976 questions total · 14pages · All types, answers revealed
An organization uses fencing, bollards, and lighting around the perimeter, guards at the main entrance, and biometric readers on server room doors. This approach is an example of:
Multiple overlapping physical controls (fencing, guards, biometrics) exemplify defense in depth.
Why this answer
Defense in depth employs multiple layers of security to protect assets.
Drag and drop the steps for the TCP three-way handshake into the correct order.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
The TCP three-way handshake is a three-step process used to establish a reliable connection. The client initiates by sending a SYN (synchronize) packet to the server. The server responds with a SYN-ACK (synchronize-acknowledge) packet, acknowledging the client's request and indicating its own synchronization.
Finally, the client sends an ACK (acknowledge) packet to confirm the connection establishment. This sequence ensures both sides agree on initial sequence numbers and that the connection is ready for data transfer.
A company's security operations center (SOC) receives an alert about suspicious outbound traffic from a server in the DMZ to an external IP address known for command-and-control activity. The SOC analyst reviews the logs and sees that the source port is 443 and the destination port is 8080. Which of the following actions should the analyst take FIRST?
Isolation contains the threat and allows forensic analysis without risk of further damage.
Why this answer
The SOC analyst should first isolate the server from the network because the outbound traffic from a DMZ server to a known C2 IP address, using source port 443 (HTTPS) to destination port 8080 (HTTP alternate), indicates a potential compromise. Isolating the server stops the data exfiltration and prevents further C2 communication, allowing for a controlled forensic investigation without alerting the attacker. This aligns with the NIST SP 800-61 incident response process, where containment is prioritized before eradication or recovery.
Exam trap
ISC2 often tests the candidate's ability to prioritize containment over notification or broad blocking, trapping those who confuse 'first action' with 'escalation' or who apply overly aggressive firewall changes without considering service impact.
How to eliminate wrong answers
Option A is wrong because notifying the incident response team and management immediately is premature; the analyst must first contain the threat by isolating the server to prevent further damage, as notification can occur after initial containment. Option C is wrong because blocking the external IP address at the firewall is a reactive measure that does not stop the compromised server from communicating with other C2 IPs or using different ports, and it may alert the attacker to change tactics. Option D is wrong because modifying the firewall rule to deny all outbound traffic from the DMZ would disrupt legitimate services hosted in the DMZ (e.g., web servers, mail relays) and is an overly broad, non-surgical response that violates the principle of least disruption.
Which THREE security mechanisms should be implemented to secure a network against ARP spoofing attacks? (Choose three.)
Prevents IP spoofing by filtering traffic based on DHCP snooping bindings.
Why this answer
IP Source Guard (A) is correct because it uses DHCP snooping binding table entries to filter traffic on a per-port basis, dropping packets where the source IP address does not match the binding. This prevents an attacker from spoofing a legitimate host's IP address in ARP spoofing attacks by ensuring only valid IP-to-MAC mappings are allowed on the port.
Exam trap
ISC2 often tests the misconception that port security or MAC filtering can prevent ARP spoofing, but these only control MAC addresses, not the IP-to-MAC bindings that ARP spoofing exploits.
The rule includes 'eq 6514' which matches only if source port is 6514; clients use dynamic ports.
Why this answer
The firewall rule on the central logging server (10.0.0.10) specifies a source port of 6514. However, syslog-ng clients, when sending over TCP or TLS, typically use a random ephemeral source port (e.g., above 1024) rather than a fixed source port. Since the firewall restricts the source port to exactly 6514, the client's packets are dropped, preventing logs from reaching the server.
Exam trap
The trap here is that candidates assume the firewall rule's source port 6514 is irrelevant or that the client must use the same port as the server, when in fact the client uses an ephemeral source port, making the rule overly restrictive and the cause of the failure.
How to eliminate wrong answers
Option A is wrong because the exhibit does not indicate that the syslog-ng client is configured to use TLS; the default transport for syslog-ng is TCP or UDP, and the firewall rule allows TCP on destination port 6514, which is the standard syslog-over-TLS port, but the issue is the source port restriction, not the protocol. Option C is wrong because the syslog-ng client does not use UDP by default when configured for TCP-based logging; the firewall rule explicitly allows TCP on destination port 6514, so if the client were using UDP, it would be blocked, but the client's configuration (not shown) would specify the transport, and the core problem is the source port mismatch. Option D is wrong because the firewall rule does not include a source IP restriction; it only specifies source port 6514 and destination port 6514, so the client IP 192.168.1.100 is not filtered out by the rule.
Which TWO of the following are recommended practices for managing privileged accounts? (Select TWO.)
Correct. Separation reduces risk.
Why this answer
Separating admin accounts from daily accounts and using PAM solutions are key practices.
Which TWO of the following are examples of security principles?
Least privilege is a security principle.
Why this answer
Least privilege is a foundational security principle that dictates users, processes, or systems should only be granted the minimum access rights necessary to perform their functions. This reduces the attack surface and limits potential damage from compromised accounts or insider threats. It is a design concept, not a specific technology, which is why it qualifies as a security principle.
Exam trap
ISC2 often tests the distinction between security principles (like least privilege and defense in depth) and security technologies (like encryption, firewalls, and VLANs), trapping candidates who confuse implementation tools with the underlying design concepts.
Which of the following is the primary purpose of a security information and event management (SIEM) system?
SIEMs collect and correlate logs for threat detection.
Why this answer
The primary purpose of a SIEM system is to aggregate, correlate, and analyze log data from multiple sources (e.g., firewalls, servers, IDS/IPS) in real time to detect security incidents. By applying correlation rules and analytics, SIEM identifies patterns or anomalies that indicate malicious activity, enabling security teams to respond promptly.
Exam trap
ISC2 often tests the distinction between a SIEM's core function (correlation and detection) and other security tools' roles (prevention, enforcement, or replacement of manual tasks), leading candidates to mistakenly choose 'replace manual log review' because they overlook the primary purpose of incident detection.
How to eliminate wrong answers
Option A is wrong because enforcing access control policies is the function of dedicated systems like firewalls, identity and access management (IAM) solutions, or directory services (e.g., Active Directory), not a SIEM, which focuses on log analysis and monitoring. Option B is wrong because while SIEM automates log analysis and reduces manual effort, its primary purpose is not simply to replace manual log review but to provide correlation and incident detection; manual review is still needed for validation and complex investigations. Option C is wrong because preventing malware infections is the role of endpoint protection platforms (EPP), antivirus software, or intrusion prevention systems (IPS); a SIEM detects signs of infection through log correlation but does not actively block malware.
A medium-sized enterprise uses a Cisco ASA firewall configured with multiple security zones (Inside, Outside, DMZ). The DMZ hosts a web server that must be accessible from the Internet on TCP 443. The Inside network (10.0.0.0/24) hosts internal clients. The web server has IP 172.16.0.10. The firewall's current rules: allow any from Outside to DMZ on TCP 443; allow any from Inside to Outside; deny all else. Recently, the security team noticed that an attacker compromised the web server and used it to launch an attack against an internal database server at 10.0.0.50. The attack was successful because the firewall allowed traffic from the DMZ to the Inside. The firewall's default behavior is to deny traffic from lower security zones to higher security zones (DMZ is lower than Inside). What is the MOST likely reason this traffic was allowed?
An explicit rule would override the default deny and allow the attack traffic.
Why this answer
The firewall's default behavior is to deny traffic from a lower security zone (DMZ) to a higher security zone (Inside). For the attack to succeed, an explicit permit rule must have been configured to allow traffic from DMZ to Inside. The existing rules only permit Outside to DMZ on TCP 443 and Inside to Outside; without an explicit DMZ-to-Inside rule, the default deny would have blocked the attack.
Thus, the most likely reason is that an administrator inadvertently or intentionally added such a permit rule.
Exam trap
ISC2 often tests the misconception that the ASA's default behavior allows traffic from lower to higher security levels if the connection is initiated from the higher level, but in reality, the ASA only permits return traffic for established connections; new connections from lower to higher are always denied by default.
How to eliminate wrong answers
Option B is wrong because transparent mode (Layer 2) forwards traffic based on MAC addresses and does not inherently allow all traffic; it still applies access control lists (ACLs) and security policies, so it would not bypass the zone-based security. Option C is wrong because a VPN connection would terminate on the firewall or a dedicated VPN concentrator, and traffic from the VPN would be subject to the same security zone policies; it would not bypass the firewall's rules unless explicitly permitted. Option D is wrong because the firewall's default behavior is to deny traffic from lower to higher security levels regardless of connection initiation; stateful inspection tracks connections, but a new connection from DMZ to Inside is still denied by default unless an explicit rule exists.
An organization uses a digital signature to verify the authenticity of a software update. This supports which part of the CIA triad?
Correct. Digital signatures ensure data has not been altered.
Why this answer
Digital signatures verify integrity and authenticity.
Match each risk management term to its meaning.
Drag a concept onto its matching description — or click a concept then click the description.
Weakness in a system
Potential cause of harm
Likelihood and impact of a threat exploiting a vulnerability
Control to mitigate risk
Why these pairings
Risk is the potential for loss when a threat exploits a vulnerability. A threat is a potential cause of harm. A vulnerability is a weakness.
Controls are measures to reduce risk.
A multinational financial services organization operates three data centers in different geographic regions. Each data center runs a mix of critical and non-critical applications. The DR plan specifies Recovery Time Objectives (RTOs) ranging from 4 hours for critical applications to 72 hours for non-critical. During a scheduled DR test, the team attempts to fail over the primary customer database to the secondary site. The failover fails because the replication link between sites was saturated due to a large data synchronization job running concurrently. The test is declared a failure, and senior management is concerned about the DR plan's reliability. The IT director suggests increasing bandwidth between sites. The security architect proposes implementing network prioritization for replication traffic. The business continuity manager recommends revising the RTOs to be more realistic based on current bandwidth. The system administrator thinks the issue will resolve if the test is repeated during off-peak hours. Which of the following is the BEST course of action to address the root cause of the failure?
QoS ensures that critical DR replication traffic gets sufficient bandwidth, preventing saturation by low-priority jobs.
Why this answer
The root cause is that the replication link was saturated by a large data synchronization job, which delayed the critical database replication traffic needed to meet the 4-hour RTO. Implementing Quality of Service (QoS) policies directly addresses this by prioritizing database replication traffic over other data transfers, ensuring that critical replication gets the necessary bandwidth even during concurrent large jobs. This is the most effective solution because it resolves the contention without requiring additional bandwidth or changing RTOs.
Exam trap
ISC2 often tests the misconception that simply adding more bandwidth (Option B) solves all congestion issues, but the trap is that without traffic prioritization, the root cause of contention between different traffic types remains unaddressed.
How to eliminate wrong answers
Option B is wrong because simply increasing bandwidth does not guarantee that replication traffic will be prioritized; without QoS, other data transfers can still saturate the link, and it may not be cost-effective or timely. Option C is wrong because rescheduling the test avoids the problem rather than fixing it; the same issue could occur during a real disaster when other replication activity is unavoidable. Option D is wrong because revising the RTO to 8 hours accepts a degraded recovery capability instead of addressing the technical root cause of traffic prioritization, which could be solved with QoS.
A company classifies its data into four categories: Public, Internal, Confidential, and Restricted. Which classification requires the highest level of protection?
Correct. Restricted data is the most sensitive and requires the highest protection.
Why this answer
Restricted is the highest classification, often equated with top secret, requiring stringent controls.
A technician is configuring a firewall to allow secure web traffic. Which port and protocol should be permitted?
HTTPS uses TCP port 443.
Which of the following is an example of Type 2 authentication?
Correct. Smart card is a possession factor.
Why this answer
Type 2 authentication relies on something the user possesses, such as a smart card or token.
A company is implementing a data classification policy. According to best practices, which THREE of the following should be classified as 'restricted' or 'top secret'? (Select THREE).
Government classified data is restricted.
Why this answer
Restricted data includes trade secrets, classified government info, and biometric data.
A mid-sized company has a network with 200 employees. The security team has implemented a policy that requires all employees to use complex passwords and change them every 60 days. However, the company has experienced multiple phishing attacks where employees have willingly provided their credentials to fake websites. The CEO wants to implement a more robust authentication method. The company uses Microsoft Active Directory and has a budget for new security tools. They also have a remote workforce. Which of the following is the BEST course of action to address the phishing risk?
Correct. MFA adds a second layer that phished passwords cannot bypass.
Why this answer
Multi-factor authentication (MFA) significantly reduces the risk of credential theft because even if a password is phished, the attacker cannot authenticate without the second factor. The other options either do not address phishing directly or are less effective.
A company deploys a web application firewall (WAF), performs regular vulnerability scans, and implements strict access controls. Which security principle is being applied?
Multiple layers of security controls exemplify defense in depth.
Why this answer
Defense in depth is the security principle of layering multiple independent security controls so that if one fails, others still provide protection. The question describes three distinct layers: a WAF (application-layer filtering), vulnerability scanning (proactive detection), and strict access controls (preventive policy). This stacking of different types of controls across the network, host, and application layers is the textbook definition of defense in depth.
Exam trap
ISC2 often tests defense in depth by listing multiple security tools and expecting candidates to recognize the layering concept, but the trap here is that candidates confuse 'defense in depth' with 'least privilege' because both involve multiple controls, when in fact least privilege is just one layer within a defense-in-depth strategy.
How to eliminate wrong answers
Option B (Accountability) is wrong because accountability refers to tracking user actions through logging and auditing (e.g., syslog, auditd) to hold individuals responsible, not to deploying multiple protective layers. Option C (Risk management) is wrong because risk management is the broader process of identifying, assessing, and mitigating risks (e.g., via risk matrices or quantitative analysis), not the specific architectural strategy of layering controls. Option D (Least privilege) is wrong because least privilege is a specific access control principle that grants only the minimum permissions needed to perform a task (e.g., using RBAC with minimal roles), not the combination of WAF, scans, and access controls.
A security administrator is configuring a system to detect unauthorized changes to critical files by calculating and storing a hash value for each file. Which security goal is primarily supported?
Correct. Hashing verifies that data has not been altered.
Why this answer
Hashing ensures that any modification to the file can be detected, supporting integrity.
A security consultant is evaluating a vendor's security practices before signing a contract. The consultant reviews the vendor's security policies, incident response plans, and conducts background checks on key personnel. This activity is an example of:
Correct. This is a thorough investigation to ensure security.
Why this answer
Due diligence involves investigating and verifying security practices before making a decision, such as vendor risk assessment.
During a security audit, it is discovered that a single administrator can create user accounts, assign privileges, and review audit logs. Which principle is most likely being violated?
Correct. The combination of account creation, privilege assignment, and audit review in one person violates separation of duties.
Why this answer
Separation of duties requires that conflicting critical tasks be performed by different individuals to prevent fraud or error. The administrator has both operational and oversight roles, violating this principle.
An organization decides to accept the risk of using an older software version known to have vulnerabilities because the cost of upgrading outweighs the potential impact. This is an example of:
Correct. The organization accepts the risk without further action.
Why this answer
Risk acceptance means acknowledging the risk and choosing not to mitigate it, often due to cost-benefit analysis.
A security analyst wants to detect malicious traffic on the network without affecting performance. Which type of device should be deployed?
IDS passively monitors and alerts without affecting performance.
A security analyst receives an alert from the SIEM indicating a potential data exfiltration event. The alert shows a large volume of data being transferred to an external IP address during non-business hours. What is the MOST appropriate immediate action?
Verification ensures that action is based on confirmed facts.
Why this answer
The most appropriate immediate action when a SIEM alert indicates potential data exfiltration is to first verify whether the transfer is authorized (Option A). This prevents unnecessary disruption of critical services and avoids false positives. Option B (calling the employee) is premature and may alert a malicious insider prematurely.
Option C (disconnecting the server) could cause business impact and should only be done after confirmation of unauthorized activity. Option D (running an antivirus scan) does not address the exfiltration event and is not the first step in incident response.
Which control type is considered a physical security control?
Security cameras are a physical control that monitors the environment.
Why this answer
Security cameras are a physical security control because they deter, detect, and record unauthorized physical access or activity in a facility. They are deployed as part of a layered physical security strategy, often integrated with access control systems and monitored by security personnel. Unlike logical or administrative controls, cameras directly protect tangible assets and premises.
Exam trap
ISC2 often tests the distinction between physical, administrative, and technical controls, and the trap here is that candidates confuse 'security cameras' as a monitoring/logging control (which is technical) rather than recognizing that the camera hardware itself is a physical asset deployed for physical security.
How to eliminate wrong answers
Option A is wrong because firewall rules are a logical/technical control that filters network traffic based on IP addresses, ports, and protocols; they do not physically prevent access to hardware or facilities. Option C is wrong because user training is an administrative control that educates personnel on security policies and procedures, not a physical barrier or monitoring mechanism. Option D is wrong because encryption is a technical/cryptographic control that protects data confidentiality during storage or transmission, but it does not physically secure hardware or locations.
Which two protocols operate at the Transport layer of the OSI model? (Choose TWO.)
Correct. TCP is a Transport layer protocol.
Drag and drop the steps to perform a password reset on a Windows user account into the correct order.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
Password reset requires admin rights and is done via Local Users and Groups in Computer Management.
Which is a key benefit of a cold site as a recovery location?
Cold sites require no equipment or data replication, making them the least expensive.
Why this answer
A cold site is a backup facility that provides only the physical infrastructure (power, cooling, and space) but no pre-installed hardware or live data. Because it lacks equipment and requires manual setup before recovery can begin, it has the lowest capital and operational costs among recovery site options, making low cost its key benefit.
Exam trap
ISC2 often tests the misconception that 'cold site' implies lower testing requirements, but in reality, cold sites demand more rigorous and frequent testing because the manual recovery process is error-prone and must be validated to avoid failure during an actual disaster.
How to eliminate wrong answers
Option A is wrong because real-time data synchronization requires active replication technologies like synchronous replication or database mirroring, which are not supported by a cold site that has no live systems or network connectivity until activated. Option C is wrong because cold sites actually increase the need for testing, as the recovery process involves manual installation and configuration of hardware and software, which must be validated through regular drills to ensure it works under pressure. Option D is wrong because cold sites have the slowest recovery time (often days or weeks) due to the absence of pre-configured equipment and data, whereas fast recovery is a benefit of hot or warm sites.
Which TWO of the following are examples of Type 3 authentication? (Select TWO).
Retina scan is a biometric (inherence).
Why this answer
Type 3 authentication relies on biometric characteristics.
A security analyst is evaluating a new vendor for cloud services. The analyst reviews the vendor's security certifications, conducts background checks, and visits the data center. This process is an example of:
Due diligence is the investigation and verification before an action, as described.
Why this answer
Due diligence involves investigating and verifying before making a decision, such as vendor risk assessment.
A security professional is implementing a file integrity monitoring (FIM) system on critical servers. Which element of the CIA triad does this primarily address?
FIM detects unauthorized modifications, directly supporting integrity.
Why this answer
File integrity monitoring detects unauthorized changes to files, ensuring data accuracy and completeness, which is the integrity element.
Which THREE of the following are common components of a disaster recovery plan?
Backups are essential for restoring data after a disaster.
Why this answer
Backup procedures are a core component of a disaster recovery plan (DRP) because they ensure that critical data can be restored after a disruptive event. This includes defining backup frequency, storage locations (e.g., off-site or cloud), and the specific data to be backed up. Without documented backup procedures, recovery of systems and data would be uncoordinated and unreliable.
Exam trap
ISC2 often tests the distinction between disaster recovery components (backup, BIA, alternate sites) and general security controls (password policies, background checks), so candidates mistakenly include the latter because they are also part of overall security operations.
An organization wants to implement a policy where employees must use a smart card and a PIN to access sensitive data. This is an example of:
Correct. This is MFA because it combines something you have (smart card) and something you know (PIN).
Why this answer
Multi-factor authentication (MFA) requires two or more different types of authentication factors. Here, the smart card (something you have) and PIN (something you know) constitute two factors, making it MFA.
Which incident category involves an attempt to make a system or network resource unavailable to its intended users?
Denial of service attacks target availability.
Why this answer
A denial of service (DoS) attack aims to disrupt service availability by overwhelming resources.
A SOC analyst notices a large spike in outbound traffic from a workstation that is not scheduled for any data transfers. Upon checking the SIEM, the analyst sees that the workstation's antivirus was disabled 30 minutes ago. What type of logs should the analyst examine first to understand the sequence of events?
System logs record service starts and stops, such as antivirus disabling.
Why this answer
System logs record service start/stop events, including antivirus disabling. Authentication logs may show who logged in, but system logs are more direct for service changes.
A network administrator needs to allow secure remote management of a router. Which protocol and port should be used?
SSH encrypts all traffic, including authentication.
Which three ports are commonly used by secure protocols? (Choose THREE.)
Correct. HTTPS is HTTP over SSL/TLS.
A company uses a mandatory access control (MAC) system where all files are labeled 'Confidential', 'Secret', or 'Top Secret'. A user with 'Secret' clearance tries to read a 'Top Secret' file. What is the outcome?
The simple security property prohibits reading up.
Why this answer
In a mandatory access control (MAC) system, access decisions are based on comparing the user's clearance level with the file's classification label. Since the user has 'Secret' clearance and the file is labeled 'Top Secret', the clearance is lower than the file's classification, so access is denied. This follows the fundamental MAC principle of 'no read up' (simple security property) in Bell-LaPadula model.
Exam trap
ISC2 often tests the misconception that 'need to know' or user role overrides clearance in MAC, but MAC strictly enforces clearance versus classification without considering discretionary permissions or need.
How to eliminate wrong answers
Option A is wrong because MAC does not consider 'need to know' or legitimate need; access is strictly based on clearance versus classification labels. Option C is wrong because categories are optional in MAC and their presence does not change the fact that clearance must meet or exceed the classification; denial occurs regardless of categories. Option D is wrong because 'Secret' clearance is lower than 'Top Secret', so access is denied, not allowed.
An organization is developing a security policy. Which TWO of the following are core components of the CIA triad?
Correct. Confidentiality is a core CIA principle.
Why this answer
The CIA triad consists of Confidentiality, Integrity, and Availability. Authentication and Non-repudiation are related but not part of the core triad.
An organization is implementing a new access control system. Which TWO of the following are examples of Type 3 authentication factors?
Correct. Fingerprint is a biometric factor.
Why this answer
Type 3 (inherence) factors are biometric characteristics. Fingerprint and retina scan are biometrics. Password and smart card are not.
PIN is knowledge.
In an LDAP directory, an entry is represented as 'CN=John Smith,OU=Sales,DC=company,DC=com'. What does 'CN' stand for?
CN is Common Name, representing the object's name.
Why this answer
In LDAP, CN stands for Common Name, which is a component of the distinguished name.
A company performs a full backup every Sunday and incremental backups on other days. On Wednesday, a server failure occurs. Which backups are needed to restore the server to its state at Tuesday's backup?
Incremental restores require full plus all incrementals since the full.
Why this answer
With incremental backups, you need the last full backup and all subsequent incremental backups up to the point of failure. Here, Sunday full + Monday incremental + Tuesday incremental.
An organization wants to separate its internal network from a publicly accessible web server. Which network segmentation technique should be used to isolate the web server while allowing controlled access?
Correct. A DMZ isolates public-facing servers from the internal network.
Why this answer
A DMZ (demilitarized zone) is a network segment that hosts public-facing services and is isolated from the internal network.
Which type of incident involves an attacker attempting to make a system or network resource unavailable to legitimate users?
DoS attacks target availability.
Why this answer
A denial of service (DoS) attack aims to disrupt services by overwhelming resources.
Match each access control model to its key characteristic.
Drag a concept onto its matching description — or click a concept then click the description.
Owner sets permissions
System-enforced labels
Roles determine access
Attributes and policies
Why these pairings
In the ISC2 CC exam, the three main access control models are DAC, MAC, and RBAC. DAC allows resource owners to control access, MAC uses labels and clearances, and RBAC uses roles.
A security administrator is configuring a network device that monitors traffic and generates alerts when suspicious patterns are detected. The device does not block traffic. Which type of system is being deployed?
Correct. IDS monitors and alerts without blocking.
A security architect is designing controls to protect a data center. Which TWO of the following are examples of physical access controls? (Select TWO.)
Biometric reader is a physical control (hardware).
Why this answer
Physical access controls include barriers and objects that physically restrict entry.
During a forensic investigation, the analyst needs to acquire a memory image from a live Windows system without altering evidence. Which tool is MOST appropriate?
FTK Imager can acquire memory live with low footprint.
Why this answer
FTK Imager can acquire a memory image from a live Windows system with minimal impact on evidence integrity. Option A (Volatility) is a memory analysis tool, not an acquisition tool. Option B (EnCase) is a comprehensive forensic suite that can acquire memory but may alter evidence during the process.
Option C (dd) is primarily used for disk imaging and is not suitable for memory acquisition.
Which THREE of the following are considered essential security principles according to ISC2?
Separation of duties prevents conflicts of interest.
Why this answer
Correct: A, C, E. Separation of duties, non-repudiation, and least privilege are considered essential security principles according to ISC2. Encryption and biometrics are security mechanisms or controls, not foundational principles.
An organization is selecting a network security solution to protect against advanced threats. Which THREE features are characteristic of a Next-Generation Firewall (NGFW)? (Select THREE.)
NGFW can identify applications regardless of port.
A network administrator is implementing a DMZ to host a web server and an email server. Which THREE security best practices should be followed? (Select THREE)
Internal servers should remain in the internal network.
An account lockout policy is implemented to protect against which type of attack?
Correct. Lockout mitigates brute-force attempts.
Why this answer
Account lockout detects and prevents brute-force attacks by disabling the account after a threshold of failed attempts.
A SOC analyst is investigating a potential data exfiltration incident. The logs show that an internal user transferred a large volume of data to a cloud storage service using HTTPS. The analyst finds that the user's workstation has BitLocker Drive Encryption enabled, and the user has administrative privileges. Which of the following best describes the PRIMARY challenge in investigating this incident?
Administrative access allows modification of logs, deletion of evidence, and use of tools to hide malicious activity.
Why this answer
The primary challenge is that administrative privileges allow the user to tamper with logs, disable security monitoring, or use tools to cover their tracks, making forensic reconstruction difficult. Even with BitLocker and HTTPS, the SOC can still analyze network logs and endpoint telemetry, but admin rights directly undermine the integrity of evidence on the workstation.
Exam trap
ISC2 often tests the misconception that encryption (BitLocker or HTTPS) is the primary obstacle, when in fact administrative privileges pose a greater threat to evidence integrity and investigation success.
How to eliminate wrong answers
Option B is wrong because the volume of data transferred does not inherently prevent analysis; network logs, file metadata, and cloud storage audit trails can still indicate what was exfiltrated. Option C is wrong because HTTPS traffic can be decrypted if the SOC has a proxy with TLS inspection or access to the client's private keys, and the question does not state that decryption is impossible. Option D is wrong because BitLocker encryption only protects data at rest; if the workstation is powered on and the user is logged in, the drive is accessible for live forensic analysis, and the SOC can also acquire memory dumps or use pre-boot authentication recovery methods.
Which THREE of the following are essential components of an incident response plan? (Select THREE.)
Preparation includes training and tools.
Why this answer
Preparation is the foundational phase of the NIST SP 800-61 incident response lifecycle, ensuring policies, tools, and trained personnel are in place before an incident occurs. Without preparation, subsequent phases like detection and containment cannot be executed effectively. The CC exam emphasizes that preparation includes establishing communication plans, acquiring forensic tools, and conducting tabletop exercises.
Exam trap
ISC2 often tests the distinction between incident response phases and adjacent operational processes (like BCP or vulnerability management) to see if candidates confuse proactive security tasks with the reactive incident response lifecycle.
During a penetration test, an analyst uses a tool to intercept and modify traffic between a client and server by exploiting the Address Resolution Protocol (ARP). This attack is an example of which type of threat?
ARP poisoning enables MITM by redirecting traffic through the attacker.
Why this answer
ARP poisoning allows an attacker to intercept traffic on a local network, enabling man-in-the-middle attacks.
During a security incident, the incident response team isolates a compromised workstation from the network. What is the primary purpose of this action?
Containment stops the attack from spreading.
Why this answer
Isolating a compromised workstation by disconnecting it from the network (e.g., disabling its switch port or unplugging the Ethernet cable) immediately stops all inbound and outbound traffic. This containment action prevents the attacker from moving laterally to other systems, exfiltrating data, or deploying additional malware, thereby limiting the scope and impact of the incident.
Exam trap
ISC2 often tests the distinction between containment (stopping the spread) and eradication (removing the threat); the trap here is that candidates confuse the secondary benefit of preserving evidence (Option C) with the primary purpose of isolation, which is to prevent further damage.
How to eliminate wrong answers
Option B is wrong because legal compliance (e.g., data breach notification laws) is a procedural requirement that follows containment, not the primary technical goal of isolation. Option C is wrong because while isolation can help preserve evidence by preventing tampering, the primary purpose is containment; forensic preservation is a secondary benefit and is better achieved by creating a forensic image before disconnection. Option D is wrong because isolation actually disrupts normal operations for the affected workstation; the goal is to stop malicious activity, not to allow continued normal operations.
You are an IT administrator for a small business. The company has a backup system that performs nightly full backups of critical servers to an external hard drive. One morning, a user reports that they accidentally deleted an important file from a shared drive. You need to restore the file from last night's backup. However, when you connect the external hard drive to the backup server, the drive is not recognized, and you hear clicking sounds. The backup software shows that the most recent backup job completed successfully with no errors. What is the most likely cause of the problem?
Clicking sounds are a common symptom of a damaged hard drive read/write head.
Why this answer
The clicking sound from the external hard drive is a classic symptom of a mechanical failure, typically caused by a stuck read/write head or a failing spindle motor. Since the backup software reported a successful completion, the data was likely written to the drive, but the drive's physical components have since failed, preventing the system from recognizing it. This is a hardware-level issue that cannot be resolved by software or driver updates.
Exam trap
ISC2 often tests the distinction between software-reported success and actual hardware integrity, trapping candidates who assume a successful backup log guarantees recoverable data without considering post-backup physical failure.
How to eliminate wrong answers
Option B is wrong because the backup software logged a successful completion with no errors, indicating that the write process finished without issues; if the data had not been written, the software would have reported a failure or incomplete job. Option C is wrong because the user reported the file was on a shared drive, and the backup job was configured to perform full backups of critical servers, which typically includes all files on those drives; there is no evidence that the file was excluded. Option D is wrong because a driver issue would prevent the drive from being recognized but would not cause clicking sounds; clicking is a mechanical noise, not a software or driver symptom.
A security analyst is implementing controls to prevent unauthorized disclosure of sensitive information. Which element of the CIA triad is being addressed?
Confidentiality ensures information is not disclosed to unauthorized parties.
Why this answer
Preventing unauthorized disclosure directly relates to confidentiality.
A network administrator wants to control traffic based on source and destination IP addresses and port numbers, while also tracking the state of connections. Which type of firewall should they choose?
Stateful firewalls maintain state tables and filter based on connection context.
Why this answer
Stateful inspection firewalls track connection state and filter based on IP/port.
An organization wants to ensure that only authorized devices can connect to the wired network. Which TWO methods can be used to enforce this?
802.1X requires device authentication before access.
Why this answer
Port security limits the number of MAC addresses on a switch port, and 802.1X requires authentication before granting network access. VLANs segment but do not authenticate, and firewalls filter traffic but not at the access level.
A security analyst is troubleshooting an access control issue where a user cannot access a file even though they seem to have the correct permissions. Which three of the following should the analyst investigate? (Select THREE)
File ownership can affect permissions, especially in systems with owner-specific privileges.
Why this answer
File ownership (A) is correct because Linux and Windows access control models (POSIX ACLs, NTFS) check the file's owner and group before applying permissions. If the user is not the owner or in the owning group, the 'other' permissions apply, which may deny access even if the user has a seemingly matching permission entry. The analyst must verify the file's owner and group against the user's identity.
Exam trap
ISC2 often tests the misconception that 'effective permissions' are simply the sum of all allow entries, when in fact deny permissions explicitly override allows, and group membership must be checked recursively (including nested groups).
Which of the following is an indicator of a phishing email?
Urgency and suspicious links are common phishing indicators.
Why this answer
Phishing emails often create a sense of urgency to pressure recipients into acting without thinking, such as claiming an account will be closed.
A security analyst notices repeated failed login attempts from a single IP address targeting multiple user accounts. Which security control should be implemented to mitigate this attack?
Mitigates brute-force attacks by locking accounts after multiple failures.
Why this answer
Implementing an account lockout policy after a defined threshold of failed attempts (e.g., 5 failed attempts within 15 minutes) directly mitigates brute-force password guessing attacks from a single source. This control prevents an attacker from continuously trying different passwords across multiple accounts, effectively rate-limiting the attack at the authentication layer.
Exam trap
ISC2 often tests the distinction between preventive controls (like account lockout) and deterrent controls (like complex passwords), and the trap here is that candidates choose complex passwords because they think stronger passwords stop brute-force attacks, but they fail to recognize that unlimited attempts still allow eventual guessing regardless of password complexity.
How to eliminate wrong answers
Option B is wrong because single sign-on (SSO) centralizes authentication but does not prevent repeated failed login attempts; it may even increase the blast radius if the SSO provider is compromised. Option C is wrong because requiring complex passwords makes individual passwords harder to guess but does not stop an attacker from making unlimited login attempts; it addresses password strength, not attack frequency. Option D is wrong because disabling an account after a single failed attempt would cause massive denial of service for legitimate users due to typos or forgotten passwords, and it is not a standard security practice; account lockout requires a reasonable threshold to balance security and usability.
An organization is experiencing network attacks where the attacker forges the source IP address. Which two types of attacks commonly use IP spoofing? (Choose TWO.)
Correct. Attackers often spoof source IPs in SYN floods.
Which of the following is a primary benefit of implementing network segmentation?
Limits scope of attacks.
Why this answer
Network segmentation divides a network into smaller, isolated segments, which limits an attacker's ability to move laterally after compromising a single host. By restricting traffic between segments using VLANs, ACLs, or firewall rules, the attack surface is reduced because fewer systems are exposed to potential threats. This is a primary security benefit, as it contains breaches and minimizes the impact of malware or unauthorized access.
Exam trap
ISC2 often tests the misconception that segmentation eliminates the need for firewalls, but in reality, segmentation and firewalls are complementary—firewalls enforce the segmentation policy, and segmentation reduces the attack surface by limiting exposure.
How to eliminate wrong answers
Option B is wrong because network segmentation does not eliminate the need for firewalls; instead, it often relies on firewalls (or ACLs on routers/L3 switches) to enforce segmentation policies and filter traffic between segments. Option C is wrong because segmentation does not increase bandwidth; it can actually introduce overhead from inter-segment routing and may require careful design to avoid bottlenecks. Option D is wrong because segmentation often complicates IP address management by requiring separate subnets or VLANs, not simplifying it.
Which THREE components are part of the AAA framework?
Verifies user identity.
Why this answer
Authentication is correct because the AAA framework (Authentication, Authorization, and Accounting) uses authentication to verify the identity of a user or device before granting access. This is typically done via credentials such as username/password, digital certificates, or tokens, and is the first step in the AAA process.
Exam trap
ISC2 often tests the distinction between 'Accounting' and 'Auditing' — candidates confuse the two because both involve logs, but Accounting is the collection of data (e.g., start/stop records), while Auditing is the analysis of that data, which is not part of the AAA framework.
An organization discovers a ransomware infection on a critical server. According to the incident response phases, what should be the first action after detection?
Containment stops the incident from spreading, which is the immediate priority.
Why this answer
Immediately after detection, the priority is to contain the ransomware to prevent it from spreading laterally to other systems. According to NIST SP 800-61 and standard incident response frameworks, containment is the first step after detection and analysis, as it limits damage and preserves evidence for forensic investigation.
Exam trap
The trap here is that candidates confuse the urgency of recovery actions (like restoring from backup) with the correct incident response sequence, forgetting that containment must always come first to stop the spread and preserve forensic evidence.
How to eliminate wrong answers
Option A is wrong because notifying law enforcement is a post-containment step, typically done after the scope is understood and evidence is preserved; premature notification can disrupt the response. Option B is wrong because eradicating the malware before containment risks alerting the attacker or causing the ransomware to trigger encryption of additional data; containment must precede eradication. Option C is wrong because restoring from backup before containment can reintroduce the infection if the backup is compromised or if the ransomware is still active on the network; containment ensures the environment is clean before recovery.
The sequential source ports and different destination ports across multiple hosts indicate a scan.
Why this answer
The repeated denied TCP packets from 192.0.2.10 (an external IP) to multiple internal hosts indicate a port scan. The access-group 'OUTSIDE_IN' is applied to the outside interface, and the firewall is denying these packets because they match a deny ACE (access control entry) that blocks unsolicited inbound traffic. This pattern of multiple denied connections from a single external source to different internal destinations is characteristic of a reconnaissance scan, not a DoS attack or data exfiltration.
Exam trap
ISC2 often tests the distinction between a port scan and a DoS attack, where candidates mistakenly choose DoS because they see 'repeated denied packets' without recognizing the pattern of multiple destinations versus a single target flood.
How to eliminate wrong answers
Option B is wrong because the firewall is correctly blocking unsolicited inbound traffic as per the configured access-group; there is no misconfiguration indicated—the denials are expected behavior for a security policy that denies inbound connections by default. Option C is wrong because data exfiltration originates from an internal host sending data outbound, not from an external host sending packets inbound; the source IP 192.0.2.10 is external, so this is not an internal compromise scenario. Option D is wrong because a denial-of-service (DoS) attack typically involves a high volume of traffic aimed at overwhelming a single target, not repeated denied packets to multiple internal hosts; the pattern here is more consistent with a scan (low rate, multiple destinations) rather than a flood.
In a directory service like Active Directory, which component is used to organize users, groups, and computers into a hierarchical structure for applying policies?
OUs are containers that organize objects and allow GPO linking.
Why this answer
Organizational Units (OUs) are containers in Active Directory that allow hierarchical organization and Group Policy application.
During a security incident, a company must notify stakeholders without revealing sensitive details that could worsen the situation. Which TWO groups should typically be notified immediately according to incident response best practices? (Select TWO)
Legal needs to assess notification requirements and potential liability.
Why this answer
Legal must be notified for regulatory and liability issues, and management/executives for decision-making and resource allocation. Customers and PR may be notified later, and law enforcement depends on the incident.
Which of the following is a connectionless, unreliable transport protocol?
UDP is connectionless and fast but unreliable.
Why this answer
UDP is connectionless and does not guarantee delivery.
A security auditor discovers that during a VLAN hopping attack, a threat actor was able to send frames from a workstation on VLAN 10 to a target on VLAN 20. Which configuration flaw is most likely responsible?
DTP allows an attacker to negotiate a trunk and access other VLANs.
Why this answer
A VLAN hopping attack exploits the Dynamic Trunking Protocol (DTP) to negotiate a trunk link between the attacker's workstation and the switch. If DTP is enabled on an access port, the attacker can send DTP frames to form a trunk, allowing frames from VLAN 10 to be tagged and forwarded to VLAN 20. Disabling DTP on all access ports with the 'switchport nonegotiate' command prevents this attack.
Exam trap
ISC2 often tests the distinction between VLAN hopping via DTP (trunk negotiation) and double-tagging attacks (native VLAN manipulation), so candidates may confuse the two and incorrectly choose the native VLAN option.
How to eliminate wrong answers
Option B is wrong because setting the native VLAN to 1 is a default configuration, but it does not directly enable VLAN hopping; native VLAN attacks (e.g., double-tagging) require the attacker to be on the native VLAN and the trunk to forward untagged frames, which is a different attack vector. Option C is wrong because using default VLAN 1 for management is a security best practice violation (it should be changed to a dedicated VLAN), but it does not allow a workstation to send frames across VLANs; management VLAN misconfiguration does not enable trunk negotiation. Option D is wrong because port security limits MAC addresses on a port but does not prevent DTP-based trunk negotiation; VLAN hopping can occur even with port security enabled if DTP is active.
A security administrator is implementing controls to protect a server room. Which TWO physical security layers should be included as part of a defense-in-depth strategy? (Select TWO.)
Fencing is an external perimeter layer.
Why this answer
Defense in depth uses multiple layers. External perimeter (fencing) and internal server room (biometric) are distinct layers.
A company stores customer PII including social security numbers and medical records. Under privacy principles, these data elements are best described as:
SSN and medical records are considered sensitive PII.
Why this answer
Medical records and SSNs are examples of sensitive PII that require additional protection.
A security analyst notices repeated failed login attempts to a critical server from a single external IP address. Which immediate action should the analyst take?
Immediate containment of the attack source.
Why this answer
Blocking the IP address at the firewall is the immediate action because it stops the ongoing brute-force attack at the network perimeter without affecting the server's availability or internal operations. Firewall rules can be applied quickly using access control lists (ACLs) to deny traffic from the specific external IP, which is a standard first response to mitigate a single-source attack.
How to eliminate wrong answers
Option A is wrong because enabling two-factor authentication (2FA) is a long-term security improvement that does not stop the current attack in progress; it requires configuration and user enrollment, leaving the server exposed during the delay. Option B is wrong because disabling the server's network interface would deny service to all legitimate users, causing a denial of service (DoS) and violating the principle of maintaining availability. Option D is wrong because changing the server's IP address is a reactive measure that does not prevent the attacker from scanning and finding the new IP, and it disrupts legitimate DNS and client connections without addressing the root cause.
Practice CC by domain
Target a specific domain to shore up weak areas.