ISC2 Certified in Cybersecurity CC (CC) — Questions 826–900

The primary factors are recovery time objective (RTO) and cost. Hot sites provide fast RTO but are expensive; warm sites are cheaper but have longer RTO.

Honeypots are decoy systems designed to attract attackers, provide early warning, and allow analysis of attacker techniques. They do not contain real production data and are not used for legitimate traffic.

NIST SP 800-61 defines the incident response process as four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity. The 'Containment, Eradication, and Recovery' phase is explicitly grouped together as a single phase in the standard, making A a correct choice.

Authentication logs typically record privilege escalation events, such as when a user is added to an admin group or granted elevated rights.

UDP is connectionless and faster, making it suitable for real-time applications like VoIP where occasional packet loss is acceptable.

PII includes any data that can identify an individual. Social Security Number (SSN) and email address are both considered PII because they can be used to identify a person.

Type 2 factors are something you have, such as a physical token.

Recovery is the phase after eradication where systems are restored and tested.

Defense in depth involves multiple overlapping controls, such as requiring both a badge and a biometric scan.

ARP (Address Resolution Protocol) maps IP addresses to MAC addresses, operating at Layer 2/3 boundary.

MFA requires two or more different factor types. Password (knowledge) + SMS code (possession) and smart card (possession) + fingerprint (inherence) qualify.

Authentication logs show user logins to different systems (lateral movement), and firewall logs show connections between internal hosts. System logs may show service creation but are not as direct.

Risk treatment options include mitigation, transfer, avoidance, and acceptance. All four are correct, but only three are listed.

Subnetting divides a larger network into smaller, logical subnetworks by manipulating the subnet mask (e.g., using VLSM or CIDR). This creates separate broadcast domains at Layer 3, allowing administrators to isolate traffic and apply distinct security policies between subnets, which is a core function of network segmentation.

Containment is the phase where actions are taken to stop the incident from spreading or causing further damage, such as isolating affected systems.

Identification is claiming an identity; authentication is proving that identity.

Typical lockout thresholds are between 3 and 10 failed attempts to balance security and usability.

Need-to-know restricts access to data required for job duties; the employee should not have accessed the document if it wasn't job-related. Least privilege ensures users have only necessary permissions; the employee likely had excessive rights if they could access unrelated data.

The policy grants users only the permissions necessary to perform their job functions, which is the core definition of least privilege. By restricting access to only required resources, the policy minimizes the attack surface and limits potential damage from compromised accounts.

Windows security event logs (specifically Event ID 4663) record every attempt to access an object, including files, and include the user's security identifier (SID) and the requested access mask. This allows the SIEM to correlate the user's identity with the file's discretionary access control list (DACL) to detect an 'Access Denied' result, making it the definitive source for detecting unauthorized file access attempts.

Sensitive PII includes medical records, financial information, and biometrics, which require extra protection.

Perimeter controls secure the outer boundary. Fencing and lighting are common perimeter controls; badges and biometrics are interior or point-of-entry controls.

Due care means exercising a minimum standard of care to protect information assets, such as implementing basic security controls.

A stateful firewall maintains a state table to track active connections, allowing it to make decisions based on the context of the traffic.

The analyst's first priority is to determine whether the attack was actually successful or was already mitigated. A Web Application Firewall (WAF) sits in front of the web application and can inspect and block SQL injection payloads before they reach the database. By verifying the WAF logs, the analyst can confirm if the attack was blocked, which dictates the next steps—if blocked, no immediate escalation is needed; if not blocked, further investigation is required.

Key factors: cost, recovery time objective (RTO), and data synchronization capabilities. Geography and vendor lock-in are considerations but not primary for site type selection.

Preparation (D), Detection and Analysis (A), and Containment, Eradication, and Recovery (C) are the core phases. Vulnerability scanning (B) is part of ongoing security, not incident response. Post-incident auditing (E) is a compliance activity.

The scenario describes a potential security incident—unauthorized access to sensitive data from an unfamiliar IP address outside business hours—which requires immediate activation of the incident response process. The first step in any security operations workflow is to follow the organization's incident response plan (NIST SP 800-61) to contain, analyze, and remediate the threat. Jumping to forensic analysis, password resets, or account disabling without a coordinated incident response can destroy evidence or fail to address the root cause.

A differential backup copies all changes since the last full backup, making it distinct from incremental which copies changes since the last backup of any type.

Defense in depth is the correct principle because it involves implementing multiple layers of security controls (firewalls, IDS, ACLs) to protect assets, ensuring that if one layer fails, others still provide protection. Separation of duties (B) divides tasks among multiple people to prevent fraud, least privilege (C) limits access rights to only what is necessary, and need-to-know (D) restricts access to information required for job functions—none of these directly address the use of multiple security layers.

Separation of duties requires multiple people to complete a critical task, reducing fraud risk.

Legal counsel approval is required before contacting law enforcement because they ensure that the disclosure complies with data privacy laws (e.g., GDPR, CCPA) and does not violate chain-of-custody requirements or expose the organization to liability. The incident response team must coordinate with legal to determine the appropriate timing and scope of law enforcement involvement, as premature contact can compromise ongoing forensic investigations or breach legal agreements.

Initial communication should confirm the disaster, provide initial instructions, and outline next steps without revealing sensitive details.

Sensitive PII includes medical records, financial account numbers, and biometric data. Name and phone number are general PII.

NIST SP 800-63 recommends favoring password length over complexity, with a minimum of 8 characters (or 15+ for high assurance) and avoiding frequent forced changes unless compromised.

A host-based firewall on each critical server can enforce the security policy by blocking direct SSH connections (TCP port 22) from any source other than the jump server's IP address. This ensures that all administrative access must go through the jump server, where logging is already in place, without disrupting legitimate operations through the authorized path.

Digital signatures provide integrity and non-repudiation.

The analysis phase involves examining the incident to determine the root cause, scope, and impact.

RPO (Recovery Point Objective) defines the maximum acceptable amount of data loss measured in time, such as seconds, minutes, or hours. It determines the age of the backup or replication data that must be restored to resume normal operations after a disaster. For example, an RPO of 1 hour means the organization can tolerate losing up to 1 hour's worth of data.

Work Recovery Time (WRT) is the time needed after systems are restored to return to normal operations, distinct from RTO which is the time to restore functionality.

Requiring authentication for shared links ensures that only intended recipients can access the data, reducing the risk of public exposure. Disabling all sharing is too restrictive. Watermarking and encryption do not prevent sharing to unauthorized users.

Account lockout is a logical access control that detects and mitigates brute-force attacks.

Type 2 factors are something you have; a smart card and a hardware token are physical devices.

The (ISC)² Code of Ethics has four canons in order of priority: Protect society, the common good, necessary public trust and confidence, and the infrastructure; Act honorably, honestly, justly, responsibly, and legally; Provide diligent and competent service to principals; Advance and protect the profession.

Separation of duties (SoD) is an access control concept that requires a critical task, such as a financial transaction, to be split into multiple steps performed by different individuals. This prevents any single employee from having the authority to both initiate and approve a transaction, thereby reducing the risk of fraud or error. In this scenario, the policy directly enforces SoD by ensuring that no one person can complete the entire process alone.

Medical records are sensitive PII because they can cause significant harm if disclosed.

SSL/TLS is a common method to secure VPN connections, typically used in SSL VPNs. It operates at the transport layer (Layer 4) and provides encryption, authentication, and integrity for data transmitted over the internet, often using port 443 to bypass firewalls. This makes it ideal for remote access VPNs where clients connect via a web browser or a lightweight client.

Baselining normal traffic patterns during peak business hours establishes a reference of legitimate network behavior, which is essential for a NIDS to distinguish benign anomalies from actual threats. Without this baseline, the NIDS may generate false positives by flagging legitimate peak-hour traffic spikes as malicious. This aligns with the principle that anomaly-based detection relies on a statistical model of normal activity to reduce noise.

Risk acceptance is acknowledging the risk and deciding not to mitigate it.

Configuring a site-to-site VPN between two routers requires a specific sequence: first establish IKE policy and pre-shared keys for authentication, then define the IPsec transform set for encryption and integrity, then specify interesting traffic via a crypto ACL, then create and apply the crypto map to the outgoing interface, and finally verify the tunnel. This order ensures all security parameters are correctly bound and operational.

Correct: D - Accountability. Disabling accounts ensures that actions are traceable to active employees, preventing unauthorized use and maintaining accountability. Option A (Availability) is about ensuring systems are accessible; Option B (Integrity) is about data accuracy; Option C (Confidentiality) is about data secrecy.

An Intrusion Detection System (IDS) is passive, monitoring and alerting without blocking traffic, unlike an IPS which is inline.

It implements the principle of least privilege for a DMZ: it allows inbound HTTP/HTTPS traffic (ports 80/443) to the public-facing web server, then permits only the web server to initiate outbound connections to the database server on port 3306 (MySQL/MariaDB default), and denies all other traffic. This ensures the database is not directly accessible from the internet, reducing the attack surface while still supporting the required application flow.

The principle of least privilege dictates that a user should be granted only the permissions necessary to perform their job functions. This minimizes the attack surface and limits potential damage from accidental or malicious actions. In practice, this means assigning specific roles or access control lists (ACLs) rather than broad permissions.

An IPS (Intrusion Prevention System) is inline and can block attacks. IDS is passive.

The scenario explicitly states that the application team lacks the necessary privileges to promote the standby database. This indicates that the disaster recovery plan did not define role-based access controls (RBAC) or assign failover permissions to specific personnel or groups. Without documented roles and privileges, even a fully replicated standby database cannot be promoted, causing a failover gap.

WPA3-SAE (Simultaneous Authentication of Equals) is a common method to authenticate users on a wireless network because it replaces the pre-shared key (PSK) exchange with a secure password-based authentication protocol that is resistant to offline dictionary attacks. It uses a Diffie-Hellman key exchange combined with a shared password to derive a Pairwise Master Key (PMK), ensuring forward secrecy and mutual authentication.

It demonstrates the principle of least privilege by using a separate standard user account for daily tasks and elevating to an administrative account only when necessary. This minimizes the attack surface by ensuring that administrative privileges are not active during routine activities, reducing the risk of accidental system changes or malware execution with elevated rights. In Windows environments, this is commonly implemented via User Account Control (UAC) and the use of a standard vs. administrator account.

GDPR requires notification within 72 hours of becoming aware of the breach.

OU stands for Organizational Unit in LDAP DNs.

ARP spoofing (or ARP poisoning) involves sending forged ARP messages to associate the attacker's MAC with the IP of another device (e.g., default gateway), enabling traffic interception.

HTTPS uses port 443 and is encrypted using SSL/TLS.

ARP (Address Resolution Protocol) maps IP to MAC addresses.