976 questions total · 14pages · All types, answers revealed
An organization decides to purchase cyber insurance to cover potential losses from a data breach. This is an example of which risk treatment strategy?
Correct. Insurance transfers the financial risk to the insurer.
Why this answer
Risk transfer involves shifting the financial impact of a risk to another party, such as through insurance.
A financial institution requires that no single employee can both initiate and approve a wire transfer. This policy enforces which security principle?
Separation of duties ensures no single person has control over all parts of a transaction.
Why this answer
Separation of duties prevents fraud by dividing critical tasks. Least privilege limits access, but here it's about task division.
Which of the following is a key component of the 3-2-1 backup rule?
This is the exact description of the 3-2-1 rule.
Why this answer
The 3-2-1 rule states: have 3 copies of data, on 2 different media types, with 1 copy off-site.
Which TWO of the following are fundamental principles of information security that form the CIA triad?
Confidentiality ensures that information is not disclosed to unauthorized individuals. It is a core component of the CIA triad.
Why this answer
Correct: Confidentiality and Integrity are part of the CIA triad. Option C (Privacy) is not part of CIA; Option D (Non-repudiation) is not; Option E (Accountability) is related but not a core CIA principle.
Which of the following ensures that data has not been tampered with during transmission?
Correct. Hashing verifies integrity.
Why this answer
Integrity ensures data accuracy and completeness; hashing detects changes.
A company has a reciprocal agreement with another organization for disaster recovery. During a major outage, the company attempts to activate the agreement but finds that the partner's facility is also impacted by the same disaster. This scenario highlights a primary disadvantage of which recovery strategy?
Reciprocal agreements rely on the partner's availability, which may be compromised in a widespread disaster.
Why this answer
Reciprocal agreements depend on the partner not being affected by the same disaster. If both are impacted, the agreement fails.
An attacker intercepts communication between two parties by sending forged ARP messages. This is an example of which type of attack?
ARP poisoning enables interception of communications.
Why this answer
ARP poisoning allows man-in-the-middle attacks by associating attacker's MAC with the victim's IP.
A critical zero-day vulnerability is actively being exploited in the wild, affecting an organization's internet-facing application. Which patching approach should be taken?
Deploying an emergency patch without testing is the appropriate response due to the immediate and severe threat posed by a critical zero-day vulnerability actively being exploited in the wild. The paramount concern is to halt active exploitation and prevent further compromise as quickly as possible. While rigorous testing is normally crucial, the urgency of stopping an ongoing attack outweighs the risks associated with an untested deployment, directly addressing the constraint of mitigating an active, critical threat.
Why this answer
Emergency patching is used for vulnerabilities that are actively exploited or have high severity, bypassing normal testing cycles to reduce risk quickly.
Which TWO of the following are best practices for password management in a corporate environment?
Complex passwords are harder to guess or crack.
Why this answer
Enforcing password complexity requirements (e.g., minimum length, character types) reduces the risk of brute-force and dictionary attacks by increasing the effective keyspace. Option E is correct because multi-factor authentication (MFA) adds an additional layer of security beyond the password, mitigating credential theft or reuse. Together, they form a defense-in-depth approach to authentication security.
Exam trap
ISC2 often tests the misconception that frequent password changes improve security, but the CC exam expects candidates to know that NIST now recommends against mandatory periodic changes unless there is evidence of compromise, and that sharing passwords is never a best practice.
According to the (ISC)² Code of Ethics, which of the following obligations takes the highest priority?
Protect society is the highest priority.
Why this answer
The Code of Ethics prioritizes protecting society, the common good, and the public trust.
Which TWO of the following are examples of physical access controls?
Biometrics are physical attributes used for authentication.
Why this answer
Biometric scanners (Option B) are physical access controls because they authenticate individuals based on unique biological traits (e.g., fingerprints, iris patterns) to grant or deny entry to a physical space, such as a server room or data center. This is a tangible, hardware-based mechanism that directly controls physical access, aligning with the definition of physical access controls in the CC exam.
Exam trap
ISC2 often tests the distinction between physical controls (tangible, hardware-based mechanisms that restrict physical access) and logical/technical controls (software or network-based protections), causing candidates to mistakenly classify encryption or firewalls as physical controls.
A company is creating a business continuity plan. Which analysis should be performed first to identify critical business functions and their dependencies?
BIA identifies critical business functions, dependencies, and recovery priorities.
Why this answer
A Business Impact Analysis (BIA) is the first step in BCP to identify critical functions, dependencies, and recovery requirements.
An attacker sends a forged ARP response to a switch, associating the attacker's MAC address with the IP address of the default gateway. The switch updates its ARP cache accordingly. This is an example of which attack?
Forged ARP replies redirect traffic to the attacker.
Why this answer
ARP spoofing (or ARP poisoning) involves sending fake ARP messages to associate the attacker's MAC with a legitimate IP, enabling man-in-the-middle attacks.
A security professional is evaluating a system that uses a trust model where every component authenticates to each other before communicating. Which security principle does this model exemplify?
Mutual authentication adds a layer of security, exemplifying defense in depth.
Why this answer
Defense in depth is the security principle of using multiple layers of defense to protect assets. In this scenario, requiring every component to authenticate to each other before communication adds a layer of verification, which is consistent with the defense in depth approach. Option A (Least privilege) is incorrect because it focuses on granting only necessary permissions, not on mutual authentication.
Option B (Separation of duties) is incorrect as it involves splitting tasks among multiple people to prevent fraud, not authentication requirements. Option C (Non-repudiation) is incorrect because it ensures that an action cannot be denied, typically through logs or signatures, not mutual authentication.
An organization needs to prioritize recovery of systems after a disaster. Which metric directly indicates the maximum acceptable outage time for a business function?
MTD is the maximum acceptable outage time.
Why this answer
Maximum Tolerable Downtime (MTD) is the maximum time a business function can be unavailable before causing unacceptable harm.
During a BIA, the maximum tolerable downtime for a critical application is determined to be 4 hours. The IT team estimates system recovery will take 2 hours, but additional manual work to reconcile data will take 1 hour. What is the Recovery Time Objective (RTO)?
The Recovery Time Objective (RTO) defines the targeted duration for restoring a business function or application to an operational state after an outage. In this scenario, the IT team estimates system recovery will take 2 hours. This timeframe directly represents the RTO, as it signifies when the critical application itself becomes available again. The additional manual data reconciliation, while crucial for full data integrity, occurs after the system is operational and does not extend the RTO, which must satisfy the 4-hour Maximum Tolerable Downtime.
Why this answer
RTO is the time within which systems must be recovered to avoid unacceptable consequences. Here, the system must be back within 2 hours to meet the 4-hour MTD, but recovery includes both system restoration and work recovery. The RTO is typically the time to restore systems to a functional state, which is 2 hours.
Which THREE are common indicators of a compromised system? (Select THREE.)
Malware often installs without user consent.
Why this answer
Unexpected software installations are a common indicator of compromise because attackers often deploy malware, backdoors, or remote access tools (RATs) without user consent. In a CC context, this aligns with the principle that unauthorized software changes signal a breach, as legitimate installations typically follow change management processes. The presence of unknown executables or services in the system's process list or startup entries is a red flag.
Exam trap
ISC2 often tests the distinction between symptoms of normal operations (e.g., high CPU usage during business hours) and true indicators of compromise, tricking candidates into selecting benign metrics as signs of a breach.
Refer to the exhibit. Based on the exhibit, which traffic will be permitted?
The permit statement allows TCP port 80 (HTTP) traffic to host 192.168.1.100 from any source.
Why this answer
The exhibit shows an access control list (ACL) that permits TCP traffic from any source to destination host 192.168.1.100 on port 80 (HTTP). The ACL entry is `permit tcp any host 192.168.1.100 eq 80`, which matches only HTTP traffic. Therefore, only HTTP traffic from any source to 192.168.1.100 is permitted.
How to eliminate wrong answers
Option A is wrong because the ACL does not permit all traffic from 192.168.1.100; it only permits inbound HTTP traffic to that host, and the source is 'any', not a specific source. Option B is wrong because the ACL does not reference the 10.0.1.0/24 network at all; the source is 'any', and the destination is a single host, not a subnet. Option C is wrong because SSH uses TCP port 22, not port 80; the ACL explicitly matches port 80 (HTTP), so SSH traffic would be denied.
Which of the following is considered Sensitive PII?
Correct. SSN is sensitive because it can lead to identity theft.
Why this answer
Sensitive PII includes information that could cause harm if disclosed, such as medical records, financial account numbers, and biometric data.
A security analyst is reviewing physical security controls. Which TWO are considered layered physical security measures for external perimeter protection?
Fencing is a perimeter barrier.
Why this answer
Fencing and lighting are external perimeter controls.
A security analyst is implementing a solution to ensure that data transmitted between two servers cannot be read by unauthorized parties. Which security principle is the analyst primarily addressing?
Correct. Encryption protects confidentiality by preventing unauthorized disclosure.
Why this answer
Confidentiality ensures that data is not disclosed to unauthorized individuals or systems. Encryption is a key mechanism to protect confidentiality of data in transit.
Refer to the exhibit. An access control policy is shown. Which action is permitted by this policy?
Reading objects is allowed by the read permission granted in the policy.
Why this answer
The policy grants the read permission, which allows reading objects from the specified container. This action corresponds to downloading or retrieving the content of an object, making option D correct.
Exam trap
ISC2 often tests the distinction between read actions and list actions, trapping candidates who assume that reading objects also allows listing them.
How to eliminate wrong answers
Option A is wrong because uploading objects requires the `s3:PutObject` action, which is not listed in the policy. Option B is wrong because listing objects requires the `s3:ListBucket` action, which is not included in the policy. Option C is wrong because deleting objects requires the `s3:DeleteObject` action, which is absent from the policy.
A user reports that they are unable to access a shared network drive that they previously could access. The administrator checks permissions and finds the user's account is still a member of the correct group. What should the administrator check next?
Deny entries override allows and can cause access issues even with correct group membership.
Why this answer
Even if group membership is correct, explicit deny permissions can override allow permissions. Checking for deny entries on the folder is a logical next step. User lockout would affect all accesses.
Effective permissions would show the combined result but checking for denies is more direct. Password expiration is a login issue, not a permissions issue.
An administrator configures a Group Policy Object (GPO) in Active Directory to enforce account lockout after 5 failed attempts within 15 minutes. Which type of control is this?
Correct. Lockout is enforced by the operating system or application, a logical control.
Why this answer
Logical access controls are software-based mechanisms that govern access to systems. Account lockout policies are logical controls.
Refer to the exhibit. Based on the report, which improvement is most appropriate?
Synchronous replication guarantees transaction consistency across sites.
Why this answer
Asynchronous replication can lead to data inconsistency during failover. Switching to synchronous replication ensures data consistency at the cost of some latency.
A network engineer is designing a DMZ. Which three servers should typically be placed in the DMZ? (Choose THREE.)
Correct. Web servers are public-facing.
Which TWO are best practices for managing backup media?
Encryption protects sensitive data from unauthorized access.
Why this answer
Encrypting backup data ensures confidentiality and integrity during transit and at rest, protecting against unauthorized access if media is lost or stolen. This is a critical best practice for compliance with standards like GDPR or HIPAA, and aligns with the principle of defense in depth. Without encryption, backup media becomes a significant security vulnerability.
Exam trap
ISC2 often tests the 3-2-1 backup rule (three copies, two different media, one offsite) to trick candidates into thinking that keeping backups on the same server is acceptable for convenience, when it actually violates the core principle of redundancy.
A security team configures a system to record all user activities for audit purposes. Which principle is being applied?
Accountability ensures actions can be traced via logs.
Why this answer
Correct: A - Accountability. Accountability ensures actions can be traced to an individual through logging. Option B is wrong because integrity ensures data accuracy and prevents unauthorized modification.
Option C is wrong because authentication verifies identity. Option D is wrong because confidentiality prevents unauthorized disclosure.
Which THREE are primary phases of the incident response lifecycle?
Containment phase limits damage and prevents spread.
Why this answer
Containment is a primary phase of the incident response lifecycle because it focuses on stopping the spread of an incident and preventing further damage. In the NIST SP 800-61 framework, containment is explicitly listed as a core phase, following detection and analysis. This phase includes actions such as isolating affected systems, blocking malicious IPs via ACLs, or disabling compromised accounts to limit the blast radius.
Exam trap
ISC2 often tests the distinction between primary phases and supporting activities, so candidates mistakenly select 'Forensic Analysis' or 'Data Archiving' as primary phases when they are actually tasks performed within the Containment or Post-Incident phases.
A security auditor is reviewing access controls at a financial institution. The auditor identifies a scenario where one employee can initiate a payment transaction, and the same employee can also approve it. Which access control principle is being violated, and what is the primary risk?
Correct. Separation of duties prevents a single person from performing conflicting tasks, reducing fraud risk.
Why this answer
Separation of duties requires that no single person has the ability to complete a high-risk action without another person's involvement. The scenario describes a violation of this principle, which increases the risk of fraud because an individual could both initiate and approve a fraudulent payment without oversight.
A security analyst is reviewing access control mechanisms. Which TWO of the following are examples of logical access controls? (Select two.)
Smart cards are logical controls for authentication.
Why this answer
Logical access controls are technology-based mechanisms. Passwords and smart cards are logical; fences and guards are physical.
Which of the following is an example of a detective control?
IDS monitors and detects potential security breaches.
Why this answer
An organization wants to implement defense in depth for its web application. Which combination of controls best illustrates this principle?
This combines technical, physical, and administrative controls at multiple layers, which is defense in depth.
A security incident report indicates that an employee used their access to view confidential records unrelated to their job. Which security principle was most likely violated?
Least privilege requires limiting access to only what is necessary for job functions; the employee had excessive access.
Which of the following is an example of a physical control that supports the availability principle of the CIA triad?
Correct. Redundancy ensures availability if one server fails.
Why this answer
Availability ensures systems are accessible when needed. Redundant servers provide failover capability, minimizing downtime.
An organization uses a Privileged Access Management (PAM) solution. Which of the following is a primary benefit of PAM?
PAM provides oversight and control over admin accounts.
Why this answer
PAM solutions monitor, control, and audit privileged account usage, reducing risk of misuse.
A medium-sized company uses a SIEM solution to collect logs from firewalls, servers, and endpoints. The security team receives an alert indicating a possible data exfiltration: an employee's workstation is sending large amounts of data to an external IP address outside business hours. The employee works in the finance department and has access to sensitive financial records. The SIEM shows the connection is ongoing. The security team must respond immediately to contain the incident while preserving evidence. The company's incident response plan designates the security team as first responders. Which of the following is the BEST first action?
Stops data exfiltration and isolates the system, following incident response best practices.
Why this answer
The best first action because it immediately stops the ongoing data exfiltration and isolates the system, containing the incident and preserving evidence. Option B delays containment, Option C may alert a potential insider threat, and Option D should be performed after containment to avoid further data loss.
Exam trap
The trap is mistaking delayed containment for a better approach. Immediate isolation (Option A) is prioritized over investigation or notification to prevent further data loss.
Which of the following is the most effective way to prevent tailgating in a secured facility?
Awareness training directly addresses the human behavior that enables tailgating.
Why this answer
Tailgating occurs when an unauthorized person follows an authorized person through a door. Employee awareness training teaches staff not to hold doors open for strangers.
Refer to the exhibit. A security analyst observes repeated outbound connection attempts from an internal server to external IP addresses on a non-standard port. What is the MOST likely interpretation?
Beaconing to multiple external IPs on a non-standard port is a common malware behavior.
Why this answer
Repeated outbound connection attempts from an internal server to external IP addresses on a non-standard port are a classic indicator of malware command-and-control (C2) activity. Malware often uses non-standard ports to evade detection and establish outbound communication with an external attacker. This behavior is not typical of legitimate services, which use well-known ports and protocols.
Exam trap
ISC2 often tests the distinction between outbound connection attempts (indicative of malware C2) and inbound connection attempts (indicative of remote access or scanning), leading candidates to mistakenly choose remote desktop or port scanning.
How to eliminate wrong answers
Option A is wrong because remote desktop access (e.g., RDP) uses TCP port 3389 by default, not a non-standard port, and would typically involve inbound connections, not repeated outbound attempts. Option B is wrong because a port scan involves sending packets to multiple ports on a target to discover open services, not repeated outbound connection attempts from a single server to external IPs on a single non-standard port. Option C is wrong because a legitimate mail server uses standard ports such as TCP 25 (SMTP), 587 (submission), or 993 (IMAPS), and would not repeatedly connect to arbitrary external IPs on a non-standard port.
Which OSI layer is responsible for routing packets based on IP addresses?
Network layer routes packets using IP addresses.
Why this answer
Layer 3 (Network) handles packet forwarding and routing using IP addresses.
Which of the following are core principles of information security?
Integrity ensures data accuracy and prevents unauthorized modification, making it a core principle.
Why this answer
The core principles of information security, known as the CIA triad, are Confidentiality, Integrity, and Availability. Therefore, the correct answers are Integrity (B), Confidentiality (C), and Availability (E). Integrity ensures data accuracy and prevents unauthorized modification, often verified through hashing.
Confidentiality ensures data is accessible only to authorized users, typically via encryption. Availability ensures that systems and data are accessible when needed. The other options—Authentication (A) and Non-repudiation (D)—are important security concepts but are not part of the CIA triad.
Exam trap
ISC2 often tests whether candidates can distinguish between core principles (CIA triad) and supporting security services (authentication, non-repudiation), leading many to incorrectly select authentication or non-repudiation as core principles instead of availability.
Which two of the following are common types of security controls?
Preventative controls block attacks before they occur.
Why this answer
Detective and Preventative controls are foundational security control categories. Corrective is also a category but not listed as one of the two most common; Reactive and Predictive are not standard categories.
A healthcare organization uses a legacy application that stores patient records in plain text. The IT team is planning to upgrade the system but needs to ensure compliance with HIPAA. The new system will be hosted on-premises and accessed by doctors and nurses via a web portal. The security team proposes implementing a VPN for remote access, but the CEO wants to allow access from any device without VPN for convenience. Which principle should guide the decision?
Defense in depth emphasizes multiple layers; a VPN alone is insufficient.
Why this answer
Defense in depth emphasizes multiple layers of security; a VPN alone is insufficient to protect sensitive health records. The CEO's request sacrifices security for convenience, and risk acceptance is not the best approach when stronger controls are feasible.
A security analyst detects a large number of incomplete TCP connection requests (SYN segments) directed at a server. This is indicative of which type of attack?
SYN flood exploits TCP three-way handshake by sending many SYN packets without completing.
Why this answer
SYN flood is a DoS attack that exhausts server resources by initiating many half-open connections.
Which process involves verifying the identity of a user who claims to be a specific person?
Correct. Authentication verifies the claimed identity.
Why this answer
Authentication is the process of proving a claimed identity, typically with passwords, biometrics, or tokens.
Refer to the exhibit. A security analyst notices that a user with the Finance role is able to write to /finance/data from a macOS device at 10:00 AM. The policy shown is the only policy affecting this resource. What is the most likely reason for this behavior?
If the device OS attribute is wrong, the condition might be satisfied.
Why this answer
The policy likely includes a condition such as 'Deny if device.os != "Windows"' to restrict write access to non-Windows devices. Since the user's device attribute is incorrectly set to 'Windows' (even though the actual device is macOS), the condition evaluates to false. Consequently, the Deny rule is not enforced, and the default Allow (or a broader Allow rule) permits write access.
This misconfiguration results in unintended access from a macOS device.
Exam trap
ISC2 often tests the nuance that a Deny rule with unmet conditions does not block access—candidates mistakenly assume a Deny rule always denies, but in policy engines, a rule only applies if all its conditions are true; otherwise, the engine falls through to the next rule or default action.
How to eliminate wrong answers
Option A is wrong because the exhibit shows a single condition block; if multiple conditions were present, they would be ANDed by default in Cisco ISE or similar policy engines, not ORed, so this does not explain the behavior. Option B is wrong because the time condition 'BETWEEN 09:00 and 17:00' in Cisco policy engines is inclusive of both endpoints (09:00 and 17:00), not exclusive; 10:00 AM falls within the inclusive range, so the Deny would apply if time were the only factor. Option C is wrong because the policy is configured with effect Deny, but the issue is that the Deny is not being triggered due to a condition mismatch; the policy itself is not misconfigured in terms of effect—it is the condition that fails to match.
Which principle ensures that a user is granted only the permissions necessary to perform their job functions, thereby reducing the potential impact of a compromised account?
Least privilege restricts user access rights to the minimum set of permissions required to complete assigned job functions, directly satisfying the stem’s requirement to reduce the impact of a compromised account. By enforcing granular permission boundaries—such as read-only access to specific Microsoft Entra ID resources rather than full administrative roles—this principle limits lateral movement and data exposure if credentials are stolen.
Why this answer
Least privilege limits permissions to the minimum required, reducing the blast radius if an account is compromised.
Refer to the exhibit. An SOC analyst pulled this log snippet. Which type of attack is most likely in progress?
Coordinated traffic from many sources to a single target is characteristic of DDoS.
Why this answer
The log snippet shows a massive volume of incoming traffic from multiple source IPs targeting a single destination, which is characteristic of a distributed denial-of-service (DDoS) attack. The high packet rate and diverse source addresses indicate an attempt to overwhelm the target's resources, such as bandwidth or server capacity, making services unavailable to legitimate users.
Exam trap
ISC2 often tests the distinction between DDoS and DoS by including logs with multiple source IPs, where candidates might mistakenly focus on the high traffic volume alone and overlook the distributed nature, leading them to choose a generic 'DoS' or another attack type.
How to eliminate wrong answers
Option A is wrong because phishing involves deceptive messages (e.g., emails) to trick users into revealing credentials or installing malware, not a flood of network traffic from many sources. Option C is wrong because a man-in-the-middle attack intercepts and potentially alters communications between two parties, which would show unusual traffic patterns or certificate anomalies, not a high-volume flood from multiple IPs. Option D is wrong because an insider threat originates from within the organization, typically involving unauthorized access or data exfiltration, not a distributed traffic flood from external sources.
An employee receives an email from an unknown sender claiming to be from the IT department, asking for their password to perform an urgent system update. What type of social engineering attack is this?
Phishing uses deceptive emails to obtain sensitive information.
Why this answer
Phishing is a social engineering attack where attackers impersonate legitimate entities to trick victims into revealing sensitive information.
You are the lead SOC analyst for a medium-sized financial services company. The company uses a hybrid infrastructure with on-premises servers and cloud services (AWS). The SIEM is Splunk Enterprise, collecting logs from firewalls, IDS/IPS, endpoints (Windows and Linux), and AWS CloudTrail. Recently, the company experienced a ransomware attack that encrypted critical file servers. The initial infection vector was a phishing email that led to the download of a malicious macro-enabled document. The document was executed on a Windows workstation, which then established a C2 connection to an external IP. The C2 traffic was over HTTPS, and the workstation was part of the domain. After the attack, the forensic team found that the workstation had Windows Event Logs cleared, and the local admin account had been used to disable the antivirus. The C2 IP was later blocked, but the ransomware had already spread to file servers via SMB. As part of the lessons learned, you need to recommend improvements to prevent and detect such attacks in the future. Which of the following is the BEST course of action to address the specific weaknesses exploited in this incident?
These controls directly address the attack vectors: macro execution, local admin abuse, and lateral movement via SMB.
Why this answer
Directly addresses the attack chain: disabling macros by default prevents the initial infection vector, application whitelisting blocks unauthorized executables (including the ransomware), strong local admin passwords hinder credential abuse, and network segmentation restricts SMB lateral movement. This combination targets the specific weaknesses exploited (macro execution, antivirus disablement via local admin, and SMB propagation) rather than just detecting or patching after the fact.
How to eliminate wrong answers
Option A is wrong because vulnerability scanning and patching do not prevent phishing-based macro execution or local admin abuse; the attack exploited user behavior and weak local credentials, not unpatched vulnerabilities. Option C is wrong because additional IDS/IPS and SIEM tuning for C2 traffic only improves detection, not prevention; the C2 traffic was over HTTPS (encrypted), making pattern detection difficult, and the ransomware had already spread before the C2 IP was blocked. Option D is wrong because MFA for remote access and privileged accounts does not address the local admin account used to disable antivirus on the workstation, nor does it prevent macro execution or SMB lateral movement within the internal network.
Which protocol is considered insecure because it transmits data, including credentials, in cleartext?
Correct. Telnet transmits data in cleartext.
An organization classifies data as 'Confidential' and requires encryption both at rest and in transit. Which data classification level best fits this requirement?
Confidential data typically requires encryption to protect against unauthorized disclosure.
Why this answer
Confidential data typically requires strong protection like encryption; restricted/top secret may require even higher controls.
Match each phase of the incident response process to its description.
Drag a concept onto its matching description — or click a concept then click the description.
Train and equip the team
Identify and scope the incident
Stop the spread and restore systems
Lessons learned and reporting
Why these pairings
The NIST SP 800-61 incident response process includes Preparation, Detection and Analysis, Containment, Eradication and Recovery, and Post-Incident Activity. Options A, B, and C are correct; D and E swap definitions between the last two phases.
Refer to the exhibit. What action did the firewall take on the traffic from 10.0.1.15 to 10.0.2.10?
The syslog message explicitly states 'denied'.
Why this answer
The firewall denied the traffic from 10.0.1.15 to 10.0.2.10 because the access control list (ACL) or security policy explicitly denies the source IP 10.0.1.15, as shown in the exhibit. The firewall processes rules sequentially, and the first matching rule for this traffic is a deny entry, so the packet is dropped without further inspection or logging unless specified.
Exam trap
ISC2 often tests the sequential processing of ACLs, where candidates mistakenly think a later permit rule overrides an earlier deny rule, but the first match always wins.
How to eliminate wrong answers
Option A is wrong because the firewall did not log the traffic; the exhibit shows no log keyword on the matching deny rule, and logging is only triggered by a permit or explicit log action. Option C is wrong because the traffic was not permitted; the first matching rule is a deny, so the packet is dropped before any permit rule is evaluated. Option D is wrong because source NAT (translation) is not applied; NAT rules are typically evaluated after ACLs, and the traffic was denied before any translation could occur.
A company wants to mitigate the risk of a man-in-the-middle (MITM) attack. Which three measures are effective? (Choose THREE.)
A VPN encrypts data in transit and prevents interception during remote connections, directly mitigating MITM attacks.
Why this answer
VPNs create an encrypted tunnel for remote connections, securing data in transit and preventing interception. Mutual authentication ensures both client and server verify each other's identities, thwarting impersonation. ARP spoofing protection prevents attackers from intercepting local network traffic by spoofing MAC addresses.
While HTTPS with proper certificate validation is effective for web traffic, it does not protect against all types of MITM attacks. WPA2 only encrypts Wi-Fi traffic and does not prevent MITM at higher layers. Therefore, the most effective measures are A, B, and C.
In incident response, which TWO are considered volatile data that should be collected first? (Select exactly 2.)
Active network connections are ephemeral and lost after reboot.
Why this answer
Network connections (option B) are volatile because they represent active communication channels that disappear when the system is powered off or disconnected. In incident response, collecting network connection data (e.g., using netstat -an) first preserves evidence of ongoing malicious activity, such as command-and-control (C2) traffic or lateral movement, before it is lost.
Exam trap
ISC2 often tests the distinction between volatile and non-volatile data, and the trap here is that candidates mistakenly classify system logs as volatile because they change frequently, but logs are stored on disk and are not lost on power-off, whereas network connections and memory are lost immediately.
An account lockout policy is designed to mitigate which type of attack?
Lockout stops repeated password guessing.
Why this answer
Account lockout prevents brute force attacks by disabling the account after several failed attempts.
A government agency stores classified documents on a secure server. The server is connected to the internet, but access is restricted using a firewall and requires two-factor authentication. An auditor discovers that the server's operating system has not been patched for over a year, making it vulnerable to remote code execution attacks. Which security principle is most directly compromised by this missing patch, and what is the best corrective action?
Integrity is most directly compromised by remote code execution, which allows unauthorized modification of data. Applying the patch immediately is the best corrective action.
Why this answer
Integrity. An unpatched vulnerability that allows remote code execution directly compromises integrity because an attacker could modify or delete data on the server. The best corrective action is to apply the security patch immediately to close the vulnerability.
While testing in a dev environment is good practice, the urgency of a remote code execution risk requires immediate patching in production after appropriate risk assessment. Confidentiality and availability could also be affected, but integrity is the most directly compromised principle because code execution enables data alteration. Option A delays patching, which is not ideal given the severity.
Option B is excessive and disrupts operations. Option D does not address the vulnerability.
Exam trap
Candidates often confuse availability with integrity. Unpatched vulnerabilities pose a direct threat to data integrity via unauthorized modification, not just system availability.
Based on the backup schedule, what is the maximum potential data loss?
Last successful backup was Tuesday 01:00; failure at Wednesday 10:00 = 33 hours.
Why this answer
Maximum potential data loss is determined by the interval between the last successful backup and the point of failure. In a differential backup scheme, each differential contains all changes since the last full backup. If the most recent differential backup fails or is unavailable, the last successful backup becomes the previous differential.
Here, the backup schedule includes a full backup on Monday at 01:00 and differential backups every 12 hours starting Tuesday at 01:00 (i.e., Tuesday 01:00, Tuesday 13:00, Wednesday 01:00, etc.). To maximize potential data loss, we assume the most recent differential backup (Tuesday 13:00) is lost, so the last successful backup is the differential from Tuesday 01:00. If a failure occurs just before the next scheduled differential (Wednesday 10:00), the data loss spans from Tuesday 01:00 to Wednesday 10:00, which is 33 hours.
This is the maximum possible data loss given the schedule. Answer C correctly identifies this.
Exam trap
ISC2 often tests the distinction between full, differential, and incremental backups, and the trap here is confusing the last full backup as the recovery point when differential backups actually allow restoration to a much more recent point, causing candidates to overestimate data loss.
How to eliminate wrong answers
Option A is wrong because 9 hours (since Tuesday 01:00) represents only the interval from the last differential backup to a failure shortly after, not the maximum possible loss; the maximum loss must consider the full period since the last successful backup that can be restored. Option B is wrong because 2 days (data since Monday) overestimates the loss; with differential backups, you can restore from the last full backup plus the latest differential, so data loss is limited to the time since that differential, not the full two days. Option D is wrong because 1 day (data since last full backup) ignores that differential backups reduce the recovery point; the maximum loss is not from the full backup but from the last differential backup that was successfully taken before the failure.
Match each network security concept to its purpose.
Drag a concept onto its matching description — or click a concept then click the description.
Filters traffic based on rules
Segments public-facing servers
Maps private to public IPs
Encrypts data over public networks
Monitors for suspicious activity
Which of the following are effective defenses against man-in-the-middle attacks? (Choose THREE)
Users can detect invalid certificates.
Why this answer
HTTPS, VPNs, and certificate validation help prevent MITM.
Which TWO of the following are components of the identification and authentication process? (Select TWO.)
Password is an authentication factor.
Why this answer
Identification claims an identity; authentication proves it.
Which THREE of the following are considered fundamental security principles? (Select three).
Correct. Separation of duties is a key principle to prevent fraud and error.
Why this answer
Separation of duties is a fundamental security principle that prevents any single individual from having excessive control over critical processes by dividing responsibilities among multiple people. This reduces the risk of fraud, error, or abuse, as collusion would be required to bypass controls. It is a core concept in access control models and compliance frameworks like SOX and PCI DSS.
Exam trap
ISC2 often tests the distinction between a security principle (a high-level design guideline) and a security mechanism (a specific tool or technology), so candidates mistakenly select SSO or hashing because they are security-related, but they are not fundamental principles.
A security team is designing a visitor management policy. Which TWO of the following are essential components? (Select TWO.)
Correct. Escort policy ensures visitors are supervised.
Why this answer
Visitor sign-in and escort policy are core to visitor management.
An IT administrator wants to inspect HTTP traffic for malicious payloads such as SQL injection. Which network security device is most appropriate?
WAF is designed for application-layer HTTP inspection.
During a ransomware incident, the incident response team isolates affected systems. Which of the following is the NEXT best step?
Preserving evidence supports investigation and potential legal action.
Why this answer
After isolating affected systems during a ransomware incident, the next best step is to preserve forensic evidence from those systems. This ensures that data such as memory dumps, logs, and encrypted files are captured intact for analysis, which is critical for understanding the attack vector, identifying the ransomware variant, and potentially recovering data without paying the ransom. Forensic preservation must occur before any remediation steps like wiping or rebuilding, as those actions would destroy the evidence needed for investigation and legal proceedings.
Exam trap
ISC2 often tests the misconception that containment (isolation) is the final step, but the trap here is that candidates skip forensic preservation and jump to remediation (wipe/rebuild) or external actions (law enforcement/payment), failing to recognize that evidence must be secured first to support both investigation and potential recovery.
How to eliminate wrong answers
Option B is wrong because wiping and rebuilding all affected systems destroys forensic evidence and prevents analysis of the ransomware's behavior, encryption keys, or entry point, which is essential for preventing future incidents and potentially recovering data. Option C is wrong because notifying law enforcement immediately is not the next operational step; while it may be required later, the immediate priority is preserving evidence to support any law enforcement investigation, and premature notification without evidence could hinder the response. Option D is wrong because paying the ransom does not guarantee data recovery, encourages further attacks, and violates many organizational policies and legal guidelines; the incident response team should never recommend payment as a first step.
What is the primary purpose of using security baselines derived from CIS Benchmarks?
Correct. Baselines define secure configurations.
Why this answer
CIS Benchmarks provide hardened configuration standards to reduce vulnerabilities and improve security posture.
Which THREE of the following are essential components of a security baseline configuration for a server?
Reduces the number of potential entry points.
Why this answer
Exam trap
ISC2 often tests the principle of least functionality by making candidates think that installing all optional software ensures compatibility, when in reality it violates the core security baseline goal of reducing the attack surface.
During a disaster recovery exercise, the team discovers that the backup site does not have the latest security patches applied. Which of the following steps should be taken FIRST?
Proper incident response documentation and risk assessment are critical first steps.
Why this answer
The first step in any incident or exercise finding is to document the issue and assess the risk it poses. Patching the backup site immediately (Option A) could introduce instability or conflicts with the current exercise, while shutting it down (Option B) would disrupt the DR test. By documenting and assessing risk first, the team can determine the appropriate remediation priority based on the backup site's role and the criticality of the missing patches.
Exam trap
ISC2 often tests the principle that 'document and assess' must precede any corrective action, even in an exercise, to avoid impulsive changes that could invalidate the test results or introduce new risks.
How to eliminate wrong answers
Option A is wrong because applying patches without first assessing the risk could break the backup site's configuration or introduce new vulnerabilities during the exercise, and it may not be the highest priority action. Option B is wrong because shutting down the backup site would halt the disaster recovery exercise and potentially leave the organization without any failover capability, which is counterproductive. Option D is wrong because simply continuing the exercise without documenting or assessing the issue ignores the security gap and could lead to a false sense of readiness, violating standard incident response procedures (NIST SP 800-61).
A security analyst notices unusual traffic on the network. Using Wireshark, they capture packets and see that an attacker is reading all unencrypted data from the network segment. Which type of attack is most likely being performed?
Correct. Sniffing captures unencrypted traffic, as seen in the scenario.
Why this answer
Sniffing or eavesdropping involves capturing network traffic to read data. In this scenario, unencrypted data is being read, which is characteristic of sniffing.
A system administrator has a regular user account for daily work and a separate account with elevated privileges. Which principle is being applied?
Correct. Using a limited account for daily work follows least privilege.
Why this answer
Least privilege for admins means using a separate account with only necessary privileges, reducing risk.
Which of the following ports is used by HTTPS?
HTTPS uses TCP port 443.
Why this answer
HTTPS uses port 443 by default for encrypted web traffic.
A healthcare organization experiences a ransomware attack that encrypts all files on file servers and workstations. The incident response team has isolated the infected systems. The backup policy includes daily incremental backups and weekly full backups stored on a separate network segment. The most recent full backup is 5 days old. The incremental backups from the past 4 days are available but are stored on the same backup server that might be compromised. To restore data with minimal loss, what should the team do?
Ensures clean backups and minimal data loss.
Why this answer
The first step should be to verify the integrity of the backups by scanning them on an isolated system, because the backup server might be compromised. If the backups are clean, restore the full backup (5 days old) and then apply the most recent clean incremental backups from the past 4 days. This minimizes data loss while ensuring no ransomware is reintroduced.
Option A is risky because if the incremental backup contains ransomware, restoring it directly would reinfect systems. Option B rebuilds from scratch and would lose all data changes from the past 5 days, which is more drastic than necessary. Option D assumes all incremental backups are safe without verification and incorrectly includes 5 days of increments when only 4 are available (the most recent full backup is 5 days old, so increments cover days 1-4).
An organization wants to implement network segmentation to improve security. Which three methods are commonly used for network segmentation? (Select THREE.)
Subnetting divides IP address space.
Why this answer
VLANs, subnets, and DMZs are common segmentation methods. Firewalls enforce rules but are not segmentation methods themselves; IDS is a monitoring tool.
A company implements a new firewall and intrusion detection system to reduce the risk of network breaches. This is an example of:
Correct. Controls are put in place to mitigate risk.
Why this answer
Risk mitigation involves implementing controls to reduce the likelihood or impact of a risk.
Practice CC by domain
Target a specific domain to shore up weak areas.