ISC2 CC Multiple Select — 50 Questions

Question 1

Which TWO are true about a differential backup? (Select two.)

Accepted Answer

It requires a full backup to be restored first. A differential backup copies all files that have changed since the last full backup. Because it does not contain the complete data set, you must first restore the most recent full backup and then apply the differential backup on top of it to recover the system. This makes option B correct.

Answer

It copies files changed since the last backup of any type

Answer

It resets the archive bit on backed-up files

Answer

It is faster to restore than a full backup

Question 2

A security administrator is implementing controls to protect a server room. Which TWO physical security layers should be included as part of a defense-in-depth strategy? (Select TWO.)

Accepted Answer

Fencing around the building. Defense in depth uses multiple layers. External perimeter (fencing) and internal server room (biometric) are distinct layers.

Answer

Complex password policy

Answer

Cable locks on individual servers

Answer

Session timeout settings

Question 3

Which THREE are differences between a hot site and a cold site? (Select three.)

Accepted Answer

Hot site is more expensive to maintain. A hot site is a fully operational, mirrored environment with real-time data synchronization, pre-installed hardware, and active network connectivity, making it significantly more expensive to maintain due to ongoing costs for power, cooling, bandwidth, and dedicated staff. In contrast, a cold site is a bare facility with no active infrastructure, requiring manual setup and provisioning before recovery can begin. The higher cost of a hot site is justified by its near-zero Recovery Time Objective (RTO), whereas a cold site's lower cost reflects its much longer RTO.

Answer

Cold site has pre-installed software and applications

Answer

Both have the same recovery time objective (RTO)

Question 4

Which TWO of the following are best practices for password management in a corporate environment?

Accepted Answer

Enforce password complexity requirements.. Enforcing password complexity requirements (e.g., minimum length, character types) reduces the risk of brute-force and dictionary attacks by increasing the effective keyspace. Option E is correct because multi-factor authentication (MFA) adds an additional layer of security beyond the password, mitigating credential theft or reuse. Together, they form a defense-in-depth approach to authentication security.

Answer

Store passwords in plaintext in a shared document.

Answer

Prohibit password changes more than once per year.

Answer

Share passwords among team members for shared accounts.

Question 5

A security operations center (SOC) analyst is investigating a potential data exfiltration. Which two indicators are most likely signs of data exfiltration?

Accepted Answer

Unexpected large file transfers via FTP. Unexpected large file transfers via FTP are a classic indicator of data exfiltration because FTP is a clear-text protocol often used to move bulk data out of a network. A sudden spike in outbound FTP traffic, especially to an unfamiliar external IP, suggests an attacker is compressing and uploading stolen files. This behavior directly matches the exfiltration phase of the Cyber Kill Chain.

Answer

Large number of failed login attempts

Answer

Frequent DNS queries to known malicious domains

Answer

Multiple antivirus alerts

Question 6

A security team is investigating a potential ARP spoofing attack on the local network. Which two measures can effectively detect or prevent such attacks? (Choose two.)

Accepted Answer

Enable DHCP snooping with Dynamic ARP Inspection.. Dynamic ARP Inspection (DAI) uses DHCP snooping binding tables to validate ARP packets, ensuring that only legitimate IP-to-MAC address mappings are accepted. This directly prevents ARP spoofing by dropping malicious ARP replies that do not match the binding table. Configuring static ARP entries on critical servers hardcodes the IP-to-MAC mapping, so the server will ignore any spoofed ARP replies attempting to redirect traffic.

Answer

Disable ICMP redirects on hosts.

Answer

Use MAC address filtering on switches.

Answer

Enable STP BPDU guard.

Question 7

Which THREE of the following are essential components of an incident response plan? (Select THREE.)

Accepted Answer

Preparation. Preparation is the foundational phase of the NIST SP 800-61 incident response lifecycle, ensuring policies, tools, and trained personnel are in place before an incident occurs. Without preparation, subsequent phases like detection and containment cannot be executed effectively. The CC exam emphasizes that preparation includes establishing communication plans, acquiring forensic tools, and conducting tabletop exercises.

Answer

Business continuity plan activation

Answer

Vulnerability scanning schedule

Question 8

Which TWO of the following are examples of sensitive PII? (Select TWO.)

Accepted Answer

Medical records. Sensitive PII includes medical records and biometrics. Name and email are general PII; IP address is not PII alone.

Answer

Name

Answer

Email address

Answer

IP address

Question 9

A financial services company is conducting a Business Impact Analysis (BIA) for its online banking platform. Which THREE of the following are correctly defined metrics used in BIA?

Accepted Answer

Recovery Time Objective (RTO) – the maximum amount of time to restore a business function after a disruption.. In BIA, Recovery Time Objective (RTO) is the maximum time allowed to recover systems after a disaster, Maximum Tolerable Downtime (MTD) is the total time a business function can be unavailable before causing irreparable harm, and Recovery Point Objective (RPO) is the maximum acceptable data loss measured in time. All three are correctly defined BIA metrics. Service Level Agreement (SLA) is a contractual term, not a BIA metric. Annualized Loss Expectancy (ALE) is a risk assessment metric, not specifically part of BIA.

Answer

Service Level Agreement (SLA) – the contractual uptime percentage guaranteed to customers.

Answer

Annualized Loss Expectancy (ALE) – the expected monetary loss per year from a risk.

Question 10

Which THREE of the following are considered risk management strategies? (Select THREE)

Accepted Answer

Risk acceptance. Risk management strategies include acceptance, mitigation, transfer, and avoidance. Acceptance, mitigation, and transfer are correct.

Answer

Risk assessment

Answer

Risk analysis

Question 11

After a major power outage, an organization needs to declare a disaster and activate its DRP. Which THREE elements should be included in the initial crisis communication?

Accepted Answer

A statement that a disaster has been declared. Initial communication should confirm the disaster, provide initial instructions, and outline next steps without revealing sensitive details.

Answer

Details of the vulnerability exploited

Answer

Names of affected customers

Question 12

A security analyst is reviewing data handling procedures. Which THREE of the following are considered sensitive PII?

Accepted Answer

Financial account numbers. Sensitive PII includes medical records, financial account numbers, and biometric data. Name and phone number are general PII.

Answer

Phone number

Answer

Name and email address

Question 13

A network security team is implementing a defense-in-depth strategy. Which TWO of the following controls are examples of network segmentation? (Choose two.)

Accepted Answer

Implementing firewall rules between internal zones.. Implementing firewall rules between internal zones is a form of network segmentation. By creating distinct security zones (e.g., inside, outside, DMZ) and applying access control lists (ACLs) or stateful firewall policies between them, traffic is restricted to only what is explicitly permitted, thereby isolating network segments and limiting lateral movement.

Answer

Deploying an intrusion detection system (IDS) on the core switch.

Answer

Placing public-facing servers in a DMZ.

Answer

Using VPN for remote access.

Question 14

Which TWO of the following are common indicators of a phishing email? (Select TWO.)

Accepted Answer

The email contains a sense of urgency, such as 'Your account will be closed.'. Phishing emails commonly exploit urgency to bypass rational decision-making. Attackers use phrases like 'Your account will be closed' to pressure recipients into clicking malicious links or providing credentials without verifying the source. This social engineering tactic is a hallmark of phishing campaigns.

Answer

The email contains an attachment with a .txt extension

Answer

The email has a high-importance flag set by the sender

Answer

The email is sent to multiple recipients in the 'To' field

Question 15

Which THREE elements are essential components of a business continuity plan (BCP)?

Accepted Answer

Data backup schedules and procedures. Data backup schedules and procedures are essential because they ensure that critical data can be restored after a disruption. A BCP must specify the frequency of backups (e.g., daily incremental, weekly full), the retention policy, and the recovery point objective (RPO) to meet business requirements. Without defined schedules and procedures, data loss or corruption could render the recovery process ineffective.

Answer

Incident response team roster

Answer

Detailed network topology diagrams

Question 16

A security team is analyzing network segmentation strategies. Which THREE of the following are benefits of using VLANs for network segmentation?

Accepted Answer

They allow logical grouping of users regardless of physical location. VLANs provide logical separation, improve security, reduce broadcast domain size, and allow flexible grouping without physical rewiring.

Answer

They eliminate the need for IP addressing

Answer

They increase the collision domain size

Question 17

Which THREE security mechanisms should be implemented to secure a network against ARP spoofing attacks? (Choose three.)

Accepted Answer

IP Source Guard. IP Source Guard (A) is correct because it uses DHCP snooping binding table entries to filter traffic on a per-port basis, dropping packets where the source IP address does not match the binding. This prevents an attacker from spoofing a legitimate host's IP address in ARP spoofing attacks by ensuring only valid IP-to-MAC mappings are allowed on the port.

Answer

Port security

Answer

MAC address filtering

Question 18

Which TWO of the following are commonly used techniques to detect phishing emails? (Choose two.)

Accepted Answer

Sandboxing email attachments in a secure environment.. Sandboxing email attachments in a secure environment (Option C) is a common technique to detect phishing emails because it allows suspicious attachments to be executed and analyzed in an isolated virtual machine. This process observes the attachment's behavior for malicious activities, such as attempting to connect to a command-and-control server or dropping malware, without risking the actual endpoint. It is a core technology used in advanced email security gateways and threat intelligence platforms.

Answer

Scanning for specific file extensions.

Answer

Disabling automatic image loading.

Answer

Implementing DKIM and DMARC records.

Question 19

Which TWO of the following are examples of integrity controls? (Select TWO)

Accepted Answer

Digital signatures. Hashing and digital signatures are integrity controls that verify data has not been altered.

Answer

Redundancy

Answer

Firewalls

Answer

Encryption

Question 20

Which two protocols operate at the Transport layer of the OSI model? (Choose TWO.)

Accepted Answer

TCP. TCP and UDP are the primary Transport layer protocols. IP is Network layer, Ethernet is Data Link, and HTTP is Application layer.

Answer

HTTP

Answer

IP

Answer

Ethernet