ISC2 CC Security Operations Practice Test 6 — 15 Questions

Question 1

Refer to the exhibit. A security analyst sees these logs from a Linux server. Which security control should the analyst recommend to address this pattern?

Accepted Answer

Implement two-factor authentication for SSH access.. The logs show repeated failed SSH login attempts from a single IP (192.168.1.100) targeting the root account, which is a classic brute-force attack pattern. Two-factor authentication (2FA) for SSH access is the most effective control because it adds a second authentication factor (e.g., TOTP or hardware token) that an attacker cannot bypass even if they guess the password, thus neutralizing the brute-force attack regardless of the number of attempts or the account targeted.

Answer

Enable account lockout after 5 failed attempts.

Answer

Disable root login via SSH.

Answer

Block the IP address 192.168.1.100 via firewall.

Question 2

Refer to the exhibit. A firewall rule set is shown (first match applies). An analyst reviews these rules. Which of the following best describes the traffic outcome for a packet from source IP 10.0.0.1 to destination 192.168.1.1?

Accepted Answer

The packet is denied because rule 1 matches and denies it.. Rule 1 matches the source IP 10.0.0.1 (which falls within the 10.0.0.0/8 range) and the destination 192.168.1.1 (within 192.168.1.0/24), and since the action is 'deny', the packet is denied immediately. Firewalls using 'first match applies' logic stop processing as soon as a matching rule is found, so subsequent rules are never evaluated. Therefore, the correct outcome is denial.

Answer

The packet is permitted because the last rule permits any any.

Answer

The packet is permitted because rule 2 explicitly permits the traffic.

Answer

The packet is denied because there is no explicit permit for 10.0.0.0/8 to 192.168.1.0/24.

Question 3

Refer to the exhibit. An AWS IAM policy is shown. Which action is permitted by this policy?

Accepted Answer

Read objects from the bucket.. The IAM policy grants the `s3:GetObject` action, which allows reading objects from the specified S3 bucket. This action corresponds to downloading or retrieving the content of an object, making option D correct.

Answer

Upload objects to the bucket.

Answer

List all objects in the bucket.

Answer

Delete objects from the bucket.

Question 4

An organization wants to ensure that critical security events are not missed during off-hours. What is the best practice?

Accepted Answer

Configure a central SIEM with 24/7 monitoring. A central SIEM with 24/7 monitoring ensures that security events are continuously analyzed and alerted upon, even during off-hours. This is the best practice because it provides real-time correlation and escalation of critical events, preventing them from being missed. Relying on automatic responses or periodic scans lacks the human oversight needed for complex threat validation.

Answer

Rely on automatic responses

Answer

Assign on-call duties only to senior analysts

Answer

Schedule nightly scans

Question 5

During a security incident, the incident response team needs to preserve evidence. Which of the following actions should be performed first?

Accepted Answer

Capture a memory dump. Capturing a memory dump (volatile data) is the first priority because it contains critical evidence such as running processes, network connections, and encryption keys that will be lost when the system is powered off. The order of volatility dictates that volatile data must be collected before any non-volatile data, and before any actions that could alter system state.

Answer

Notify law enforcement

Answer

Power off the system

Answer

Run antivirus scan

Question 6

A company's IDS generates an alert for a potential SQL injection attack on a web application. The analyst reviews the log and sees the following: "SELECT * FROM users WHERE username = 'admin' OR 1=1 --'". Which action should the analyst take next?

Accepted Answer

Verify if the WAF blocked the attack. Option C is correct because the analyst's first priority is to determine whether the attack was actually successful or was already mitigated. A Web Application Firewall (WAF) sits in front of the web application and can inspect and block SQL injection payloads before they reach the database. By verifying the WAF logs, the analyst can confirm if the attack was blocked, which dictates the next steps—if blocked, no immediate escalation is needed; if not blocked, further investigation is required.

Answer

Submit a change request to patch the application

Answer

Conduct a forensic analysis of the database

Answer

Block the source IP immediately

Question 7

Which of the following is a primary goal of security operations?

Accepted Answer

Reduce attack surface. Reducing the attack surface is a primary goal of security operations because it minimizes the number of potential entry points an attacker can exploit. By disabling unnecessary services, applying strict access controls, and segmenting networks, the organization lowers its risk of compromise. This directly supports the core security operations objective of protecting assets and maintaining confidentiality, integrity, and availability.

Answer

Minimize user complaints

Answer

Increase network speed

Answer

Ensure compliance with marketing standards

Question 8

An organization is implementing a new logging policy. Which type of data should be excluded from logs to comply with privacy regulations?

Accepted Answer

Personal identifiable information (PII). Option C is correct because Personal Identifiable Information (PII) should be excluded from logs to comply with privacy regulations like GDPR. Options A, B, and D are typically safe to log and important for security monitoring.

Answer

System performance metrics

Answer

User authentication attempts

Answer

Network traffic patterns

Question 9

A security analyst notices that system logs are being overwritten before the retention period ends. What is the most likely cause?

Accepted Answer

Log rotation settings are misconfigured. Option B is correct because misconfigured log rotation settings can cause logs to be overwritten prematurely. Option A is wrong because insufficient disk space would cause log failure, not overwriting. Option C is wrong while possible, but less likely than configuration error. Option D is wrong because SIEM consumption does not overwrite local logs.

Answer

Malware is deleting logs

Answer

SIEM is consuming logs too quickly

Answer

Disk space is insufficient

Question 10

Which of the following is an example of a detective control?

Accepted Answer

Intrusion Detection System (IDS). Option A is correct because an Intrusion Detection System (IDS) detects and alerts on suspicious activity. Option B is a preventive control. Option C is a preventive control. Option D is a directive control.

Answer

Security awareness training

Answer

Firewall

Answer

Encryption

Question 11

During a vulnerability scan, the security team discovers a critical vulnerability on a public-facing server. According to best practices, what should the team do next?

Accepted Answer

Schedule a maintenance window. Option D is correct because, according to vulnerability management best practices, the first step after discovering a critical vulnerability is to schedule a maintenance window to apply a patch or mitigation in a controlled manner. This minimizes service disruption and allows for testing, ensuring the fix does not introduce new issues. Immediate remediation during business hours (Option B) could cause downtime or impact users, while disabling the server (Option A) is an extreme measure reserved for active exploitation with no available patch.

Answer

Disable the server

Answer

Remediate immediately during business hours

Answer

Inform all users

Question 12

An analyst is reviewing a series of failed login attempts from multiple IP addresses targeting a single user account. This pattern is indicative of what type of attack?

Accepted Answer

Password spraying. Password spraying involves an attacker attempting a small number of common passwords (e.g., 'Password123', 'Welcome1') against many user accounts, or in this case, multiple IP addresses targeting a single user account. This pattern avoids account lockout thresholds by keeping attempts per IP low, making it distinct from brute force attacks that hammer a single account with many passwords from one source.

Answer

Keylogging

Answer

Brute force

Answer

Credential stuffing

Question 13

Which two of the following are common types of security controls?

Accepted Answer

Preventative. Detective and Preventative controls are foundational security control categories. Corrective is also a category but not listed as one of the two most common; Reactive and Predictive are not standard categories.

Answer

Corrective

Answer

Predictive

Answer

Reactive

Question 14

According to the NIST incident response lifecycle, which three phases are considered the core phases?

Accepted Answer

Containment, Eradication, and Recovery. The NIST incident response lifecycle (SP 800-61) defines four phases: Preparation, Detection and Analysis, Containment Eradication and Recovery, and Post-Incident Activity. The core phases that form the active response cycle are Preparation, Detection and Analysis, and Containment Eradication and Recovery. Option B correctly lists these three as the essential operational phases, while Post-Incident Activity is a follow-up phase.

Answer

Root cause analysis

Answer

Incident declaration

Question 15

A security operations center (SOC) analyst is investigating a potential data exfiltration. Which two indicators are most likely signs of data exfiltration?

Accepted Answer

Unexpected large file transfers via FTP. Unexpected large file transfers via FTP are a classic indicator of data exfiltration because FTP is a clear-text protocol often used to move bulk data out of a network. A sudden spike in outbound FTP traffic, especially to an unfamiliar external IP, suggests an attacker is compressing and uploading stolen files. This behavior directly matches the exfiltration phase of the Cyber Kill Chain.

Answer

Large number of failed login attempts

Answer

Frequent DNS queries to known malicious domains

Answer

Multiple antivirus alerts

ISC2 CC Security Operations Practice Test 6 — 15 Questions

Exhibit

ISC2 CC Security Operations Practice Test 6 — 15 Questions

Exhibit