ISC2 CC Security Operations Practice Test 5 — 15 Questions

Question 1

Refer to the exhibit. Based on the log entries, what type of attack is most likely occurring?

Accepted Answer

Dictionary attack.. The log entries show repeated failed login attempts using different usernames and passwords, which is characteristic of a dictionary attack where an attacker uses a list of common usernames and passwords to gain unauthorized access. Unlike a brute-force attack that tries all possible combinations, a dictionary attack uses a predefined list of likely credentials, making it more efficient and matching the pattern in the logs.

Answer

Brute-force attack.

Answer

Privilege escalation.

Answer

Denial of service.

Question 2

Refer to the exhibit. Given the ACL shown, which traffic is allowed to reach 10.0.0.1?

Accepted Answer

HTTP and HTTPS only.. The ACL permits TCP traffic to destination 10.0.0.1 with destination port numbers 80 (HTTP) and 443 (HTTPS). Since the ACL ends with an implicit deny any, only HTTP and HTTPS traffic is allowed to reach 10.0.0.1. Option B is correct because the ACL explicitly permits these two services.

Answer

No traffic is allowed.

Answer

Only traffic from the internal network.

Answer

All TCP traffic from any source.

Question 3

Refer to the exhibit. Based on the JSON policy, what access does the SecurityAuditor role have?

Accepted Answer

Read-only access to all objects in the critical-data bucket.. The JSON policy grants the SecurityAuditor role the `s3:GetObject` action on the `arn:aws:s3:::critical-data/*` resource, which provides read-only access to all objects in the critical-data bucket. The `Effect` is set to `Allow`, and no other actions like `s3:PutObject` or `s3:DeleteObject` are included, so the role cannot write or delete objects. This matches the correct answer B.

Answer

No access to any S3 resources.

Answer

Write access to the critical-data bucket.

Answer

Full access to the S3 bucket critical-data.

Question 4

A security analyst notices repeated failed login attempts from a single IP address targeting multiple user accounts. Which security control should be implemented to mitigate this attack?

Accepted Answer

Implement account lockout after a threshold of failed attempts.. Option A is correct because implementing an account lockout policy after a defined threshold of failed attempts (e.g., 5 failed attempts within 15 minutes) directly mitigates brute-force password guessing attacks from a single source. This control prevents an attacker from continuously trying different passwords across multiple accounts, effectively rate-limiting the attack at the authentication layer.

Answer

Enable single sign-on (SSO).

Answer

Require complex passwords.

Answer

Disable the accounts after one failed attempt.

Question 5

During a security incident, the incident response team needs to preserve evidence for potential legal action. Which of the following is the most important action to take when collecting volatile data from a compromised server?

Accepted Answer

Capture the contents of RAM.. Volatile data in RAM is lost when power is removed. Capturing RAM preserves evidence that might contain running processes, network connections, and encryption keys. Disk images are non-volatile and can be collected later.

Answer

Make a bit-for-bit copy of all storage.

Answer

Create a forensic image of the hard drive.

Answer

Review system logs.

Question 6

An organization wants to ensure that its backup strategy can recover data within 2 hours after a system failure. Which metric should be defined in the disaster recovery plan?

Accepted Answer

Recovery Time Objective (RTO). The Recovery Time Objective (RTO) defines the maximum acceptable time to restore systems and data after a disaster, directly addressing the 2-hour recovery requirement. In the context of backup strategy, RTO drives decisions on failover mechanisms, replication speed, and restoration procedures to meet the specified downtime limit.

Answer

Mean Time Between Failures (MTBF)

Answer

Recovery Point Objective (RPO)

Answer

Service Level Agreement (SLA)

Question 7

A company deploys a new intrusion detection system (IDS) on the internal network. Which of the following best describes the primary purpose of this system?

Accepted Answer

Detect and alert on potential security incidents.. An intrusion detection system (IDS) is a passive monitoring technology that analyzes network traffic or system activity for signs of malicious behavior or policy violations. Unlike an intrusion prevention system (IPS), an IDS does not take inline action to block traffic; its primary purpose is to detect suspicious activity and generate alerts for security personnel to investigate and respond.

Answer

Block malicious traffic in real time.

Answer

Encrypt sensitive data at rest.

Answer

Prevent unauthorized access to the network.

Question 8

An organization's security policy requires that all employees change their passwords every 90 days. This is an example of which type of security control?

Accepted Answer

Preventive control. Password expiration policies, such as requiring a change every 90 days, are classified as preventive controls because they proactively reduce the risk of credential compromise by limiting the window of opportunity for an attacker to use a stolen or guessed password. This control enforces a security baseline before any unauthorized access can occur, directly preventing prolonged use of compromised credentials.

Answer

Deterrent control

Answer

Detective control

Answer

Corrective control

Question 9

A security analyst reviews firewall logs and sees a series of outbound connections from an internal server to a known command-and-control (C2) IP address at regular intervals. Which step should the analyst take first according to incident response best practices?

Accepted Answer

Check if the IP address is associated with known malware or threats.. First, verify the alert is not a false positive by checking threat intelligence. Immediately isolating the server (B) might be too aggressive if it's a false positive. Terminating (C) or quarantining (D) without confirmation can cause unnecessary disruption.

Answer

Isolate the server from the network immediately.

Answer

Quarantine the server and begin forensic analysis.

Answer

Terminate the outbound connections by blocking the IP.

Question 10

Which of the following is the primary purpose of a security information and event management (SIEM) system?

Accepted Answer

Correlate and analyze log data to detect incidents.. The primary purpose of a SIEM system is to aggregate, correlate, and analyze log data from multiple sources (e.g., firewalls, servers, IDS/IPS) in real time to detect security incidents. By applying correlation rules and analytics, SIEM identifies patterns or anomalies that indicate malicious activity, enabling security teams to respond promptly.

Answer

Enforce access control policies.

Answer

Replace the need for manual log review.

Answer

Prevent malware infections.

Question 11

A company experiences a ransomware attack that encrypts all files on a critical server. The backup strategy includes nightly backups stored on a separate network. What should be the first action during recovery?

Accepted Answer

Verify the integrity and availability of the backup data.. Option C is correct because before any recovery action, you must verify that the backup data is intact, uncorrupted, and free from the ransomware. If the backup itself is encrypted or compromised, restoring it would re-infect the environment. This step aligns with the 3-2-1 backup rule and ensures the recovery point is clean.

Answer

Restore all files from the most recent backup.

Answer

Isolate the affected server from the network.

Answer

Report the incident to law enforcement.

Question 12

A security operations center (SOC) analyst is investigating an alert about a user downloading a suspicious file. The analyst opens the file on a sandboxed virtual machine and observes that it attempts to modify registry keys and establish persistence. This type of analysis is known as:

Accepted Answer

Dynamic analysis. Dynamic analysis involves executing a suspicious file in a controlled environment, such as a sandboxed virtual machine, to observe its runtime behavior. In this scenario, the analyst runs the file and directly observes registry modifications and persistence mechanisms, which are characteristic of dynamic analysis. This approach captures actual system interactions that static analysis cannot reveal.

Answer

Static analysis

Answer

Reverse engineering

Answer

Threat hunting

Question 13

Which TWO of the following are commonly used techniques to detect phishing emails? (Choose two.)

Accepted Answer

Sandboxing email attachments in a secure environment.. Sandboxing email attachments in a secure environment (Option C) is a common technique to detect phishing emails because it allows suspicious attachments to be executed and analyzed in an isolated virtual machine. This process observes the attachment's behavior for malicious activities, such as attempting to connect to a command-and-control server or dropping malware, without risking the actual endpoint. It is a core technology used in advanced email security gateways and threat intelligence platforms.

Answer

Scanning for specific file extensions.

Answer

Disabling automatic image loading.

Answer

Implementing DKIM and DMARC records.

Question 14

Which TWO of the following are examples of detective security controls? (Choose two.)

Accepted Answer

Security logging and monitoring.. Intrusion detection systems (B) and security logging and monitoring (D) are detective controls. Firewalls (A) and encryption (C) are preventive. Data backup (E) is corrective/recovery.

Answer

Data backup and restoration procedures.

Answer

Encryption of sensitive data.

Answer

Firewall rules that block certain traffic.

Question 15

Which THREE of the following are important steps in the incident response process as defined by the NIST framework? (Choose three.)

Accepted Answer

Detection and Analysis. Preparation (B), Detection & Analysis (C), and Containment, Eradication & Recovery (D) are the core phases. Vulnerability scanning (A) is part of ongoing security, not incident response. Auditing (E) is a compliance activity.

Answer

Vulnerability scanning

Answer

Post-incident auditing

ISC2 CC Security Operations Practice Test 5 — 15 Questions

Exhibit

ISC2 CC Security Operations Practice Test 5 — 15 Questions

Exhibit