ISC2 CC Security Operations Practice Test 7 — 15 Questions

Question 1

Refer to the exhibit. A security analyst sees this log entry from a firewall. What is the most likely reason for this denial?

Accepted Answer

The destination port is not allowed. The firewall log entry indicates a packet was denied due to a policy violation, and the most common reason for such a denial in a stateful firewall is that the destination port is not permitted by the configured access control list (ACL) or security policy. Firewalls evaluate traffic against rules that specify allowed source/destination IPs, ports, and protocols; if the destination port is not explicitly allowed, the packet is dropped. This is a standard security practice to restrict unauthorized services.

Answer

The source IP is blacklisted

Answer

The access-group is misconfigured

Answer

The packet is malformed

Question 2

Refer to the exhibit. An analyst sees many alerts from this IDS rule. What is a likely cause?

Accepted Answer

The rule is poorly written generating false positives. Option D is correct because the IDS rule is likely generating excessive alerts due to poor signature design, such as using overly broad content matches or lacking proper contextual filters. Without the 'flow' keyword to establish session state (e.g., 'to_server, established'), the rule may trigger on any packet containing the SQL pattern, including non-exploit traffic like error messages or benign queries, resulting in false positives.

Answer

A web application is vulnerable to SQL injection

Answer

An attacker is scanning for SQL injection

Answer

The rule is missing the "flow" keyword

Question 3

Refer to the exhibit. What type of event is this?

Accepted Answer

Failed network login. Option C is correct because Logon Type 3 indicates a network logon (remote connection). Option A is wrong because it's a failed logon. Option B is wrong because Logon Type 3 is remote, not local (local is Type 2 or 10). Option D is wrong because there is no account lockout event.

Answer

Account lockout

Answer

Successful remote login

Answer

Failed local login

Question 4

A help desk technician receives a report that a user cannot access a shared network drive. The technician checks the file server and sees that the disk is full. What is the most immediate action the technician should take?

Accepted Answer

Free up space by deleting unnecessary files or moving data. Option B is correct because freeing up space restores access. The other options are either not immediate or do not directly address the disk full issue.

Answer

Reboot the file server

Answer

Run antivirus scan

Answer

Increase disk quota

Question 5

A security analyst is configuring an intrusion detection system (IDS) to detect SQL injection attacks. Which method is most effective?

Accepted Answer

Examine HTTP request parameters for SQL commands. Option D is correct because examining HTTP request parameters for SQL commands directly detects SQL injection attempts. The other options are unrelated or less effective.

Answer

Analyze DNS query patterns

Answer

Detect port scans from external IPs

Answer

Monitor bandwidth usage for spikes

Question 6

A company's security policy requires that all sensitive data be encrypted during transfer. A security administrator discovers that an internal web application is using a self-signed TLS certificate. What vulnerability does this introduce?

Accepted Answer

Man-in-the-middle attacks because the certificate cannot be verified. A self-signed TLS certificate is not signed by a trusted Certificate Authority (CA), so clients cannot verify the certificate's authenticity. This allows an attacker to intercept the TLS handshake, present their own self-signed certificate, and perform a man-in-the-middle (MITM) attack, decrypting and reading or modifying the data in transit.

Answer

Data corruption

Answer

Increased latency

Answer

Replay attacks because TLS is not used

Question 7

A security operations center (SOC) analyst receives an alert for a potential malware infection on a workstation. Which of the following is the first action the analyst should take?

Accepted Answer

Isolate the workstation from the network to prevent spread. When a potential malware infection is detected, the immediate priority is containment to prevent lateral movement and further compromise. Isolating the workstation from the network (e.g., disabling the network interface or disconnecting the cable) stops the malware from communicating with command-and-control servers or spreading to other hosts. This aligns with the NIST incident response framework's containment phase, which precedes eradication and recovery actions.

Answer

Reimage the workstation

Answer

Run a full antivirus scan

Answer

Notify law enforcement

Question 8

An organization implements a bring-your-own-device (BYOD) policy. Which security control is most important to enforce in the BYOD policy?

Accepted Answer

Implement mobile device management (MDM) for remote wipe and policy enforcement. Mobile device management (MDM) is the most important control for a BYOD policy because it provides centralized policy enforcement, remote wipe capabilities, and device compliance monitoring. Unlike isolated controls like passwords or encryption, MDM allows the organization to enforce security policies dynamically and revoke access or wipe corporate data if a device is lost, stolen, or non-compliant.

Answer

Require complex passwords

Answer

Install a firewall on each device

Answer

Enable full disk encryption

Question 9

During a security incident, a forensic analyst needs to acquire the contents of RAM from a live system. Which tool should be used?

Accepted Answer

Memory dump tool like DumpIt. Option A is correct because specialized memory dump tools like DumpIt are designed for live memory acquisition. Other tools are for disk or network analysis.

Answer

Disk cloning tool like dd

Answer

Network monitoring tool like Wireshark

Answer

Antivirus scanner

Question 10

A user reports that they received a suspicious email with an attachment claiming to be an invoice. What should the user do?

Accepted Answer

Report the email to the security team without opening the attachment. Option A is correct because the user should immediately report the suspicious email to the security team without opening the attachment. Opening the attachment could trigger a malicious payload, such as a macro-enabled document or executable, that exploits vulnerabilities in the email client or operating system. The security team can analyze the email headers, attachment hash, and sender domain using tools like sandboxing or threat intelligence feeds to determine if it is a phishing attempt or malware delivery.

Answer

Reply to the email and ask for confirmation

Answer

Delete the email immediately

Answer

Open the attachment to check what it contains

Question 11

An organization has a policy that all servers must have security patches applied within 30 days of release. Which of the following is the best practice for patching?

Accepted Answer

Test patches in a non-production environment before deploying to production. Option C is correct because testing patches in a non-production environment first allows the organization to identify compatibility issues, performance regressions, or conflicts with existing software before risking production systems. This aligns with the change management principle of validating changes in a controlled setting, ensuring that the 30-day patching deadline can be met without introducing instability. Skipping testing (A) or applying patches simultaneously (B) could lead to widespread outages, while only applying critical patches (D) would leave the organization exposed to non-critical vulnerabilities that could be chained in an attack.

Answer

Skip patches that have not been widely tested

Answer

Apply patches to all servers simultaneously

Answer

Only apply critical patches

Question 12

A security analyst investigates a possible data exfiltration. The analyst sees a large amount of data being sent to an external IP address at regular intervals. Which of the following is the most likely technique being used?

Accepted Answer

DNS tunneling. DNS tunneling encodes data within DNS queries and responses, allowing attackers to bypass network security controls by exfiltrating data through UDP port 53, which is often allowed through firewalls. The regular intervals of large data transfers to an external IP address are characteristic of a DNS tunnel, as the attacker segments data into multiple DNS queries to avoid detection.

Answer

SQL injection

Answer

Phishing

Answer

Man-in-the-middle

Question 13

Which THREE of the following are common components of a disaster recovery plan?

Accepted Answer

Backup procedures. Backup procedures are a core component of a disaster recovery plan (DRP) because they ensure that critical data can be restored after a disruptive event. This includes defining backup frequency, storage locations (e.g., off-site or cloud), and the specific data to be backed up. Without documented backup procedures, recovery of systems and data would be uncoordinated and unreliable.

Answer

Password policy

Answer

Employee background checks

Question 14

Which TWO of the following are types of security controls?

Accepted Answer

Corrective. Preventive and corrective controls are recognized types. The other options are not standard categories or are too broad.

Answer

Network

Answer

All of the above

Answer

None of the above

Question 15

Which THREE of the following are best practices for securing a wireless network?

Accepted Answer

Disable SSID broadcast. WPA2 encryption, disabling SSID broadcast (though not strong, often considered best practice in older materials), and using a strong passphrase are commonly recommended. MAC filtering and captive portals are not primary security controls.

Answer

Enable MAC address filtering

Answer

Implement a captive portal

ISC2 CC Security Operations Practice Test 7 — 15 Questions

Exhibit

ISC2 CC Security Operations Practice Test 7 — 15 Questions

Exhibit