ISC2 CC Timed Practice Test 5 — 10 Questions

Question 1

An organization uses Active Directory and wants to grant a group of temporary interns access to a shared folder for exactly 30 days. Which access control approach is most efficient?

Accepted Answer

Create a security group with a time-based membership that expires automatically after 30 days.. Option B is correct because Active Directory supports time-based group membership via the `memberTimeToLive` attribute (introduced in Windows Server 2016 and later), which allows a security group to be configured so that members are automatically removed after a specified duration. This eliminates manual intervention and ensures the interns lose access exactly after 30 days without requiring password changes or calendar reminders.

Answer

Use a group managed service account with a 30-day password expiration.

Answer

Assign each intern directly to the folder permissions and set a calendar reminder to revoke.

Answer

Create a security group, add interns, and manually remove them after 30 days.

Question 2

A company is designing a new authentication system for remote employees. They want to ensure that if one authentication factor is compromised, the system remains secure. Which security principle should they apply?

Accepted Answer

Defense in depth. Defense in depth is the correct principle because it involves implementing multiple layers of security controls so that if one authentication factor is compromised, other layers still protect the system. In this scenario, requiring multiple authentication factors (e.g., password plus biometric or token) ensures that a single compromised factor does not grant full access, maintaining overall system security.

Answer

Fail-safe

Answer

Least privilege

Answer

Need to know

Question 3

After a security breach, it was discovered that an attacker used a stolen certificate to sign malicious code. Which security principle was compromised?

Accepted Answer

Non-repudiation. Non-repudiation ensures that an entity cannot deny having performed an action, such as signing code. When an attacker uses a stolen certificate to sign malicious code, the legitimate owner of the certificate cannot deny the signature, because the cryptographic proof (the digital signature) is bound to the certificate. This compromises the principle of non-repudiation, as the signature can no longer be reliably attributed to the intended signer.

Answer

Integrity

Answer

Confidentiality

Answer

Availability

Question 4

A company has implemented a security information and event management (SIEM) system. The SOC team notices that the SIEM is generating a high volume of false positive alerts from a specific web application firewall (WAF). The WAF logs show many requests with SQL injection patterns, but the application is not vulnerable. Which of the following actions would BEST reduce false positives without compromising security?

Accepted Answer

Tune the WAF's detection rules based on the application's normal traffic profile. Option C is correct because tuning the WAF's detection rules to match the application's normal traffic profile reduces false positives by filtering out benign requests that resemble SQL injection patterns. This approach maintains security by still detecting actual attacks, unlike simply suppressing alerts or disabling detection. The SIEM should correlate WAF alerts with application context, but the root cause is the WAF's overly broad rules, which need refinement.

Answer

Create a SIEM rule to suppress alerts from that WAF

Answer

Increase the alert threshold in the WAF to reduce sensitivity

Answer

Disable SQL injection detection in the WAF for that application

Question 5

During a security audit, it is found that a database administrator can access payroll data. The company policy states that administrators should not have access to sensitive HR data. Which security principle is being violated?

Accepted Answer

Separation of duties. The scenario describes a single database administrator having both the ability to access and modify payroll data, which combines operational and oversight roles. Separation of duties (SoD) is the principle that requires splitting critical tasks and privileges among multiple individuals to prevent fraud or error. Here, the administrator's access violates SoD because they can both manage the database and view sensitive HR data, which should require separate authorization.

Answer

Accountability

Answer

Least privilege

Answer

Privacy

Question 6

A security engineer is configuring a firewall to allow web traffic but block all other inbound connections. The firewall is set to deny all traffic by default and only allow specific ports. Which security principle is being applied?

Accepted Answer

Default deny. The correct answer is A, Default deny. The scenario describes a firewall configured to deny all traffic by default and then explicitly allow only specific ports (e.g., TCP 80/443 for web traffic). This directly implements the default deny security principle, where any traffic not explicitly permitted is blocked. This contrasts with a default allow posture, which would permit all traffic unless explicitly denied.

Answer

Defense in depth

Answer

Fail-safe

Answer

Least privilege

Question 7

An organization is implementing a new system that processes financial transactions. To reduce the risk of fraud, they ensure that no single individual can both initiate and approve a transaction. Which security principle is this?

Accepted Answer

Separation of duties. Separation of duties (SoD) is the security principle that prevents a single individual from having conflicting responsibilities, such as both initiating and approving a financial transaction. By splitting these tasks across different roles, the organization reduces the risk of fraud or error because collusion would be required to bypass controls. This is a core internal control mechanism in financial systems and aligns with the principle of dual control.

Answer

Need to know

Answer

Accountability

Answer

Least privilege

Question 8

Which THREE of the following are examples of the principle of least privilege? (Select THREE.)

Accepted Answer

Granting a user only the permissions needed to perform their job. Option A is correct because the principle of least privilege dictates that a user should be granted only the permissions necessary to perform their job functions. This minimizes the attack surface and limits potential damage from accidental or malicious actions. In practice, this means assigning specific roles or access control lists (ACLs) rather than broad permissions.

Answer

Giving all employees full access to the file server

Answer

Assigning administrator rights to all employees by default

Question 9

During a ransomware incident, the incident response team isolates affected systems. Which of the following is the NEXT best step?

Accepted Answer

Preserve forensic evidence from the isolated systems.. After isolating affected systems during a ransomware incident, the next best step is to preserve forensic evidence from those systems. This ensures that data such as memory dumps, logs, and encrypted files are captured intact for analysis, which is critical for understanding the attack vector, identifying the ransomware variant, and potentially recovering data without paying the ransom. Forensic preservation must occur before any remediation steps like wiping or rebuilding, as those actions would destroy the evidence needed for investigation and legal proceedings.

Answer

Wipe and rebuild all affected systems.

Answer

Notify law enforcement immediately.

Answer

Pay the ransom to restore operations quickly.

Question 10

An organization's recovery time objective (RTO) for its customer database is 4 hours. During a disaster, the backup restore process takes 2 hours, but reconfigure and test tasks add another 3 hours. Which action best addresses this gap?

Accepted Answer

Automate the configuration and validation steps after restore.. The RTO is 4 hours, but the actual recovery time is 2 hours (restore) + 3 hours (reconfigure and test) = 5 hours, exceeding the RTO by 1 hour. Automating the configuration and validation steps (option D) reduces the post-restore manual effort, bringing the total recovery time closer to or within the 4-hour RTO. This directly addresses the gap without altering the RTO or neglecting testing.

Answer

Conduct the restore test only during annual disaster recovery drills.

Answer

Reduce the recovery point objective (RPO) to minimize data loss.

Answer

Increase the RTO to 6 hours.