ISC2 CC Security Principles Practice Test 8 — 15 Questions

Question 1

A system administrator configured the sudoers file as shown. What is the primary security risk of this configuration?

Accepted Answer

It removes the password requirement for sudo, weakening authentication for privileged access. Option D is correct because '!authenticate' removes the password requirement for the admin group, which violates the principle of least privilege and authentication. It does not grant passwordless sudo for all users (A) — only the admin group. (B) is a risk, but not as severe as no password. (C) is not implied by the config. The main risk is bypassing authentication.

Answer

It enables privilege escalation for all users on the system

Answer

It logs all commands run by admin users, creating a privacy risk

Answer

It allows any user in the admin group to run commands as any user without a password

Question 2

A company's security policy requires that employees must change their passwords every 90 days and passwords must be at least 12 characters. Which security principle is being enforced?

Accepted Answer

Integrity. Option B is correct because password complexity and expiration directly support the integrity of authentication by making it harder for attackers to guess or reuse credentials. Confidentiality (A) is about secrecy, but the primary goal here is ensuring that only authorized users can access systems (integrity of access control). Availability (C) and non-repudiation (D) are not the main focus.

Answer

Availability

Answer

Non-repudiation

Answer

Confidentiality

Question 3

During a forensic investigation, it is crucial to preserve the original evidence. What is the first step the investigator should take when acquiring a hard drive?

Accepted Answer

Create a forensic image using a write blocker. Option C is correct because creating a bit-for-bit forensic image (write blocker) preserves the original evidence. Hashing (A) verifies integrity but is done after imaging. Booting (B) modifies data. Turning off (D) may be necessary but not the first acquisition step; the first step is to image with a write blocker.

Answer

Boot the drive to check for operating system errors

Answer

Turn off the computer and remove the hard drive

Answer

Calculate the hash of the original drive

Question 4

A security analyst observes the log entries on an SSH server as shown. What is the most likely type of attack in progress?

Accepted Answer

Brute-force attack. Option B is correct because repeated failed password attempts for the same account (root) from the same IP in rapid succession is characteristic of a brute-force attack. Dictionary attack (A) uses a list of common passwords, but the log does not show different passwords; it could be either, but brute-force is more general. (C) is wrong because it's not a DoS (though it might degrade performance). (D) is wrong because there is no indication of privilege escalation beyond root attempts.

Answer

Dictionary attack

Answer

Privilege escalation

Answer

Denial-of-service (DoS) attack

Question 5

You are implementing a security control to prevent unauthorized devices from connecting to the corporate wired network. Which network access control method should be used?

Accepted Answer

802.1X authentication. Option C is correct because 802.1X authentication requires devices to authenticate before gaining network access, providing port-level security. MAC filtering (A) can be bypassed by spoofing. NAC (B) is a broader concept, but 802.1X is the specific technology. VLAN segmentation (D) separates traffic but does not authenticate devices.

Answer

VLAN segmentation

Answer

MAC address filtering

Answer

Network Access Control (NAC) only

Question 6

Which TWO of the following are examples of administrative security controls?

Accepted Answer

Security policies and procedures. Options B and D are correct because security policies and security awareness training are administrative controls. Firewalls (A) are technical controls. Biometrics (C) is physical/technical. Encryption (E) is technical.

Answer

Firewall rule sets

Answer

Data encryption

Answer

Biometric access controls

Question 7

Which THREE of the following are core principles of the CIA triad?

Accepted Answer

Confidentiality. Options A, C, and D are correct: confidentiality, integrity, and availability are the three pillars. Accountability (B) and non-repudiation (E) are related but not part of the CIA triad.

Answer

Non-repudiation

Answer

Accountability

Question 8

Which TWO of the following are best practices for implementing the principle of least privilege?

Accepted Answer

Assign permissions based on the minimum necessary to perform job functions. Options B and D are correct: assign minimal permissions and regularly audit privileges. Granting all permissions (A) violates least privilege. Using a single shared admin account (C) prohibits accountability. Removing default accounts is good but not directly least privilege (E).

Answer

Grant all users full administrative rights to reduce support calls

Answer

Use a single shared administrative account for all IT staff

Answer

Remove all default accounts from systems

Question 9

A cloud security engineer reviews the following S3 bucket policy. What is the primary security risk?

Accepted Answer

The bucket is publicly readable, allowing anyone to access its contents. Option A is correct because the policy allows any anonymous user to read any object in the bucket (Principal: * without condition). Option B is wrong because write access is not granted. Option C is wrong because the risk is unauthorized read, not deletion. Option D is wrong; encryption is not addressed here.

Answer

The bucket does not have encryption enabled

Answer

The bucket policy permits deletion of objects by anyone

Answer

The bucket allows unauthorized users to write objects

Question 10

A network administrator configures the ACL on a router as shown. What is the effect of this access list?

Accepted Answer

Blocks Telnet traffic entering the interface, but allows all other traffic. Option A is correct because the ACL denies TCP traffic to port 23 (Telnet) and permits all other IP traffic. Option B is wrong because SSH is port 22. Option C is wrong because the ACL is applied inbound on Gig0/1, so it filters incoming traffic only, not outgoing. Option D is wrong because it applies to all TCP traffic, not just Telnet.

Answer

Blocks SSH traffic (port 22) from entering the interface

Answer

Blocks Telnet traffic leaving the interface, but allows all other traffic

Answer

Blocks all TCP traffic except Telnet

Question 11

A security team discovers that an internal database server is sending large amounts of data to an unknown external IP address. The server is not supposed to communicate externally. Which security control should be implemented to prevent such data exfiltration?

Accepted Answer

Configure a firewall to deny all outbound traffic from the database server except to specific authorized destinations. Option A is correct because a restrictive firewall egress rule blocks unauthorized outbound traffic. IDS (C) only detects, not prevent. DLP (B) monitors content but may not block at network level. VPN (D) would not stop exfiltration; it could even facilitate it.

Answer

Implement a VPN for all external communications

Answer

Install an intrusion detection system (IDS) on the network segment

Answer

Deploy a data loss prevention (DLP) system on the server

Question 12

A security administrator needs to ensure that a user cannot view the contents of a file but can execute it. Which access control principle should be applied?

Accepted Answer

Apply least privilege. Least privilege grants only the permissions necessary to perform a task. The user only needs execute, not read. Option C is correct because it restricts access to the minimum required. Option A (need-to-know) limits access to sensitive info but not execution. Option B (separation of duties) divides tasks among different people. Option D (defense in depth) uses multiple layers of security.

Answer

Enforce separation of duties

Answer

Use defense in depth

Answer

Implement need-to-know

Question 13

A company deploys a web application that stores user passwords using a salted hash. During a security review, an auditor recommends switching from SHA-1 to SHA-256. What is the primary security benefit of this change?

Accepted Answer

It increases collision resistance. SHA-1 is considered weak due to collision vulnerabilities, while SHA-256 is more resistant. The change improves integrity protection for stored passwords. Option B (collision resistance) is correct. Option A (encryption) is wrong because hashing is not encryption. Option C (availability) is not directly related. Option D (non-repudiation) requires digital signatures, not just hashing.

Answer

It improves system availability

Answer

It provides encryption of the passwords at rest

Answer

It enhances non-repudiation

Question 14

A security analyst discovers that an organization's firewall rule set allows all inbound traffic on TCP port 443 from any source to a single web server. Additionally, the server has a known critical vulnerability in its TLS implementation. Which principle of security architecture is most directly violated by this configuration?

Accepted Answer

Least privilege. Least privilege requires restricting access to only what is necessary. Allowing inbound from any source (0.0.0.0/0) violates least privilege because it is broader than necessary. Option B is correct. Option A (defense in depth) would be violated if no other controls exist, but the question asks the most direct violation. Option C (separation of duties) is about task division. Option D (fail-safe) is about default deny.

Answer

Defense in depth

Answer

Separation of duties

Answer

Fail-safe defaults

Question 15

A system administrator must grant a help desk technician the ability to reset user passwords but not change user roles. Which security principle does this scenario enforce?

Accepted Answer

Principle of least privilege. Least privilege ensures users have only the permissions needed. Granting password reset but not role changes limits permissions to the job function. Option A is correct. Option B (need-to-know) limits data access. Option C (accountability) tracks actions. Option D (non-repudiation) ensures actions can't be denied.

Answer

Accountability

Answer

Need-to-know

Answer

Non-repudiation

ISC2 CC Security Principles Practice Test 8 — 15 Questions

Exhibit

ISC2 CC Security Principles Practice Test 8 — 15 Questions

Exhibit