ISC2 Certified in Cybersecurity CC (CC) — Questions 901–975

The log pattern shows the internal web server (10.0.1.100) sending traffic to an external host (203.0.113.50). In a typical network, internal web servers serve content to internal users, not initiate outbound connections to external hosts. This anomalous outbound traffic pattern, especially if it involves a high volume of packets or connections, is characteristic of a denial-of-service (DoS) attack where the internal server is used as a source to flood the external target, potentially due to compromise or misconfiguration.

Setting the IP ID field to 0 and the DF flag in packets is characteristic of an idle scan (also known as a stealth scan). This technique uses a zombie host (with an incremental IP ID) to probe a target; by sending packets with DF set and IP ID 0 to the zombie, the attacker can observe changes in the zombie's IP ID to infer open ports on the target, thereby hiding the attacker's true IP address.

Attribute-based access control (ABAC) is the correct model because it evaluates access decisions based on a combination of user attributes (e.g., department, clearance), resource attributes, and environmental conditions (e.g., time of day, location). Unlike RBAC, which relies solely on predefined roles, ABAC uses policies that can incorporate dynamic factors like current time or threat level, making it ideal for fine-grained, context-aware enforcement.

Differential backup includes changes since last full backup.

A vulnerability is a weakness that can be exploited by a threat to cause harm.

The 'need to know' principle restricts access to information based on the specific requirements of a user's role or project. In this scenario, the analyst must verify if the user's project actually required access to those specific files, not just if the user had the technical ability to access them. This principle is a subset of least privilege, focusing on data access rather than system permissions.

Common malware types include viruses (need host), worms (self-spreading), and trojans (deceptive). Distractors confuse their replication methods.

Redundancy supports availability by minimizing downtime.

Medical records and financial account numbers are considered sensitive PII and should be classified as confidential or restricted. Common classification labels include 'Confidential', 'Restricted', and 'Sensitive'. In many frameworks, 'Confidential' and 'Restricted' are used for highly sensitive data. 'Sensitive' is also a common label. 'Public' and 'Internal' are not appropriate for this level of sensitivity.

The (ISC)² Code of Ethics includes four canons: Protect society, the common good, necessary public trust and confidence, and the infrastructure; Act honorably, honestly, justly, responsibly, and legally; Provide diligent and competent service to principals; and Advance and protect the profession. Reporting vulnerabilities to the vendor protects society. Refusing to share confidential credentials demonstrates honorable behavior.

Separation of duties ensures that no single individual has control over two or more phases of a critical transaction, such as both approving and disbursing payments. By splitting these responsibilities, the organization reduces the risk of fraud or error because collusion between two or more people would be required to bypass controls. In payment systems, this is often enforced through dual-authorization workflows in ERP or financial management software.

Risk acceptance means acknowledging the risk and choosing not to mitigate it, often due to cost-benefit analysis.

A stateful firewall tracks the state of active connections and can block unsolicited inbound traffic. Packet filtering is stateless, and application inspection is typical of proxy firewalls.

Traffic filtering, rate limiting, and using a CDN can help absorb DDoS traffic. Changing IP addresses is reactive and not a standard mitigation; disabling ICMP may help against some attacks but is not a primary mitigation.

Recovery time objectives (RTOs) define the maximum acceptable downtime for a system or application after a disaster. They are essential because they directly drive the design of the recovery strategy, including resource allocation and technology choices, ensuring that critical services are restored within the business's tolerance for interruption.

Due diligence involves investigating and assessing risks before making decisions, such as vendor selection.

A warm site has partially configured infrastructure but no current data, leading to RTO of days.

A smart card is a physical item you possess, making it Type 2.

A hot site is fully configured with current data and systems, allowing recovery within hours.

Defense in depth for physical security involves multiple layers: external perimeter controls (fencing, bollards, lighting), building entrance controls (guards, access badges, mantraps), and internal controls (server room biometric readers, equipment locks). Together they create overlapping barriers.

Data classification assigns sensitivity labels to enable appropriate protection.

The policy includes both an allow for the 10.0.0.0/16 range and a more specific deny for the 10.0.1.0/24 subnet. Since 10.0.1.5 falls within the deny condition, the explicit deny overrides the allow, resulting in denied access.

Risk avoidance, mitigation, transfer, and acceptance are standard. Risk identification is a step, not treatment. Risk duplication is not a term.

Confidentiality, Integrity, and Availability are the three core principles. Authentication and Non-repudiation are additional security goals.

Sensitive PII includes information that, if disclosed, could cause significant harm. Medical records and Social Security numbers are both considered sensitive PII because their exposure can lead to identity theft, discrimination, or other serious consequences. Phone numbers and name/email combinations are typically not classified as sensitive PII on their own.

Account lockout policies typically include an attempt threshold (e.g., 3-10 failed attempts) and a lockout duration or manual unlock requirement to prevent continuous brute-force attempts. These settings directly limit an attacker's ability to guess passwords.

The correct sequence to implement a firewall rule for inbound HTTPS traffic is: first define the source and destination zones to control traffic direction, then specify the protocol (TCP) and destination port (443) for HTTPS, next set the action to 'allow', and finally save and apply the rule. Zones provide context, the port identifies the service, the action permits the traffic, and saving ensures the rule is active. Common mistakes include swapping the order of zones and port specification, setting the action prematurely, or saving before defining the action.

The logs show repeated failed login attempts from the same IP address. This pattern is characteristic of a brute-force attack, where an attacker tries many password combinations to gain unauthorized access. Phishing involves tricking users into revealing credentials, SQL injection targets database queries, and port scans probe for open ports.

Sniffing captures sensitive data, violating confidentiality.

Checksum mismatch indicates data corruption on one side. The first step is to verify data integrity on the primary to determine which copy is correct.

The RTO (Recovery Time Objective) defines the maximum acceptable downtime, not the guaranteed recovery time. A hot standby site is fully operational and synchronized, so recovery can be completed in less than the RTO if the disaster does not cause additional complications. Option D is correct because the expected recovery time should be less than the 2-hour RTO, assuming the hot site functions as designed.

Type 2 (possession) factors include something the user has, such as a smart card, OTP token, or mobile authenticator app.

During the identification phase of incident response, the goal is to detect and confirm that an incident is occurring. Correlating alerts from multiple sources (e.g., IDS/IPS logs, firewall logs, and endpoint detection) helps reduce false positives and provides a clearer picture of the attack chain. Reviewing system logs for anomalies is a core detection technique that can reveal indicators of compromise (IoCs) such as unusual process execution or failed login bursts.

Confidentiality ensures that information is not disclosed to unauthorized individuals, entities, or processes. Encryption and access controls are primary mechanisms to enforce confidentiality.

The principle of least privilege dictates that users should be granted only the permissions necessary to perform their job functions and nothing more. In an identity management system, this is implemented by assigning minimal access rights to resources, reducing the attack surface and limiting potential damage from compromised accounts. This directly aligns with the scenario of ensuring users can only access resources essential for their roles.

A Business Impact Analysis (BIA) is essential in a BCP because it identifies critical business functions, their dependencies, and the impact of disruptions. It quantifies the financial and operational consequences of downtime, directly informing the selection of recovery strategies and resource allocation. Without a BIA, the BCP lacks a data-driven foundation for prioritizing recovery efforts.

Containment aims to limit damage. Filtering traffic and disconnecting affected systems are typical containment actions for a DoS attack.

A Web Application Firewall (WAF) is designed to filter and monitor HTTP/HTTPS traffic, often using OWASP rules to protect against web vulnerabilities.

Isolating the internal host immediately stops the potential command-and-control (C2) communication with the SpyEye botnet, preventing data exfiltration or further compromise. This is the first step in incident response (containment) before any forensic analysis or remediation, as per NIST SP 800-61 guidelines. Delaying containment could allow the botnet to receive new instructions or spread laterally.

According to vulnerability management best practices, the first step after discovering a critical vulnerability is to schedule a maintenance window to apply a patch or mitigation in a controlled manner. This minimizes service disruption and allows for testing, ensuring the fix does not introduce new issues. Immediate remediation during business hours (Option B) could cause downtime or impact users, while disabling the server (Option A) is an extreme measure reserved for active exploitation with no available patch.

Telnet and FTP transmit data, including credentials, in cleartext. SSH and HTTPS encrypt all traffic.

A differential backup copies all files that have changed since the last full backup. Because it does not contain the complete data set, you must first restore the most recent full backup and then apply the differential backup on top of it to recover the system. This makes option B correct.

The scenario describes a user in the finance department unable to access a shared folder on a server that is reachable from other departments. This points to a segmentation or access control issue specific to the finance VLAN. A firewall rule blocking traffic from the finance VLAN to the server is the most likely cause because it would selectively prevent access for that subnet while allowing other VLANs to reach the server, matching the symptom of partial connectivity.

Encryption protects data from unauthorized disclosure, directly supporting confidentiality.

A DMZ must selectively permit essential services from the internet to the public-facing servers while blocking all other inbound traffic. HTTP (80), HTTPS (443), SMTP (25), and DNS (53) are the standard protocols required for web and email servers to function. This rule implements the principle of least privilege by allowing only the necessary traffic to the DMZ.

Risk acceptance means acknowledging the risk and its potential impact without taking action to reduce it.

It balances security and productivity by alerting on policy violations while allowing users to override the block with manager approval. This approach ensures that legitimate business communications are not disrupted, while still enforcing DLP policies through a secondary review process. In a DLP solution, this is often implemented via a 'justify and override' workflow, where the user must provide a reason and receive approval from a manager before the email is sent.

Reciprocal agreements often fail because one party may lack capacity or resources when needed.

A hot site is a fully operational, mirrored environment with real-time data synchronization, pre-installed hardware, and active network connectivity, making it significantly more expensive to maintain due to ongoing costs for power, cooling, bandwidth, and dedicated staff. In contrast, a cold site is a bare facility with no active infrastructure, requiring manual setup and provisioning before recovery can begin. The higher cost of a hot site is justified by its near-zero Recovery Time Objective (RTO), whereas a cold site's lower cost reflects its much longer RTO.

A router is the correct device because it operates at Layer 3 (Network layer) of the OSI model and can segment a network into separate broadcast domains by forwarding packets based on IP addresses while blocking broadcast traffic (e.g., ARP requests) from crossing between interfaces. This isolation improves performance by reducing broadcast overhead and enhances security by controlling traffic flow between segments.

Dynamic ARP Inspection (DAI) uses DHCP snooping binding tables to validate ARP packets, ensuring that only legitimate IP-to-MAC address mappings are accepted. This directly prevents ARP spoofing by dropping malicious ARP replies that do not match the binding table. Configuring static ARP entries on critical servers hardcodes the IP-to-MAC mapping, so the server will ignore any spoofed ARP replies attempting to redirect traffic.

VLANs logically segment the flat network into separate broadcast domains for Sales, HR, and Engineering, containing malware spread at Layer 2. Using multiple managed switches with VLANs and trunking to the firewall allows inter-VLAN traffic to be inspected and controlled by the firewall, providing segmentation with minimal cost and complexity. This approach leverages existing hardware (router/firewall) and avoids the expense of additional appliances.

MTD = RTO + WRT. Given MTD=4, RTO=2, so WRT ≤ 2 hours.

The exhibit shows an extended ACL applied inbound on the client's interface that denies TCP traffic from the client to the server on port 80 (HTTP) but permits all other IP traffic. Therefore, the HTTP request is blocked, but any other traffic from the client (e.g., DNS, ICMP) is allowed. Option D correctly states that the HTTP request is blocked but other traffic is allowed.

An Intrusion Prevention System (IPS) is inline and can actively block threats, unlike an IDS which only alerts.

Least privilege, separation of duties, and defense in depth are fundamental. Security through obscurity is not a recognized principle.

NGFWs often include SSL inspection capabilities to examine encrypted traffic for threats.

Redundancy and failover ensure systems remain accessible, which supports availability.

SSH (Secure Shell) is correct because it encrypts all traffic, including authentication credentials and commands, using strong cryptographic algorithms, making it safe for remote administration over untrusted networks. It operates on TCP port 22 and provides confidentiality, integrity, and authentication, unlike cleartext protocols. SSH is the standard for secure CLI access to network devices such as routers and switches.

The root cause is a role misconfiguration, and the best long-term solution is to implement a process of periodic role reviews and recertification. This ensures that role assignments are regularly audited and validated against current job responsibilities, preventing role creep and unauthorized privilege accumulation. In RBAC, the principle of least privilege is maintained through ongoing governance, not through a one-time fix.

The Network layer (Layer 3) handles routing and logical addressing (IP addresses).

Access badges are a common physical control at building entrances.

Encrypting traffic (e.g., using HTTPS, VPN) makes sniffed data unreadable.

Cloud backup with instant restore (Option B) is the most cost-effective solution because the business has a limited budget, data changes infrequently, and the RTO is 24 hours. Cloud backup eliminates the need for maintaining physical infrastructure, and instant restore from cloud snapshots can meet the 24-hour RTO without the high costs of a warm or hot site.

Incremental backups only back up changes since the last backup (any type), making them fastest to perform but slowest to restore because all increments since the last full must be applied.

Phishing emails commonly exploit urgency to bypass rational decision-making. Attackers use phrases like 'Your account will be closed' to pressure recipients into clicking malicious links or providing credentials without verifying the source. This social engineering tactic is a hallmark of phishing campaigns.