976 questions total · 14pages · All types, answers revealed
In a directory service such as Active Directory, which component is responsible for storing information about users, groups, and computers in a hierarchical structure?
Correct. OUs are containers that organize directory objects.
Why this answer
Organizational Units (OUs) are containers that organize objects like users and computers in a hierarchy.
An incident response team is analyzing a data breach. Which THREE actions are part of the 'Lessons Learned' phase? (Select THREE)
Documentation helps improve future response.
Why this answer
Lessons Learned involves reviewing the incident, updating plans, and conducting post-mortems to improve future response. Identifying the root cause is part of analysis/eradication.
Which of the following is an example of a logical access control?
Correct. Passwords are logical access controls.
Why this answer
Logical access controls are software-based mechanisms that restrict access to systems and data. Passwords are a common logical control.
An organization wants to ensure that no single employee can both request and approve a payment. Which access control principle does this enforce?
Separation of duties divides critical functions among multiple people.
Why this answer
Separation of duties (SoD) is the access control principle that prevents a single individual from having conflicting permissions, such as both requesting and approving a payment. By splitting the payment lifecycle into distinct roles (e.g., requester vs. approver), the organization enforces a dual-control mechanism that reduces the risk of fraud or error. This is commonly implemented in financial systems using role-based access control (RBAC) where the 'payment request' and 'payment approval' roles are mutually exclusive.
Exam trap
ISC2 often tests the confusion between 'separation of duties' and 'least privilege' because both limit user capabilities, but the trap is that least privilege reduces the scope of permissions for a single user while separation of duties divides a critical process across multiple users.
How to eliminate wrong answers
Option B (Least privilege) is wrong because it focuses on granting only the minimum permissions necessary to perform a job function, not on splitting conflicting tasks across multiple people. Option C (Need to know) is wrong because it restricts access to data based on whether it is required for a specific task, not on preventing a single user from holding two conflicting functional roles. Option D (Defense in depth) is wrong because it describes a layered security architecture (e.g., firewalls, IDS, encryption) rather than a principle for segregating duties within a process.
What is the primary purpose of identification in the context of access control?
Identification provides a claimed identity (e.g., username).
Why this answer
In access control, identification is the process by which a user claims an identity (e.g., by providing a username or account name). It is distinct from authentication, which verifies that claim. The primary purpose of identification is to assert who you are, not to prove it.
Exam trap
ISC2 often tests the distinction between identification (claiming an identity) and authentication (proving that identity), so candidates mistakenly select 'To verify the identity of the user' (Option B) because they conflate the two steps.
How to eliminate wrong answers
Option A is wrong because granting permissions to resources is the function of authorization, not identification. Option B is wrong because verifying the identity of the user is the purpose of authentication, which typically follows identification. Option C is wrong because recording user activities is the role of accounting (auditing), not identification.
During a disaster recovery exercise, the backup systems are not available because the storage array failed. Which of the following should be done FIRST?
The DR plan includes procedures for such failures and guides next steps.
Why this answer
When backup systems are unavailable due to a storage array failure, the first action must be to activate the disaster recovery plan (DRP). The DRP is the predefined, documented set of procedures that guides the organization through the recovery process, including escalation, communication, and alternative recovery methods. Without activating the plan, subsequent steps like contacting vendors or restoring from tape lack coordination and may violate recovery time objectives (RTOs) and recovery point objectives (RPOs).
Exam trap
ISC2 often tests the principle that the disaster recovery plan must be activated before any technical recovery action is taken, trapping candidates who jump to a specific recovery step like restoring from tape or contacting a vendor without first following the documented process.
How to eliminate wrong answers
Option B is wrong because contacting the vendor is a tactical step that should be performed after the DRP is activated, as the plan specifies when and how to engage vendors. Option C is wrong because restoring from offsite tape is a specific recovery action that must be directed by the DRP, which first requires assessing the situation and authorizing the restore process. Option D is wrong because ordering replacement hardware is a procurement action that occurs later in the recovery timeline, after the DRP has been activated and a gap analysis has been performed.
Which TWO of the following are valid types of disaster recovery tests?
Tabletop exercises involve walkthroughs of disaster scenarios.
Why this answer
Options A and E are correct. Tabletop exercises involve team members discussing simulated scenarios, and parallel tests involve running the primary and backup systems simultaneously to verify failover. Option B is not a standard DR test type; full-scale simulations typically involve prior notification.
Option C is unit testing of applications, not related to disaster recovery testing. Option D is a security assessment, not a DR test.
An organization wants to ensure that a critical database can be restored within 2 hours after a failure. Which metric should the organization define?
RTO sets the target restoration time.
Why this answer
(Recovery Time Objective). RTO defines the maximum acceptable time to restore a system after a failure, which directly aligns with the requirement to restore the database within 2 hours. Option A (MTD) is the total downtime an organization can tolerate, but it is not the specific metric for restoration time; option B (SLA) is a contractual agreement; option C (RPO) deals with data loss, not downtime.
Which of the following best describes the difference between due care and due diligence in security governance?
Due care involves implementing controls; due diligence involves verifying.
Why this answer
Due care is implementing basic security; due diligence is investigating and assessing risks.
You are the security administrator for a mid-sized e-commerce company. The company uses a Linux-based web server running Apache, with a MySQL database backend. User authentication is handled via LDAP. Recently, the security team discovered that a former employee's account was used to access the customer database two weeks after the employee was terminated. The account had not been disabled. The database contains personally identifiable information (PII). The incident was traced to an internal IP address from the marketing department. The marketing department's network segment is not segregated from the database server. Additionally, the database server's firewall rules allow any internal IP to connect to the MySQL port (3306). The company has a written policy that accounts must be disabled within 24 hours of termination, but the HR department did not notify IT in a timely manner. Which combination of controls would BEST prevent a recurrence of this incident?
Automated account disablement prevents use of terminated accounts; segmentation limits lateral movement.
Why this answer
The best combination because it addresses both root causes: the account not being disabled (by integrating HR with identity management for automatic deprovisioning) and the lack of network segmentation (by restricting database access to only authorized application servers via firewall). Option B only addresses network issues, not account management. Option A is monitoring, not prevention.
Option D adds complexity but does not directly fix the broken termination process or network segregation.
Which TWO are key components of an effective incident response plan? (Select TWO.)
Critical for coordination during an incident.
Why this answer
Options D and E are correct because an effective incident response plan must include a communication plan for stakeholders (D) to ensure timely and accurate information sharing during a security incident, and a post-incident review process (E) to analyze the incident, identify lessons learned, and improve future response efforts. Option D includes predefined escalation paths, contact lists, and communication channels to coordinate response and manage external notifications. Option E ensures that after an incident, the team conducts a thorough review to update policies, procedures, and controls, preventing recurrence.
Without both components, the plan lacks coordination and continuous improvement.
Exam trap
ISC2 often tests the distinction between incident response and adjacent processes (like business continuity or disaster recovery) to see if candidates confuse overlapping but distinct security operations concepts.
An organization wants to securely manage network devices from remote locations. Which of the following protocols should be used for command-line access?
SSH provides encrypted remote access.
A company's business continuity plan requires a maximum tolerable downtime of 2 hours for the ERP system. The current backup process takes 3 hours to restore. Which of the following is the BEST corrective action?
Synchronous replication ensures data is mirrored in real-time, allowing near-instant failover.
Why this answer
The maximum tolerable downtime (MTD) is 2 hours, but the current restore process takes 3 hours, which exceeds the MTD. Synchronous replication writes data to both primary and secondary storage simultaneously, ensuring that the secondary copy is always current and can be failed over to in seconds or minutes, not hours. This reduces the recovery time objective (RTO) to well under the required 2 hours, directly addressing the gap.
Exam trap
ISC2 often tests the distinction between RTO and RPO, and the trap here is that candidates confuse backup frequency (which affects RPO) with restore speed (which affects RTO), leading them to incorrectly choose Option B.
How to eliminate wrong answers
Option A is wrong because reducing the RTO to 1 hour does not fix the underlying problem—the restore process still takes 3 hours, and simply changing a target number without improving the technology does not achieve compliance. Option B is wrong because increasing backup frequency reduces the recovery point objective (RPO), not the recovery time objective (RTO); the restore time remains 3 hours regardless of how often backups are taken. Option D is wrong because quarterly restoration testing validates that backups work but does not reduce the 3-hour restore time; testing alone cannot bring the RTO below the MTD.
Which TWO of the following are common indicators of a phishing email?
Phishing often uses spoofed or unexpected addresses.
Why this answer
Unexpected sender and urgent language are classic phishing indicators. File attachments can be malicious, but presence alone is not always phishing; legitimate emails have attachments too. The other options are not typical phishing indicators.
Which of the following is an example of a Type 2 authentication factor?
Smart card is a possession factor (Type 2).
Why this answer
Type 2 authentication is based on possession, such as a smart card.
Which of the following is an example of a Type 1 authentication factor?
Correct. PIN is something you know.
Why this answer
Type 1 is knowledge-based, such as a password.
A security analyst notices repeated failed login attempts from an internal IP address to a domain controller, followed by a successful login. Which log type is most likely to provide detailed evidence of this activity?
Correct. Authentication logs capture login attempts and outcomes.
Why this answer
Authentication logs record login attempts, including failures and successes, making them ideal for detecting brute-force attacks.
A company implements a policy where users must swipe their access card and then enter a PIN to enter the data center. This is an example of:
Correct. Card (something you have) and PIN (something you know) constitute MFA.
Why this answer
Multi-factor authentication (MFA) requires two or more factors: something you have (card) and something you know (PIN).
A company implements a policy that requires two employees to approve any financial transaction over $10,000. Which security principle is being applied?
Correct. The policy requires two individuals, which is a classic example of separation of duties.
Why this answer
Separation of duties ensures that no single individual has control over all critical functions, reducing the risk of fraud or error. In this scenario, requiring two approvals for large transactions institutionalizes the principle.
A company's backup strategy involves daily full backups only. What is the primary risk associated with this approach?
Restoring a full backup takes significant time, which may violate the RTO.
Why this answer
With daily full backups only, the Recovery Point Objective (RPO) is effectively 24 hours, which may be acceptable depending on business requirements. However, the primary risk is that restoring from a single full backup can take a very long time, especially for large datasets, potentially exceeding the Recovery Time Objective (RTO). This is because full backups contain all data and must be restored entirely, unlike incremental or differential backups that allow faster recovery by restoring only changed blocks.
Exam trap
ISC2 often tests the distinction between RPO and RTO, and the trap here is that candidates assume the primary risk is a long RPO (Option A) because they think daily backups mean losing a day of data, but the question specifically asks about the primary risk of this approach, which is the long restore time impacting RTO.
How to eliminate wrong answers
Option A is wrong because the RPO for daily full backups is fixed at 24 hours, which may be acceptable for many organizations; the question asks for the primary risk, and RPO is not inherently too long—it depends on the business requirement. Option C is wrong because daily full backups do not inherently have high storage cost; in fact, they can be more storage-efficient than combining full and incremental backups if retention is short, and cost is not the primary risk. Option D is wrong because data corruption spreading across backups is a risk associated with any backup strategy, not specific to daily full backups; it is not the primary risk highlighted by this approach.
A security analyst implements a hashing algorithm to verify that a downloaded file has not been altered. Which security goal is being achieved?
Hashing verifies that data has not been modified.
Why this answer
Hashing ensures data integrity by detecting changes.
An organization's security policy requires that all employees change their passwords every 90 days. This is an example of which type of security control?
Regular password changes help prevent unauthorized access if credentials are stolen.
Why this answer
Password expiration policies, such as requiring a change every 90 days, are classified as preventive controls because they proactively reduce the risk of credential compromise by limiting the window of opportunity for an attacker to use a stolen or guessed password. This control enforces a security baseline before any unauthorized access can occur, directly preventing prolonged use of compromised credentials.
Exam trap
ISC2 often tests the distinction between preventive and deterrent controls, where candidates mistakenly classify password policies as deterrent because they 'discourage' sharing, but the key is that password expiration actively blocks access, not just discourages behavior.
How to eliminate wrong answers
Option A is wrong because a deterrent control is designed to discourage malicious behavior through the threat of consequences (e.g., warning banners, surveillance cameras), not to enforce a mandatory action like password rotation. Option B is wrong because a detective control identifies and logs security events after they occur (e.g., audit logs, intrusion detection systems), whereas password expiration proactively prevents stale credentials from being used. Option D is wrong because a corrective control remediates damage after an incident (e.g., restoring from backup, patching a vulnerability), not a scheduled administrative action to maintain security posture.
According to the NIST 800-61 incident response lifecycle, after containment and eradication have been performed, what is the next phase?
Recovery follows containment and eradication to bring systems back online.
Why this answer
According to the NIST 800-61 incident response lifecycle, the phases are Preparation, Detection & Analysis, Containment/Eradication, and Recovery. After containment (isolating the threat) and eradication (removing malware, patching vulnerabilities), the next phase is Recovery, where systems are carefully restored to normal operations, often using clean backups and verifying system integrity before reconnecting to the network.
Exam trap
ISC2 often tests the exact NIST 800-61 phase order, and the trap here is that candidates confuse 'Post-incident activity' as the immediate next step after eradication, when in fact Recovery must occur first to restore operations before conducting the final review.
How to eliminate wrong answers
Option B is wrong because Post-incident activity is the final phase that occurs after Recovery, involving lessons learned, documentation, and evidence retention. Option C is wrong because Detection and analysis occurs before containment/eradication, not after. Option D is wrong because Preparation is the initial phase that happens before any incident occurs, establishing policies, tools, and training.
A company wants to implement defense in depth for its data center. Which THREE of the following controls should be included? (Select THREE.)
Correct. Badges control entry.
Why this answer
Defense in depth uses multiple layers: perimeter fencing (physical), access badges (physical/administrative), and encryption (logical).
Which document outlines the procedures for maintaining critical business functions during a disruption?
BCP outlines procedures to sustain essential business operations.
Why this answer
The Business Continuity Plan (BCP) is the correct answer because it specifically outlines the procedures and strategies to maintain critical business functions during a disruption. Unlike other plans that focus on IT recovery or incident response, the BCP ensures that essential business operations continue, often by leveraging alternate work sites, manual workarounds, or scaled-down processes, until normal operations can be restored.
Exam trap
ISC2 often tests the distinction between BCP and DRP, where candidates mistakenly choose Disaster Recovery Plan because they focus only on IT recovery, forgetting that BCP covers the broader business continuity including non-IT functions like manual order processing or alternate facilities.
How to eliminate wrong answers
Option B (Continuity of Operations Plan) is wrong because it is a U.S. government-specific framework (COOP) focused on maintaining essential government functions at an alternate facility, not a general business continuity document. Option C (Incident Response Plan) is wrong because it focuses on detecting, containing, and eradicating security incidents (e.g., malware outbreaks or data breaches), not on maintaining ongoing business functions during a disruption. Option D (Disaster Recovery Plan) is wrong because it is a subset of BCP that specifically addresses the recovery of IT infrastructure and systems after a disaster, not the broader maintenance of critical business functions.
A company is designing a new authentication system for remote employees. They want to ensure that if one authentication factor is compromised, the system remains secure. Which security principle should they apply?
Correct. Multiple authentication factors provide layered security.
Why this answer
Defense in depth is the correct principle because it involves implementing multiple layers of security controls so that if one authentication factor is compromised, other layers still protect the system. In this scenario, requiring multiple authentication factors (e.g., password plus biometric or token) ensures that a single compromised factor does not grant full access, maintaining overall system security.
Exam trap
ISC2 often tests the distinction between defense in depth and fail-safe, where candidates mistakenly choose fail-safe because they think it means 'safe if one factor fails,' but fail-safe is about system failure modes, not layered authentication.
How to eliminate wrong answers
Option A is wrong because fail-safe refers to a system that defaults to a secure state when a failure occurs (e.g., locking all doors on power loss), not to layering multiple authentication factors. Option B is wrong because least privilege limits user access rights to only what is necessary for their role, but does not address the scenario of a compromised authentication factor. Option C is wrong because need to know restricts access to information based on job requirements, which is about data confidentiality, not about ensuring security when one factor is breached.
A company has implemented a policy where all employees must use a smart card and PIN to access the data center. Which security principle does this practice support?
Correct. Multiple factors create depth.
Why this answer
The use of both a smart card (something you have) and a PIN (something you know) creates a multi-factor authentication mechanism. This layered approach ensures that even if one factor is compromised, the other still provides protection, which is the core of the defense-in-depth principle. Defense in depth is about implementing multiple, overlapping security controls rather than relying on a single point of defense.
Exam trap
ISC2 often tests the concept that defense in depth is about multiple layers of security, not just multiple factors of authentication, but here the smart card and PIN specifically represent two distinct authentication factors, which is a clear example of a layered defense.
How to eliminate wrong answers
Option A is wrong because 'Keep it simple' advocates for minimizing complexity to reduce errors and attack surface, whereas adding a smart card and PIN introduces additional complexity for stronger security. Option C is wrong because 'Least privilege' restricts users to only the permissions necessary for their job, which is unrelated to the authentication method used to access the data center. Option D is wrong because 'Fail-safe' ensures that a system defaults to a secure state (e.g., locking access) when a failure occurs, but the question describes a normal operational authentication process, not a failure scenario.
Which firewall type reads packet headers and also tracks the state of active connections to make filtering decisions?
Stateful firewalls track connection state.
Why this answer
Stateful inspection firewalls maintain a state table to track connections, allowing return traffic for permitted outbound connections.
An organization requires both a password and a fingerprint scan to access a secure system. This is an example of:
Two different authentication types are used.
Why this answer
Combining a knowledge factor (password) and an inherence factor (fingerprint) constitutes multi-factor authentication.
A system administrator uses a separate administrative account with elevated privileges only when performing system maintenance, and uses a standard user account for daily activities like email. This practice aligns with which principle?
Using separate accounts ensures admin rights are only used when necessary, adhering to least privilege.
Why this answer
Least privilege for administrators: using separate admin accounts minimizes the risk of accidental changes or compromise, as the admin account is only used when needed.
Which THREE of the following are best practices for privileged account management? (Select THREE.)
PAM solutions centralize and secure privileged access.
Why this answer
Privileged accounts require special controls like separate accounts, PAM, and least privilege.
An organization wants to implement multi-factor authentication for remote access. Which TWO of the following would provide multi-factor authentication? (Select TWO)
Correct. This combines knowledge (password) and possession (SMS code), which are different factors.
Why this answer
Multi-factor authentication requires combining at least two different factors: something you know (knowledge), something you have (possession), or something you are (inherence). Option C (Password + SMS one-time code) combines knowledge (password) and possession (SMS code sent to a device). Option D (Smart card + PIN) combines possession (smart card) and knowledge (PIN).
Option A (Fingerprint + iris scan) is two inherence factors, not multi-factor. Option B (Password + security questions) is two knowledge factors. Option E (Two different passwords) is also two knowledge factors.
A security administrator is reviewing the principles of access control. Which TWO of the following are core components of the AAA framework? (Select TWO.)
Authorization determines access rights; it is a core AAA component.
Why this answer
The AAA framework consists of Authentication, Authorization, and Accounting. Authentication verifies the identity of a user or device (e.g., via RADIUS or TACACS+). Authorization determines what resources or actions the authenticated entity is permitted to access (e.g., via privilege levels or ACLs).
Accounting tracks and logs user activities for auditing and billing purposes. Therefore, Authorization (A) and Authentication (D) are two of the three core components of AAA.
Exam trap
ISC2 often tests that candidates confuse 'Identification' with 'Authentication' or think 'Auditing' is a core AAA component instead of 'Accounting', leading them to select B or E incorrectly.
Which TWO of the following are common indicators of a ransomware attack?
Encrypted file extensions are a common sign of ransomware.
Why this answer
Options D and E are correct because ransomware typically encrypts files and appends a new extension such as .encrypted (Option D) and displays a ransom note demanding payment for decryption (Option E). These are two of the most common indicators of a ransomware attack. In contrast, new user accounts (Option A) are not typically associated with ransomware, elevated system performance (Option B) is the opposite of what occurs, and a sudden decrease in network traffic (Option C) may indicate other issues but is not a direct indicator of ransomware.
Exam trap
ISC2 often tests the distinction between ransomware indicators and general malware or intrusion indicators, so candidates mistakenly associate user account creation (Option A) with ransomware when it is actually a lateral movement technique, not a direct ransomware artifact.
An organization requires that a financial transaction must be initiated by one employee and approved by a manager before processing. Which access control principle does this enforce?
Separation of duties prevents a single person from performing both initiation and approval.
Why this answer
Separation of duties ensures no single individual can complete a high-risk action alone, reducing fraud risk.
A company's business continuity plan includes an alternate work site with full IT capabilities. Which type of recovery site does this describe?
A hot site is fully operational with all necessary hardware, software, and data.
Why this answer
A hot site is a fully equipped alternate work site with all necessary IT infrastructure—servers, networking, telecommunications, and power—ready to take over operations immediately. The question specifies 'full IT capabilities,' which aligns with the hot site's purpose of enabling rapid failover with minimal downtime, typically within hours.
Exam trap
ISC2 often tests the distinction between hot, warm, and cold sites by emphasizing the 'full IT capabilities' phrase—candidates may confuse a warm site (which has some equipment) with a hot site, but the key differentiator is that a hot site is fully operational and ready for immediate use, while a warm site requires additional setup.
How to eliminate wrong answers
Option B (Mobile site) is wrong because a mobile site is a portable, temporary facility (e.g., a trailer) that may not have full IT capabilities pre-installed and is used for short-term emergencies, not as a permanent alternate work site with full IT readiness. Option C (Cold site) is wrong because a cold site provides only basic physical infrastructure (space, power, cooling) but lacks IT equipment, requiring days or weeks to procure and configure systems, which contradicts 'full IT capabilities.' Option D (Warm site) is wrong because a warm site has some pre-installed hardware and connectivity but not full IT capabilities; it typically requires additional configuration and data restoration before operations can resume, making it slower than a hot site.
A security analyst is reviewing firewall logs and notices an unusually high number of blocked outbound connections to a single external IP address. Which TWO actions should the analyst take to investigate this potential security incident? (Choose two.)
Threat intelligence can confirm if the IP is associated with malicious activity.
Why this answer
Investigating the source system helps determine if it is compromised; checking threat intelligence can reveal if the IP is known malicious.
Which TWO of the following are types of security controls?
Corrective controls remedy damage after an incident.
Why this answer
Preventive and corrective controls are recognized types. The other options are not standard categories or are too broad.
A security team is developing an incident response plan. Which THREE of the following are essential components of crisis communications during a data breach? (Choose three.)
Customers whose data was breached must be informed.
Why this answer
Crisis communications should include notifying affected customers, informing management, and complying with legal/regulatory notification requirements. Public relations is also involved, but the options focus on key stakeholders.
A company implements a policy where no single employee can approve a purchase order over $10,000. Instead, two managers must jointly approve it. Which security principle does this practice exemplify?
Requiring two approvals for high-risk actions prevents a single person from committing fraud.
Why this answer
Separation of duties ensures that no single individual has control over all critical functions, reducing the risk of fraud or error.
A company is selecting a recovery site strategy. Which TWO factors should be considered when choosing between a hot site and a warm site? (Select TWO.)
Hot sites are significantly more expensive than warm sites.
Why this answer
RTO and cost are primary differentiators: hot sites have shorter RTO but higher cost.
During a disaster recovery test, the recovery time objective (RTO) for a critical application is 4 hours, but the actual recovery takes 6 hours. Which of the following best describes the impact?
Matches the definition of RTO breach.
Why this answer
The recovery time objective (RTO) defines the maximum acceptable downtime for an application. Since the RTO is 4 hours but the actual recovery took 6 hours, the application was unavailable for 2 hours beyond the acceptable threshold, directly impacting business continuity. This is a failure to meet the RTO, not the RPO, which concerns data loss.
Exam trap
ISC2 often tests the distinction between RTO and RPO, and the trap here is confusing the two metrics — candidates may incorrectly associate a recovery time failure with data loss (RPO) instead of availability (RTO).
How to eliminate wrong answers
Option A is wrong because data loss is measured by the recovery point objective (RPO), not the RTO; exceeding the RTO does not imply any data loss. Option B is wrong because the RPO is a separate metric that defines the maximum acceptable age of data in the recovery copy; the scenario does not mention any data loss or failure to meet the RPO. Option D is wrong because RTO is a contractual or policy-driven requirement, not a guideline; exceeding it represents a non-compliance that can have serious operational and financial consequences.
You are the incident response lead for a financial services company. At 09:00, the SOC detects unusual outbound traffic from a server in the DMZ to an external IP known to be a command-and-control (C2) server. The server runs a legacy application that cannot be patched. The server is critical for customer transactions, but an alternate manual process can sustain operations for up to 4 hours. The CTO wants to keep the server online to avoid customer impact. The CEO is concerned about data exfiltration. The compliance officer reminds you of regulatory requirements to report breaches within 72 hours. Which action should you take FIRST?
Immediate containment stops the C2 communication and protects data.
Why this answer
The correct first action is to disconnect the server from the network and activate the manual process. This immediately stops potential data exfiltration to the C2 server and contains the incident, aligning with the NIST incident response lifecycle's containment phase. Since the server runs a legacy application that cannot be patched and the manual process can sustain operations for up to 4 hours, isolation is both feasible and necessary to prevent further compromise while maintaining business continuity.
Exam trap
ISC2 often tests the principle that containment must precede any other action, even when business pressure or regulatory deadlines exist, to prevent candidates from prioritizing reporting or analysis over stopping the active threat.
How to eliminate wrong answers
Option A is wrong because reporting to the regulatory authority immediately (within 72 hours) is a post-containment step; the priority is to stop the active C2 communication and data loss first. Option B is wrong because performing forensic analysis on a live, compromised server connected to a C2 server risks altering evidence and allows continued data exfiltration; containment must precede forensics. Option D is wrong because keeping the server online under close monitoring does not stop the active outbound traffic to the C2 server, allowing ongoing data exfiltration and potential lateral movement, which violates the containment principle.
Refer to the exhibit. A security analyst runs the above iptables command on a Linux server. The server is configured with a default policy of DROP on the INPUT chain. Users report they can SSH to the server but cannot ping it. What is the most likely reason?
Outgoing echo replies require an OUTPUT chain rule to be allowed.
Why this answer
The displayed iptables rules only govern the INPUT chain, which controls incoming packets. While the rule allows incoming ICMP echo requests (type 8), the server's response—an ICMP echo reply (type 0)—is an outgoing packet that must traverse the OUTPUT chain. If the OUTPUT chain has a default policy of DROP or lacks an explicit ACCEPT rule for ICMP echo replies, the replies are dropped, preventing ping from working even though SSH succeeds (since SSH uses TCP, which is handled differently).
Exam trap
ISC2 often tests the misconception that a single chain (INPUT) controls all traffic to and from the server, leading candidates to overlook the fact that outgoing packets (like ICMP echo replies) are filtered by the OUTPUT chain, not the INPUT chain.
How to eliminate wrong answers
Option A is wrong because the default policy DROP on the INPUT chain does drop unmatched packets, but echo replies are not incoming packets from the server's perspective; they are outgoing. The ESTABLISHED,RELATED rule would only match incoming packets that are part of an established connection, but ICMP is connectionless, and the echo reply is not considered RELATED to the echo request in the context of iptables' conntrack module unless explicitly configured. Option B is wrong because the order of rules is irrelevant here; the ICMP rule is evaluated for new ICMP packets, but the issue is that the echo reply is not an incoming packet on the INPUT chain—it is an outgoing packet on the OUTPUT chain.
Option C is wrong because the ACCEPT rule for ICMP permits echo request (type 8) correctly, but ping requires the server to send echo replies (type 0), which are outgoing and not governed by the INPUT chain; the rule does not need to allow echo replies on INPUT.
Which THREE of the following are recognized security control types according to ISC2? (Choose three.)
Technical controls include firewalls, encryption, etc.
Why this answer
(Technical) is correct because ISC2 recognizes technical controls as a primary security control type, encompassing mechanisms like firewalls, encryption, and intrusion detection systems that enforce security policies through technology. These controls operate at the system or network level to protect assets directly.
Exam trap
ISC2 often tests the distinction between control types and control functions (like deterrent, detective, preventive), causing candidates to mistakenly select 'deterrent' as a type instead of recognizing it as a function that can be fulfilled by any of the three recognized types.
A security administrator is implementing measures to protect log integrity. Which of the following is the most effective method to prevent tampering with logs after they are generated?
Correct. Write-once media prevents modification after writing.
Why this answer
Write-once storage (e.g., WORM) ensures logs cannot be altered or deleted, preserving integrity.
During a security incident, a forensic analyst needs to acquire the contents of RAM from a live system. Which tool should be used?
DumpIt captures volatile memory contents without powering down the system.
Why this answer
DumpIt is a specialized memory dump tool designed for live RAM acquisition. Options A, B, and D are incorrect as they are used for disk cloning, network monitoring, and antivirus scanning respectively, not memory acquisition.
A visitor signs in at a company's reception, receives a badge, and is escorted throughout the building. This process is part of which type of access control?
Visitor management is a physical security measure.
Why this answer
Visitor management includes sign-in, badge issuance, and escort policies, all of which are physical access controls to secure the premises.
A small financial firm has a single server that hosts a critical database and also runs a web application. The server is located in a closet with a simple lock. An intern accidentally left the closet door open, and an unauthorized person gained physical access, connected a laptop to the server, and copied the database. The company wants to prevent such incidents in the future. Which of the following is the most effective course of action?
Separating the database and encrypting it reduces the risk of data theft from physical access.
Why this answer
Moving the database to a separate server and encrypting it reduces the risk of data theft from physical access. CCTV is detective, 2FA protects remote access, and strong ACLs can be bypassed with physical control of the server.
A company stores customer records that include names, addresses, and Social Security numbers. According to ISC2 Code of Ethics, which canon has the highest priority when handling this sensitive data?
Correct. This is the first and highest priority canon.
Why this answer
The Code of Ethics prioritizes: Protect society, the common good, and the public trust first.
A security analyst discovers that an employee shared their password with a colleague to complete a task. Which security principle has been violated?
Password sharing undermines accountability because actions cannot be tied to a specific individual.
Why this answer
Accountability relies on unique identification. Password sharing breaks this link.
An organization implements encryption for data at rest and in transit. Which principle of the CIA triad is primarily being addressed?
Correct. Encryption protects data from unauthorized disclosure.
Why this answer
Encryption ensures data is not readable by unauthorized parties, thereby protecting confidentiality.
A company wants to implement a security control that ensures users are who they claim to be before granting access to a system. Which type of control should they prioritize?
Authentication verifies identity, which is the first step in access control.
Why this answer
Authentication verifies identity. Authorization determines permissions. Accounting tracks actions.
Auditing reviews logs.
An organization labels data as 'Confidential' and requires encryption both at rest and in transit. This classification is an example of:
Data classification assigns labels and dictates protection requirements.
Why this answer
Data classification labels (e.g., Confidential) define handling requirements, such as encryption, to protect the data.
A bank implements a policy that requires two different employees to approve any wire transfer over $10,000. One employee initiates the transfer, and another approves it. This is an example of which access control principle?
Separation of duties requires multiple people to complete a sensitive action, preventing fraud.
Why this answer
Separation of duties prevents any single individual from having complete control over a high-risk action, reducing the risk of fraud.
An organization uses a primary data center and a backup site 500 miles away. The backup site replicates data synchronously. Which risk is MOST likely introduced by this configuration?
Synchronous replication requires acknowledgment from backup, causing latency proportional to distance.
Why this answer
Synchronous replication requires the primary site to wait for an acknowledgment from the backup site before completing each write operation. The 500-mile distance introduces a minimum round-trip latency of approximately 8-10 ms (based on fiber optic propagation at ~200 km/ms), which directly increases the time taken for write operations. This latency impact is the most likely risk introduced by this configuration.
Exam trap
ISC2 often tests the distinction between synchronous and asynchronous replication, and the trap here is that candidates confuse 'synchronous' with 'high RPO' or assume bandwidth is the main constraint, when in fact synchronous replication introduces latency as the primary risk due to the distance-dependent acknowledgment delay.
How to eliminate wrong answers
Option A is wrong because synchronous replication ensures that data is written to both sites before acknowledging the write, resulting in an RPO of zero (no data loss), not high RPO. Option B is wrong because data encryption overhead is a general security concern unrelated to the replication method or distance; it applies equally to any encrypted data transfer. Option C is wrong because insufficient bandwidth between sites is a capacity planning issue that can affect replication throughput but is not inherently introduced by synchronous replication or distance; latency is the primary risk, not bandwidth.
According to the (ISC)² Code of Ethics, which principle has the highest priority?
Protect society is the first and highest priority.
Why this answer
The (ISC)² Code of Ethics prioritizes protecting society, the common good, and public safety above all.
Which access control model uses subject and object labels to enforce access based on a security policy?
MAC uses labels and a central policy to control access.
Why this answer
Mandatory Access Control (MAC) enforces access decisions based on security labels assigned to subjects (users/processes) and objects (files/resources). The system, not the user, controls access by comparing these labels against a security policy, such as Bell-LaPadula or Biba. This is why MAC is the correct answer for label-based enforcement.
Exam trap
ISC2 often tests the misconception that ABAC uses labels (since attributes can be labels), but the key distinction is that MAC uses mandatory, system-enforced labels tied to a security policy, whereas ABAC evaluates attribute-based rules dynamically without fixed subject/object labels.
How to eliminate wrong answers
Option A is wrong because Discretionary Access Control (DAC) allows the owner of an object to set permissions at their discretion, using Access Control Lists (ACLs) or owner-based rights, not system-enforced labels. Option B is wrong because Attribute-Based Access Control (ABAC) uses attributes (e.g., user role, time, location) evaluated against policies, but it does not rely on fixed subject/object labels as the primary enforcement mechanism. Option D is wrong because Role-Based Access Control (RBAC) assigns permissions based on predefined roles (e.g., 'admin', 'viewer'), not on security labels that compare subject and object classifications.
An organization wants to ensure that an email message has not been altered during transmission. Which security control should be used?
Digital signatures use hashing and asymmetric encryption to verify integrity and authenticity.
Why this answer
Digital signatures provide integrity and non-repudiation by detecting any changes to the message.
Refer to the exhibit. What is the first action the incident responder should take?
Investigating the target server will confirm whether the attack succeeded and what data may be compromised.
Why this answer
The incident responder must first investigate the web server at 192.168.1.10 to confirm whether the alert is a true positive or a false positive. Jumping to containment actions like disabling the application or blocking the IP without verification could disrupt legitimate services or overlook the root cause. The initial step in any incident response process (as per NIST SP 800-61) is to validate the alert through analysis of logs, processes, and system state.
Exam trap
ISC2 often tests the candidate's understanding that the first step in incident response is always to investigate and validate the alert, not to immediately contain or dismiss it, tempting candidates to jump to a reactive action like blocking the IP or disabling the application.
How to eliminate wrong answers
Option A is wrong because disabling the web application immediately could cause unnecessary business disruption and may destroy volatile evidence (e.g., running processes, memory contents) before the incident is confirmed. Option B is wrong because blocking the source IP in the firewall is a containment action that should only occur after the alert is verified and the scope of the incident is understood; premature blocking could also block legitimate traffic if the IP is spoofed or shared. Option C is wrong because ignoring the alert as a false positive without investigation violates the fundamental incident response principle of 'trust but verify' and could allow an actual breach to go undetected.
What is the primary purpose of hashing in information security?
Hashing produces a digest that changes if the data is modified, ensuring integrity.
Why this answer
Hashing is used to verify data integrity by detecting changes to the data.
Which TWO are principles of access control?
Principle that no single person has excessive control.
Why this answer
Separation of duties is a principle of access control that prevents any single individual from having excessive control over critical processes by dividing tasks and privileges among multiple people. This reduces the risk of fraud or error, as collusion is required to bypass controls. It is a foundational concept in security frameworks like NIST SP 800-53 and is often enforced through role-based access control (RBAC) policies.
Exam trap
ISC2 often tests the distinction between access control principles (like least privilege and separation of duties) and access control mechanisms or technologies (like multifactor authentication and SSO), causing candidates to confuse a method for a principle.
A company's backup strategy requires daily full backups of all servers. The backup window is 4 hours. What is the primary risk if backups consistently take longer than the window?
Overlapping backups can degrade system performance.
Why this answer
When backups consistently exceed the 4-hour window, they overlap with production hours, causing resource contention (CPU, I/O, network bandwidth) that degrades application performance and user experience. This directly risks production operations, as backup jobs compete with live workloads for system resources.
Exam trap
ISC2 often tests the misconception that exceeding a backup window is a compliance or storage issue, when the core risk is operational interference with production workloads.
How to eliminate wrong answers
Option A is wrong because compliance requirements typically mandate that backups exist, not that they complete within a specific window; exceeding the window does not inherently violate compliance unless the backup itself fails or is absent. Option B is wrong because backup media filling up is a capacity planning issue unrelated to the backup window duration; it occurs when retention policies or data growth are mismanaged, not when backups run long. Option D is wrong because backups being corrupted is a data integrity issue caused by hardware faults, software bugs, or network errors, not by the backup taking longer than the window.
An organization wants to ensure that its backup strategy can recover data within 2 hours after a system failure. Which metric should be defined in the disaster recovery plan?
Specifies the maximum time to restore services after a disaster.
Why this answer
The Recovery Time Objective (RTO) defines the maximum acceptable time to restore systems and data after a disaster, directly addressing the 2-hour recovery requirement. In the context of backup strategy, RTO drives decisions on failover mechanisms, replication speed, and restoration procedures to meet the specified downtime limit.
Exam trap
ISC2 often tests the distinction between RTO and RPO, where candidates mistakenly choose RPO because they confuse 'recovery of data' with 'time to recover' rather than 'point in time to which data is recovered'.
How to eliminate wrong answers
Option A is wrong because Mean Time Between Failures (MTBF) measures the average time between system failures, not recovery time, and is used for reliability planning rather than disaster recovery timelines. Option B is wrong because Recovery Point Objective (RPO) defines the maximum acceptable data loss measured in time (e.g., 15 minutes of lost transactions), not the time to restore operations. Option C is wrong because a Service Level Agreement (SLA) is a contractual commitment that may include RTO/RPO targets but is not itself a metric; it is an agreement, not a specific recovery time measurement.
A company decides to accept the risk of using a legacy system because the cost of replacing it exceeds potential losses. This is an example of:
The company accepts the risk as is.
Why this answer
Risk acceptance means acknowledging the risk and not taking further action.
A security analyst needs to ensure that log data cannot be altered after it is written. Which of the following is the most effective method to protect log integrity?
Write-once media prevents modification of stored data.
Why this answer
Write-once storage (e.g., WORM drives) ensures data cannot be modified, deleted, or overwritten, preserving integrity.
A security architect is evaluating a biometric authentication system. The system's false positive rate is 0.1%, and the false negative rate is 2%. Which security principle is most compromised if the organization prioritizes user convenience over security?
Prioritizing convenience often involves lowering security thresholds to reduce false negatives, which increases false positives. This leads to unauthorized users gaining access, directly breaking confidentiality.
Why this answer
When the organization prioritizes user convenience over security, they may lower the biometric system's threshold to reduce false negatives (improving availability by letting more legitimate users in). However, this increases the false positive rate, allowing unauthorized users to be authenticated. This directly compromises confidentiality, as unauthorized access to systems and data can occur.
Availability is initially improved (not compromised) by this action, so it is not the principle most compromised. Therefore, the correct answer is A (Confidentiality).
Match each authentication factor to an example.
Drag a concept onto its matching description — or click a concept then click the description.
Password
Smart card
Fingerprint
GPS location
Why these pairings
Multi-factor authentication (MFA) requires at least two distinct types of factors. Knowledge (something you know), possession (something you have), inherence (something you are), and location (somewhere you are) are common categories.
Application proxy examines application-layer content.
A visitor enters a company building and is required to sign in, present identification, and wear a visitor badge. This is an example of which type of access control?
Visitor management involves physical security measures.
Why this answer
Visitor management procedures are part of physical access controls to monitor and restrict entry.
A company's security policy requires that all sensitive data be encrypted during transfer. A security administrator discovers that an internal web application is using a self-signed TLS certificate. What vulnerability does this introduce?
Without a trusted CA, clients cannot confirm the server's identity, allowing interception.
Why this answer
A self-signed TLS certificate is not signed by a trusted Certificate Authority (CA), so clients cannot verify the certificate's authenticity. This allows an attacker to intercept the TLS handshake, present their own self-signed certificate, and perform a man-in-the-middle (MITM) attack, decrypting and reading or modifying the data in transit.
Exam trap
ISC2 often tests the misconception that self-signed certificates mean TLS is not used, but the trap here is that TLS is still active; the real issue is the lack of certificate validation, which opens the door to MITM attacks.
How to eliminate wrong answers
Option A is wrong because data corruption refers to accidental bit flips or storage errors, not to the security weakness introduced by an untrusted certificate. Option B is wrong because increased latency is a performance issue, not a security vulnerability; self-signed certificates do not inherently cause more network delay than CA-signed certificates. Option C is wrong because TLS is still used with a self-signed certificate; the vulnerability is not the absence of TLS but the inability to verify the server's identity, which enables MITM attacks, not replay attacks (which are prevented by TLS sequence numbers and timestamps).
In a MAC environment implementing Bell-LaPadula, a subject with Secret clearance attempts to read an object classified as Confidential and write to an object classified as Top Secret. Which operations are permitted?
Both operations are permitted under Bell-LaPadula's mandatory access control principles. The subject, with Secret clearance, is allowed to read the Confidential object because this satisfies the Simple Security Property, which permits reading down to lower classifications. Concurrently, writing to the Top Secret object is permitted as it adheres to the \*-Property (Star Property), which allows writing up to higher classifications. This design ensures information only flows upwards, preventing unauthorised disclosure.
Why this answer
In Bell-LaPadula, the Simple Security Property (no read up) prevents a subject from reading an object at a higher classification, but reading down is allowed. The *-Property (no write down) prevents writing to a lower classification, but writing up is allowed. Since the subject has Secret clearance, reading Confidential (lower) is permitted, and writing to Top Secret (higher) is permitted, so both operations are allowed.
Exam trap
ISC2 often tests the misconception that both read and write must be at the same clearance level, but Bell-LaPadula actually allows reading down and writing up, not the reverse.
How to eliminate wrong answers
Option A is wrong because it claims read is denied, but reading down (Secret reading Confidential) is allowed by the Simple Security Property. Option C is wrong because it claims write is denied, but writing up (Secret writing to Top Secret) is allowed by the *-Property. Option D is wrong because it claims both are denied, but both operations are actually permitted under Bell-LaPadula rules.
Which common port is used by DNS and which transport layer protocol does it primarily use?
Correct. DNS uses UDP for queries and TCP for zone transfers.
An organization enforces a password policy requiring a minimum of 15 characters with no complexity requirements, and does not force periodic changes. This policy aligns with which current best practice?
NIST SP 800-63 recommends longer passwords and only forced changes upon compromise.
Why this answer
NIST SP 800-63 recommends favoring length over complexity and avoiding frequent forced changes unless compromised.
A network administrator is implementing a defense-in-depth strategy. Which THREE of the following are considered network security controls? (Select THREE)
VPN provides encrypted tunnels for secure communication over untrusted networks, a network security control.
Why this answer
A Virtual Private Network (VPN) is a network security control because it creates an encrypted tunnel (using protocols such as IPsec or TLS) between a remote user and the corporate network, ensuring data confidentiality and integrity over untrusted networks like the internet. This protects data in transit and authenticates endpoints, which is a core network-layer security function.
Practice CC by domain
Target a specific domain to shore up weak areas.