ISC2 CC Security Operations Practice Test 4 — 15 Questions

Question 1

A security analyst reviews this firewall configuration. Which potential security issue exists?

Accepted Answer

Outbound traffic is not inspected for malicious content. Option B is correct because the firewall configuration shown only inspects inbound traffic (from the internet to the internal network) but does not apply any inspection to outbound traffic. Without outbound inspection, malicious content such as malware command-and-control traffic or data exfiltration can leave the network undetected. A security analyst should ensure that both inbound and outbound traffic are inspected for malicious content to provide comprehensive threat protection.

Answer

Logging is not enabled at session start

Answer

The source is too restrictive

Answer

The policy does not specify a destination

Question 2

A security analyst observes these SSH logs. What is the MOST likely attack?

Accepted Answer

Brute force attack on SSH service. Option B is correct because repeated failed login attempts from the same IP indicate a brute force attack. Option A is phishing. Option C is SSH hijacking. Option D is a DoS, but not evident.

Answer

Session hijacking via SSH

Answer

Phishing attack targeting root and admin accounts

Answer

Denial of service attack on port 22

Question 3

An AWS bucket policy is shown. What is the security implication?

Accepted Answer

The bucket allows read access to anyone from a specific IP range. The bucket policy grants the `s3:GetObject` action (read access) to all principals (`"Principal": "*"`) but only if the request originates from the specified IP range (`"IpAddress": {"aws:SourceIp": "10.0.0.0/24"}`). This means anyone on the internet can read objects, but only if their source IP falls within that CIDR block. This is a common pattern for allowing read access to a trusted network without requiring AWS credentials.

Answer

The bucket allows anonymous write access

Answer

The policy contains a syntax error

Answer

The bucket is fully public

Question 4

A security analyst notices repeated failed login attempts to a critical server from a single external IP address. Which immediate action should the analyst take?

Accepted Answer

Block the IP address at the firewall.. Blocking the IP address at the firewall is the immediate action because it stops the ongoing brute-force attack at the network perimeter without affecting the server's availability or internal operations. Firewall rules can be applied quickly using access control lists (ACLs) to deny traffic from the specific external IP, which is a standard first response to mitigate a single-source attack.

Answer

Enable two-factor authentication.

Answer

Disable the server's network interface.

Answer

Change the server's IP address.

Question 5

During a security incident, the incident response team isolates a compromised workstation from the network. What is the primary purpose of this action?

Accepted Answer

To prevent further damage.. Isolating a compromised workstation by disconnecting it from the network (e.g., disabling its switch port or unplugging the Ethernet cable) immediately stops all inbound and outbound traffic. This containment action prevents the attacker from moving laterally to other systems, exfiltrating data, or deploying additional malware, thereby limiting the scope and impact of the incident.

Answer

To comply with legal requirements.

Answer

To preserve forensic evidence.

Answer

To allow normal operations to continue.

Question 6

An organization's backup strategy includes daily full backups and hourly incremental backups. During a restoration, they discover that a critical file was corrupted 6 hours ago. Which backup set is required for the restoration?

Accepted Answer

The most recent full backup plus the incremental backups from the last 6 hours.. The correct answer is C because restoring a file that was corrupted 6 hours ago requires the most recent full backup as the base, plus all incremental backups taken in the last 6 hours. Incremental backups only store changes since the last backup (full or incremental), so to reconstruct the file as it existed 6 hours ago, you need the full backup and every incremental backup from that point forward until the corruption time. Without all those increments, the file state cannot be fully reconstructed.

Answer

The most recent incremental backup only.

Answer

The most recent full backup only.

Answer

The most recent full backup plus all incremental backups since.

Question 7

Which security control is most effective in preventing unauthorized physical access to a data center?

Accepted Answer

Mantraps.. Mantraps create a double-door system that prevents tailgating, making them highly effective. Other controls like video surveillance and guards are deterrents but less direct at preventing unauthorized entry.

Answer

Video surveillance.

Answer

Biometric door locks.

Answer

Security guards.

Question 8

A company is implementing a security information and event management (SIEM) system. Which data source is most critical for detecting an ongoing brute-force attack?

Accepted Answer

Authentication logs.. Authentication logs record successful and failed login attempts, which are directly indicative of brute-force attacks. Other logs may provide supporting information but are not as directly tied to the attack.

Answer

DNS logs.

Answer

Firewall logs.

Answer

Application logs.

Question 9

During a disaster recovery test, the recovery time objective (RTO) for a critical application is 4 hours, but the actual recovery takes 6 hours. Which of the following best describes the impact?

Accepted Answer

The application is unavailable for 2 hours longer than acceptable.. The recovery time objective (RTO) defines the maximum acceptable downtime for an application. Since the RTO is 4 hours but the actual recovery took 6 hours, the application was unavailable for 2 hours beyond the acceptable threshold, directly impacting business continuity. This is a failure to meet the RTO, not the RPO, which concerns data loss.

Answer

Data loss beyond the recovery point objective (RPO).

Answer

The recovery point objective (RPO) is not met.

Answer

No impact because RTO is only a guideline.

Question 10

An employee reports receiving a suspicious email with an attachment from an unknown sender. What is the first action the employee should take?

Accepted Answer

Report the email to the security team.. Reporting the email to the security team allows professionals to analyze and respond appropriately. Deleting the email or opening the attachment can be dangerous; forwarding may spread the threat.

Answer

Open the attachment to check its content.

Answer

Forward the email to all employees as a warning.

Answer

Delete the email immediately.

Question 11

A security operations center (SOC) analyst receives an alert for a high volume of outbound traffic from an internal server to a known malicious IP address. Which step should the analyst take next?

Accepted Answer

Isolate the server from the network.. Isolating the server stops the suspicious traffic and prevents further data exfiltration or lateral movement while the incident is investigated. Other actions are either too broad or premature.

Answer

Shut down the server.

Answer

Disregard the alert as a false positive.

Answer

Block all outbound traffic from the server.

Question 12

Which of the following is the best practice for managing cryptographic keys in a large organization?

Accepted Answer

Store keys in a centralized hardware security module (HSM) with strict access controls.. Option D is correct because a centralized Hardware Security Module (HSM) provides tamper-resistant, dedicated hardware for secure key generation, storage, and cryptographic operations. Strict access controls (e.g., role-based access, multi-factor authentication) ensure that only authorized personnel can manage keys, while the HSM prevents key extraction even if the host system is compromised. This aligns with NIST SP 800-57 guidelines for key management in large organizations.

Answer

Embed keys in application code to ensure availability.

Answer

Distribute keys to administrators via email for convenience.

Answer

Use a single key for all encryption to simplify management.

Question 13

Which TWO of the following are common indicators of a ransomware attack?

Accepted Answer

Files with .encrypted extension.. Option D is correct because ransomware commonly encrypts victim files and appends a new extension such as .encrypted to indicate the files have been locked. This extension change is a direct artifact of the encryption process performed by the ransomware payload, making it a key forensic indicator during incident response.

Answer

New user accounts created.

Answer

Elevated system performance.

Answer

Sudden decrease in network traffic.

Question 14

Which TWO of the following are essential elements of an incident response plan?

Accepted Answer

Step-by-step procedures for each incident type.. Option C is correct because an incident response plan must include step-by-step procedures for each incident type to ensure consistent, repeatable actions during a security event. These procedures guide responders through detection, containment, eradication, and recovery phases, reducing errors and response time. Without predefined steps, teams risk ad-hoc actions that can worsen the incident or miss critical containment measures.

Answer

A list of compliance standards.

Answer

Personal phone numbers of executives.

Answer

Contact information for all employees.

Question 15

Which THREE of the following are best practices for securing a remote access VPN?

Accepted Answer

Enable multi-factor authentication.. Multi-factor authentication (MFA) adds an additional layer of security beyond just a password, requiring a second factor such as a one-time code from a token or biometric. For a remote access VPN, this mitigates the risk of credential theft or brute-force attacks against the VPN gateway. Even if an attacker obtains a user's password, they cannot authenticate without the second factor, significantly reducing the likelihood of unauthorized access.

Answer

Use pre-shared keys for authentication.

Answer

Implement split tunneling by default.

ISC2 CC Security Operations Practice Test 4 — 15 Questions

Exhibit

ISC2 CC Security Operations Practice Test 4 — 15 Questions

Exhibit