ISC2 Certified in Cybersecurity CC (CC) — Questions 1–75

Confidentiality is a core principle of the CIA triad, ensuring that data is accessible only to authorized entities. This is typically enforced through encryption (e.g., AES-256) and access control mechanisms, preventing unauthorized disclosure.

The principle of least privilege dictates that users and systems should be granted only the minimum permissions necessary to perform their tasks. By restricting data access to job-required information, the company directly implements this security control, reducing the attack surface and limiting potential damage from compromised accounts.

A Web Application Firewall (WAF) is specifically designed to protect web applications by inspecting HTTP/HTTPS traffic and applying rules like OWASP.

Regular permission reviews are essential to maintaining least privilege over time. Users' roles and responsibilities change, and without periodic audits, excessive permissions can accumulate, violating the principle. This aligns with the NIST SP 800-53 AC-6 control for least privilege, which requires organizations to review user access rights at defined intervals.

Differential backups copy all changes since the last full backup, making them medium-sized and faster to restore than incremental, but slower to back up than incremental.

Visitor management controls physical access and ensures visitors are monitored.

Network isolation (segmentation) limits the system's exposure to potential attackers. A WAF can protect web-facing systems, but isolation is broader.

Least privilege means granting only the minimum permissions needed, reducing the blast radius of account compromise.

Risk mitigation applies controls to reduce risk.

The exhibit shows repeated authentication attempts with different passwords for the same username, which is the hallmark of a brute-force attack. In authentication logs, a high frequency of failed login attempts (e.g., multiple 'Failed password' entries in quick succession) indicates an attacker systematically guessing credentials. This aligns with the CC domain of Access Controls, where brute-force attacks target weak password policies.

The first step is to investigate the cause of the drift, as it may indicate a misconfiguration or compromise.

The exhibit shows a backup verification failure where the checksum or hash of the source file does not match the backup copy. This typically occurs when the source file is modified during the backup process (e.g., an open file that is being written to), causing the verification algorithm to detect a mismatch. The correct answer is A because the backup software correctly identifies that the source changed, not that the backup medium or file is corrupt.

Confidential data typically requires encryption and strict access controls. Public posting would be inappropriate.

Redundancy ensures that systems remain available despite failures, directly supporting availability.

Digital signatures provide integrity by allowing verification that data has not been modified and confirming the source.

This is most likely a SYN scan (option D), a reconnaissance technique where an attacker sends TCP SYN packets to a specific port on multiple hosts to determine if the port is open. A SYN scan is stealthier than a full TCP connect scan because it never completes the three-way handshake, leaving fewer logs. The IDS alert describes the hallmark behavior of a SYN scan: a single external IP targeting the same port across many internal hosts.

Digital signatures provide integrity (detect tampering) and non-repudiation (proof of origin).

A Business Impact Analysis (BIA) identifies critical functions, dependencies, and recovery priorities, forming the foundation for the BCP.

A Network-based Intrusion Detection System (NIDS) passively monitors network traffic and generates alerts when suspicious patterns are detected, but it does not take any inline action to block traffic. This makes it the correct choice for an organization that wants to detect and alert on potential intrusions without any risk of blocking legitimate traffic, as the NIDS operates out-of-band and cannot drop packets.

Capturing a memory dump (volatile data) is the first priority because it contains critical evidence such as running processes, network connections, and encryption keys that will be lost when the system is powered off. The order of volatility dictates that volatile data must be collected before any non-volatile data, and before any actions that could alter system state.

Tier 2 analysts conduct deeper investigation to determine the scope and impact of a confirmed incident before initiating response actions.

Password complexity requirements are administrative access controls because they are defined in security policies and enforced through user behavior and organizational rules, not through hardware or software mechanisms. They fall under the administrative category of access control, which includes policies, procedures, and guidelines that govern user actions and access rights.

NIST SP 800-63 recommends checking passwords against breached lists, setting minimum length (8+ characters, 15+ for high assurance), and avoiding frequent forced changes unless compromised.

This is a social engineering attack, specifically phishing (or business email compromise), aiming to trick the employee into transferring money.

Work Recovery Time (WRT) is the time needed to return to normal operations after systems are restored; it is separate from RTO.

A centralized Hardware Security Module (HSM) provides tamper-resistant, dedicated hardware for secure key generation, storage, and cryptographic operations. Strict access controls (e.g., role-based access, multi-factor authentication) ensure that only authorized personnel can manage keys, while the HSM prevents key extraction even if the host system is compromised. This aligns with NIST SP 800-57 guidelines for key management in large organizations.

The principle of least privilege dictates that users should be granted only the minimum permissions necessary to perform their job functions. Granting write access when only read access is required violates this principle by providing unnecessary and potentially harmful capabilities. This is a core access control concept in the CC exam.

Internal management and legal/PR need to be informed early to coordinate response and manage communications.

The Recovery Time Objective (RTO) defines the maximum acceptable time that a system or application can be unavailable after a disruption. In this scenario, the requirement to restore critical systems within 2 hours directly specifies the RTO. It is a key metric in business continuity planning that drives the design of failover and recovery strategies.

NIST SP 800-63 emphasizes password length over complexity and discourages frequent mandatory changes.

In a typical Windows environment, file permissions are managed using Discretionary Access Control (DAC), where the owner of a resource (e.g., a file or folder) can grant or deny access to other users or groups. This is implemented via NTFS permissions, which allow the owner to set ACLs (Access Control Lists) on objects, giving them discretion over who can read, write, or execute. Windows does not enforce a system-wide policy beyond the owner's decisions, which is the hallmark of DAC.

Security guards are a physical access control because they provide a human barrier to unauthorized entry, monitoring and challenging individuals who attempt to access restricted areas. They enforce physical security policies through observation, verification, and intervention, making them a classic example of a deterrent and preventive physical control.

Incremental backups capture only changes since the last backup (full or incremental), saving time and space, but restoration requires all incrementals since the last full backup.

High volume of traffic from many sources and increased latency are signs of DDoS.

Session timeouts are logical access controls that reduce risk of unauthorized access from unattended workstations.

Account lockout disables an account after a threshold of failed attempts, thwarting brute force attacks.

A Web Application Firewall (WAF) specifically inspects HTTP/HTTPS traffic and can block attacks like SQL injection and XSS.

A SYN flood sends many SYN packets to exhaust server resources by leaving half-open connections.

Collisions occur at the Data Link layer (Layer 2) where frames are transmitted over shared media. Hubs and CSMA/CD operate at this layer.

Defense in depth is a fundamental security principle that implements multiple layers of security controls (e.g., firewalls, IDS/IPS, encryption, access controls) so that if one layer fails, others still provide protection. This layered approach ensures no single point of failure can compromise the entire system, aligning with the CC exam's emphasis on holistic security strategies.

Defense in depth uses multiple overlapping controls. These three represent different layers.

Need-to-know restricts access to data only when necessary for job tasks, separate from least privilege which focuses on permissions.

The scenario describes unauthorized access to sensitive files from an unknown IP address outside normal hours, which directly violates the principle of confidentiality. Confidentiality ensures that data is accessible only to authorized users and systems, and this breach indicates that sensitive information may have been exposed to an unauthorized party.

Risk is the probability that a threat exploits a vulnerability, causing harm.

VLANs provide logical separation, improve security, reduce broadcast domain size, and allow flexible grouping without physical rewiring.

It decouples the web servers from the database IP address by introducing a load balancer or proxy with a virtual IP (VIP). During failover, the VIP is simply moved to the DR database, and the web servers continue connecting to the same VIP without any DNS dependency or cache refresh issues. This eliminates the problem of stale DNS caches and ensures minimal disruption, as the connection endpoint remains constant.

Tier 1 analysts are responsible for monitoring alerts and performing initial triage to determine if further investigation is needed.

The exhibit shows an access control list (ACL) that explicitly denies ICMP traffic with the entry 'deny icmp any any' and then permits all other IP traffic with 'permit ip any any'. Since ACLs are processed sequentially and the 'permit ip any any' matches all IP protocols (including HTTP, HTTPS, etc.) except those already denied, the result is that all IP traffic is permitted except ICMP. This makes option A correct.

Account lockout mitigates brute-force password guessing attacks.

A vulnerability is a weakness that can be exploited by a threat to cause harm.

In 802.1X, the authentication server (typically a RADIUS server) is the component that validates user credentials against an identity store such as LDAP, Active Directory, or a local database. The supplicant (client) provides credentials, the authenticator (switch or access point) relays EAP frames, but only the RADIUS server performs the actual authentication decision.

Confidentiality ensures that data is not disclosed to unauthorized individuals, systems, or processes.

The immediate priority is to eliminate the critical vulnerability by restricting inbound SSH access to only authorized management IPs. This aligns with the principle of least privilege and the immediate remediation steps in security incident response, as leaving the misconfiguration active even briefly exposes the servers to potential compromise.

Unusual outbound network traffic (e.g., data exfiltration) and unauthorized access attempts are typical signs of a breach.

Smart cards are physical devices that a user possesses, making them Type 2 (possession) authentication.

Restricted or top secret classification is used for information that could cause exceptionally grave damage to the organization or nation if disclosed.

Hashing and digital signatures are integrity controls that verify data has not been altered.

PCI DSS requires a minimum of 12 months retention with at least 3 months immediately available for analysis.

Examining HTTP request parameters for SQL commands directly detects SQL injection attempts. The other options are unrelated or less effective.

Combining two different authentication types (knowledge and possession) is multi-factor authentication.

Risk acceptance means acknowledging the risk and choosing not to mitigate, transfer, or avoid it.

The lessons learned phase captures improvements for future incidents.

Repeated failed login attempts from a single external IP targeting a VPN concentrator are the hallmark of a brute force attack. The attacker systematically tries many username/password combinations to gain unauthorized access, exploiting weak or common credentials rather than exploiting a protocol vulnerability.

The principle of least privilege requires that users be granted only the permissions necessary to perform their job functions. A standard user modifying a system file indicates they have been assigned unnecessary administrative rights, violating this principle. This could occur if the user is a member of a group like Administrators or has been granted explicit write access to protected directories such as %SystemRoot%\System32.

Social Security numbers combined with names and addresses are considered sensitive PII that can cause significant harm if disclosed.

Using write-once storage (e.g., WORM) or a separate log server prevents tampering with log data.