ISC2 CC Security Operations Practice Test 8 — 15 Questions

Question 1

Refer to the exhibit. An analyst sees these logs. What type of attack is occurring?

Accepted Answer

Brute-force attack. Option A is correct because repeated failed login attempts from the same IP indicate a brute-force attack. The other options do not match the pattern.

Answer

Phishing

Answer

SQL injection

Answer

Port scan

Question 2

Refer to the exhibit. An administrator notices that external access to the MySQL database (port 3306) is blocked, but internal access should be allowed. What change should be made?

Accepted Answer

Create a rule to allow traffic from internal IP range to port 3306. The correct answer is C because the exhibit shows a DROP rule for port 3306 in the INPUT chain, which blocks all incoming traffic to the MySQL database. To allow internal access while keeping external access blocked, a specific rule must be added to ACCEPT traffic from the internal IP range to port 3306, placed before the DROP rule. This ensures that internal packets are matched first and permitted, while external packets hit the DROP rule and are rejected. Simply modifying or removing the DROP rule would allow all traffic, violating the requirement to block external access.

Answer

Change the DROP rule to ACCEPT for port 3306

Answer

Allow port 3306 in the FORWARD chain

Answer

Remove the DROP rule for port 3306

Question 3

You are a security analyst at a medium-sized company with 500 employees. The company uses a centralized log management system that collects logs from all servers and network devices. For the past week, you have noticed a pattern: every night at 2:00 AM, a series of failed login attempts occurs on the domain controller from an internal IP address (10.10.50.100). The attempts use the username "Administrator" and are always from the same workstation in the accounting department. The accounting department operates 9 AM to 6 PM, so no one is in the office at 2 AM. You have checked the workstation's physical security; it is in a locked office with access only by authorized accounting staff. The workstation is running Windows 10 with up-to-date antivirus and has no signs of compromise. You also checked the network switch logs and see that the workstation is connected to a specific port. You suspect the workstation might be compromised or being used remotely. What is the most appropriate next step?

Accepted Answer

Perform a forensic analysis of the workstation to identify any malware or remote access tools.. Option B is correct because the pattern of failed logins at 2 AM from a locked workstation with no signs of compromise strongly suggests a remote access tool (RAT) or hidden malware that is not detected by standard antivirus. Forensic analysis of the workstation is the most appropriate next step to identify the specific malware or remote access tool, its persistence mechanism, and the attacker's entry point, which is essential before taking any remediation actions. This aligns with the incident response process of identification and analysis before containment or eradication.

Answer

Reimage the workstation with a clean OS image and reset all passwords.

Answer

Increase the password complexity requirements for the domain.

Answer

Immediately block the IP address at the firewall and disable the administrator account.

Question 4

A SOC analyst detects a series of failed login attempts from a single external IP address targeting multiple user accounts within a short time. Which action should the analyst take FIRST?

Accepted Answer

Verify if any accounts were successfully compromised.. The correct first step is to verify if any accounts were successfully compromised (Option B). In security operations, the priority is to assess the impact of an incident before taking containment actions. If an account was breached, immediate password resets and session invalidation are needed; blocking the IP prematurely could destroy forensic evidence and alert the attacker, while disabling all accounts causes unnecessary business disruption. The analyst must confirm compromise via log review (e.g., checking for successful authentication events after the failed attempts) to guide the appropriate response.

Answer

Block the IP address at the firewall immediately.

Answer

Disable all user accounts that were targeted.

Answer

Notify law enforcement about the attempted breach.

Question 5

Which of the following is a best practice for securing physical access to a data center?

Accepted Answer

Implement mantrap entry with biometric verification.. Option D is correct because mantrap entry with biometric verification provides strong physical access control. Option A weakens security by allowing personal badges. Option B does not cover all areas. Option C single-factor is insufficient.

Answer

Allow employees to use personal badges for entry.

Answer

Install CCTV only at the main entrance.

Answer

Use a single-factor authentication for all doors.

Question 6

During a forensic investigation, an analyst acquires a live system memory dump. Which tool is most appropriate for capturing the contents of volatile memory on a Windows system?

Accepted Answer

DumpIt. DumpIt is a lightweight, standalone tool designed specifically for capturing the full contents of volatile memory (RAM) on a Windows system. It creates a raw memory dump file without requiring installation or complex configuration, making it ideal for forensic acquisition of live system memory.

Answer

Wireshark

Answer

FTK Imager

Answer

dd

Question 7

An organization wants to ensure that system logs are tamper-proof after generation. Which control should be implemented?

Accepted Answer

Use a write-once read-many (WORM) storage device.. Option C is correct because WORM storage prevents modification or deletion of logs. Option A local storage is not tamper-proof. Option B compression does not prevent tampering. Option D encryption protects in transit but not at rest on the storage device.

Answer

Compress logs before archiving.

Answer

Store logs on the local hard drive of each server.

Answer

Encrypt logs during transmission.

Question 8

Which of the following is an example of a detective control in a security operations context?

Accepted Answer

Reviewing audit logs for suspicious activity.. Detective controls are designed to identify and alert on security incidents after they have occurred. Reviewing audit logs for suspicious activity is a classic detective control because it involves examining historical records to detect unauthorized access or anomalies. In contrast, preventive controls like patching, MFA, and firewall rules aim to stop incidents before they happen.

Answer

Installing a security patch to fix a vulnerability.

Answer

Requiring multi-factor authentication for remote access.

Answer

Firewall rules blocking unauthorized traffic.

Question 9

A security analyst receives an alert from the SIEM indicating a potential data exfiltration event. The alert shows a large volume of data being transferred to an external IP address during non-business hours. What is the MOST appropriate immediate action?

Accepted Answer

Verify whether the transfer is authorized.. Option D is correct because verifying the transfer's authorization prevents unnecessary disruption. Option A is too drastic without confirmation. Option B is not efficient and may tip off the user. Option C does not address exfiltration.

Answer

Call the employee who owns the server.

Answer

Disconnect the affected server from the network.

Answer

Run an antivirus scan on the server.

Question 10

An organization is implementing a patch management program. Which of the following is the BEST approach to minimize risk while maintaining operational stability?

Accepted Answer

Deploy patches to a test environment before production.. Option A is correct because testing patches in a staging environment reduces the chance of adverse impacts. Option B is risky without testing. Option C leaves many systems vulnerable. Option D ignores important security patches.

Answer

Skip patches that are not related to security.

Answer

Apply patches to all systems simultaneously.

Answer

Only patch systems that are internet-facing.

Question 11

Which TWO of the following are best practices for password management in a corporate environment?

Accepted Answer

Enforce password complexity requirements.. Option B is correct because enforcing password complexity requirements (e.g., minimum length, character types) reduces the risk of brute-force and dictionary attacks by increasing the effective keyspace. Option E is correct because multi-factor authentication (MFA) adds an additional layer of security beyond the password, mitigating credential theft or reuse. Together, they form a defense-in-depth approach to authentication security.

Answer

Store passwords in plaintext in a shared document.

Answer

Prohibit password changes more than once per year.

Answer

Share passwords among team members for shared accounts.

Question 12

Which TWO of the following are valid types of disaster recovery tests?

Accepted Answer

Tabletop exercise.. Options B and D are correct. Tabletop exercises and parallel tests are common DR test types. Option A is a simulation but not typically classified as a test type. Option C is unit testing unrelated to DR. Option E is a security assessment.

Answer

Full-scale simulation without prior notification.

Answer

Unit testing of individual applications.

Answer

Vulnerability scan.

Question 13

Which THREE of the following are essential components of a security baseline configuration for a server?

Accepted Answer

Disable unnecessary services.. Disabling unnecessary services reduces the attack surface by removing potential entry points for exploitation. Services like Telnet, FTP, or unused web servers should be disabled via systemctl or service managers to prevent unauthorized access or privilege escalation.

Answer

Install all optional software for functionality.

Answer

Grant administrative rights to all users.

Question 14

You are a SOC analyst for a financial institution. At 2:00 AM, your SIEM generates a critical alert from the email security gateway indicating that an internal user received a phishing email with a malicious attachment. The email was delivered to the user's inbox, and the user's account activity logs show that the attachment was opened 10 minutes ago. The user is a junior accountant who works in the accounts payable department. You have access to endpoint detection tools, email logs, and network traffic data. The organization's incident response policy requires containment within 30 minutes of detection. Which action should you take FIRST?

Accepted Answer

Isolate the user's workstation from the network to prevent lateral movement.. The incident response policy requires containment within 30 minutes. Isolating the workstation (e.g., via network access control or disabling the switch port) immediately stops any ongoing malicious activity, such as command-and-control communication or lateral movement, which is the highest priority after detection. This aligns with the NIST SP 800-61 containment strategy and the SANS PICERL model, where containment precedes eradication and recovery.

Answer

Scan the user's workstation with antivirus software.

Answer

Block the sender's email address at the email gateway.

Answer

Send an email to the user instructing them to delete the email.

Question 15

You are a forensic analyst responding to a reported compromise of a Linux web server. The server hosts a public-facing web application and is part of a DMZ. The initial investigation shows that unauthorized outbound connections were made to a known malicious IP address during the previous night. The server is still running and connected to the network, but the web application has been taken offline for maintenance. The incident response team wants to preserve evidence for potential legal action. You have a forensic workstation with tools like dd, netcat, and memory acquisition tools. Which of the following should be your FIRST step in the forensic acquisition process?

Accepted Answer

Capture the contents of volatile memory (RAM) using a memory acquisition tool.. Volatile memory (RAM) contains critical evidence such as running processes, network connections, encryption keys, and in-memory malware that would be lost when the system is powered off. In a forensic response, the order of volatility dictates that RAM must be captured first before any non-volatile data. Option D is correct because it follows the established forensic principle of preserving the most volatile data first.

Answer

Create a bit-for-bit copy of the hard drive using dd and a write blocker.

Answer

Capture network traffic from the server for analysis.

Answer

Run a full antivirus scan to identify malware.

ISC2 CC Security Operations Practice Test 8 — 15 Questions

Exhibit

ISC2 CC Security Operations Practice Test 8 — 15 Questions

Exhibit