ISC2 CC Quick Quiz — 10 Questions

Question 1

Which of the following is the primary purpose of a security information and event management (SIEM) system?

Accepted Answer

Correlate and analyze log data to detect incidents.. The primary purpose of a SIEM system is to aggregate, correlate, and analyze log data from multiple sources (e.g., firewalls, servers, IDS/IPS) in real time to detect security incidents. By applying correlation rules and analytics, SIEM identifies patterns or anomalies that indicate malicious activity, enabling security teams to respond promptly.

Answer

Enforce access control policies.

Answer

Replace the need for manual log review.

Answer

Prevent malware infections.

Question 2

During a security incident, the incident response team isolates a compromised workstation from the network. What is the primary purpose of this action?

Accepted Answer

To prevent further damage.. Isolating a compromised workstation by disconnecting it from the network (e.g., disabling its switch port or unplugging the Ethernet cable) immediately stops all inbound and outbound traffic. This containment action prevents the attacker from moving laterally to other systems, exfiltrating data, or deploying additional malware, thereby limiting the scope and impact of the incident.

Answer

To comply with legal requirements.

Answer

To preserve forensic evidence.

Answer

To allow normal operations to continue.

Question 3

Which THREE are essential elements of a disaster recovery plan? (Select THREE.)

Accepted Answer

Recovery time objectives (RTOs). Recovery time objectives (RTOs) define the maximum acceptable downtime for a system or application after a disaster. They are essential because they directly drive the design of the recovery strategy, including resource allocation and technology choices, ensuring that critical services are restored within the business's tolerance for interruption.

Answer

Communication plan for employees

Answer

Business impact analysis results

Question 4

Drag and drop the steps for the TCP three-way handshake into the correct order.

Accepted Answer

SYN, then SYN-ACK, then ACK. The TCP three-way handshake is a three-step process used to establish a reliable connection. The client initiates by sending a SYN (synchronize) packet to the server. The server responds with a SYN-ACK (synchronize-acknowledge) packet, acknowledging the client's request and indicating its own synchronization. Finally, the client sends an ACK (acknowledge) packet to confirm the connection establishment. This sequence ensures both sides agree on initial sequence numbers and that the connection is ready for data transfer.

Answer

SYN, then ACK, then SYN-ACK

Answer

SYN-ACK, then SYN, then ACK

Answer

ACK, then SYN, then SYN-ACK

Question 5

A small business uses a cloud file storage service that allows sharing links. An employee mistakenly shared a folder containing customer data via a public link. The business wants to prevent such incidents in the future without blocking legitimate sharing. Which access control method should they implement?

Accepted Answer

Require authentication for shared links. Requiring authentication for shared links ensures that only authorized users can access the shared content, preventing public exposure of sensitive data while still allowing legitimate sharing with specific individuals. This balances security with the need to share files externally.

Answer

Disable all external sharing

Answer

Use watermarking on documents

Answer

Encrypt all files

Question 6

A company implements a policy where a financial transaction must be initiated by one employee and approved by a different employee. This is an example of which access control concept?

Accepted Answer

Separation of duties. Separation of duties (SoD) is an access control concept that requires a critical task, such as a financial transaction, to be split into multiple steps performed by different individuals. This prevents any single employee from having the authority to both initiate and approve a transaction, thereby reducing the risk of fraud or error. In this scenario, the policy directly enforces SoD by ensuring that no one person can complete the entire process alone.

Answer

Need-to-know

Answer

Least privilege

Answer

Job rotation

Question 7

A company is developing a business continuity plan (BCP). Which TWO of the following are essential components that must be included in a BCP?

Accepted Answer

Business Impact Analysis (BIA). Option C, Business Impact Analysis (BIA), is essential because it identifies critical business functions, quantifies the operational and financial impact of their disruption, and establishes the priorities and dependencies that drive the entire BCP strategy. Option D, Recovery Time Objective (RTO), is essential because it defines the maximum acceptable downtime for each critical process, directly shaping the recovery strategies, resource allocation, and backup/replication design documented in the BCP. Options A, B, and E are supporting inputs rather than mandatory BCP components: an asset inventory and network diagram are useful technical references, and a vulnerability assessment belongs to risk assessment activities that inform, but are not part of, the core BCP structure.

Answer

Asset inventory

Answer

Vulnerability assessment

Answer

Network diagram

Question 8

A vulnerability assessment reveals that a legacy system has unpatched software. The organization decides to accept the risk because the system is isolated and has compensating controls. This decision is an example of:

Accepted Answer

Risk acceptance. Risk acceptance means the organization acknowledges the risk and chooses to retain it without taking further action, often because the cost of mitigation outweighs the potential impact or because compensating controls reduce it to an acceptable level. Here, the legacy system is isolated with compensating controls, so the organization formally accepts the residual risk.

Answer

Risk avoidance

Answer

Risk mitigation

Answer

Risk transfer

Question 9

Drag and drop the steps for the incident response process according to NIST into the correct order.

Accepted Answer

Preparation, then Detection and Analysis, then Containment/Eradication/Recovery, then Post-Incident Activity. NIST incident response lifecycle: Preparation, Detection and Analysis, Containment/Eradication/Recovery, Post-Incident Activity.

Answer

Detection and Analysis, then Containment/Eradication/Recovery, then Preparation, then Post-Incident Activity

Answer

Preparation, then Containment/Eradication/Recovery, then Detection and Analysis, then Post-Incident Activity

Answer

Post-Incident Activity, then Preparation, then Detection and Analysis, then Containment/Eradication/Recovery

Question 10

A company is implementing a data loss prevention (DLP) solution. Which strategy BEST balances security and productivity when monitoring outgoing email?

Accepted Answer

Alert on policy violations and allow user to override with manager approval. It balances security and productivity by alerting on policy violations while allowing users to override the block with manager approval. This approach ensures that legitimate business communications are not disrupted, while still enforcing DLP policies through a secondary review process. In a DLP solution, this is often implemented via a 'justify and override' workflow, where the user must provide a reason and receive approval from a manager before the email is sent.

Answer

Log all emails without any alerts

Answer

Block all emails containing keywords like 'confidential'

Answer

Encrypt all outgoing emails automatically