ISC2 Certified in Cybersecurity CC (CC) — Questions 226–300

Due care means taking reasonable steps to protect assets, such as implementing basic security controls like patch management.

An Intrusion Prevention System (IPS) sits inline and can block traffic based on deep inspection, but may cause false positives that disrupt legitimate communications.

Implementing firewall rules between internal zones is a form of network segmentation. By creating distinct security zones (e.g., inside, outside, DMZ) and applying access control lists (ACLs) or stateful firewall policies between them, traffic is restricted to only what is explicitly permitted, thereby isolating network segments and limiting lateral movement.

Per incident response best practices, the first step is to verify the alert through threat intelligence to confirm it's not a false positive. Checking if the IP address is associated with known malware or threats (option B) validates the alert before taking any disruptive actions. Immediately isolating, quarantining, or blocking (options A, C, D) without confirmation can cause unnecessary disruption if the alert is benign.

Continuous database mirroring (C) is correct because it maintains a synchronous copy of the database on a secondary server, ensuring that every committed transaction is immediately written to both servers. This provides zero data loss (RPO=0) and automatic failover, which is required for a transactional database that cannot tolerate any data loss.

Need-to-know means only accessing data necessary for job functions. Data classification and role-based access help enforce this.

SYN cookies allow the server to respond to SYN requests without maintaining state until the connection is verified, reducing the impact of SYN floods.

In LDAP, a distinguished name uses CN (Common Name), OU (Organizational Unit), and DC (Domain Component). CN=John Smith and OU=Sales are valid components.

OU = Organizational Unit, DC = Domain Component.

Telnet (port 23) sends all data, including credentials, in plaintext.

Type 3 factors are biometric characteristics unique to an individual.

Network isolation prevents attackers from reaching the vulnerable system, while a WAF adds an additional layer of defense for web-based vulnerabilities.

A password is a logical (software-based) control that authenticates users.

The primary purpose of a business impact analysis (BIA) is to identify critical business processes and quantify the impact of their disruption, which directly determines recovery priorities and objectives (RTO/RPO). This output drives the business continuity and disaster recovery strategy, not asset inventory or cost estimation.

The log entries show repeated failed login attempts using different usernames and passwords, which is characteristic of a dictionary attack where an attacker uses a list of common usernames and passwords to gain unauthorized access. Unlike a brute-force attack that tries all possible combinations, a dictionary attack uses a predefined list of likely credentials, making it more efficient and matching the pattern in the logs.

A cloud-based scrubbing center (DDoS mitigation service) can filter malicious traffic before it reaches the retailer's network, preserving the active-active data center architecture. Since the internal network is operational, the attack only saturates external connectivity; redirecting traffic to the scrubbing center allows clean traffic to be re-injected into the data centers, maintaining service availability without taking any site offline.

Redundancy and load balancing help maintain access for authorized users, supporting availability.

For critical vulnerabilities being actively exploited, emergency patching should bypass normal testing cycles to reduce risk quickly.

Hardened baselines include disabling unnecessary services to reduce attack surface, enforcing strong password policies, and applying security updates to fix known vulnerabilities.

Tier 2 analysts conduct deeper investigation to confirm if the activity is malicious and determine the scope.

Combining a password (Type 1) and a mobile device approval (Type 2) constitutes multi-factor authentication.

Sandboxing email attachments in a secure environment (Option C) is a common technique to detect phishing emails because it allows suspicious attachments to be executed and analyzed in an isolated virtual machine. This process observes the attachment's behavior for malicious activities, such as attempting to connect to a command-and-control server or dropping malware, without risking the actual endpoint. It is a core technology used in advanced email security gateways and threat intelligence platforms.

A DMZ (demilitarized zone) is a segmented network that sits between the internet and the internal network, hosting public-facing servers while allowing controlled access from both sides.

After isolating the workstation, the next best step is to capture a memory image (RAM) to preserve volatile evidence such as running processes, network connections, and malware artifacts that would be lost on shutdown. This follows the order of volatility (RFC 3227) and is critical for forensic analysis to determine the scope of the compromise.

An inline IPS actively inspects and can block traffic based on its signature database. If the signature set is too aggressive or contains false positives, legitimate traffic matching those signatures will be incorrectly blocked. This is the most direct cause of blocking legitimate web traffic after deployment.

It allows inbound traffic on TCP 8443 to the server and outbound traffic on TCP 443 from the server to the internet. Stateful inspection automatically tracks the outbound HTTPS connection and permits the return traffic (the license server's response) without needing an explicit inbound rule. This matches the requirement while maintaining a default-deny posture.

TCP provides reliable delivery via acknowledgments and retransmissions, and uses a three-way handshake to establish a connection. UDP is connectionless and unreliable.

A Business Impact Analysis (BIA) is the first step in BCP to identify critical functions, dependencies, and recovery priorities.

The backup log only records the success or failure of the backup job as a whole, not the inclusion of every individual file. If the database file was not selected in the backup source configuration (e.g., a file-level backup job that excluded the database directory or a volume shadow copy that did not include the file), the backup would complete successfully without backing up that file. When the administrator attempts to restore, the file is missing from the backup set, even though the job log shows success.

A smart card is a physical device that stores cryptographic keys or certificates, making it a classic 'something you have' factor. It requires possession of the card to authenticate, even if the user knows a PIN, because the PIN unlocks the card but does not replace the physical possession requirement.

HTTPS (HTTP Secure) uses TLS/SSL encryption over TCP port 443 by default. To allow inbound HTTPS traffic to a web server, the firewall rule must permit TCP destination port 443. Port 80 is used for unencrypted HTTP, not HTTPS.

The most critical factor in real-time log collection is ensuring that the network can handle the volume of log data without congestion and that storage can ingest and retain the data without dropping events. Without sufficient bandwidth, logs will be delayed or lost, defeating the purpose of real-time analysis. Storage capacity directly impacts the ability to retain and query logs for immediate and historical investigation.

Least privilege requires granting only the minimum permissions necessary to perform job functions.

PAM solutions control, monitor, and audit privileged access to critical systems.

Options B and C are correct. Investigating the source IP address for malicious activity (C) helps determine if there is a broader threat, and escalating to the incident response team (B) ensures proper handling. The other options—disabling the account, blocking the IP at the firewall, or resetting the password—may be necessary later but should not be performed without further investigation.

Biometrics (fingerprint, retina, iris) fall under Type 3 (inherence) authentication, which checks 'something you are'.

The requirement for two different administrators to approve firewall configuration changes enforces separation of duties. This principle ensures that no single individual has the authority to make unilateral changes, reducing the risk of unauthorized or malicious modifications. In firewall management, this prevents a single admin from bypassing security controls or introducing backdoors without oversight.

Defense in depth employs multiple, overlapping layers of security controls to protect assets; if one layer fails, others still provide protection.

Separation of duties ensures that no single individual has complete control over a critical action, reducing the risk of fraud or error.

A DMZ (demilitarized zone) hosts public-facing services with controlled access to internal network.

Preparation includes establishing tools, training staff, and developing the plan.

DNS tunneling encodes data within DNS queries and responses, allowing attackers to bypass network security controls by exfiltrating data through UDP port 53, which is often allowed through firewalls. The regular intervals of large data transfers to an external IP address are characteristic of a DNS tunnel, as the attacker segments data into multiple DNS queries to avoid detection.

WAF (Web Application Firewall) inspects HTTP/HTTPS traffic and applies OWASP rules.

Creating three VLANs on the existing switch segments the flat /24 network into separate broadcast domains, preventing lateral movement by default. Configuring ACLs on the router allows only necessary inter-VLAN traffic (e.g., Sales and HR can access the file server in IT), which stops the ransomware from spreading across departments without requiring new hardware.

Isolating the server is a containment action to prevent spread.

The log shows an account lockout after multiple failed authentication attempts, indicating an account lockout policy is in effect.

AES-256 offers a higher security margin than AES-128. Using weaker encryption (AES-128) directly reduces the confidentiality protection, making it easier for an attacker to decrypt the data.

Logical access controls are technology-based mechanisms that restrict access to systems and data, such as passwords.

A SIEM aggregates and correlates logs from various sources, generates alerts, and stores historical data for analysis and forensics.

Logical controls are software-based. Passwords and account lockout are logical.

ARP poisoning and rogue Wi-Fi are common MITM techniques. IP spoofing can be part of MITM but is not a standalone technique; SYN flood is DoS.

The scenario describes an employee accessing files they should not have access to, which directly violates the principle of least privilege. This principle mandates that users and processes should be granted only the minimum permissions necessary to perform their job functions. The administrator's observation indicates that the employee's access rights exceed what is required, leading to unauthorized file access.

GDPR requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach.

Top secret is the highest classification and requires strict controls.

The first priority when encountering unexpected outbound traffic to an external IP on port 443 (HTTPS) is to investigate the workstation for possible malware. This traffic could indicate a command-and-control (C2) beacon or data exfiltration, and immediate investigation allows the administrator to gather forensic evidence before taking disruptive actions. Disabling the port or blocking traffic without investigation could destroy evidence or alert an attacker, while allowing the traffic would be negligent.

For critical vulnerabilities under active exploitation, emergency patching should bypass normal testing to reduce risk, but compensating controls can be applied if immediate patching is not possible.

The policy explicitly denies the s3:DeleteBucket action on the critical-data bucket, overriding any allow.

Firewall logs show allowed outbound connections, and proxy logs can reveal web traffic and file uploads, both critical for detecting exfiltration.

Non-repudiation ensures that a user cannot deny having performed a specific action, typically by using cryptographic mechanisms such as digital signatures or audit logs. In the context of the CC exam, this is most commonly achieved through public key infrastructure (PKI) where a private key signs an action, and the corresponding public key verifies the signature, providing irrefutable proof of origin. This prevents a user from later claiming they did not send a message or perform a transaction.

Confidential data typically includes trade secrets, customer PII, and financial records. Public information and marketing brochures are public data.

The first step in the containment phase is to disconnect the workstation from the network. This immediately stops the ransomware from spreading laterally to other systems via SMB, RDP, or other network protocols. Containment prioritizes preventing further damage over remediation or analysis.

The last backup was the incremental backup at 11 AM (assuming 4-hour intervals from 11 PM). The failure at 2:30 PM means data from 11 AM to 2:30 PM (3.5 hours) could be lost, which exceeds the 1-hour RPO.

Least privilege in network security means denying all traffic except explicitly allowed.

Disabling unused ports on a network switch prevents unauthorized physical access and eliminates the risk of an attacker connecting to an open port to launch attacks such as ARP spoofing or DHCP starvation. This is a fundamental security best practice that reduces the attack surface by ensuring that only necessary ports are active and can be administratively controlled.

Conducting a quarterly review and recertification of role memberships and permissions is the industry-standard practice for maintaining the principle of least privilege in an RBAC system. This process ensures that role assignments are periodically validated against current job functions, removing accumulated permissions that no longer align with user responsibilities. It directly addresses permission creep by enforcing a formal, auditable lifecycle for role membership.

MAC address filtering restricts network access to devices with pre-approved MAC addresses, adding a layer of access control. While not foolproof (MACs can be spoofed), it is a recognized best practice for reducing the attack surface in small or home networks.

Account lockout thresholds (typically 3-10 attempts) help prevent brute-force attacks by temporarily disabling the account after repeated failures.

The correct matches pair each policy type with its primary focus. Common confusions involve swapping definitions between similar policies, such as Acceptable Use with Access Control, or Incident Response with Data Retention.