hosts.

Answer

Use MAC address filtering on switches.

Answer

Enable STP BPDU guard.

Question 5

Which TWO of the following are common indicators of a phishing email? (Select TWO.)

Accepted Answer

The email contains a sense of urgency, such as 'Your account will be closed.'. Phishing emails commonly exploit urgency to bypass rational decision-making. Attackers use phrases like 'Your account will be closed' to pressure recipients into clicking malicious links or providing credentials without verifying the source. This social engineering tactic is a hallmark of phishing campaigns.

Answer

The email contains an attachment with a .txt extension

Answer

The email has a high-importance flag set by the sender

Answer

The email is sent to multiple recipients in the 'To' field

Question 6

A SOC analyst is investigating an incident where an employee's workstation was compromised via a phishing email. The analyst has captured the following indicators: the email originated from a known malicious domain, the attachment was a macro-enabled document, and the macro executed a PowerShell command that downloaded a payload from a remote server. Which TWO actions should the analyst take immediately as part of the incident response process? (Choose two.)

Accepted Answer

Isolate the workstation from the network.. Option B is correct because isolating the compromised workstation from the network immediately contains the incident, preventing the PowerShell-downloaded payload from establishing C2 communication or lateral movement to other hosts. Option D is correct because blocking the known malicious domain at the email gateway stops further phishing emails from that domain reaching other employees, addressing the initial infection vector. Option A is not an immediate containment step; law enforcement notification typically occurs later per legal/organizational policy. Option C, sandboxing the macro, is useful for deeper analysis but is not an immediate containment action and can be done after isolation. Option E, deleting the email from all mailboxes, is a remediation step that may follow, but blocking the domain at the gateway is the more immediate preventive action.

Answer

Contact law enforcement immediately.

Answer

Analyze the macro code in a sandbox.

Answer

Delete the phishing email from all mailboxes.

Question 7

An organization wants to implement network segmentation to improve security. Which three methods are commonly used for network segmentation? (Select THREE.)

Accepted Answer

Subnetting. Subnetting (A) is correct because dividing a larger IP network into smaller logical subnets using CIDR and subnet masks creates distinct broadcast domains and limits lateral movement between segments. DMZs (B) are correct because a demilitarized zone places internet-facing services such as web, mail, or DNS servers in a separate screened segment, isolating them from the internal trusted network. VLANs (D) are correct because IEEE 802.1Q VLANs logically segment a switched network at Layer 2, allowing departments or device groups to be separated without physical rewiring and enforcing traffic isolation via trunk and access port configuration. Firewalls (C) are not a segmentation method themselves; they are policy enforcement devices that control traffic between segments, so they are typically deployed to secure segmentation rather than create it. Intrusion Detection Systems (E) are monitoring tools that detect malicious activity and generate alerts, but they do not divide or isolate network segments.

Answer

Firewalls

Answer

Intrusion Detection Systems

Question 8

Which THREE security mechanisms should be implemented to secure a network against ARP spoofing attacks? (Choose three.)

Accepted Answer

IP Source Guard. IP Source Guard (A) is correct because it uses DHCP snooping binding table entries to filter traffic on a per-port basis, dropping packets where the source IP address does not match the binding. This prevents an attacker from spoofing a legitimate host's IP address in ARP spoofing attacks by ensuring only valid IP-to-MAC mappings are allowed on the port.

Answer

Port security

Answer

MAC address filtering

Question 9

A security team is developing an incident response plan. Which THREE of the following are essential components of crisis communications during a data breach? (Choose three.)

Accepted Answer

Notifying affected customers. Option A (Notifying affected customers) is correct because crisis communications during a data breach must include timely, clear notification to the individuals whose personal data was compromised, enabling them to take protective steps such as changing passwords or monitoring accounts. Option C (Complying with regulatory notification requirements) is correct because laws and regulations such as GDPR, HIPAA, and state breach-notification statutes mandate specific disclosures to regulators and affected parties within defined timeframes, making compliance a core communications obligation. Option D (Informing the organization's executive management) is correct because executives need accurate, prompt situational awareness to authorize response actions, allocate resources, and serve as the organization's authoritative voice internally and externally. Option B is not correct because publicly revealing technical attack details can expose unpatched vulnerabilities, aid attackers, and jeopardize ongoing forensic investigations. Option E is not correct because deleting logs destroys evidence, violates legal hold and retention obligations, and would obstruct incident response and regulatory compliance.

Answer

Revealing technical details of the attack to the public

Answer

Deleting all logs to prevent evidence leakage

Question 10

Which of the following are core principles of information security?

Accepted Answer

Integrity. The CIA triad is the foundational model of information security, and its three core principles are Confidentiality, Integrity, and Availability. Option C (Confidentiality) is correct because it ensures data is disclosed only to authorized parties, typically enforced through encryption, access controls, and classification. Option B (Integrity) is correct because it guarantees data remains accurate, complete, and unaltered, protected via hashing, checksums, and digital signatures. Option E (Availability) is correct because it ensures systems and data are accessible to authorized users when needed, supported by redundancy, backups, and DDoS mitigation. Options A (Authentication) and D (Non-repudiation) are not core principles of the CIA triad; authentication is an access-control mechanism that verifies identity, and non-repudiation is a security service that prevents denial of an action, often achieved with digital signatures.

Answer

Authentication

Answer

Non-repudiation

Question 11

A network administrator is implementing a defense-in-depth strategy. Which THREE of the following are considered network security controls? (Select THREE)

Accepted Answer

Virtual Private Network (VPN). A Virtual Private Network (VPN) is a network security control because it creates an encrypted tunnel (using protocols such as IPsec or TLS) between a remote user and the corporate network, ensuring data confidentiality and integrity over untrusted networks like the internet. This protects data in transit and authenticates endpoints, which is a core network-layer security function.

Answer

Full disk encryption

Answer

Antivirus software

Question 12

During a ransomware incident, the incident response team needs to communicate with stakeholders. According to best practices, which TWO groups should be notified immediately? (Select TWO.)

Accepted Answer

Legal and public relations. Option B (Legal and public relations) is correct because during a ransomware incident, legal counsel must be engaged immediately to assess regulatory notification obligations (e.g., GDPR, HIPAA, SEC disclosure rules) and preserve attorney-client privilege, while public relations manages external messaging to protect the organization's reputation and prevent misinformation. Option E (Internal management) is correct because executive leadership and management must be notified right away to authorize incident response actions, allocate resources, make critical business decisions, and fulfill their governance and oversight responsibilities. Option A (Affected customers) is not an immediate notification group; customer notification typically occurs after the scope of the breach is determined and legal/regulatory guidance is obtained, often with a defined timeline. Option C (All employees) is too broad for immediate notification, as mass communication can cause panic or leaks; only those with a need to know are informed initially. Option D (Competitors) has no legitimate role in incident response notification and would only expose the organization to further risk.

Answer

Affected customers

Answer

All employees

Answer

Competitors

Question 13

A company is implementing a data classification policy. According to best practices, which THREE of the following should be classified as 'restricted' or 'top secret'? (Select THREE).

Accepted Answer

Classified government intelligence. Option B (classified government intelligence) is correctly marked restricted/top secret because it is information whose unauthorized disclosure would cause exceptional damage to national security and is legally protected at the highest classification levels. Option D (trade secrets) is correct because trade secrets are proprietary intellectual property whose disclosure would cause severe competitive and financial harm, so best-practice data classification places them in the highest sensitivity tier. Option E (biometric data of employees) is correct because biometric identifiers are sensitive personal data (often special-category data under regimes like GDPR) that cannot be changed if compromised, warranting restricted handling. The unmarked options do not belong: A (company cafeteria menu) and C (marketing brochures) are intended for public or internal distribution and carry negligible confidentiality impact, so they would be classified as public or internal, not restricted.

Answer

Company cafeteria menu

Answer

Marketing brochures

Question 14

Which TWO of the following are fundamental principles of information security that form the CIA triad?

Accepted Answer

Confidentiality. Confidentiality (A) is a core CIA triad principle because it ensures information is not disclosed to unauthorized individuals, systems, or processes, typically enforced through encryption, access controls, and classification. Integrity (B) is also a core CIA triad principle because it ensures data and systems remain accurate, complete, and protected from unauthorized modification, whether in storage or transit, using mechanisms like hashing, checksums, and digital signatures. Together with Availability, these three form the CIA triad, the foundational model for information security. Privacy (C) is a related concept concerning the appropriate handling of personal data, but it is not one of the three CIA triad principles. Non-repudiation (D) is a security property that prevents a party from denying an action, often achieved with digital signatures, but it is not part of the CIA triad. Accountability (E) supports security through auditing and traceability, but it is likewise not one of the three CIA triad pillars.

Answer

Privacy

Answer

Non-repudiation

Answer

Accountability

Question 15

Which TWO are best practices for managing backup media?

Accepted Answer

Encrypt backup data. Option A (Encrypt backup data) is correct because backups contain sensitive data at rest, and encryption protects confidentiality if media is lost, stolen, or accessed by unauthorized parties, satisfying compliance and security best practices. Option C (Store backups in a separate physical location) is correct because offsite storage ensures survivability against site-wide disasters such as fire, flood, or theft, enabling recovery even if the primary site is destroyed. Option B is wrong because keeping backups only on the same server leaves them vulnerable to the same failure, ransomware, or disaster that affects the production system. Option D is wrong because best practice is a tiered or diversified media strategy (disk, tape, cloud) based on RPO/RTO and cost, not reliance on a single media type. Option E is wrong because backups should be tested regularly — ideally after each backup cycle or at least quarterly — not just annually, since untested backups may be unusable when needed.

Answer

Keep backups on the same server for easy access

Answer

Use only tape media

Answer

Test backups annually

Question 16

Which TWO of the following are essential elements of an incident response plan?

Accepted Answer

Step-by-step procedures for each incident type.. Option C is correct because an incident response plan must include step-by-step procedures for each incident type, giving responders a documented, repeatable playbook (e.g., containment, eradication, recovery steps) so they can act quickly and consistently during an actual event. Option E is correct because defined roles and responsibilities establish who leads the response, who handles communications, who performs forensics, and who has authority to make decisions, which is essential for coordination and accountability under pressure. Options A, B, and D do not belong: a list of compliance standards is a governance/audit reference rather than a core response element, personal phone numbers of executives are too narrow and not a structural component of the plan, and contact information for all employees is an overly broad directory detail rather than an essential element of the incident response plan itself.

Answer

A list of compliance standards.

Answer

Personal phone numbers of executives.

Answer

Contact information for all employees.

Question 17

Which THREE of the following are key objectives of a security risk management program?

Accepted Answer

Assess risks. The three key objectives of a security risk management program are to identify risks (B), assess risks (A), and mitigate risks (E). Identifying risks means discovering and documenting threats, vulnerabilities, and potential adverse events that could affect the organization's assets. Assessing risks involves analyzing the likelihood and impact of those identified risks, often through qualitative or quantitative methods, to determine their severity and priority. Mitigating risks means applying controls, such as administrative, technical, or physical safeguards, to reduce risk to an acceptable level. Options C and D are not key objectives of risk management itself; implementing intrusion detection systems and encrypting all data at rest are specific security controls or countermeasures that may be selected during risk mitigation, not the overarching objectives of the program.

Answer

Implement intrusion detection systems

Answer

Encrypt all data at rest

Question 18

Which TWO of the following are examples of Type 3 authentication? (Select TWO).

Accepted Answer

Retina scan. Type 3 authentication is "something you are," i.e., biometrics based on a physical or behavioral characteristic of the user. Option B, retina scan, is correct because it authenticates by measuring the unique pattern of blood vessels in the eye's retina, a physiological biometric trait. Option C, fingerprint recognition, is correct because it verifies identity from the unique ridge patterns of a finger, another physiological biometric. The other options belong to different factors: A (one-time password token) and D (smart card) are Type 2, "something you have," while E (password) is Type 1, "something you know."

Answer

One-time password token

Answer

Smart card

Answer

Password

Question 19

An organization is implementing a new access control system. Which TWO of the following are examples of Type 3 authentication factors?

Accepted Answer

Fingerprint scan. Type 3 authentication factors are based on something you are — biometric characteristics — so option D (fingerprint scan) is correct because it verifies a unique physical trait of the user, and option E (retina scan) is correct because it measures the distinct vascular pattern of the eye's retina. Both are biometric methods that cannot easily be shared or forgotten, which is the defining property of Type 3 factors. Option A (password) is wrong because it is a Type 1 factor (something you know), and option C (PIN) is also a Type 1 factor (something you know). Option B (smart card) is wrong because it is a Type 2 factor (something you have).

Answer

Password

Answer

Smart card

Answer

Question 20

Which THREE of the following are acceptable risk treatment options according to NIST risk management framework?

Accepted Answer

Risk mitigation. Risk avoidance, mitigation, transfer, and acceptance are standard. Risk identification is a step, not treatment. Risk duplication is not a term.

Answer

Risk duplication

Answer

Risk identification