976 questions total · 14pages · All types, answers revealed
Which THREE of the following are valid security control categories based on function? (Select three).
Correct. Corrective controls remediate damage after an incident.
Why this answer
Preventive, detective, and corrective controls are standard functional categories. Reactive and passive are not recognized as primary control categories.
Which protocol is used to resolve IP addresses to MAC addresses on a local network?
ARP resolves IP to MAC.
Why this answer
ARP (Address Resolution Protocol) maps IP addresses to MAC addresses within the same network.
An organization is implementing a risk management strategy for a new system. Which THREE actions are examples of risk mitigation?
Patching reduces the risk of exploitation.
Why this answer
Risk mitigation involves implementing controls to reduce risk. Installing firewalls, patching vulnerabilities, and training users all reduce risk.
An organization is designing a privileged access management (PAM) solution. Which THREE of the following are best practices for managing privileged accounts? (Select three.)
Admins should only have permissions necessary for their role.
Why this answer
PAM best practices include using separate admin accounts, monitoring privileged sessions, and applying least privilege. Sharing passwords and storing them in plaintext are security risks.
A network administrator needs to segment traffic and isolate sensitive systems. Which two technologies can achieve this? (Choose TWO.)
Correct. VLANs segment traffic on a switch.
Why this answer
VLANs provide logical segmentation at Layer 2, and subnetting divides IP networks, often used with routing to isolate traffic. DMZ is a specific segment for public servers, not general segmentation. Firewalls and IDS are security devices, not segmentation technologies.
A security team is conducting a risk assessment for a new cloud application. They have identified a vulnerability in the application that could allow unauthorized access to sensitive data. Which three risk management strategies should they consider? (Choose three.)
Eliminating the activity that introduces the risk, such as removing the vulnerable component.
Why this answer
Risk avoidance (B) is correct because it involves eliminating the vulnerability by not deploying the cloud application or removing the vulnerable component entirely, thus preventing any possibility of unauthorized access to sensitive data. This strategy is appropriate when the risk exceeds the organization's risk appetite and cannot be effectively reduced through other means.
Exam trap
A common trap is the distinction between risk acceptance and risk ignorance. Candidates mistakenly think 'doing nothing' is a valid strategy, but acceptance requires formal documentation and approval from management, not simply ignoring the risk.
A security operations center (SOC) analyst is investigating an alert about a user downloading a suspicious file. The analyst opens the file on a sandboxed virtual machine and observes that it attempts to modify registry keys and establish persistence. This type of analysis is known as:
Running the sample in a sandbox to observe behavior is dynamic analysis.
Why this answer
Dynamic analysis involves executing a suspicious file in a controlled environment, such as a sandboxed virtual machine, to observe its runtime behavior. In this scenario, the analyst runs the file and directly observes registry modifications and persistence mechanisms, which are characteristic of dynamic analysis. This approach captures actual system interactions that static analysis cannot reveal.
Exam trap
ISC2 often tests the distinction between dynamic and static analysis, and the trap here is that candidates may confuse 'reverse engineering' (which includes both static and dynamic methods) with the specific act of executing a file to observe behavior, leading them to select reverse engineering instead of the more precise dynamic analysis.
How to eliminate wrong answers
Option B is wrong because static analysis examines the file without executing it, typically by inspecting its binary structure, strings, or metadata, not by observing runtime behavior like registry changes. Option C is wrong because reverse engineering is a broader process that often includes static and dynamic techniques to understand a program's logic, but the specific act of running the file in a sandbox to observe behavior is dynamic analysis, not reverse engineering itself. Option D is wrong because threat hunting is a proactive search for indicators of compromise across an environment, not the analysis of a single file in a sandbox.
An analyst is reviewing a series of failed login attempts from multiple IP addresses targeting a single user account. This pattern is indicative of what type of attack?
Password spraying uses multiple sources and common passwords to avoid detection.
Why this answer
Password spraying involves an attacker attempting a small number of common passwords (e.g., 'Password123', 'Welcome1') against many user accounts, or in this case, multiple IP addresses targeting a single user account. This pattern avoids account lockout thresholds by keeping attempts per IP low, making it distinct from brute force attacks that hammer a single account with many passwords from one source.
Exam trap
ISC2 often tests the distinction between password spraying and brute force by describing the number of IPs versus the number of passwords tried, so the trap here is confusing a distributed low-rate attack (password spraying) with a high-rate single-source attack (brute force).
How to eliminate wrong answers
Option B is wrong because keylogging requires malware to capture keystrokes on the user's device, not failed login attempts from multiple IP addresses. Option C is wrong because a brute force attack typically targets a single account with many password attempts from one or few IPs, not a low number of attempts from many IPs. Option D is wrong because credential stuffing uses previously leaked username/password pairs from other breaches, not a small set of common passwords tried across many IPs.
An organization's incident response plan specifies containment, eradication, and recovery phases. During containment, the team isolates a compromised server from the network. However, the server is a domain controller. What is the PRIMARY risk of this action?
Domain controllers provide authentication; isolating them disrupts network logins.
Why this answer
Isolating a domain controller from the network prevents it from processing authentication requests (Kerberos and NTLM), which halts user logins, resource access, and group policy updates across the domain. This loss of authentication services is the primary risk because the domain controller is the authoritative source for identity verification in Active Directory.
Exam trap
The trap here is that candidates may focus on the general containment goal of stopping malware spread (Option C) rather than recognizing that isolating a domain controller specifically cripples the authentication infrastructure, which is the most critical and immediate risk.
How to eliminate wrong answers
Option A is wrong because data loss on the server is not the primary risk; domain controllers store Active Directory databases (NTDS.dit), but isolation does not inherently cause data loss—it prevents replication and authentication. Option B is wrong because chain of custody relates to preserving evidence for forensic analysis, not to the immediate operational impact of isolating a domain controller. Option C is wrong because propagation of malware to other systems is the very risk containment aims to prevent; isolating the server stops further spread, not causes it.
A security analyst notices a high volume of ICMP Echo Reply packets from an external server to an internal host that never sent Echo Requests. Which type of attack is likely occurring?
Smurf attack sends ICMP Echo Requests to a broadcast address with spoofed source, causing many replies to flood the victim.
Why this answer
Unsolicited ICMP replies may indicate a DoS attack using reflected traffic.
Which of the following is an indicator of a phishing email?
Correct. Phishing often uses look-alike domains to trick users.
Why this answer
Phishing emails often contain suspicious links that lead to malicious websites. Unexpected senders and urgency are also common indicators.
After a security breach, it was discovered that an attacker used a stolen certificate to sign malicious code. Which security principle was compromised?
Correct. The certificate's owner can deny signing the malicious code.
Why this answer
Non-repudiation ensures that an entity cannot deny having performed an action, such as signing code. When an attacker uses a stolen certificate to sign malicious code, the legitimate owner of the certificate cannot deny the signature, because the cryptographic proof (the digital signature) is bound to the certificate. This compromises the principle of non-repudiation, as the signature can no longer be reliably attributed to the intended signer.
Exam trap
ISC2 often tests the distinction between integrity and non-repudiation, where candidates mistakenly think that a stolen certificate only affects data integrity, but the core issue is the inability to prove who signed the code.
How to eliminate wrong answers
Option A is wrong because integrity ensures data has not been altered, but the breach here involves the misuse of a certificate for signing, not the modification of data. Option C is wrong because confidentiality protects data from unauthorized access, whereas the stolen certificate was used to sign code, not to read or expose secret information. Option D is wrong because availability ensures systems are accessible when needed, and the breach did not cause a denial of service or system unavailability.
An organization is selecting a recovery site strategy that offers the fastest recovery time, measured in hours, to minimize downtime for critical applications. Which recovery site type best meets this requirement?
Hot site is fully operational and can achieve RTO in hours.
Why this answer
The hot site is the best choice for the fastest recovery time, as it is fully equipped and operational with real-time data replication, allowing recovery within hours. In contrast, a warm site requires activation and data restoration, typically taking days, while a cold site needs hardware and software installation, taking weeks. Cloud-based recovery can be fast but may involve data retrieval and configuration delays, making it slower than a hot site for critical applications.
An employee is assigned a user account with read-only access to the sales database. However, the employee's job requires viewing only customer contact information, not sales figures. Which access control principle is being violated?
Even with read-only access, the employee should only access data required for their role.
Why this answer
Need-to-know restricts access to only the data necessary for job functions, separate from the permissions level (least privilege). Here, the employee has permissions to read data they do not need.
During a security assessment, a penetration tester captures unencrypted credentials over the network. Which protocol is most likely being used?
FTP sends username and password in plaintext over the network.
Why this answer
FTP (File Transfer Protocol) transmits data, including credentials, in cleartext over the network. When a penetration tester captures unencrypted credentials, FTP is a likely candidate because it does not encrypt the authentication process, making it vulnerable to packet sniffing attacks.
How to eliminate wrong answers
Option A is wrong because SMTPS (SMTP over SSL/TLS) encrypts the entire communication channel, preventing credentials from being transmitted in cleartext. Option B is wrong because SSH (Secure Shell) provides encrypted remote login and file transfer, ensuring credentials are never sent unencrypted. Option D is wrong because HTTPS (HTTP over SSL/TLS) encrypts HTTP traffic, including any form-based authentication, so credentials are protected from sniffing.
You are a SOC analyst for a financial institution. At 2:00 AM, your SIEM generates a critical alert from the email security gateway indicating that an internal user received a phishing email with a malicious attachment. The email was delivered to the user's inbox, and the user's account activity logs show that the attachment was opened 10 minutes ago. The user is a junior accountant who works in the accounts payable department. You have access to endpoint detection tools, email logs, and network traffic data. The organization's incident response policy requires containment within 30 minutes of detection. Which action should you take FIRST?
Isolation contains the incident quickly, as per policy.
Why this answer
The incident response policy requires containment within 30 minutes. Isolating the workstation (e.g., via network access control or disabling the switch port) immediately stops any ongoing malicious activity, such as command-and-control communication or lateral movement, which is the highest priority after detection. This aligns with the NIST SP 800-61 containment strategy and the SANS PICERL model, where containment precedes eradication and recovery.
Exam trap
ISC2 often tests the principle that containment must happen before any eradication or recovery steps, so candidates mistakenly choose scanning or blocking the sender because they focus on the email vector rather than the active compromise on the endpoint.
How to eliminate wrong answers
Option B is wrong because scanning with antivirus is an eradication step that should only occur after containment; the malware may already be executing, and scanning could trigger further malicious actions or alert the attacker. Option C is wrong because blocking the sender's email address is a preventive measure that does not address the already-opened attachment and active compromise on the user's workstation. Option D is wrong because instructing the user to delete the email is ineffective and dangerous—the attachment has already been opened, and the user may be compromised, so relying on user action wastes critical containment time.
Drag and drop the steps for the incident response process according to NIST into the correct order.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
NIST incident response lifecycle: Preparation, Detection and Analysis, Containment/Eradication/Recovery, Post-Incident Activity.
Drag and drop the steps to create a new VLAN on a managed switch into the correct order.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
The correct sequence for creating a new VLAN on a managed switch is to first enter global configuration mode, then create the VLAN with its ID, then assign a name for identification, and finally assign the appropriate ports to the VLAN. This order ensures all necessary parameters are in place before ports are configured.
An employee receives an email that appears to be from the CEO requesting an urgent wire transfer to a new vendor. The email contains several grammatical errors and the sender's address is slightly misspelled. What type of security incident is this?
The email is fraudulent and attempts to deceive the employee.
Why this answer
This is a social engineering attack, specifically phishing (or CEO fraud), where the attacker impersonates a trusted figure to trick the employee.
A company experiences a data breach involving personal data of EU residents. Under GDPR, what is the maximum time within which the organization must notify the supervisory authority?
GDPR mandates notification within 72 hours.
Why this answer
GDPR requires data controllers to notify the supervisory authority within 72 hours of becoming aware of a personal data breach.
Your organization runs a critical e-commerce platform on a private cloud. The database server is located in a data center in a seismic zone. The current DR plan uses a warm site with daily differential backups and a 12-hour RTO. A recent earthquake caused a power outage but no physical damage. The database corruption was discovered after 6 hours. The backups from last night are intact but restoring involves applying transaction logs. The RTO is now at risk. What should be done FIRST?
Fastest recovery option given the warm site setup.
Why this answer
The immediate priority is to restore the latest differential backup onto the warm site's standby servers. This approach minimizes recovery time by applying only the changes since the last full backup, directly addressing the RTO risk. The warm site is already prepared, and restoring the differential backup is the fastest path to operational readiness without the overhead of full backup restoration or log replay.
Exam trap
ISC2 often tests the misconception that point-in-time recovery or full backup restoration is always the safest first step, but in a time-critical DR scenario with intact differential backups, the fastest recovery path is to restore the latest differential backup to meet RTO.
How to eliminate wrong answers
Option A is wrong because failing over without data restoration would result in a stale or inconsistent database state, likely causing data loss and application errors. Option B is wrong because performing a point-in-time recovery using the last full backup and all transaction logs is time-consuming and would exceed the RTO; it is not the first action when a faster differential restore is available. Option D is wrong because restoring the last full backup before applying differential and log backups adds unnecessary steps and time, increasing the risk of RTO breach when the latest differential backup alone can be restored directly.
Which of the following is an example of a logical access control?
Password policies enforce logical controls.
Why this answer
Logical access controls are technology-based mechanisms like passwords, biometrics, and ACLs.
Refer to the exhibit. Given the ACL shown, which traffic is allowed to reach 10.0.0.1?
Permit statements for ports 80 and 443 allow HTTP and HTTPS.
Why this answer
Exam trap
ISC2 often tests the implicit deny any at the end of ACLs, leading candidates to forget that only explicitly permitted traffic is allowed, and that the ACL does not block traffic based on source network unless specified.
How to eliminate wrong answers
Option A is wrong because the ACL does permit some traffic (HTTP and HTTPS), so it is not true that no traffic is allowed. Option C is wrong because the ACL does not filter based on source network; it permits traffic from any source as long as the destination and port match. Option D is wrong because the ACL only permits TCP traffic to ports 80 and 443, not all TCP traffic.
A company uses a proxy server for internet access. Employees can browse websites (HTTP/HTTPS), but they cannot connect to external FTP servers using FTP client software (e.g., FileZilla). The proxy is configured to allow HTTP and HTTPS only. The security team wants to allow FTP while maintaining security (e.g., logging and filtering). The FTP traffic is used for occasional file transfers with partners. Which of the following is the BEST solution to meet both requirements?
An FTP proxy can inspect and log FTP traffic, and being in the DMZ adds security; firewall rules can restrict access.
Why this answer
Deploying a dedicated FTP proxy in the DMZ allows the security team to inspect, log, and filter FTP traffic while keeping the existing HTTP/HTTPS proxy unchanged. Firewall rules can be tightened to permit FTP only to that proxy, which then forwards connections to external FTP servers, maintaining a secure, auditable chokepoint without exposing internal clients directly to FTP.
How to eliminate wrong answers
Option B is wrong because SSH tunneling encapsulates FTP traffic but does not provide native logging or filtering of FTP commands and data; it bypasses the proxy and creates an encrypted tunnel that the security team cannot inspect, defeating the requirement for logging and filtering. Option C is wrong because standard HTTP/HTTPS proxies cannot natively proxy FTP protocol; they lack support for FTP command channels and data connections, and simply adding 'FTP as an allowed protocol' is not technically feasible without an FTP-specific proxy module or separate FTP proxy. Option D is wrong because enabling FTP passive mode on the proxy does not solve the core issue; passive mode is a client-server configuration that changes how data connections are established, but the proxy still cannot proxy FTP traffic unless it is specifically designed to handle FTP protocol.
A security analyst detects a large volume of small ICMP echo request packets from multiple external sources targeting a single internal server, causing the server to become unresponsive. Which type of attack is this?
Multiple sources send ICMP echo requests, a common DDoS technique.
Why this answer
A DDoS attack using ICMP flood overwhelms the target with echo requests, consuming bandwidth and resources.
Which of the following is a primary goal of security operations?
Security operations aim to reduce vulnerabilities and exposure.
Why this answer
Reducing the attack surface is a primary goal of security operations because it minimizes the number of potential entry points an attacker can exploit. By disabling unnecessary services, applying strict access controls, and segmenting networks, the organization lowers its risk of compromise. This directly supports the core security operations objective of protecting assets and maintaining confidentiality, integrity, and availability.
Exam trap
ISC2 often tests the misconception that security operations is about user satisfaction or performance optimization, when in fact its primary goal is risk reduction through attack surface minimization.
How to eliminate wrong answers
Option A is wrong because minimizing user complaints is a usability or helpdesk goal, not a primary security operations objective; security operations may even increase user friction (e.g., requiring MFA) to enforce security. Option B is wrong because increasing network speed is a performance goal typically handled by network engineering, not security operations; security controls like deep packet inspection can actually reduce speed. Option D is wrong because ensuring compliance with marketing standards is unrelated to security operations; compliance with security standards (e.g., PCI DSS, HIPAA) is relevant, but marketing standards are not a security concern.
A system administrator needs to grant a user the ability to read files in a specific folder but not modify them. Which access control principle should be applied?
Least privilege grants only the permissions necessary for the job, such as read-only access.
Why this answer
The principle of Least Privilege dictates that a user should be granted only the minimum permissions necessary to perform their job functions. In this scenario, granting read-only access to a specific folder (e.g., using NTFS 'Read' permission or Linux 'r--' on the directory) ensures the user cannot modify files, directly applying Least Privilege. This prevents accidental or intentional data alteration while still allowing necessary access.
Exam trap
ISC2 often tests the distinction between an access control *model* (like RBAC or MAC) and a security *principle* (like Least Privilege), causing candidates to confuse the mechanism with the overarching goal of minimizing permissions.
How to eliminate wrong answers
Option A is wrong because RBAC is an access control model that assigns permissions based on roles, not a principle that specifically limits permissions to the minimum required; it could still grant excessive permissions if the role is poorly defined. Option C is wrong because Separation of Duties (SoD) is a principle that prevents a single individual from having conflicting responsibilities (e.g., both authorizing and executing a transaction), not a method for limiting file permissions to read-only. Option D is wrong because Mandatory Access Control (MAC) enforces system-wide policies (e.g., using SELinux labels or Windows Integrity Levels) that users cannot override, but it is a model, not the specific principle of granting only the minimum necessary access for a given task.
An organization is implementing a patch management policy. Which THREE steps are part of the standard patch lifecycle?
Deployment is the final step in the standard lifecycle.
Why this answer
The standard patch lifecycle includes vulnerability disclosure, testing in staging, and deployment to production. Emergency patching is a separate process, and verifying backup is not a standard step in patching.
Refer to the exhibit. An analyst sees many alerts from this IDS rule. What is a likely cause?
The rule matches common SQL keywords in normal traffic, causing false positives.
Why this answer
The IDS rule is likely generating excessive alerts due to poor signature design, such as using overly broad content matches or lacking proper contextual filters. Without the 'flow' keyword to establish session state (e.g., 'to_server, established'), the rule may trigger on any packet containing the SQL pattern, including non-exploit traffic like error messages or benign queries, resulting in false positives.
Exam trap
ISC2 often tests the distinction between a rule triggering due to actual malicious activity versus poor rule design, and the trap here is assuming that many alerts always indicate a real attack (like SQL injection scanning) rather than considering signature quality issues.
How to eliminate wrong answers
Option A is wrong because the alerts are from the IDS rule itself, not from confirmed exploitation; SQL injection vulnerability would require evidence of successful data extraction or error-based responses, not just rule hits. Option B is wrong because scanning for SQL injection typically involves sending multiple crafted payloads to probe endpoints, which would generate fewer, more targeted alerts rather than a high volume of false positives. Option C is wrong because while missing the 'flow' keyword can contribute to false positives, the question asks for the 'likely cause' of many alerts, and a poorly written rule (Option D) is the broader, more direct reason—missing 'flow' is just one specific example of poor rule writing.
A company requires employees to use biometric authentication to access the data center. This is an example of which security principle?
Authentication verifies identity; biometrics is a method.
Why this answer
Correct: A - Authentication. Authentication is the process of verifying the identity of a user, and biometrics is one method. Option B is wrong because availability ensures systems are accessible.
Option C is wrong because integrity ensures data accuracy. Option D is wrong because non-repudiation ensures actions cannot be denied, not identity verification.
An organization is re-evaluating its disaster recovery site options. Which TWO of the following describe characteristics of a warm site?
Correct. Warm sites have an RTO of days.
Why this answer
A warm site has partially configured hardware and software, but requires some setup before use. It typically has a longer RTO (days) compared to a hot site (hours). Hot sites mirror production exactly, cold sites are empty, and cloud-based recovery can be quickly spun up.
In the identification and authentication process, which step occurs first?
Identification is the first step, such as entering a username.
Why this answer
Identification is the claim of identity (e.g., username) before authentication proves it.
An organization implements full-disk encryption on all laptops. Which element of the CIA triad is primarily being addressed?
Encryption prevents unauthorized viewing of data, ensuring confidentiality.
Why this answer
Encryption protects data from unauthorized disclosure, which is the goal of confidentiality.
Which security control is most effective in preventing unauthorized physical access to a data center?
Physically restricts entry to one person at a time.
Why this answer
Mantraps create a double-door system that prevents tailgating, making them highly effective. Other controls like video surveillance and guards are deterrents but less direct at preventing unauthorized entry.
Refer to the exhibit. What is the effect of this ACL?
Correct. The two permit lines allow those protocols; the deny all blocks everything else.
Which TWO technologies provide network segmentation? (Choose two.)
Routers can segment networks based on IP addresses and ACLs.
Why this answer
Routers with ACLs (Access Control Lists) provide network segmentation by filtering traffic based on Layer 3 (IP addresses) and Layer 4 (port numbers) criteria, effectively dividing a network into separate security zones or subnets. VLANs (Virtual Local Area Networks) segment a network at Layer 2 by logically grouping devices into separate broadcast domains, even if they share the same physical switch. Both technologies isolate traffic to enforce security policies and reduce attack surfaces.
Exam trap
ISC2 often tests the misconception that switches inherently segment networks, but without VLANs, a standard switch creates a single broadcast domain; the trap is that candidates confuse switching (forwarding) with segmentation (isolation).
Refer to the exhibit. A security analyst sees this log entry from a firewall. What is the most likely reason for this denial?
The access-group denies traffic to the destination port 33456.
Why this answer
The firewall log entry indicates a packet was denied due to a policy violation, and the most common reason for such a denial in a stateful firewall is that the destination port is not permitted by the configured access control list (ACL) or security policy. Firewalls evaluate traffic against rules that specify allowed source/destination IPs, ports, and protocols; if the destination port is not explicitly allowed, the packet is dropped. This is a standard security practice to restrict unauthorized services.
Exam trap
ISC2 often tests the concept that a firewall's default implicit deny will drop traffic if no explicit permit exists for the destination port, leading candidates to incorrectly assume the source IP is blacklisted or the packet is malformed.
How to eliminate wrong answers
Option B is wrong because a blacklisted source IP would typically generate a log with a specific reason such as 'blacklist' or 'reputation', not a generic denial, and the log entry does not indicate a blacklist match. Option C is wrong because a misconfigured access-group would likely cause broader connectivity issues or permit unintended traffic, not a single specific denial; the log entry shows a targeted drop, not a configuration error. Option D is wrong because a malformed packet would usually be dropped by the firewall's stateful inspection or TCP/IP stack with a different log message (e.g., 'invalid packet' or 'TCP flags violation'), not a standard policy denial.
An organization labels its financial reports as "Confidential" and requires encryption at rest and in transit. This is an example of:
Correct. The label and controls are part of data classification.
Why this answer
Data classification determines handling requirements (e.g., encryption for confidential data).
A security administrator needs to ensure that only authorized personnel can access the server room. Which physical control is most appropriate?
A biometric access control system uses unique biological traits (e.g., fingerprints) for authentication, providing strong security and accountability.
Why this answer
A biometric access control system uses unique biological traits for authentication, providing strong physical security. Option A (Mantrap) is used for high-security areas but is more complex and expensive. Option B (Keypad lock) is less secure because codes can be shared.
Option D (Video surveillance) is detective, not preventive. Biometric access (Option C) is the best fit for this requirement.
A system administrator configured the sudoers file as shown. What is the primary security risk of this configuration?
Correct: The '!authenticate' tag removes the need to enter a password when using sudo for members of the admin group, weakening authentication.
Why this answer
The '!authenticate' directive in the sudoers file removes the password requirement for members of the admin group when executing sudo commands. This weakens authentication for privileged access, making it the primary security risk. Option A is incorrect because the configuration only affects the admin group, not all users.
Option B is incorrect because the configuration does not enable logging; rather it disables authentication. Option D, while factually describing the configuration, does not directly address the primary security risk of weakened authentication; the core issue is the removal of password verification, which is exactly what option C states.
During a data breach incident, the incident response team discovers that personally identifiable information (PII) of European Union residents was compromised. According to GDPR, what is the maximum time frame for notifying the supervisory authority?
GDPR mandates notification within 72 hours.
Why this answer
GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.
A company is implementing an access control system to protect sensitive data. Employees in the finance department must access financial records, but only during business hours and from company-issued devices. Which access control model best supports these requirements?
RuBAC enforces access based on rules including time and device.
Why this answer
Rule-Based Access Control (RuBAC) is the correct choice because it enforces access decisions based on a set of predefined rules, such as time-of-day restrictions and device compliance. In this scenario, the rules 'business hours only' and 'company-issued devices only' are static conditions that can be implemented as access control rules (e.g., using a firewall ACL or a policy engine) without requiring user attributes or labels. RuBAC is ideal when access is governed by operational policies that are not tied to user identity or data classification.
Exam trap
ISC2 often tests the distinction between RuBAC and ABAC by presenting a scenario with multiple conditions (time, device, location) that seems to require ABAC, but the trap is that if the conditions are static and predefined (not evaluated dynamically from user/object attributes), RuBAC is the simpler and correct model.
How to eliminate wrong answers
Option A is wrong because Attribute-Based Access Control (ABAC) evaluates access based on multiple dynamic attributes (e.g., user role, time, device type, location) using a policy engine, which is more complex than needed for simple static rules; while it could technically enforce these requirements, the question asks for the model that 'best supports' them, and RuBAC is simpler and more direct. Option C is wrong because Discretionary Access Control (DAC) allows resource owners to set permissions at their discretion, which cannot enforce mandatory time-of-day or device restrictions. Option D is wrong because Mandatory Access Control (MAC) enforces access based on system-wide labels (e.g., security clearance and classification), not on time or device attributes, and is typically used in high-security environments like military systems.
A company experiences a ransomware attack that encrypts all files on a file server. The IT team decides to restore the server from the most recent full backup taken 24 hours ago, followed by all differential backups taken since then. If the last full backup was on Sunday at midnight, and the attack occurs on Wednesday at 6:00 AM, with differential backups taken daily at noon, how many differential backups must be restored?
Two differential backups (Monday and Tuesday) were taken after the full backup and before the attack.
Why this answer
Differential backups contain changes since the last full backup. The last full backup was Sunday midnight. Differential backups were taken Monday noon, Tuesday noon, and Wednesday noon (but the attack was at 6 AM Wednesday, so Wednesday's backup hadn't occurred yet).
So differential backups available: Monday and Tuesday. That's 2 differential backups to restore.
Refer to the exhibit. The network administrator configured NAT as shown. Internal hosts can access the internet, but no external hosts can access the company's web server (192.168.1.10). What is the issue?
The pool range includes 200.100.50.1, which is already used by the static NAT, causing a conflict.
Why this answer
The dynamic NAT pool includes the IP address 200.100.50.1, which is also used for the static NAT mapping to the web server. When a packet arrives from the internet destined for the static NAT address, the router first checks dynamic NAT entries and may assign that address from the pool to an internal host, causing a conflict and preventing the static translation from being applied. This is a classic IP address overlap issue where the pool should exclude the static NAT address.
Exam trap
ISC2 often tests the misconception that static NAT always overrides dynamic NAT, but the trap here is that an overlapping pool address causes a conflict that prevents the static translation from being installed, not a priority issue.
How to eliminate wrong answers
Option A is wrong because static NAT entries have higher priority than dynamic NAT entries in Cisco IOS; the static mapping is not overridden by dynamic NAT unless there is an address conflict, which is the actual issue. Option B is wrong because the outside and inside interface designations are correct for NAT operation: the inside interface connects to the internal network (192.168.1.0/24) and the outside interface connects to the internet; swapping them would break internal host access. Option C is wrong because the access-list is used to match traffic for dynamic NAT translation, not for static NAT; static NAT does not require an access-list to permit the web server's traffic.
Which access control model allows the owner of a resource to decide who can access it?
DAC allows resource owners to set permissions at their discretion.
Why this answer
Discretionary Access Control (DAC) allows the owner of a resource to determine who can access it and with what permissions. In DAC, the resource creator or authorized owner can grant or revoke access rights to other subjects, typically through access control lists (ACLs) or file permissions. This model is commonly implemented in operating systems like Windows NTFS and Linux file systems, where the owner sets read, write, or execute permissions.
Exam trap
ISC2 often tests the distinction between DAC and MAC by presenting a scenario where a user can change permissions on their own files, and candidates mistakenly choose MAC because they confuse 'mandatory' with 'owner-controlled' or think MAC allows user discretion.
How to eliminate wrong answers
Option A is wrong because Mandatory Access Control (MAC) enforces access decisions based on system-wide security labels (e.g., classifications like Top Secret) and does not allow resource owners to change permissions; only administrators or the system can. Option B is wrong because Role-Based Access Control (RBAC) assigns permissions based on predefined roles (e.g., 'Manager' or 'Auditor'), not at the discretion of the resource owner. Option C is wrong because Attribute-Based Access Control (ABAC) uses policies that evaluate attributes of the user, resource, and environment (e.g., time of day, location) to grant access, and the resource owner does not have direct control over individual access decisions.
A company is deploying a multi-factor authentication (MFA) solution. Which combination represents two different authentication factors?
Smart card is Type 2 (possession) and PIN is Type 1 (knowledge), providing two different factors.
Why this answer
MFA requires two or more different types: something you know (password), something you have (OTP token), and something you are (fingerprint).
Which THREE of the following are core principles of the CIA triad?
Confidentiality ensures data is accessible only to authorized persons.
Why this answer
Options A, B, and E are correct: confidentiality, integrity, and availability are the three pillars. Non-repudiation (C) and accountability (D) are related but not part of the CIA triad.
Match each security control type to its description.
Drag a concept onto its matching description — or click a concept then click the description.
Discourages potential attackers
Blocks unauthorized access
Identifies and logs incidents
Restores after an incident
Alternative control when primary is not feasible
Why these pairings
Security controls are categorized by their primary function. Preventive controls stop incidents, detective controls identify them, and corrective controls restore operations. Common confusions involve swapping preventive and detective roles.
Which THREE of the following are characteristics of a stateful firewall? (Select exactly three.)
Stateful firewalls permit return traffic for established sessions.
Why this answer
A stateful firewall automatically allows return traffic for outbound connections because it tracks the state of each connection in a state table. When a packet from an internal host initiates an outbound TCP connection (e.g., SYN), the firewall creates an entry in the state table. When the corresponding return packet (e.g., SYN-ACK) arrives, the firewall checks the state table and permits it without needing an explicit inbound rule, as it recognizes the packet as part of an established session.
Exam trap
ISC2 often tests the distinction between stateful and stateless firewalls, and the trap here is that candidates confuse 'stateful' with 'application-layer inspection,' leading them to select option C, when in fact stateful firewalls only track session state at Layers 3 and 4, not the application payload.
A security analyst notices unusual traffic on the network and wants to capture packets for analysis without altering traffic. Which device should they use?
A network tap provides a passive copy of traffic for analysis.
What is the process of claiming an identity called?
Identification is the claim of identity.
Why this answer
Identification is the act of claiming an identity, such as providing a username.
Which of the following ports is used by HTTPS for secure web traffic?
443 is HTTPS.
Why this answer
HTTPS uses port 443 by default.
Which TWO of the following are primary objectives of an incident response plan? (Choose two.)
Recovery is a primary objective of IR.
Why this answer
A primary objective of an incident response plan is to return affected systems to normal operation. This involves containment, eradication, and recovery steps to restore business functions after a security incident, ensuring the organization can resume operations securely.
Exam trap
ISC2 often tests the distinction between the incident response plan's primary objectives (containment and recovery) and the secondary or post-incident activities (root cause analysis, evidence collection), causing candidates to mistakenly select options like C or E as primary objectives.
A network administrator is designing a DMZ to host a web server, an email server, and a DNS server. Which TWO of the following principles should be applied to secure the DMZ? (Select TWO.)
A firewall enforces strict access rules from DMZ to internal.
Why this answer
Proper segmentation and access control are key; placing servers on separate VLANs and restricting inbound/outbound traffic with firewalls are essential.
Which phase of the incident response process involves restoring systems to normal operation and applying patches to prevent recurrence?
Recovery involves restoring systems and applying lessons learned.
Why this answer
Eradication removes the cause, and recovery restores systems. The question describes both eradication (patches) and recovery (restore), but 'recovery' is the phase where normal operations resume after eradication.
According to the (ISC)² Code of Ethics, which canon has the highest priority?
Correct. This is the first and highest priority canon.
Why this answer
The Code of Ethics prioritizes protecting society first, then acting honorably, providing diligent service, and advancing the profession.
Which TWO are examples of technical access controls?
Encryption is a technical control that protects data confidentiality.
Why this answer
Encryption (C) is a technical access control because it uses cryptographic algorithms (e.g., AES-256, RSA) to transform data into an unreadable format, ensuring that only authorized entities with the correct decryption key can access the original information. This enforces confidentiality and access restrictions at the data level, independent of user behavior or administrative policies.
Exam trap
ISC2 often tests the distinction between administrative, physical, and technical controls, and the trap here is that candidates confuse 'security awareness training' or 'security policies' as technical controls because they are part of a security program, but they are not implemented through technology or code.
An organization wants to ensure that its critical business functions can continue operating during a disruption. Which plan specifically addresses keeping the business running during a disruption?
BCP is designed to keep business running during a disruption.
Why this answer
The Business Continuity Plan (BCP) focuses on maintaining business operations during a disruption, while the Disaster Recovery Plan (DRP) focuses on restoring IT systems after a disruption.
Which TWO of the following are primary goals of the security principle of confidentiality?
Protecting data in transit from interception is part of confidentiality.
Why this answer
Correct: D and E. Confidentiality ensures that data is not disclosed to unauthorized individuals or systems. Protecting data in transit (D) prevents interception during transmission, and preventing unauthorized disclosure (E) is the core goal.
Data accuracy (A) is integrity, system uptime (B) is availability, and authentication (C) is identity verification—none are confidentiality goals.
Match each cryptographic concept to its definition.
Drag a concept onto its matching description — or click a concept then click the description.
Same key for encrypt and decrypt
Key pair: public and private
One-way transformation to fixed size
Ensures authenticity and non-repudiation
Binds a public key to an identity
Why these pairings
Symmetric encryption uses one shared key; asymmetric uses a public-private key pair; hashing is a one-way function; digital signatures use asymmetric cryptography for authentication, integrity, and non-repudiation. Common confusions include mixing up symmetric and asymmetric key usage, or thinking hashing is reversible.
Which OSI layer is responsible for logical addressing and routing?
Network layer (Layer 3) is responsible for IP addressing and routing.
Why this answer
The Network layer (Layer 3) handles IP addressing and routing decisions.
A security analyst detects unusual outbound traffic from a server that suggests a data breach. According to GDPR, within what timeframe must the organization notify the supervisory authority?
GDPR Article 33 requires notification within 72 hours.
Why this answer
GDPR mandates notification within 72 hours of awareness of a breach.
Which of the following is an example of a detective control in a security operations context?
Audit log review detects incidents that have already happened.
Why this answer
Detective controls are designed to identify and alert on security incidents after they have occurred. Reviewing audit logs for suspicious activity is a classic detective control because it involves examining historical records to detect unauthorized access or anomalies. In contrast, preventive controls like patching, MFA, and firewall rules aim to stop incidents before they happen.
Exam trap
ISC2 often tests the distinction between preventive and detective controls, and the trap here is that candidates confuse 'blocking' or 'preventing' actions (like patching or firewalls) with detective controls that only monitor and alert after the fact.
How to eliminate wrong answers
Option A is wrong because installing a security patch is a corrective control that fixes a known vulnerability, not a detective control that identifies ongoing or past threats. Option C is wrong because requiring multi-factor authentication is a preventive control that verifies identity before granting access, not a detective measure. Option D is wrong because firewall rules blocking unauthorized traffic is a preventive control that enforces access policies at the network layer, not a detective control that reviews events after the fact.
A company is creating a backup strategy for its critical database. The database is updated continuously, and the company can tolerate up to 2 hours of data loss. Which TWO backup methods would best help achieve a recovery point objective (RPO) of 2 hours? (Select TWO.)
Hourly backups limit data loss to at most 1 hour, within the 2-hour RPO.
Why this answer
To achieve an RPO of 2 hours, backups must be taken at least every 2 hours. Hourly full backups or transaction log backups (which capture changes frequently) can meet this RPO. Daily full backups alone would cause up to 24 hours of loss.
A security team implements a load balancer to distribute traffic across multiple web servers. This control primarily supports which principle?
Correct. Load balancing improves uptime and availability.
Why this answer
Load balancing helps ensure availability by preventing server overload.
A company needs to enforce access based on attributes such as time of day and location. Which access control model is most appropriate?
ABAC evaluates policies based on subject and object attributes.
Why this answer
Attribute-Based Access Control (ABAC) is the correct choice because it evaluates policies based on multiple attributes (e.g., time of day, location, user role, device type) at runtime. This allows fine-grained, context-aware access decisions, such as permitting access only during business hours from a corporate office. ABAC uses a policy engine to evaluate attribute-based rules, making it ideal for dynamic environments where access depends on environmental conditions.
Exam trap
ISC2 often tests the distinction between RBAC and ABAC by presenting a scenario with dynamic attributes (like time/location) — candidates mistakenly choose RBAC because they associate roles with access control, but RBAC cannot evaluate contextual attributes without additional mechanisms.
How to eliminate wrong answers
Option B (MAC) is wrong because it enforces access based on fixed security labels (e.g., classification levels like Top Secret) assigned by a central authority, not on dynamic attributes like time or location. Option C (DAC) is wrong because it allows resource owners to set permissions at their discretion, which lacks the centralized, attribute-driven policy enforcement needed for time- and location-based controls. Option D (RBAC) is wrong because it grants access based solely on predefined roles (e.g., manager, employee), not on contextual attributes such as time of day or geographic location.
A company uses a stateful firewall. A user reports that an application requiring multiple dynamic ports is not working. The firewall logs show that packets from the server are being dropped. What is the most likely cause?
The firewall may not associate the data channel with the control session if it does not inspect the application protocol.
Why this answer
A stateful firewall tracks sessions by monitoring the control channel. For applications like FTP that use dynamic ports, the firewall must inspect the control channel to dynamically open pinholes for data channels. If the control channel is not tracked correctly, the firewall will not recognize the data channel packets as part of an established session and will drop them, even if the initial control session was allowed.
Exam trap
ISC2 often tests the misconception that a stateful firewall automatically handles all dynamic port protocols, when in fact it requires proper ALG configuration to inspect control channel payloads for port negotiation.
How to eliminate wrong answers
Option B is wrong because if the firewall lacked a rule allowing inbound traffic for the application, the initial control channel packets would also be dropped, not just the data channel packets. Option C is wrong because while the firewall may not be inspecting application-layer data, the core issue is specifically about stateful tracking of the control channel; lack of application-layer inspection would affect other protocols like HTTP or SMTP, not the dynamic port negotiation. Option D is wrong because a full state table would prevent new sessions entirely, not selectively drop packets from an existing session's data channel.
Which three of the following are benefits of using VLANs in a network? (Choose three.)
VLANs isolate traffic between groups.
Why this answer
VLANs improve security through segmentation, reduce broadcast traffic, and simplify network changes. They do not increase collision domains (switches eliminate collisions) and do not replace routing.
An organization wants to ensure that all workstations are configured according to a hardened baseline. Which process detects when a workstation deviates from this baseline?
Automated scanning compares current state to baseline and identifies deviations.
Why this answer
Configuration drift detection involves automated scanning that compares current configurations to the approved baseline and reports discrepancies.
An organization's recovery time objective (RTO) for its customer database is 4 hours, and the recovery point objective (RPO) is 1 hour. The database is backed up every hour using full backups. A disaster occurs at 2:00 PM, and the last successful backup was at 1:00 PM. The system is restored and operational at 5:30 PM, but data from 1:00 PM to 2:00 PM is lost. Which statement is correct?
RTO: 3.5 hours < 4 hours. RPO: 1 hour loss = 1 hour RPO, so both are met.
Why this answer
The RTO (4 hours) was met because recovery took 3.5 hours (2:00 PM to 5:30 PM). The RPO (1 hour) was exceeded because the data loss was 1 hour (consistent with backup frequency), but the question implies the loss is exactly 1 hour; however, the backup at 1:00 PM covers up to that time, and the loss of 1 hour is within the RPO of 1 hour. Actually, the loss is from 1:00 PM to 2:00 PM = 1 hour, which meets the RPO.
So both RTO and RPO were met.
IPS is inline and can take action.
An employee uses a password and a one-time code from a mobile authenticator app to log in. Which authentication type is being used?
Two different factors (knowledge and possession) are used.
Why this answer
Combining password (Type 1) and OTP (Type 2) is multi-factor authentication.
A security analyst is investigating a potential DDoS attack on the company's web server. Which two symptoms are indicative of a SYN flood attack? (Select TWO.)
The server keeps connections in SYN-RECEIVED state.
Why this answer
Options D and E are both correct indicators of a SYN flood attack. Option D is correct because a SYN flood sends many SYN packets to initiate TCP connections but never completes the three-way handshake, leaving numerous half-open connections in the SYN_RECEIVED state on the server, which exhausts resources. Option E is correct because the attack generates a high number of SYN packets from the attacker, and since the handshake is never completed, the corresponding ACK packets are absent.
Both symptoms—half-open connections and SYN packets without ACK—are characteristic of a SYN flood.
Exam trap
A common pitfall in the ISC2 CC exam is distinguishing between the symptom of 'half-open connections' (server-side resource exhaustion) and the traffic pattern of 'SYN packets with no ACK' (attacker behavior). Both are correct indicators of a SYN flood.
According to the (ISC)² Code of Ethics, which canon has the highest priority?
This is the first canon.
Why this answer
The first canon is to protect society, the common good, and the public trust.
Which of the following is an example of a Type 2 authentication factor?
A security token is a physical device the user possesses, making it Type 2.
Why this answer
Type 2 (possession) factors are items a user has, such as a smart card or OTP token.
Practice CC by domain
Target a specific domain to shore up weak areas.