ISC2 CC Timed Practice Test 3 — 10 Questions

Question 1

A network security team is implementing a defense-in-depth strategy. Which TWO of the following controls are examples of network segmentation? (Choose two.)

Accepted Answer

Implementing firewall rules between internal zones.. Option A is correct because implementing firewall rules between internal zones is a form of network segmentation. By creating distinct security zones (e.g., inside, outside, DMZ) and applying access control lists (ACLs) or stateful firewall policies between them, traffic is restricted to only what is explicitly permitted, thereby isolating network segments and limiting lateral movement.

Answer

Deploying an intrusion detection system (IDS) on the core switch.

Answer

Placing public-facing servers in a DMZ.

Answer

Using VPN for remote access.

Question 2

A security analyst is reviewing an alert from the IDS that shows a large number of TCP SYN packets sent to a single port on multiple internal hosts from a single external IP address. The analyst suspects a reconnaissance attack. Which type of attack is this most likely?

Accepted Answer

SYN scan. This is most likely a SYN scan (option D), a reconnaissance technique where an attacker sends TCP SYN packets to a specific port on multiple hosts to determine if the port is open. A SYN scan is stealthier than a full TCP connect scan because it never completes the three-way handshake, leaving fewer logs. The IDS alert describes the hallmark behavior of a SYN scan: a single external IP targeting the same port across many internal hosts.

Answer

SYN flood

Answer

Ping sweep

Answer

Smurf attack

Question 3

A SOC analyst is investigating an incident where an employee's workstation was compromised via a phishing email. The analyst has captured the following indicators: the email originated from a known malicious domain, the attachment was a macro-enabled document, and the macro executed a PowerShell command that downloaded a payload from a remote server. Which TWO actions should the analyst take immediately as part of the incident response process? (Choose two.)

Accepted Answer

Isolate the workstation from the network.. Option B is correct because isolating the workstation from the network is a critical containment step in incident response. It immediately stops the compromised system from communicating with the attacker's command-and-control server, preventing further data exfiltration or lateral movement. This aligns with the NIST SP 800-61 containment strategy, which prioritizes stopping the spread of an incident before deeper analysis.

Answer

Contact law enforcement immediately.

Answer

Analyze the macro code in a sandbox.

Answer

Delete the phishing email from all mailboxes.

Question 4

A security team implements a policy that requires all access to sensitive data to be logged and audited. Which principle is being enforced?

Accepted Answer

Accountability. Accountability is enforced because logging and auditing create a traceable record of who accessed sensitive data and what actions they performed. This allows security teams to hold individuals responsible for their actions by correlating log entries with specific user identities, typically via authentication systems like LDAP or SAML. The policy directly supports the principle that users must be answerable for their access to protected resources.

Answer

Non-repudiation

Answer

Integrity

Answer

Least privilege

Question 5

Refer to the exhibit. A security analyst is reviewing firewall logs and notices repeated denied TCP packets from 192.0.2.10 to internal hosts. The packets are being denied by the access-group "OUTSIDE_IN". What is the most likely reason for these denials?

Accepted Answer

An external host is performing a port scan against internal systems.. The repeated denied TCP packets from 192.0.2.10 (an external IP) to multiple internal hosts indicate a port scan. The access-group 'OUTSIDE_IN' is applied to the outside interface, and the firewall is denying these packets because they match a deny ACE (access control entry) that blocks unsolicited inbound traffic. This pattern of multiple denied connections from a single external source to different internal destinations is characteristic of a reconnaissance scan, not a DoS attack or data exfiltration.

Answer

The firewall is misconfigured and blocking legitimate traffic.

Answer

An internal host has been compromised and is exfiltrating data.

Answer

An external host is launching a denial-of-service (DoS) attack.

Question 6

Which access control model uses subject and object labels to enforce access based on a security policy?

Accepted Answer

Mandatory Access Control (MAC). Mandatory Access Control (MAC) enforces access decisions based on security labels assigned to subjects (users/processes) and objects (files/resources). The system, not the user, controls access by comparing these labels against a security policy, such as Bell-LaPadula or Biba. This is why MAC is the correct answer for label-based enforcement.

Answer

Discretionary Access Control (DAC)

Answer

Attribute-Based Access Control (ABAC)

Answer

Role-Based Access Control (RBAC)

Question 7

A company's security policy mandates that all changes to the firewall configuration must be approved by two different administrators before implementation. This is an example of which security principle?

Accepted Answer

Separation of duties. Option C is correct because the requirement for two different administrators to approve firewall configuration changes enforces separation of duties. This principle ensures that no single individual has the authority to make unilateral changes, reducing the risk of unauthorized or malicious modifications. In firewall management, this prevents a single admin from bypassing security controls or introducing backdoors without oversight.

Answer

Defense in depth

Answer

Need to know

Answer

Least privilege

Question 8

Which TWO are characteristics of Role-Based Access Control (RBAC)?

Accepted Answer

Users are assigned to roles, and inherit permissions from those roles.. Option A is correct because RBAC defines roles that group specific permissions, and users are assigned to these roles. When a user is added to a role, they automatically inherit all permissions associated with that role, simplifying administration and ensuring consistent access rights across the organization.

Answer

Object owners can delegate permissions to others.

Answer

Access decisions are based on security labels.

Answer

It enforces a centralized policy that cannot be overridden by users.

Question 9

A network administrator is designing a DMZ to host a public-facing web server and a database server that should only be accessible from the web server. Which of the following firewall rule sets best achieves this design?

Accepted Answer

Allow inbound HTTP/HTTPS to web server; allow web server to database on port 3306; deny all else. Option A is correct because it implements the principle of least privilege for a DMZ: it allows inbound HTTP/HTTPS traffic (ports 80/443) to the public-facing web server, then permits only the web server to initiate outbound connections to the database server on port 3306 (MySQL/MariaDB default), and denies all other traffic. This ensures the database is not directly accessible from the internet, reducing the attack surface while still supporting the required application flow.

Answer

Allow web server to initiate outbound connections to internet; allow database to initiate connections to web server; deny all else

Answer

Allow inbound HTTP/HTTPS to web server; allow all traffic from web server to database; deny all else

Answer

Allow inbound HTTP/HTTPS to web server; allow inbound SQL from internet to database; deny all else

Question 10

A security administrator notices that an employee is able to access files in a project folder they should not have access to. Which security principle is being violated?

Accepted Answer

Least privilege. The scenario describes an employee accessing files they should not have access to, which directly violates the principle of least privilege. This principle mandates that users and processes should be granted only the minimum permissions necessary to perform their job functions. The administrator's observation indicates that the employee's access rights exceed what is required, leading to unauthorized file access.

Answer

Non-repudiation

Answer

Separation of duties

Answer

Defense in depth