ISC2 Certified in Cybersecurity CC (CC) — Questions 751–825

The NIST incident response lifecycle includes: Preparation, Detection & Analysis, Containment/Eradication/Recovery, and Post-Incident Activity (lessons learned). The correct two from options are Preparation and Recovery.

Telnet transmits data, including credentials, in cleartext, making it susceptible to sniffing. SSH is the secure alternative.

A hot site is a fully operational duplicate of the primary data center, complete with live servers, storage, networking, and synchronized data. This eliminates the need to procure and configure hardware after a disaster, enabling recovery in minutes or hours rather than days or weeks. The primary advantage is therefore a significantly faster recovery time objective (RTO) compared to a cold site, which has no pre-installed equipment.

Fail-safe ensures that when a server fails, it defaults to a secure state (e.g., closed ports, denied access) rather than an insecure one. This prevents a security breach by guaranteeing that failure does not inadvertently expose data or allow unauthorized access. In the CC exam, this principle is directly tied to designing systems that remain secure even under fault conditions.

Organizational Units (OUs) are containers that organize objects like users and computers in a hierarchy.

Lessons Learned involves reviewing the incident, updating plans, and conducting post-mortems to improve future response. Identifying the root cause is part of analysis/eradication.

Logical access controls are software-based mechanisms that restrict access to systems and data. Passwords are a common logical control.

Separation of duties (SoD) is the access control principle that prevents a single individual from having conflicting permissions, such as both requesting and approving a payment. By splitting the payment lifecycle into distinct roles (e.g., requester vs. approver), the organization enforces a dual-control mechanism that reduces the risk of fraud or error. This is commonly implemented in financial systems using role-based access control (RBAC) where the 'payment request' and 'payment approval' roles are mutually exclusive.

In access control, identification is the process by which a user claims an identity (e.g., by providing a username or account name). It is distinct from authentication, which verifies that claim. The primary purpose of identification is to assert who you are, not to prove it.

When backup systems are unavailable due to a storage array failure, the first action must be to activate the disaster recovery plan (DRP). The DRP is the predefined, documented set of procedures that guides the organization through the recovery process, including escalation, communication, and alternative recovery methods. Without activating the plan, subsequent steps like contacting vendors or restoring from tape lack coordination and may violate recovery time objectives (RTOs) and recovery point objectives (RPOs).

Due care is implementing basic security; due diligence is investigating and assessing risks.

Option D is correct because an incident response plan must include a communication plan for stakeholders to ensure timely and accurate information sharing during a security incident. This includes predefined escalation paths, contact lists, and communication channels (e.g., email, phone, secure messaging) to coordinate response efforts and manage external notifications (e.g., legal, PR, customers). Without a communication plan, response teams risk confusion, delays, and inconsistent messaging, which can exacerbate the incident's impact.

SSH (port 22) encrypts all traffic, including passwords and commands, making it secure for remote administration. Telnet transmits data in cleartext and should be avoided.

The maximum tolerable downtime (MTD) is 2 hours, but the current restore process takes 3 hours, which exceeds the MTD. Synchronous replication writes data to both primary and secondary storage simultaneously, ensuring that the secondary copy is always current and can be failed over to in seconds or minutes, not hours. This reduces the recovery time objective (RTO) to well under the required 2 hours, directly addressing the gap.

Unexpected sender and urgent language are classic phishing indicators. File attachments can be malicious, but presence alone is not always phishing; legitimate emails have attachments too. The other options are not typical phishing indicators.

Type 2 authentication is based on possession, such as a smart card.

Type 1 is knowledge-based, such as a password.

Authentication logs record login attempts, including failures and successes, making them ideal for detecting brute-force attacks.

Multi-factor authentication (MFA) requires two or more factors: something you have (card) and something you know (PIN).

Separation of duties ensures that no single individual has control over all critical functions, reducing the risk of fraud or error. In this scenario, requiring two approvals for large transactions institutionalizes the principle.

With daily full backups only, the Recovery Point Objective (RPO) is effectively 24 hours, which may be acceptable depending on business requirements. However, the primary risk is that restoring from a single full backup can take a very long time, especially for large datasets, potentially exceeding the Recovery Time Objective (RTO). This is because full backups contain all data and must be restored entirely, unlike incremental or differential backups that allow faster recovery by restoring only changed blocks.

Hashing ensures data integrity by detecting changes.

Password expiration policies, such as requiring a change every 90 days, are classified as preventive controls because they proactively reduce the risk of credential compromise by limiting the window of opportunity for an attacker to use a stolen or guessed password. This control enforces a security baseline before any unauthorized access can occur, directly preventing prolonged use of compromised credentials.

According to the NIST 800-61 incident response lifecycle, the phases are Preparation, Detection & Analysis, Containment/Eradication, and Recovery. After containment (isolating the threat) and eradication (removing malware, patching vulnerabilities), the next phase is Recovery, where systems are carefully restored to normal operations, often using clean backups and verifying system integrity before reconnecting to the network.

Defense in depth uses multiple layers: perimeter fencing (physical), access badges (physical/administrative), and encryption (logical).

The Business Continuity Plan (BCP) is the correct answer because it specifically outlines the procedures and strategies to maintain critical business functions during a disruption. Unlike other plans that focus on IT recovery or incident response, the BCP ensures that essential business operations continue, often by leveraging alternate work sites, manual workarounds, or scaled-down processes, until normal operations can be restored.

Defense in depth is the correct principle because it involves implementing multiple layers of security controls so that if one authentication factor is compromised, other layers still protect the system. In this scenario, requiring multiple authentication factors (e.g., password plus biometric or token) ensures that a single compromised factor does not grant full access, maintaining overall system security.

The use of both a smart card (something you have) and a PIN (something you know) creates a multi-factor authentication mechanism. This layered approach ensures that even if one factor is compromised, the other still provides protection, which is the core of the defense-in-depth principle. Defense in depth is about implementing multiple, overlapping security controls rather than relying on a single point of defense.

Stateful inspection firewalls maintain a state table to track connections, allowing return traffic for permitted outbound connections.

Combining a knowledge factor (password) and an inherence factor (fingerprint) constitutes multi-factor authentication.

Least privilege for administrators: using separate admin accounts minimizes the risk of accidental changes or compromise, as the admin account is only used when needed.

Privileged accounts require special controls like separate accounts, PAM, and least privilege.

Option D is correct because ransomware commonly encrypts victim files and appends a new extension such as .encrypted to indicate the files have been locked. This extension change is a direct artifact of the encryption process performed by the ransomware payload, making it a key forensic indicator during incident response.

Separation of duties ensures no single individual can complete a high-risk action alone, reducing fraud risk.

A hot site is a fully equipped alternate work site with all necessary IT infrastructure—servers, networking, telecommunications, and power—ready to take over operations immediately. The question specifies 'full IT capabilities,' which aligns with the hot site's purpose of enabling rapid failover with minimal downtime, typically within hours.

Investigating the source system helps determine if it is compromised; checking threat intelligence can reveal if the IP is known malicious.

Preventive and corrective controls are recognized types. The other options are not standard categories or are too broad.

Crisis communications should include notifying affected customers, informing management, and complying with legal/regulatory notification requirements. Public relations is also involved, but the options focus on key stakeholders.

Separation of duties ensures that no single individual has control over all critical functions, reducing the risk of fraud or error.

RTO and cost are primary differentiators: hot sites have shorter RTO but higher cost.

The recovery time objective (RTO) defines the maximum acceptable downtime for an application. Since the RTO is 4 hours but the actual recovery took 6 hours, the application was unavailable for 2 hours beyond the acceptable threshold, directly impacting business continuity. This is a failure to meet the RTO, not the RPO, which concerns data loss.

The correct first action is to disconnect the server from the network and activate the manual process. This immediately stops potential data exfiltration to the C2 server and contains the incident, aligning with the NIST incident response lifecycle's containment phase. Since the server runs a legacy application that cannot be patched and the manual process can sustain operations for up to 4 hours, isolation is both feasible and necessary to prevent further compromise while maintaining business continuity.

Option D is correct because the displayed iptables rules only govern the INPUT chain, which controls incoming packets. While the rule allows incoming ICMP echo requests (type 8), the server's response—an ICMP echo reply (type 0)—is an outgoing packet that must traverse the OUTPUT chain. If the OUTPUT chain has a default policy of DROP or lacks an explicit ACCEPT rule for ICMP echo replies, the replies are dropped, preventing ping from working even though SSH succeeds (since SSH uses TCP, which is handled differently).

Option B (Technical) is correct because ISC2 recognizes technical controls as a primary security control type, encompassing mechanisms like firewalls, encryption, and intrusion detection systems that enforce security policies through technology. These controls operate at the system or network level to protect assets directly.

Write-once storage (e.g., WORM) ensures logs cannot be altered or deleted, preserving integrity.

Option A is correct because specialized memory dump tools like DumpIt are designed for live memory acquisition. Other tools are for disk or network analysis.

Visitor management includes sign-in, badge issuance, and escort policies, all of which are physical access controls to secure the premises.

Moving the database to a separate server and encrypting it reduces the risk of data theft from physical access. CCTV is detective, 2FA protects remote access, and strong ACLs can be bypassed with physical control of the server.

The Code of Ethics prioritizes: Protect society, the common good, and the public trust first.

Accountability relies on unique identification. Password sharing breaks this link.

Encryption ensures data is not readable by unauthorized parties, thereby protecting confidentiality.

Data classification labels (e.g., Confidential) define handling requirements, such as encryption, to protect the data.

Separation of duties prevents any single individual from having complete control over a high-risk action, reducing the risk of fraud.

Synchronous replication requires the primary site to wait for an acknowledgment from the backup site before completing each write operation. The 500-mile distance introduces a minimum round-trip latency of approximately 8-10 ms (based on fiber optic propagation at ~200 km/ms), which directly increases the time taken for write operations. This latency impact is the most likely risk introduced by this configuration.

The (ISC)² Code of Ethics prioritizes protecting society, the common good, and public safety above all.

Mandatory Access Control (MAC) enforces access decisions based on security labels assigned to subjects (users/processes) and objects (files/resources). The system, not the user, controls access by comparing these labels against a security policy, such as Bell-LaPadula or Biba. This is why MAC is the correct answer for label-based enforcement.

Digital signatures provide integrity and non-repudiation by detecting any changes to the message.

The incident responder must first investigate the web server at 192.168.1.10 to confirm whether the alert is a true positive or a false positive. Jumping to containment actions like disabling the application or blocking the IP without verification could disrupt legitimate services or overlook the root cause. The initial step in any incident response process (as per NIST SP 800-61) is to validate the alert through analysis of logs, processes, and system state.

Hashing is used to verify data integrity by detecting changes to the data.

Separation of duties is a principle of access control that prevents any single individual from having excessive control over critical processes by dividing tasks and privileges among multiple people. This reduces the risk of fraud or error, as collusion is required to bypass controls. It is a foundational concept in security frameworks like NIST SP 800-53 and is often enforced through role-based access control (RBAC) policies.

When backups consistently exceed the 4-hour window, they overlap with production hours, causing resource contention (CPU, I/O, network bandwidth) that degrades application performance and user experience. This directly risks production operations, as backup jobs compete with live workloads for system resources.

The Recovery Time Objective (RTO) defines the maximum acceptable time to restore systems and data after a disaster, directly addressing the 2-hour recovery requirement. In the context of backup strategy, RTO drives decisions on failover mechanisms, replication speed, and restoration procedures to meet the specified downtime limit.

Risk acceptance means acknowledging the risk and not taking further action.

Write-once storage (e.g., WORM drives) ensures data cannot be modified, deleted, or overwritten, preserving integrity.

An application proxy firewall (also known as an application-level gateway) performs deep packet inspection at the application layer, allowing it to filter based on content like URLs or SQL commands.

Visitor management procedures are part of physical access controls to monitor and restrict entry.

A self-signed TLS certificate is not signed by a trusted Certificate Authority (CA), so clients cannot verify the certificate's authenticity. This allows an attacker to intercept the TLS handshake, present their own self-signed certificate, and perform a man-in-the-middle (MITM) attack, decrypting and reading or modifying the data in transit.