ISC2 Certified in Cybersecurity CC (CC) — Questions 376–450

Capturing the contents of RAM is crucial because memory holds highly volatile data that would be irretrievably lost upon system shutdown or reboot. This includes active processes, network connections, loaded kernel modules, and potentially malicious code residing solely in memory. Preserving RAM contents directly addresses the requirement to collect 'volatile data' for forensic analysis, ensuring critical evidence is secured before it becomes ephemeral and unusable for potential legal action.

When object access auditing is enabled, the file server's Security log records events such as 4663 for attempts to access an object, including the account name, object path, and access type. This directly answers whether the compromised account touched the sensitive share. It is the most specific and authoritative source for file share access on Windows.

ARP spoofing forges gratuitous ARP replies that bind the gateway's IP address to the attacker's MAC address, so victims forward their frames to the attacker. The attacker then relays traffic onward while capturing credentials and session data, or alters payloads in transit, satisfying the eavesdropping and modification goal.

A hacker group is an external threat actor with the intent and capability to exploit vulnerabilities. In risk management, a threat is any circumstance or event with the potential to cause harm. This group represents a threat because it actively seeks to compromise systems, and its existence is independent of any specific weakness in the CRM.

A DMZ (demilitarised zone) sits between the internet-facing perimeter and the internal network, so public-facing servers are reachable from the internet while firewall rules block direct access to internal corporate systems. This satisfies the isolation requirement without exposing the internal network.

Updating plan testing and maintenance ensures recovery procedures are validated against actual backup formats before a disaster, exposing incompatibilities during exercises rather than live recovery. This directly addresses the stem's constraint: tapes failing to restore because format compatibility was never verified, so the maintenance schedule must mandate periodic restore testing.

TCP port 3389 is used by Remote Desktop Protocol (RDP). Repeated inbound connection attempts from multiple external IP addresses suggest a brute-force attack attempting to guess credentials for RDP access. This is a common attack vector for gaining unauthorized remote access to Windows systems. Monitoring and blocking such attempts is critical to prevent compromise.

Implementing access controls directly reduces the likelihood of unauthorised actions by enforcing least privilege, satisfying the stem's requirement for risk mitigation. Rather than transferring or accepting risk, it lowers inherent exposure through preventive technical controls such as role-based access assignments in Microsoft Entra ID.

Fencing, bollards, lighting, guards, and biometric readers are distinct control layers, each imposing a separate obstacle before the next. An attacker must defeat all layers sequentially, which is precisely the layered, delay-and-detect approach defence in depth describes.

Isolation contains the threat and allows forensic analysis without risk of further damage.

Prevents IP spoofing by filtering traffic based on DHCP snooping bindings.

Segmenting the database server into its own VLAN isolates it at the network layer, and firewall rules restrict access to only the application server. This combination enforces least privilege and reduces the attack surface. It ensures that even if other systems are compromised, they cannot directly reach the database.

Firewall rules filtering on source port 6514 break syslog-ng's TCP transport, because clients originate connections from random ephemeral ports; only the destination port is 6514. Since the stem's rule constrains the source port, the client's packets are dropped before reaching 10.0.0.10, preventing log delivery.

Separating administrative duties from everyday user activity prevents routine browsing, email and document handling from exposing highly privileged credentials to phishing or credential theft. This directly satisfies the least-privilege and separation-of-duties requirements for privileged account management, limiting the blast radius if a standard account is compromised.

Least privilege grants users and processes only the permissions required to perform their tasks, limiting the blast radius of compromise or error. It is a foundational security principle, directly constraining access rights rather than merely detecting or responding to threats.

SIEM platforms aggregate logs from disparate sources, then apply correlation rules and analytics to link related events across systems. This correlation is what surfaces multi-stage incidents that individual device logs would not reveal, satisfying the stem's requirement for detecting incidents rather than merely storing or forwarding raw log data.

Rule-based access control evaluates administrator-defined conditions, and the time-of-day and day-of-week window is precisely such a condition. The policy applies uniformly regardless of who the teller is, and users cannot alter it. This matches the defining characteristic of rule-based control, where objective criteria govern the decision.

A digital signature verifies that the update has not been altered after signing, because any modification invalidates the hash encrypted with the signer's private key. This detects tampering, satisfying integrity; authenticity of the sender is a related but separate assurance.

QoS policies prioritise database replication traffic, preventing bulk synchronisation jobs from saturating the link and causing failover failure. This addresses the root cause—unmanaged bandwidth contention—rather than merely adding capacity or relaxing RTOs, satisfying the stem's requirement to fix the underlying fault.

Restricted data demands the strongest controls because it carries the greatest potential harm if disclosed, satisfying the stem's requirement for the highest protection level. Public, Internal, and Confidential each warrant progressively less stringent safeguards, so Restricted sits at the top of this four-tier classification scheme.

HTTPS traffic uses TCP port 443, where TLS encapsulates HTTP. Permitting TCP 443 satisfies the secure web traffic requirement; port 80 carries unencrypted HTTP, and UDP 443 is used by HTTP/3 rather than standard secure browsing.

Correct. Smart card is a possession factor.

Government intelligence material is classified at the highest tier because unauthorised disclosure causes exceptional damage to national security. Its handling mandates the strictest controls, so it belongs in the restricted or top secret category rather than internal or public.

DNS cache poisoning inserts false records into a resolver's cache so that legitimate domain names resolve to attacker-controlled addresses. Since the workstation uses the corporate resolver and no local configuration changed, a poisoned cache on that resolver would explain the incorrect answer. This enables redirection to malicious sites and is a classic man-in-the-middle enabler.

MFA defeats phishing because a stolen password alone is insufficient; the second factor blocks the attacker. It directly addresses willing credential disclosure across remote access and critical systems, satisfying the remote workforce constraint without relying on password complexity or rotation.

Layering a WAF, vulnerability scans and strict access controls applies defense in depth: multiple independent controls so one failure does not expose the application. This satisfies the stem's scenario, where several distinct protective mechanisms combine rather than a single restrictive entitlement.

Risk is a function of likelihood and impact. Here, likelihood is high, but the backup reduces the impact from severe to moderate. The residual risk is therefore moderate. This classification acknowledges both the high likelihood and the mitigating effect of the backup, resulting in a balanced risk rating that reflects the remaining exposure.

Encrypting backup tapes renders the data unreadable without the appropriate keys, even if the physical media is lost or stolen. This directly satisfies the requirement that unauthorized parties cannot read the data. Therefore, encryption is the correct control for protecting data at rest on transported media in this scenario.

Hashing detects unauthorised file modification because any change to the file's contents produces a different hash value, so comparison against the stored baseline reveals tampering. This directly satisfies the stem's requirement to detect unauthorised changes to critical files, supporting integrity rather than confidentiality or availability.

Due diligence is the pre-contract investigation of a vendor's controls, plans and personnel, gathering evidence before commitment. Audits and penetration tests examine an existing relationship, whereas due diligence satisfies the consultant's need to assess risk prior to signing.

Separation of duties requires splitting sensitive functions across different people so no single account controls an entire process. One administrator holding account creation, privilege assignment and audit review concentrates incompatible duties, removing the checks that would otherwise detect abuse.

Risk acceptance means deliberately acknowledging a residual risk and proceeding without further controls because the upgrade cost exceeds the potential impact. This matches the stem's scenario of tolerating a known vulnerable software version rather than mitigating, transferring or avoiding it.

An IDS passively copies and analyses network traffic, comparing it against signatures or anomalies to raise alerts. Because it sits out-of-band rather than inline, it detects malicious activity without adding latency or dropping packets, satisfying the no-performance-impact constraint.

Confirming whether the transfer was authorised distinguishes legitimate scheduled replication or backup traffic from genuine exfiltration. Acting before verification risks disrupting business operations or destroying evidence, so validation is the immediate step the alert scenario demands.

The root cause is that permissions were never re-evaluated when the employee changed roles, a failure of the access control lifecycle. A periodic access review, sometimes called recertification, compares current entitlements against what the job now requires and removes the excess. Revoking the stale Finance rights directly corrects the excessive privilege and prevents similar drift for other transfers.

Cameras monitor and record activity in a physical space, so they satisfy the stem's requirement for a physical security control. Unlike logical controls such as access lists or encryption, they operate on the tangible environment, deterring and detecting intrusions at the perimeter or within a facility.

TCP operates at the Transport layer, providing connection-oriented, reliable delivery with sequencing, acknowledgements and flow control. Its layer 4 port addressing and segmentation satisfy the question's requirement for protocols operating at the Transport layer of the OSI model.

A cold site provides only basic space and power, with no pre-installed hardware or replicated data, so the organisation pays minimal ongoing facility costs. That low cost is the defining benefit, accepting lengthy activation and restoration times.

Type 3 authentication relies on something you are — a biometric trait. A retina scan measures a physiological characteristic unique to the individual, satisfying that category rather than knowledge (Type 1) or possession (Type 2).

Due diligence is the investigation and verification of a vendor's controls before contracting, covering certification review, background checks and site visits. These activities assess the vendor's actual security posture, satisfying the evaluation described in the scenario.

File integrity monitoring detects unauthorised changes to critical files by comparing hashes against a known baseline. This directly addresses integrity, ensuring data and system files remain unaltered and trustworthy, rather than focusing on confidentiality or availability.

The employee ID identifies the user, the password is something the nurse knows, and the one-time code from a hardware token is something the nurse has. Combining two different factors from separate categories satisfies multi-factor authentication. This accurately describes the hospital's login process and is the correct categorization.

A remote access VPN authenticates each developer and can integrate a posture or host-check step that evaluates device health before granting network access. The repositories remain on an internal subnet that is not directly reachable from the internet. This satisfies identity verification, device health assessment, and non-exposure of the repositories in one design.

A tabletop exercise is a discussion-based test where participants walk through a simulated emergency scenario. It allows stakeholders to practice roles, decision-making, and communication without affecting production systems. This makes it a low-risk, cost-effective way to identify gaps in plans and coordination. It does not validate technical recovery capabilities, but it is valuable for testing the human and procedural aspects of the plan.

Backup procedures form a core disaster recovery component because they enable data restoration after loss, corruption or site failure. They directly satisfy the plan's recovery requirement by defining what data is copied, how frequently, where copies are stored, and how restoration is tested and performed within agreed recovery time objectives.

Denial-of-service attacks exhaust a system's capacity — flooding bandwidth, connection tables or CPU — so legitimate users cannot reach the resource, directly matching the stem's unavailability criterion. Unlike data-theft or intrusion categories, the objective here is disruption rather than access, making this the precise incident classification.

SSH encrypts the entire management session, including credentials and commands, preventing eavesdropping and man-in-the-middle interception. Port 22 is its assigned transport port. Telnet on port 23 sends everything in cleartext, failing the secure remote management constraint.

Port 443 carries HTTPS, which wraps HTTP inside TLS, encrypting credentials and session data in transit. This directly satisfies the stem's requirement for a secure protocol port, unlike cleartext alternatives such as port 80. Microsoft Entra ID authentication traffic and most modern web APIs rely on 443 for this reason.

In mandatory access control, the no-read-up rule forbids reading data classified above the subject's clearance. A Secret-cleared user requesting a Top Secret file therefore fails the dominance check, and the reference monitor denies access regardless of need or ownership.

Confidentiality ensures information is disclosed only to authorised parties, typically enforced through encryption, access controls and classification. It forms one of the three pillars the policy must address, directly satisfying the stem's requirement for a core CIA triad component.

A fingerprint scan is a biometric characteristic, placing it in Type 3 "something you are". It satisfies the stem's requirement for a Type 3 factor because the trait is inherent to the individual, unlike possession tokens or memorised passwords.

Separation of duties ensures that a critical task is divided among multiple people so that no single individual can complete it without oversight. By requiring code to be reviewed and approved by a different team member and denying developers direct production write access, the company prevents one person from both authoring and deploying changes. This directly enforces separation of duties in the software deployment process.

CN is the attribute naming the entry itself within its container, holding the object's common name — here "John Smith". The stem's DN places CN as the leftmost, most specific relative distinguished name, with OU and DC components locating it hierarchically, so CN satisfies the question's request for the abbreviation's meaning.

Incremental backups capture only changes since the previous backup, so restoration requires the last full backup plus every incremental in sequence. Sunday's full plus Monday's and Tuesday's incrementals reconstruct Tuesday's state; omitting either incremental loses intervening changes.

A DMZ sits between the internal network and the internet, exposing the web server to public traffic while firewalls restrict inbound connections to that segment alone. This satisfies the stem's requirement to isolate the server yet permit controlled access, preventing direct reach from the public internet into internal systems.

Fingerprint recognition measures a physiological trait, which classifies it as a biometric control. Because the scan is matched against an enrolled template to confirm the person's claimed identity, it functions as an authentication mechanism at the lab entrance, satisfying the requirement that a biometric verifies something the individual is.

Denial of service floods a system or network with traffic or malformed requests, exhausting bandwidth, connections or processing capacity so legitimate users cannot access the resource. Availability, rather than confidentiality or integrity, is the target of this incident type.

An IDS passively inspects network traffic, matching signatures or anomalies to raise alerts without dropping packets. Because the stem specifies the device monitors and alerts but does not block, an Intrusion Detection System satisfies that non-preventive constraint; an IPS would actively block traffic inline.

A biometric reader authenticates identity through fingerprint or iris traits before granting entry, directly controlling who physically passes through the server room door. It is a preventive physical control restricting human access to the facility.

Separation of duties is an essential ISC2 security principle, splitting critical tasks across multiple people to prevent fraud and error. It satisfies the requirement by ensuring no single individual controls an entire process, enforcing checks and balances. ISC2 lists it alongside least privilege and defence in depth as foundational.

NGFWs inspect traffic to identify applications regardless of port, then allow, block, or shape them by category. This application-layer control directly addresses advanced threats that tunnel over permitted ports, a capability absent from traditional port-based firewalls.

Segregating public-facing web and email servers into the DMZ keeps them off the internal network, so a compromise cannot directly pivot inward. This satisfies the DMZ design constraint that only externally reachable services reside in that screened subnet.

An account lockout policy locks an account after a set number of failed authentication attempts, directly thwarting brute force attacks that rely on repeated password guessing. It satisfies the stem by halting the automated trial-and-error process before credentials are discovered.

Preparation includes training and tools.

Kerberos supports mutual authentication because the service ticket is encrypted with the service's secret key, proving the ticket came from the Key Distribution Center, while the authenticator proves the client holds the session key. This lets both parties verify each other, which is valuable in domain environments where clients must be sure they are contacting a legitimate service and not an impostor.

ARP spoofing lets the attacker position themselves between client and server, silently relaying and altering frames while both endpoints believe they hold a direct connection. That interception and modification of live traffic is precisely the man-in-the-middle condition the scenario describes, satisfying the requirement that communications pass through the attacker.

Isolating the workstation severs the attacker's network path, containing the compromise so lateral movement, data exfiltration and further payload delivery cannot continue. This limits incident scope while forensic imaging and eradication proceed on the quarantined host.

Clicking sounds plus non-recognition indicate the drive's read/write heads or platters have physically failed. The successful backup job only confirms data was written earlier; mechanical failure now prevents the drive from spinning up, so the file cannot be restored from it.

Confidentiality directly addresses preventing unauthorised disclosure, which is the exact control objective stated in the stem. Encryption, access controls and data classification enforce confidentiality by restricting data access to authorised parties only. Integrity would concern unauthorised modification, and availability would concern timely access, neither of which matches the disclosure constraint.

Limiting administrative rights and running services under dedicated low-privilege accounts constrains what an attacker can do after gaining a foothold. It reduces the number of accounts and processes capable of modifying the system or escalating privileges. This directly shrinks the exploitable surface and limits blast radius, making it a core hardening practice.

Stateful inspection tracks connection state in a session table, so it filters on source and destination IP addresses and ports while recognising established flows. Stateless packet filtering cannot track connection state, which the stem explicitly requires.

802.1X authentication requires a supplicant to authenticate against a RADIUS server via EAP before the switch grants port access, satisfying the authorised-devices-only constraint. Unauthenticated devices remain in an uncontrolled state and cannot pass traffic onto the wired network.