ISC2 Certified in Cybersecurity CC (CC) — Questions 676–750

An identity-aware proxy evaluates each request against Microsoft Entra ID identity and device posture before granting access, so a stolen VPN credential alone no longer opens the network. Micro-segmentation then enforces per-application reachability, satisfying the requirement that remote workers reach only role-specific apps and that segmentation holds regardless of location.

Accessing another department's files breaches need-to-know, which restricts data to individuals whose specific duties require it. Least privilege governs permission scope, not data relevance, so it does not fit this scenario. Need-to-know satisfies the stem's constraint: a user reaching files outside their own department.

UDP operates at the Transport layer and is connectionless, sending datagrams without handshaking, acknowledgement, or retransmission, so delivery is unreliable. TCP, the alternative Transport protocol, establishes connections and guarantees ordered, reliable delivery, which contradicts both stated constraints.

Verifying whether any accounts were successfully compromised establishes impact before containment, distinguishing a failed brute-force attempt from an actual breach. This determines escalation and remediation scope, so it precedes blocking the source IP or resetting credentials.

A digital signature or hash verifies the file has not been altered in transit, directly protecting integrity against interception and modification. Confidentiality would address eavesdropping, but the stem's concern is tampering with the financial reports.

Port 3389 is bound to Remote Desktop Protocol, which permits interactive remote logon and is a frequent target for brute-force and ransomware entry. Disabling it where remote administration is not required removes that exposure, whereas ports 80 and 443 serve expected web traffic.

Half-open connections arise when a host receives SYN packets but never completes the three-way handshake, exhausting the backlog queue. A SYN flood deliberately sends spoofed SYNs at volume, matching the observed pattern and denying legitimate clients access to the web server.

Rule-based access control decides access by evaluating conditions at request time. A rule can require that the current time fall within contracted hours and that the connecting device be enrolled and compliant in the management system. Both constraints in the scenario are conditions, making rule-based access control the appropriate model to enforce them dynamically.

RBAC grants permissions to roles rather than individuals, and users receive access through role assignment. When the employee moves from accounting to marketing, the role changes and permissions follow automatically. This matches the scenario precisely, where HR role data drives access updates without per-user permission edits.

Segmenting the guest wireless onto separate IP addressing and blocking routes to internal systems isolates untrusted traffic from sensitive resources. This is a core network security control that limits the blast radius if a guest device is compromised. It directly implements the requirement that guests reach only the internet, not the file server or payroll system.

Storing the tape copy offsite satisfies the 3-2-1 rule's requirement for one copy at a separate geographic location, protecting against site-wide disasters such as fire or flood. The external hard drive and on-site tape already provide three copies across two media types, so only geographic separation remains outstanding.

Hashing produces a fixed-length digest from the transmitted data; any modification changes the digest, so the recipient can verify the data arrived unaltered. This directly satisfies the requirement to detect alteration during transmission, which is the integrity principle.

Risk transference shifts the financial impact of a risk to a third party, such as an insurance company. By purchasing cyber insurance, the organization transfers some of the financial risk of a data breach to the insurer. This is a classic example of risk transference.

ARP poisoning sends forged ARP replies that bind the attacker's MAC address to a legitimate IP, so traffic between victim and gateway flows through the attacker. This enables interception and modification on the local subnet, a classic MITM technique.

ARP spoofing works by sending forged ARP replies that bind the attacker's MAC address to a legitimate server's IP, poisoning victims' ARP caches so traffic is redirected through the attacker for interception. This directly satisfies the stem's constraint of impersonating the server's IP-to-MAC mapping.

Subnetting divides a larger IP network into smaller logical subnets using the subnet mask, separating traffic at Layer 3. Each subnet forms its own broadcast domain, giving the administrator a valid method to segment the network.

Confidentiality directly prevents unauthorised disclosure by restricting data access to approved parties only. It is the CIA principle concerned with secrecy, unlike integrity (unauthorised modification) or availability (timely access). This satisfies the stem's requirement that data is not disclosed to unauthorised individuals.

Defense in depth is a layered security approach where multiple controls are used to protect assets. By deploying firewalls, intrusion detection systems, and endpoint protection, the organization creates overlapping defenses that reduce the likelihood of a single point of failure. This directly exemplifies the defense-in-depth principle, which is a core security strategy.

Non-repudiation provides irrefutable evidence that a specific identity performed a specific action, so the clinician cannot credibly deny approving the order. Digital signatures and tamper-evident audit logs bound to the clinician's authenticated identity deliver this proof. The legal team wants documented assurance of authorship and approval, which is precisely what non-repudiation supplies in a dispute.

A hot site provides a fully mirrored, continuously replicated environment, enabling activation well within the two-hour RTO while keeping data loss inside the fifteen-minute RPO. Warm and cold sites cannot meet such aggressive recovery targets.

A host-based firewall on the POS system enforces least privilege at the endpoint by permitting only required outbound and inbound flows for the payment application and management agent. Even if the terminal is compromised, other network paths are blocked. This directly limits what the system can reach, complementing network segmentation.

Revoking access rights is the administrative control that directly removes the contractor's ability to authenticate and reach internal repositories once the engagement ends. Timely offboarding, including disabling accounts and removing group memberships, closes the window in which former credentials remain usable. This matches the scenario because the goal is to prevent a dismissed contractor from using issued credentials, which only revocation accomplishes.

Isolating WKS-045 at 14:25 satisfies the containment requirement by severing the compromised endpoint's network connectivity, preventing lateral movement and further command-and-control communication. Containment means limiting spread, not eradication or recovery, so this action directly matches the incident response phase the question asks about.

MFA ensures that a password alone is not sufficient for access.

Training is an administrative control that educates users on security policies.

Separation of duties splits a critical transaction across distinct roles, so initiation and approval require different identities. This directly satisfies the stem's constraint that no single individual performs both actions, preventing unilateral fraud. Unlike least privilege, which limits access scope, separation of duties enforces workflow-level checks within Microsoft Entra ID governance.

Encryption renders data unreadable to anyone lacking the decryption key, whether stored on disk or moving across the network. This directly satisfies the confidentiality aspect of the CIA triad, which concerns preventing unauthorised disclosure. Integrity concerns alteration, and availability concerns access, so neither fits the scenario's protection of data at rest and in transit.

SIEM correlates events and alerts analysts, reducing detection time.

Total recovery of five hours exceeds the four-hour RTO, so that target is breached. Hourly incremental backups with transaction-log rollforward cap data loss near one hour, so the one-hour RPO is likely satisfied despite the overrun.

Separation of duties splits a critical transaction across multiple people so no single employee controls it end to end. Requiring one person to raise a payment and another to approve it directly satisfies the stem's constraint: preventing one employee from both approving and disbursing funds.

Security logging and monitoring records and analyses activity to identify incidents after or during their occurrence, satisfying the stem's requirement for detective controls. Unlike preventive controls, which block actions, logging detects and alerts on suspicious events, enabling timely response. This makes it a recognised example of a detective security control.

Data minimization means collecting and retaining only the data necessary for a specific purpose. Not storing the CVV after authorization reduces the amount of sensitive data at risk and aligns with the principle of limiting data retention to what is needed. This directly matches the architect's recommendation to avoid storing a sensitive element once it is no longer required.

SIEM platforms aggregate and normalise logs from disparate sources, then apply correlation rules to link related events across systems. This cross-source correlation is what surfaces incidents that isolated log review would miss, satisfying the question's requirement for a key SIEM function.

Regular backups preserve an unencrypted copy of data offline, so files can be restored without the attacker's decryption key. This directly satisfies the recovery requirement, whereas antivirus, patching or firewalls may block initial infection but cannot restore data already encrypted by ransomware.

PEAP-MSCHAPv2 lets users authenticate with directory credentials without a client certificate on the personal laptop, satisfying the no-certificate constraint. The RADIUS or NAC layer can then apply authorization policies that map each user or group to a role, which controls access to internal applications. This combination meets both user authentication and role-based access.

Fingerprint is inherence factor.

Reduces the attack surface.

Defense in depth layers controls — network segmentation, least privilege, monitoring — so breaching the public application does not grant direct database access. The stem's impact limitation is satisfied because no single exploited vulnerability yields full internal reach.

HTTPS with proper certificate validation encrypts traffic and authenticates the server via a trusted certificate chain, preventing an attacker from silently intercepting or altering communications. This directly satisfies the stem's man-in-the-middle mitigation requirement by ensuring clients reject forged or untrusted certificates rather than trusting an impostor endpoint.

Dynamic ARP Inspection validates ARP packets against the DHCP snooping binding table, dropping packets with spoofed IP-to-MAC mappings. This directly neutralises ARP spoofing on the switched segment, unlike encryption or static entries, satisfying the stem's mitigation requirement.

Rate limiting caps the number of requests a server accepts per client within a time window, throttling floods before they exhaust connection or processing capacity. This directly satisfies the DoS mitigation requirement by preserving availability for legitimate users during volumetric or application-layer attacks.

Separation of duties divides a critical task among multiple people so that no single individual can complete it alone, reducing the risk of fraud or error. Requiring one employee to create and another to approve the wire transfer directly implements this principle. It ensures that a single person cannot both initiate and authorize a high-risk financial action.

Allowing the internal IP range inbound to TCP 3306 satisfies the stem's constraint that internal access should be permitted while external access stays blocked. A network security group rule scoped to the internal subnet permits only that source, leaving the existing deny for external traffic intact.

RAM holds running processes, network connections and encryption keys that vanish on power-off, so capturing it first preserves volatile evidence the malicious outbound sessions left behind. Disk imaging can follow afterwards without losing this data, satisfying the legal preservation requirement.

Accountability binds each configuration change to a verified identity through logging, so any modification can be traced to the specific person responsible. This directly satisfies the requirement that changes are recorded alongside the actor's identity, distinguishing it from authentication, which merely verifies identity at access time.

A default DROP policy denies all traffic that no explicit rule permits, so only expressly allowed flows pass. This directly enforces fail-safe defaults: access decisions fall back to denial rather than permission, satisfying the stem's requirement that the default policy itself embody the principle.

Two distinct approvers from sales and finance enforce separation of duties, preventing one person completing the whole transaction. The IP-based bypass collapses both approvals into a single actor, so the control fails. Remediation is to correct the configuration so two different managers must approve, restoring the dual-authorisation constraint.

IPsec tunnel mode encapsulates the entire original IP packet and can apply ESP encryption for confidentiality plus an authentication mechanism that provides data origin authentication and integrity. This protects the images from being read or altered in transit and lets the remote clinic verify the hospital as the source. It matches both requirements in a single, standard site-to-site design.

Firewall rulesets evaluate top-down and stop at the first match, so rule 1's deny for that source takes effect before any later permit is reached. The packet never reaches subsequent rules, making the outcome a denial rather than an allow.

A VPN builds an encrypted tunnel between the remote employee's device and the corporate network, so internal resources are reachable as if on-site. This satisfies the requirement for secure internet-based access, unlike a public-facing endpoint or unencrypted connection.

Network flow analysis examines metadata such as IP addresses, ports, byte counts, and timing without needing payload decryption. Anomaly detection can flag deviations like regular beaconing to a known C2 IP on non-standard ports. This approach works with the SIEM's flow data and can detect encrypted C2 traffic based on behavioral patterns.

Step-by-step procedures translate policy into executable actions, specifying exactly who does what, in which order, during each incident class. This satisfies the stem's demand for essential plan elements: without predefined playbooks, responders improvise under pressure, delaying containment and recovery. Procedures also enable consistent handling and post-incident review across the organisation.

Need to know limits access to only the specific information a user requires to perform their duties. The teller needs records for their own branch's customers to serve them, but has no legitimate need to view customers at other branches. Restricting the teller's visibility to only the records necessary for their work is the essence of the need-to-know principle.

Redundant servers directly satisfy the availability requirement by eliminating single points of failure: if one server fails, another continues serving requests, so the service remains accessible. Unlike confidentiality or integrity controls, redundancy targets uptime specifically, matching the stem's availability constraint through failover rather than prevention of unauthorised access or data alteration.

An IPS sits inline in the traffic path, so it can drop or reset malicious packets in real time rather than merely alerting. This satisfies the scenario's requirement to actively protect the network, whereas an IDS only monitors a copy of traffic and cannot block.

Least privilege means granting only the access required for a user's job function, nothing broader. This directly limits the blast radius of compromised accounts and satisfies the principle's core constraint: permissions scoped to actual duties rather than convenience or role seniority.

A customer database is an information asset: it holds valuable data the organisation must protect, and it carries risk exposure if compromised, lost or corrupted. Risk assessments inventory such assets before identifying threats and vulnerabilities, making the database a legitimate asset in this scenario.

Social engineering manipulates human trust rather than exploiting software flaws, using phishing, pretexting or impersonation to persuade an employee to hand over credentials. The attacker targets the person, not the system, which is the defining characteristic of this incident category.

A time-based ACL enforces access windows directly on the server, so the contractor's permissions activate only during the patching period and lapse automatically afterwards. This satisfies the stem's constraint that access be limited to the patching window, without relying on manual revocation or account lifecycle management.

Integrity guarantees data is not altered in transit, detecting any modification between sender and receiver. Cryptographic hashes or MACs verify that received data matches what was sent, directly satisfying the requirement that data remains unaltered over the internet.

A fingerprint is something you are (inherence), while a password is something you know (knowledge). Pairing them spans two separate factor categories, satisfying true multi-factor authentication. Two biometrics, or two passwords, would not qualify as genuine multi-factor.

Recovery Point Objective (RPO) specifies the maximum tolerable data loss expressed as elapsed time before an incident, directly satisfying the stem's requirement for a time-measured loss threshold. It determines backup frequency, unlike Recovery Time Objective, which bounds service restoration duration instead.

Port 25 is the standard TCP port for SMTP, used for sending and relaying email. Outbound traffic from an internal workstation to an external address on this port suggests the host is acting as a mail client or, more likely in this scenario, a compromised machine sending spam.

Refusing to plug in found drives removes the attack vector entirely, since the malicious payload executes only on connection. This satisfies the stem's training-message requirement by targeting the physical action the USB drop attack depends upon, before any autorun or HID emulation can trigger.

The JSON policy grants `s3:GetObject` and `s3:ListBucket` on the critical-data bucket's ARN, permitting retrieval and enumeration of every object without write, delete or overwrite permissions. This satisfies the stem's read-only constraint, since no mutating actions such as `PutObject` or `DeleteObject` appear in the statement.

A warm site provides partially configured infrastructure, enabling systems to be operational within roughly two days. That timeframe directly defines the Recovery Time Objective, the maximum acceptable downtime, rather than data loss measured by RPO.

Outbound traffic inspection is frequently neglected because many firewall rulesets focus on inbound threats, leaving internal hosts free to exfiltrate data or reach command-and-control servers. This satisfies the scenario's requirement for a commonly found misconfiguration, as unrestricted egress permits malware beaconing and data loss without triggering perimeter defences.

Separation of duties splits authorisation from execution so no single person can both approve and perform a change. Requiring one individual to submit the change request and a different individual to implement it enforces that split, preventing fraud and errors in the sensitive research database.

Custom exceptions suppress only the specific signatures matching the legitimate application's encrypted traffic, eliminating those false positives while leaving all other signatures active. This directly satisfies the stem's requirement to reduce false positives without weakening detection of genuine threats.

Digital signatures use the sender's private key to produce a value verifiable with their public key, binding the sender's identity to the message. This provides non-repudiation, the exact constraint in the stem, because only the private-key holder could have generated the signature, so the sender cannot later deny it.

Placing guests on a dedicated VLAN segments the guest broadcast domain from employee systems, and an ACL on the router or Layer 3 switch can explicitly deny guest-to-payroll traffic. This directly satisfies the requirement to keep guests from reaching the payroll server while preserving the existing flat employee network, resulting in minimal disruption to employee workflows.

Authorization defines the specific resources and actions an authenticated identity may use, satisfying the stem's requirement to determine access after authentication succeeds. It operates on permissions, group memberships and policies, unlike authentication (identity verification) or accounting (usage logging). Microsoft Entra ID enforces this through role assignments and conditional access.

Least privilege grants each user only the minimum permissions their job requires, limiting blast radius if credentials are compromised. It directly satisfies the stem's constraint of minimum necessary access, unlike broader models such as role-based or discretionary access.

GDPR Article 33(5) requires controllers to document all breaches, including the facts, effects and remedial action taken. This record-keeping duty applies regardless of whether the breach is notifiable, satisfying the stem's requirement for a mandatory action following the PII incident.

Medical records combine health information with identifying details, forming sensitive PII whose exposure causes harm or discrimination. Unlike names or email addresses alone, health data attracts stricter legal protection, making it the sensitive category here.