ISC2 Certified in Cybersecurity CC (CC) — Questions 226–300

The recovery phase involves restoring systems to normal operation after an incident has been contained and eradicated. Applying a rollback to a previous working version is a recovery action because it brings the production web servers back to a functional state. This phase focuses on implementing the fix and verifying that the service is fully operational. It follows containment and eradication, where the faulty update would have been identified and removed.

Simultaneous successful authentications from geographically distant locations within an impossibly short window strongly suggest the credentials were used by someone other than the legitimate user, especially since the user confirms only one session. Treating impossible travel as a compromise indicator prompts containment steps such as session termination, password reset, and review of accessed resources, which is the appropriate response.

A next-generation firewall performs deep packet inspection, examining payload and application-layer data rather than only headers and ports. It also integrates with directory services to enforce rules based on user identity, satisfying both constraints in the stem, unlike packet-filtering or stateful inspection firewalls.

A hot site maintains a fully operational, mirrored environment with current data and ready hardware, enabling failover within hours. This satisfies the stem's fastest-RTO constraint, unlike warm or cold sites, which require longer setup and data restoration.

Reporting preserves the original message and headers for the security team to analyse, block the sender and warn other recipients, while avoiding attachment execution prevents malware detonation. Opening or forwarding the attachment risks compromise and destroys forensic evidence.

Due care means taking reasonable, ongoing steps to protect assets, and regularly updating antivirus software demonstrates continuous diligence against known malware. It satisfies the stem by showing sustained protective action rather than a one-off measure, distinguishing due care from mere policy documentation or due diligence assessment.

An IPS inspects packet payloads and application-layer data inline, blocking malicious traffic in real time. Its signature-based detection can flag benign activity as malicious, producing false positives that block legitimate traffic — exactly the occasional over-blocking described. A firewall filtering only headers could not inspect payloads, so it fails the stem's inspection constraint.

A technical constraint that blocks one account from performing both steps enforces separation of duties automatically rather than relying on policy alone. It removes the possibility of a single user completing the whole transaction, which is exactly what the firm needs. This makes the control reliable and auditable in the payment system.

Checking the IP address against current threat intelligence feeds is the crucial first step. While the IP is identified as 'known command-and-control', verifying its specific associations with malware families or active campaigns provides essential context. This enrichment confirms the nature of the threat and informs subsequent incident response phases, satisfying the need for initial validation before proceeding with containment or eradication.

Continuous replication addresses the RPO by keeping data loss well under one hour, and automated failover at a secondary site brings the order system back online far faster than a 10-hour tape restore, comfortably meeting the 12-hour RTO. This solution targets both metrics simultaneously and provides a resilient architecture rather than incremental tweaks to a slow tape process.

Separation of duties splits a sensitive transaction across more than one person so no single individual controls the entire process. Because the clerk processes reimbursements, letting her also approve her own claim would give her unchecked control over a payment to herself. Requiring a different approver for her own reimbursement prevents that conflict and is the textbook application of separation of duties.

A retina scanner analyzes the unique pattern of blood vessels in the eye, which is a biological characteristic. This makes it a biometric control that verifies identity based on inherence. It is well suited for high-security environments like data centers because the trait is difficult to replicate, and it directly matches the requirement for biological verification.

Data classification labels tag information by sensitivity, enabling need-to-know enforcement because access decisions can be tied to clearance and label matching. Without labels, administrators cannot determine who legitimately requires specific data, so this practice directly supports least-privilege need-to-know access.

A remote access VPN authenticates the user and encrypts the entire session between the remote device and the corporate gateway, so file-share traffic is protected in transit without requiring per-application agents. It is well suited to a small business because it uses standard client software or a browser-based portal and centralizes access control at the VPN concentrator, meeting the authentication and encryption goals.

SYN cookies let the server avoid allocating state for half-open connections: it encodes connection details in the sequence number of the SYN-ACK, so the backlog cannot be exhausted by spoofed SYNs. This directly mitigates the resource-exhaustion constraint of a SYN flood.

Granting the database administrator only the permissions their specific tasks demand directly enacts least privilege, which requires limiting each identity to the minimum access necessary. This satisfies the stem's constraint by scoping rights to job function rather than granting broad, standing database privileges, thereby reducing the blast radius of compromised or misused credentials.

DNS filtering intercepts domain name resolution requests and blocks those matching a threat intelligence list of malicious domains. It requires no endpoint software, works network-wide, and is easy to update centrally. This directly prevents users from reaching harmful sites by returning a block response before any connection to the malicious IP is made.

In LDAP distinguished names, OU identifies the Organizational Unit container holding the object, while DC marks each Domain Component of the DNS-based directory namespace. Reading right to left, DC=com and DC=company define the domain hierarchy, and OU=Sales places John Smith within the Sales organisational unit.

Telnet transmits all session data, including login credentials, as unencrypted cleartext across the network, so anyone capturing traffic can read passwords directly. This satisfies the stem's constraint of a protocol deemed insecure precisely because it lacks encryption, unlike SSH, which tunnels the same terminal access within an encrypted channel.

A retina scan measures a physiological characteristic of the user's body, which is inherent and therefore a Type 3 inherence factor. It is not something the user knows or possesses, so it satisfies the requirement for an inherence-based example.

ABAC supports compound policy conditions that must all evaluate true before access is granted. Expressing the department match, classification allowance, approved hours, and managed-device requirement as a combined policy directly implements the auditors' four conditions. This is a correct description of how attribute-driven rules translate business requirements into enforceable access decisions.

A BIA determines which business processes are most critical and sets their recovery priorities, typically through impact ratings over time. This directly satisfies the stem's focus on prioritisation, distinguishing it from risk assessment or purely technical recovery sequencing activities.

The post-incident activity phase is designed to review the incident, gather feedback from responders, and update plans and controls. A lessons-learned meeting helps the retail company understand how the DDoS was detected, what worked well, and what needs improvement. This aligns with the goal of continuous improvement and is a core activity after the incident is closed.

Availability ensures systems and data remain accessible to authorised users when required. Redundant internet connections and load balancers remove single points of failure, maintaining web service access during DDoS traffic floods. Confidentiality and integrity address disclosure and modification respectively, not uptime.

Disabling unnecessary services and ports shrinks the attack surface by removing listening daemons and open sockets that are not required for the server's role. This is a core hardening step, directly satisfying the baseline requirement to minimise exploitable entry points on new servers.

Tier 2 analysts handle deeper investigation, correlating the malicious-IP indicator against threat intelligence, historical logs and endpoint telemetry. Tier 1 performs initial triage only, so escalation to Tier 2 satisfies the requirement for a deeper investigation of confirmed malicious outbound traffic.

Confidentiality ensures that information is not disclosed to unauthorized individuals, entities, or processes. In this scenario, restricting patient record access to authorized clinicians directly addresses preventing unauthorized disclosure, which is the core goal of confidentiality. The integrity and availability aspects are separate concerns; the question specifically asks about preventing unauthorized disclosure, making confidentiality the correct principle.

A SYN flood is a type of denial-of-service attack where the attacker sends a large number of TCP SYN packets to a target but does not complete the handshake, exhausting the target's connection resources. In this scenario, the internal host is sending SYN packets to many external IPs on port 443 without completing the handshake, which is characteristic of a SYN flood. The host is likely compromised and participating in a botnet.

A DMZ sits between the internet-facing firewall and the internal network, so public web and email servers are reachable externally while internal hosts stay shielded. This satisfies the stem's requirement to host public services and protect the internal network, since inbound traffic terminates in the DMZ rather than crossing into the trusted zone.

Isolating the workstation preserves volatile evidence, but memory contents such as running processes and network connections are lost on shutdown or reboot. Capturing a memory image next secures that volatile data before any remediation or power-off destroys it.

Inline IPS blocks traffic matching enabled signatures. If legitimate web traffic is dropped, the signature set is likely too aggressive or contains false positives, so tuning or disabling those signatures restores legitimate traffic while preserving genuine threat detection.

When object access auditing is enabled, file creation and access events are written to the Windows Security log with event IDs such as 4663 and 4656, including the account name and object path. This makes the Security log the authoritative source for attribution of file operations. Reviewing it requires the appropriate audit policy and sufficient log retention.

Stateful inspection permits the server's outbound HTTPS session to the licence server and returns replies, while the inbound rule exposes only TCP 8443 from the internet. This satisfies both the public accessibility and outbound licensing requirements under default deny.

Availability ensures systems and data remain accessible to authorized users when needed. Rate limiting preserves checkout responsiveness for real customers by throttling bot traffic that would otherwise consume server capacity, directly protecting the ability of legitimate buyers to complete purchases. This is the primary principle at stake because the scenario is about sustained access to the storefront, not about keeping review data secret or unaltered.

This ensures the user has only the permissions needed for their new role, following least privilege.

TCP establishes a connection via a three-way handshake and uses sequence numbers, acknowledgements and retransmissions to guarantee ordered, error-free delivery. This connection-oriented reliability at the Transport layer satisfies the stem's requirement, unlike connectionless UDP, which offers no delivery guarantees.

A Business Impact Analysis identifies critical business functions and maps their dependencies, plus tolerable downtime and recovery priorities. It is performed first because its output — the RTO and RPO figures — drives every subsequent BCP and recovery strategy decision.

Successful backup logs only confirm the job ran; they do not prove the file was selected. If the backup source or selection list omitted that database file, no restore point exists, regardless of job status.

A smart card is a physical token the user possesses, so it satisfies the possession factor. Authentication factors split into something you know, have, or are; the card's stored certificate proves possession, not knowledge or inherence.

Port 443 carries HTTPS over TLS, satisfying the stem's requirement for inbound secure web traffic. The firewall must permit TCP 443 so clients can establish encrypted sessions with the web server; port 80 would only serve unencrypted HTTP. This directly matches the HTTPS constraint rather than any alternative service.

Granting full financial database access to a user who only views quarterly reports exceeds their job requirements. Least privilege requires granting only the minimum access needed for assigned duties, so this excessive entitlement violates that principle most directly.

PAM brokers access to privileged credentials, vaulting them and injecting sessions through a controlled jump host. This delivers both control (least privilege, approval workflows, credential rotation) and monitoring (keystroke and command logging), satisfying the requirement to govern administrative accounts rather than ordinary user identities.

A successful login after many failures suggests a breached account, so the incident response team must be engaged to contain and investigate. Escalation satisfies the scenario's requirement to act on probable credential compromise rather than treating it as routine noise.

Type 3 authentication verifies something the user is, through inherence factors such as fingerprints, iris patterns or facial geometry. The stem explicitly requires something the user 'is', ruling out Type 1 (knowledge) and Type 2 (ownership) factors. Biometrics therefore satisfy the high-security facility's requirement.

A preventive control stops an unwanted event before it occurs. Automatically disabling accounts on the last working day prevents the former employee from authenticating at all, closing off the possibility of unauthorized access. Because the control acts in advance of any attempted misuse, it is preventive in nature, even though it also supports other goals such as audit compliance.

Requiring two different administrators to approve each firewall change splits authority over one sensitive action, preventing any single person from both authoring and authorising it. That division of duties is precisely the separation of duties principle.

Layering fencing, badge readers, biometrics and cable locks creates successive independent barriers, so defeating one control still leaves others. This matches defence in depth, which the stem's layered approach exemplifies, rather than single-mechanism concepts such as least privilege or separation of duties.

Separation of duties splits a sensitive transaction across two distinct approvers, so no single manager can authorise a payment alone. Requiring two different managers for transactions above $10,000 directly enforces this principle by preventing unilateral action and creating mutual oversight.

A mantrap uses interlocked doors so the second door cannot open until the first is secured, and typically only one person fits in the vestibule. This physically separates individuals, defeating the common practice of an unauthorized person following an authorized badge holder through a single door. That is precisely the anti-tailgating function the scenario describes.

A DMZ is a perimeter subnetwork exposing public-facing services such as web and email servers to the internet while firewall rules block direct access to the internal LAN, limiting exposure if those hosts are compromised.

Tabletop exercises rehearse the plan against simulated scenarios, exposing gaps in roles, escalation paths and communications before a real incident. This validates readiness during preparation, satisfying the requirement to test and refine response capabilities rather than improvise them live.

A Web Application Firewall inspects HTTP and HTTPS request content, applying signatures and rules to detect and block injection, cross-site scripting and similar attacks. Network firewalls filter by port and address only, so they cannot inspect application-layer payloads.

VLANs logically separate traffic, and ACLs enforce policy; uses existing hardware if the switch supports VLANs (most do).

Isolation halts the malware's spread and external communication while the environment is still compromised, which is the containment phase's defining action. It sits between detection and eradication, satisfying the stem's need to stop ongoing impact before recovery begins.

AES-128 still provides confidentiality, but the policy mandates AES-256 specifically. The compromised objective is compliance with the stated cryptographic standard, not confidentiality itself. Since the question asks which security objective is most directly affected, weaker-than-mandated encryption weakens the assurance level the policy requires, making confidentiality the closest fit.

A SIEM collects log and event data from across the estate, then correlates it to detect patterns indicating incidents and raises alerts. This aggregation and correlation capability is its primary purpose, satisfying the stem's requirement.

Password complexity requirements are a logical access control because they govern authentication through software-enforced rules on the credential itself, restricting who can gain system access. No physical barrier is involved, satisfying the question's requirement for a logical, rather than physical, control.

Detection and Analysis is the phase where monitoring tools, alerts, and staff identify that an incident is occurring and determine its scope. A 36-hour gap between the start of the ransomware attack and its discovery is a direct failure of this phase. The organization did not detect the unauthorized encryption activity in a timely manner, delaying the entire response effort.

Least privilege grants users only the access required for their role. The employee reaching files outside their project folder shows permissions exceeding that minimum, so the principle is breached regardless of whether the access was intentional.

72 hours is the maximum period under GDPR Article 33(1) for notifying a supervisory authority of a personal data breach, counted from awareness. This satisfies the stem's PHI breach scenario, since the regulation sets a single deadline regardless of sector; healthcare organisations must also document the breach internally.

Before restoring any data, the recovery team must ensure that the backups are not compromised. Ransomware often attempts to encrypt or delete backups, and restoring an infected backup could reintroduce the malware. Validating the integrity and cleanliness of backups is a critical first step to prevent reinfection. This aligns with incident response best practices, which emphasize verifying the trustworthiness of recovery sources before initiating restoration.

Top secret is the highest classification tier, so it mandates the strongest controls: strict need-to-know access, enhanced encryption, and rigorous handling procedures. Lower tiers such as confidential or internal permit weaker safeguards, so this level satisfies the stem's requirement for maximum protection.

Unusual outbound port 443 traffic from a workstation with no business justification suggests command-and-control or exfiltration activity. Investigating the host for malware establishes the cause before containment, satisfying the requirement to act first on a suspected compromised endpoint.

Risk likelihood is the probability or frequency that a threat will exploit a vulnerability and cause harm within a defined period. By estimating how often an attack is likely to succeed in a year, the firm is directly quantifying likelihood, which is one of the two core dimensions of risk alongside impact. This estimate then feeds into risk analysis and prioritization, making it the concept the firm is measuring.

Firewall logs capture allowed and denied connections with source and destination IP addresses, ports and byte counts, revealing large or anomalous outbound flows to external hosts. This satisfies the exfiltration scenario by exposing volume and destination of egress traffic crossing the network perimeter.

Non-repudiation provides cryptographic proof of origin and integrity, binding a user to an action through digital signatures or audit trails. This satisfies the stem's requirement that a user cannot later deny performing a specific action, as the evidence is verifiable and tamper-evident.

Customer PII uniquely identifies individuals and, if disclosed, enables identity theft and triggers breach-notification and privacy-law duties. That harm potential places it at Confidential or higher, satisfying the policy's requirement to protect data whose exposure causes legal, financial or reputational damage to individuals and the organisation.

Disconnecting the workstation from the network immediately severs the ransomware's command-and-control channel and blocks lateral movement to shared drives or other hosts, satisfying the stem's requirement to contain an infection isolated to one machine before eradication or recovery begins.

On Red Hat-based Linux distributions, /var/log/secure serves the same purpose as /var/log/auth.log on Debian-based systems. It records authentication and security-related events, including failed logins and sudo usage. Monitoring this file is critical for detecting unauthorized access attempts on those systems. It is a primary source for security auditing.

Default-deny firewall rules permit only explicitly required services, embodying least privilege by granting the minimum access necessary. This satisfies the stem's constraint of blocking all inbound traffic except specific necessary services, rather than relying on implicit trust.

Reduces attack surface.

Scheduled recertification forces role owners to confirm each membership and permission remains justified, stripping entitlements left over from previous job functions. This directly addresses accumulated drift after reorganisation, which RBAC alone cannot prevent once assignments persist.

The scenario describes a spoofed executive identity, an urgent financial request, and a newly registered look-alike domain. These are hallmarks of business email compromise, where attackers impersonate executives to trick employees into transferring funds or revealing sensitive data. The message passing authentication checks suggests the attacker may have compromised a legitimate account or used a carefully crafted domain that bypasses some filters.

Senior leadership and the board own risk appetite and strategic direction because they are accountable to stakeholders and can commit resources across the organization. A security policy that assigns this responsibility at the executive or board level ensures security decisions align with business objectives and regulatory obligations. This is a core governance function rather than a day-to-day operational task.

Lockout thresholds directly throttle repeated authentication failures, so an attacker cannot iterate passwords indefinitely. The 5-attempts-in-15-minutes constraint caps the guessing rate, defeating brute-force attempts while allowing legitimate users to retry after the lockout window expires.