How many Troubleshooting Scenario Questions questions are on this page?

This page has 11 Troubleshooting Scenario Questions scenario questions for the CC exam, each with detailed explanations and wrong-answer analysis.

How should I approach CC scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to ISC2 Certified in Cybersecurity CC questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise ISC2 Certified in Cybersecurity CC practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

exam code

ISC2

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1hardmultiple choice

Full question →

Refer to the exhibit. An IDS generates this alert for traffic from an internal server (10.1.1.50) to an external IP on port 443. The security team investigates and finds that the server is a web application that normally uses TLS 1.2. What does this alert most likely indicate?

Exhibit

Refer to the exhibit.

[IDS Alert Log]
Timestamp: 2024-03-15 10:23:45
Signature: ET POLICY Outgoing SSLv3 Handshake (Possible SSL Stripping)
Source IP: 10.1.1.50
Destination IP: 203.0.113.10
Protocol: TCP
Port: 443
Payload: [Hex dump of ClientHello with version 3.0]

A
An attacker is performing an SSL stripping attack, downgrading the connection to SSLv3
The alert signature suggests SSL stripping, and the use of SSLv3 is a red flag.
B
The server is experiencing a buffer overflow attack
Why wrong: No indication of buffer overflow in the alert.
C
The server's certificate has expired and the client is falling back to SSLv3
Why wrong: Certificate expiration typically causes browser warnings, not a protocol downgrade to SSLv3.
D
The server has been misconfigured to use SSLv3 instead of TLS
Why wrong: While possible, the alert specifically mentions 'SSL Stripping' as a signature, indicating an attack.

Full breakdown with real-world context →

Question 2hardmultiple choice

Full question →

A security analyst investigates a possible data exfiltration. The analyst sees a large amount of data being sent to an external IP address at regular intervals. Which of the following is the most likely technique being used?

A
DNS tunneling
DNS tunneling encodes data in DNS requests, allowing stealthy exfiltration.
B
SQL injection
Why wrong: SQL injection targets databases but does not necessarily result in regular data dumps to an external IP.
C
Phishing
Why wrong: Phishing is an initial access method, not data exfiltration.
D
Man-in-the-middle
Why wrong: MITM intercepts traffic, but does not typically involve regular large data transfers to an external IP.

Full breakdown with real-world context →

Question 3hardmultiple choice

Full question →

During a disaster recovery exercise, the system fails to achieve the RTO. Analysis shows that restoring the database from tape takes 3 hours, but the RTO is 2 hours. Which is the most effective solution?

A
Use differential instead of full backups
Why wrong: Differential backups still require restore time and may not reduce it enough.
B
Switch from tape to disk-based backups
Why wrong: Disk may improve speed but still requires restoring data, likely still >2 hours.
C
Implement a hot standby database replica
A hot replica is synchronized and can be activated immediately, meeting RTO.
D
Increase the RTO to 3 hours
Why wrong: Changing the requirement does not solve the underlying capability issue.

Full breakdown with real-world context →

Question 4hardmultiple choice

Full question →

Refer to the exhibit. A security analyst runs the above iptables command on a Linux server. The server is configured with a default policy of DROP on the INPUT chain. Users report they can SSH to the server but cannot ping it. What is the most likely reason?

Network Topology

A
The default policy DROP on the INPUT chain drops echo replies, but they should be matched by the ESTABLISHED,RELATED rule.
Why wrong: Echo replies are outgoing, so INPUT chain does not process them.
B
The ICMP rule is placed after the ESTABLISHED,RELATED rule, so it is never evaluated for new ICMP packets.
Why wrong: The ICMP rule is before the DROP rule, so it is evaluated and matches echo requests.
C
The ACCEPT rule for ICMP only permits echo request (type 8), but ping requires echo reply (type 0) which is not allowed.
Why wrong: Echo reply is outgoing from the server, not incoming.
D
The ICMP rule only allows incoming echo requests; outgoing echo replies are not covered by the displayed rules and must be allowed by the OUTPUT chain.
Outgoing echo replies require an OUTPUT chain rule to be allowed.

Full breakdown with real-world context →

Question 5easymultiple choice

Full question →

A network administrator is troubleshooting a connectivity issue between two segments separated by a firewall. The firewall rule allows traffic from 10.1.1.0/24 to 10.2.2.0/24 on TCP 443. Users in 10.1.1.0/24 can access the web server at 10.2.2.10, but users in 10.2.2.0/24 cannot access a web server in 10.1.1.0/24. What is the most likely cause?

A
The web server in 10.1.1.0 is blocking the IP range of 10.2.2.0/24.
Why wrong: If the server were blocking, users in 10.1.1.0 would also be affected, but they can access it.
B
The firewall rule is incorrectly applied to the wrong interface.
Why wrong: The rule is applied correctly as traffic from 10.1.1.0/24 to 10.2.2.0/24 works, so interface assignment is likely correct.
C
The subnet masks are misconfigured, causing routing issues.
Why wrong: Subnet mask issues would cause bidirectional connectivity problems, not one-way.
D
The firewall is not stateful and does not automatically allow return traffic; a separate rule is needed.
Without stateful inspection, each direction requires an explicit rule. The existing rule only covers one direction.

Full breakdown with real-world context →

Question 6mediummultiple choice

Full question →

A user reports that they are unable to access a shared network drive that they previously could access. The administrator checks permissions and finds the user's account is still a member of the correct group. What should the administrator check next?

A
Group membership inheritance
Why wrong: Inheritance might affect permissions, but the user is already in the correct group.
B
User account lockout status
Why wrong: Lockout would prevent all network access, not just this drive.
C
Check for explicit deny permissions on the folder
Deny entries override allows and can cause access issues even with correct group membership.
D
Effective permissions
Why wrong: Effective permissions show the result, but checking for denies is a more direct diagnostic step.

Full breakdown with real-world context →

Question 7hardmultiple choice

Full question →

A company uses a stateful firewall. A user reports that an application requiring multiple dynamic ports is not working. The firewall logs show that packets from the server are being dropped. What is the most likely cause?

A
The firewall is only allowing packets that match an established session, but the application's control channel is not being tracked correctly.
The firewall may not associate the data channel with the control session if it does not inspect the application protocol.
B
The firewall does not have a rule allowing inbound traffic for the application.
Why wrong: If user initiated outbound, stateful firewall should allow return traffic automatically.
C
The firewall is not inspecting application-layer data.
Why wrong: Lack of app-layer inspection can cause issues but stateful firewall may still track by address/port.
D
The firewall's state table is full and cannot track new sessions.
Why wrong: Would affect many sessions, not just this application.

Full breakdown with real-world context →

Question 8easymultiple choice

Full question →

During a disaster recovery test, the team discovers that the backup generator fails to start. What is the BEST immediate action?

A
Continue the test with manual procedures
Why wrong: While possible, it is better to document the failure first.
B
Cancel the test
Why wrong: Canceling loses the opportunity to test other components.
C
Document the issue and proceed
Documenting allows the test to continue while capturing the failure for later analysis.
D
Shut down the data center
Why wrong: Shutting down is unnecessary and could cause more disruption.

Full breakdown with real-world context →

Question 9hardmulti select

Full question →

A security analyst is troubleshooting an access control issue where a user cannot access a file even though they seem to have the correct permissions. Which three of the following should the analyst investigate? (Select THREE)

A
File ownership
File ownership can affect permissions, especially in systems with owner-specific privileges.
B
Password expiration
Why wrong: Password expiration would prevent login but not specifically block access to a single file.
C
Group membership of the user
The user might not be in the expected group, or the group may have different permissions.
D
Deny permissions
Deny entries override allow permissions and can cause unexpected access failures.
E
Network connectivity
Why wrong: Network issues would disrupt all remote access, not just to one file.

Full breakdown with real-world context →

Question 10hardmultiple choice

Full question →

Refer to the exhibit. A user from the Auditors group is unable to access the folder. What is the most likely cause?

Exhibit

icacls C:\Projects\Financial
C:\Projects\Financial CONTOSO\Accounting:(R,W)
                      CONTOSO\Auditors:(R)
                      CONTOSO\Management:(F)
                      CONTOSO\Auditors:(DENY)(R)

A
The user is not a member of the Auditors group
Why wrong: The question states the user is from Auditors, so they are a member.
B
A deny entry for Auditors overrides the allow
The deny entry explicitly blocks read access, causing the failure despite the allow.
C
The Auditors group has only read permission, which is insufficient
Why wrong: Read permission is typically sufficient to access the folder; the deny is the issue.
D
The folder is encrypted
Why wrong: No encryption is mentioned in the exhibit.

Full breakdown with real-world context →

Question 11easymultiple choice

Read the full VPN explanation →

A network technician is setting up a remote access VPN for employees using IPsec. The company's firewall is configured to allow IPsec traffic. Employees report that they can successfully establish the VPN connection (tunnel appears up), but they cannot ping or access any internal resources (e.g., file servers). The firewall logs show that packets from the VPN client IP addresses are being dropped at the firewall interface. Which of the following is the MOST likely cause of this issue?

A
The VPN client is not assigned a correct IP address from the pool.
Why wrong: Incorrect IP assignment would typically prevent tunnel establishment or routing.
B
The firewall's access control list does not permit traffic from the VPN subnet to the internal network.
The tunnel being up indicates IPsec negotiation succeeded, but the firewall still needs ACL to allow forwarded traffic.
C
The firewall's intrusion prevention system is blocking the traffic.
Why wrong: IPS may block specific malicious traffic, but logs show drops at firewall, not IPS; also, all traffic is dropped, not selective.
D
The IPsec encryption algorithm is incompatible between client and firewall.
Why wrong: If incompatible, the tunnel would not establish.

Full breakdown with real-world context →

These CC practice questions are part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style CC questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related CC topic practice pages

Access Controls Concepts practice questions

Business Continuity, DR & Incident Response practice questions

Security Principles practice questions

Network Security practice questions

Security Operations practice questions

CC fundamentals practice questions

CC scenario practice questions

CC troubleshooting practice questions

Practice scenarios

Refer to the exhibit. An IDS generates this alert for traffic from an internal server (10.1.1.50) to an external IP on port 443. The security team investigates and finds that the server is a web application that normally uses TLS 1.2. What does this alert most likely indicate?

Exhibit

A security analyst investigates a possible data exfiltration. The analyst sees a large amount of data being sent to an external IP address at regular intervals. Which of the following is the most likely technique being used?

During a disaster recovery exercise, the system fails to achieve the RTO. Analysis shows that restoring the database from tape takes 3 hours, but the RTO is 2 hours. Which is the most effective solution?

Refer to the exhibit. A security analyst runs the above iptables command on a Linux server. The server is configured with a default policy of DROP on the INPUT chain. Users report they can SSH to the server but cannot ping it. What is the most likely reason?

A user reports that they are unable to access a shared network drive that they previously could access. The administrator checks permissions and finds the user's account is still a member of the correct group. What should the administrator check next?

A company uses a stateful firewall. A user reports that an application requiring multiple dynamic ports is not working. The firewall logs show that packets from the server are being dropped. What is the most likely cause?

During a disaster recovery test, the team discovers that the backup generator fails to start. What is the BEST immediate action?

A security analyst is troubleshooting an access control issue where a user cannot access a file even though they seem to have the correct permissions. Which three of the following should the analyst investigate? (Select THREE)

Refer to the exhibit. A user from the Auditors group is unable to access the folder. What is the most likely cause?

Exhibit