How many Refer to the Exhibit Practice Questions questions are on this page?

This page has 14 Refer to the Exhibit Practice Questions scenario questions for the CC exam, each with detailed explanations and wrong-answer analysis.

How should I approach CC scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to ISC2 Certified in Cybersecurity CC questions

Scenario-based practice

Refer to the Exhibit Practice Questions

Practise ISC2 Certified in Cybersecurity CC practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

exam code

ISC2

vendor

Scenario guide

How to approach refer to the exhibit practice questions

Practise exhibit-style questions that ask you to read a topology, table, command output or diagram before choosing the best answer.

Quick answer

Exhibit-style questions test whether you can read a topology, command output, diagram or table before choosing the best answer.

How to extract the relevant detail from an exhibit.

How topology, command output or routing information affects the answer.

How to avoid answering from memory before reading the evidence.

How to map the exhibit back to the exam objective.

Practice scenarios

Question 1mediummultiple choice

Full question →

Based on the exhibit, what is the most likely result of the client's HTTP request?

Exhibit

Refer to the exhibit.

Router# show running-config | section interface GigabitEthernet0/1
interface GigabitEthernet0/1
 ip address 192.168.1.1 255.255.255.0
 ip access-group BLOCK_HTTP in
!
ip access-list extended BLOCK_HTTP
 deny tcp any any eq 80
 permit ip any any

A client at 192.168.1.100 attempts to access a web server at 10.0.0.1. The router's interface IP is 192.168.1.1.

A
The HTTP request is permitted because the ACL is applied to the wrong interface.
Why wrong: The ACL is correctly applied inbound on the client's subnet interface; it will filter traffic coming from clients.
B
The HTTP request is permitted because the ACL only blocks traffic from the router's own IP.
Why wrong: The ACL does not filter based on source IP; it blocks TCP port 80 from any source.
C
The HTTP request is blocked, and all other traffic from the client is also blocked.
Why wrong: The permit ip any any allows all other traffic.
D
The HTTP request is blocked, but other traffic from the client is allowed.
The ACL denies TCP port 80, then permits all other IP traffic.

Full breakdown with real-world context →

Question 2mediummultiple choice

Full question →

Refer to the exhibit. ``` -rw-r-x--- 1 user1 developers 1024 Apr 12 10:00 config.cfg ``` The security policy states that only the file owner (user1) and members of the developers group should be able to read the file. Which change is necessary to align with the principle of least privilege?

Exhibit

Refer to the exhibit.
```
-rw-r-x--- 1 user1 developers 1024 Apr 12 10:00 config.cfg
```
The security policy states that only the file owner (user1) and members of the developers group should be able to read the file. Which change is necessary to align with the principle of least privilege?

A
Add world read permission.
Why wrong: This would violate the policy by allowing others to read the file.
B
Change group permissions to rw-r--.
Why wrong: This would give group write permission, which is not needed and violates least privilege.
C
Change the file mode to 640.
640 (rw-r-----) removes the execute permission that is not required for read-only access, adhering to least privilege.
D
Change the owner to user2.
Why wrong: Changing owner does not address the group's unnecessary execute permission.

Full breakdown with real-world context →

Question 3mediummultiple choice

Full question →

An analyst reviews the exhibit. Which security principle is being violated by allowing root login via SSH?

Exhibit

Refer to the exhibit.

```
Oct 15 10:23:45 server sshd[1234]: Failed password for root from 192.168.1.100 port 22 ssh2
Oct 15 10:23:46 server sshd[1234]: Failed password for root from 192.168.1.100 port 22 ssh2
Oct 15 10:23:47 server sshd[1234]: Failed password for root from 192.168.1.100 port 22 ssh2
Oct 15 10:23:48 server sshd[1234]: Failed password for root from 192.168.1.100 port 22 ssh2
Oct 15 10:23:49 server sshd[1234]: Failed password for root from 192.168.1.100 port 22 ssh2
```

A
Fail-safe
Why wrong: Fail-safe is not relevant.
B
Least privilege
Correct. Root should not be allowed to log in directly.
C
Defense in depth
Why wrong: Defense in depth is about multiple layers, not this issue.
D
Separation of duties
Why wrong: Separation of duties is not directly related.

Full breakdown with real-world context →

Question 4hardmultiple choice

Study the full ACL explanation →

Refer to the exhibit. What is the effect of this ACL?

Exhibit

access-list 100 permit tcp host 10.0.1.0 0.0.0.255 host 192.168.2.100 eq 443
access-list 100 deny tcp any any eq 443
access-list 100 permit ip any any

A
All HTTPS traffic is permitted
Why wrong: The deny line blocks all other HTTPS except the permitted traffic.
B
Only hosts from 10.0.1.0/24 can access HTTPS on 192.168.2.100
Why wrong: This is true but incomplete; the ACL also denies HTTPS to other destinations.
C
HTTPS traffic from 10.0.1.0/24 to 192.168.2.100 is permitted; all other HTTPS is denied
This accurately describes the combined effect of the permit and deny statements.
D
The ACL is invalid due to ordering
Why wrong: The ordering is correct; specific permit before the broad deny, followed by permit all.

Full breakdown with real-world context →

Question 5easymultiple choice

Full question →

An administrator reviews the exhibit. Which security principle is being violated?

Exhibit

Refer to the exhibit.

```
User: jdoe
Groups: Domain Users, VPN Users, HR-Read
Effective Permissions on \\server\HRDocs:
  - Read
  - Write (inherited from HR-Read group)
  - Deny Delete
```

A
Non-repudiation
Why wrong: Non-repudiation is not relevant.
B
Separation of duties
Why wrong: No duty separation issue.
C
Least privilege
Correct. Write access may be excessive.
D
Accountability
Why wrong: Accountability is about logging, not permissions.

Full breakdown with real-world context →

Question 6mediummultiple choice

Full question →

Refer to the exhibit. An administrator notices that external access to the MySQL database (port 3306) is blocked, but internal access should be allowed. What change should be made?

Network Topology

A
Change the DROP rule to ACCEPT for port 3306
Why wrong: This would allow all traffic to port 3306, which is not the goal (only internal).
B
Allow port 3306 in the FORWARD chain
Why wrong: The INPUT chain is for traffic to the local system; MySQL runs locally, so FORWARD is irrelevant.
C
Create a rule to allow traffic from internal IP range to port 3306
A specific allow rule for internal IPs overrides the default DROP, enabling internal access.
D
Remove the DROP rule for port 3306
Why wrong: Since the policy is DROP, removing the DROP rule still leaves port 3306 implicitly blocked.

Full breakdown with real-world context →

Question 7mediummultiple choice

Study the full ACL explanation →

Refer to the exhibit. What is the effect of this ACL?

Exhibit

Firewall configuration snippet:
access-list 101 permit tcp any host 10.0.1.100 eq 80
access-list 101 permit tcp any host 10.0.1.100 eq 443
access-list 101 deny ip any any log

A
Allows only HTTPS to 10.0.1.100
Why wrong: Incorrect. Both HTTP and HTTPS are allowed.
B
Denies HTTP and HTTPS to 10.0.1.100
Why wrong: Incorrect. Those are permitted.
C
Allows all traffic to 10.0.1.100
Why wrong: Incorrect. Only HTTP/HTTPS are permitted; other protocols are denied.
D
Allows HTTP and HTTPS traffic to server 10.0.1.100, denies all other traffic
Correct. The two permit lines allow those protocols; the deny all blocks everything else.

Full breakdown with real-world context →

Question 8mediummultiple choice

Full question →

Refer to the exhibit. Based on the exhibit, which traffic will be permitted?

Exhibit

access-list 100 deny ip 10.0.1.0 0.0.0.255 any log
access-list 100 permit tcp any host 192.168.1.100 eq 80
access-list 100 deny ip any any

A
All traffic from 192.168.1.100
Why wrong: The access list is inbound; it controls traffic to 192.168.1.100, not from it. Also, the permit entry only allows specific traffic to that host.
B
All traffic from 10.0.1.0/24
Why wrong: The first deny statement blocks all IP traffic from 10.0.1.0/24 to any destination.
C
SSH traffic from any source to 192.168.1.100
Why wrong: SSH uses TCP port 22, which is not permitted; only port 80 is allowed.
D
HTTP traffic from any source to 192.168.1.100
The permit statement allows TCP port 80 (HTTP) traffic to host 192.168.1.100 from any source.

Full breakdown with real-world context →

Question 9easymultiple choice

Full question →

Refer to the exhibit. Which security control is MOST likely triggered?

Exhibit

Error log:
[2024-03-15 10:23:45] User 'jsmith' failed authentication from IP 192.168.1.50
[2024-03-15 10:23:47] User 'jsmith' failed authentication from IP 192.168.1.50
[2024-03-15 10:23:49] User 'jsmith' failed authentication from IP 192.168.1.50
[2024-03-15 10:23:51] User 'jsmith' account locked due to multiple failed attempts.

A
Intrusion prevention system
Why wrong: IPS typically blocks network attacks, not account lockouts.
B
Account lockout policy
Correct. The message 'account locked due to multiple failed attempts' directly indicates this.
C
Antivirus software
Why wrong: Antivirus detects malware; unrelated to authentication failures.
D
Firewall rule
Why wrong: Firewalls filter traffic; account lockout is an OS/application function.

Full breakdown with real-world context →

Question 10hardmultiple choice

Full question →

Refer to the exhibit. A user from IP 10.0.1.5 attempts to download an object from example-bucket. What will happen?

Exhibit

JSON policy snippet:
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/16"
        }
      }
    },
    {
      "Effect": "Deny",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.1.0/24"
        }
      }
    }
  ]
}

A
Denied because the deny statement overrides
Correct. Explicit deny takes precedence over allow.
B
Access denied due to implicit deny
Why wrong: Implicit deny exists but the explicit deny is the direct reason; the result is the same but the explanation is less precise.
C
Allowed because the allow statement matches
Why wrong: Incorrect. The deny statement is more specific and overrides the allow.
D
Allowed because the deny statement is invalid
Why wrong: The deny statement is syntactically valid and enforced.

Full breakdown with real-world context →

Question 11mediummultiple choice

Full question →

Refer to the exhibit. A security analyst is reviewing firewall logs and notices repeated denied TCP packets from 192.0.2.10 to internal hosts. The packets are being denied by the access-group "OUTSIDE_IN". What is the most likely reason for these denials?

Exhibit

Refer to the exhibit.

=== syslog output ===
Jan 15 09:23:45 firewall01 %ASA-4-106023: Deny tcp src outside:192.0.2.10/3456 dst inside:10.0.0.5/22 by access-group "OUTSIDE_IN" [0x0, 0x0]
Jan 15 09:23:46 firewall01 %ASA-4-106023: Deny tcp src outside:192.0.2.10/3457 dst inside:10.0.0.5/23 by access-group "OUTSIDE_IN" [0x0, 0x0]
Jan 15 09:23:47 firewall01 %ASA-4-106023: Deny tcp src outside:192.0.2.10/3458 dst inside:10.0.0.5/80 by access-group "OUTSIDE_IN" [0x0, 0x0]
Jan 15 09:23:48 firewall01 %ASA-4-106023: Deny tcp src outside:192.0.2.10/3459 dst inside:10.0.0.6/22 by access-group "OUTSIDE_IN" [0x0, 0x0]
Jan 15 09:23:49 firewall01 %ASA-4-106023: Deny tcp src outside:192.0.2.10/3460 dst inside:10.0.0.6/23 by access-group "OUTSIDE_IN" [0x0, 0x0]

A
An external host is performing a port scan against internal systems.
The sequential source ports and different destination ports across multiple hosts indicate a scan.
B
The firewall is misconfigured and blocking legitimate traffic.
Why wrong: There is no indication of legitimate traffic; the pattern suggests scanning.
C
An internal host has been compromised and is exfiltrating data.
Why wrong: Exfiltration would show outbound traffic, not inbound denied packets.
D
An external host is launching a denial-of-service (DoS) attack.
Why wrong: DoS attacks typically flood a single port, not scan multiple ports and hosts.

Full breakdown with real-world context →

Question 12hardmultiple choice

Full question →

Refer to the exhibit. A firewall rule set is shown (first match applies). An analyst reviews these rules. Which of the following best describes the traffic outcome for a packet from source IP 10.0.0.1 to destination 192.168.1.1?

Exhibit

rule deny any 10.0.0.0/8 log
rule permit any 10.0.0.0/8 any
rule deny any any log

A
The packet is permitted because the last rule permits any any.
Why wrong: The last rule denies any any, not permits; also, earlier match prevents further processing.
B
The packet is denied because rule 1 matches and denies it.
First-match logic: rule 1 matches and denies before rule 2 can permit.
C
The packet is permitted because rule 2 explicitly permits the traffic.
Why wrong: Rule 2 is never reached because rule 1 already matched.
D
The packet is denied because there is no explicit permit for 10.0.0.0/8 to 192.168.1.0/24.
Why wrong: Rule 2 permits all traffic from 10.0.0.0/8 to any, but rule 1 overrides.

Full breakdown with real-world context →

Question 13hardmultiple choice

Full question →

Refer to the exhibit. The IDS alert indicates a possible SpyEye botnet check-in from an internal host. What immediate action should the analyst take?

Exhibit

Refer to the exhibit.

```
[IDS Alert] Signature: ET TROJAN Win32/SpyEye Checkin
Source IP: 10.10.10.5 -> Destination IP: 203.0.113.50
Time: 2023-03-15 14:32:45
Alert: Priority 1
```

A
Isolate the internal host from the network
Isolating the host stops the C2 traffic and prevents lateral movement.
B
Ignore the alert as it is a false positive
Why wrong: Priority 1 alerts should not be ignored without investigation.
C
Block the destination IP at the firewall
Why wrong: Blocking the IP is a good step, but isolating the host is more immediate to contain the threat.
D
Run a full antivirus scan on the internal host
Why wrong: Scanning is a later step; containment first.

Full breakdown with real-world context →

Question 14easymultiple choice

Full question →

Refer to the exhibit. A network administrator configured the above on a switch port. After connecting a single workstation, the port goes into err-disabled state within minutes. What is the most likely cause?

Exhibit

interface GigabitEthernet0/1
 switchport mode access
 switchport port-security
 switchport port-security maximum 2
 switchport port-security violation shutdown
 switchport port-security mac-address sticky

A
The workstation is sending traffic with multiple source MAC addresses.
Exceeding the maximum MAC count triggers violation shutdown.
B
The port-security maximum is set to 2, so it should allow up to 2 MACs; the issue is elsewhere.
Why wrong: If the workstation sends more than 2 MACs, it will still violate the limit.
C
Sticky MAC learning is disabled.
Why wrong: The command shows 'sticky' is enabled, so that is not the issue.
D
The violation mode should be 'restrict' instead of 'shutdown'.
Why wrong: Restrict would not cause shutdown, but the issue is exceeding the MAC limit.

Full breakdown with real-world context →

These CC practice questions are part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style CC questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Refer to the Exhibit Practice Questions

How to approach refer to the exhibit practice questions

Quick answer

Related CC topic practice pages

Security Principles practice questions

Business Continuity, Disaster Recovery, and Incident Response practice questions

Access Controls Concepts practice questions

Security Operations practice questions

Network Security practice questions

Business Continuity, DR & Incident Response practice questions

CC fundamentals practice questions

CC scenario practice questions

CC troubleshooting practice questions

Practice scenarios

Based on the exhibit, what is the most likely result of the client's HTTP request?

Exhibit

Refer to the exhibit. ``` -rw-r-x--- 1 user1 developers 1024 Apr 12 10:00 config.cfg ``` The security policy states that only the file owner (user1) and members of the developers group should be able to read the file. Which change is necessary to align with the principle of least privilege?

Exhibit

An analyst reviews the exhibit. Which security principle is being violated by allowing root login via SSH?

Exhibit

Refer to the exhibit. What is the effect of this ACL?

Exhibit

An administrator reviews the exhibit. Which security principle is being violated?

Exhibit

Refer to the exhibit. An administrator notices that external access to the MySQL database (port 3306) is blocked, but internal access should be allowed. What change should be made?

Refer to the exhibit. What is the effect of this ACL?

Exhibit

Refer to the exhibit. Based on the exhibit, which traffic will be permitted?

Exhibit

Refer to the exhibit. Which security control is MOST likely triggered?

Exhibit

Refer to the exhibit. A user from IP 10.0.1.5 attempts to download an object from example-bucket. What will happen?

Exhibit

Refer to the exhibit. A security analyst is reviewing firewall logs and notices repeated denied TCP packets from 192.0.2.10 to internal hosts. The packets are being denied by the access-group "OUTSIDE_IN". What is the most likely reason for these denials?

Exhibit

Refer to the exhibit. A firewall rule set is shown (first match applies). An analyst reviews these rules. Which of the following best describes the traffic outcome for a packet from source IP 10.0.0.1 to destination 192.168.1.1?

Exhibit

Refer to the exhibit. The IDS alert indicates a possible SpyEye botnet check-in from an internal host. What immediate action should the analyst take?

Exhibit

Refer to the exhibit. A network administrator configured the above on a switch port. After connecting a single workstation, the port goes into err-disabled state within minutes. What is the most likely cause?

Exhibit