ISC2 Certified in Cybersecurity CC practice test

A security analyst discovers that a user's account has been used to access sensitive data outside of normal business hours from an unfamiliar IP address. The user claims they were not logged in at that time. Which security operations process should be initiated first?

Trap 1: Perform a forensic analysis of the user's workstation

Forensic analysis is a later step in incident response; first, the incident must be declared and the response team mobilized.

Trap 2: Reset the user's password and enforce multi-factor authentication

These are remediation steps that would follow the initial incident response actions like containment.

Trap 3: Disable the user account immediately

Disabling the account is a containment step that should be part of the incident response plan, but it is not the first process to initiate. First, the incident should be reported and triaged.

A
Perform a forensic analysis of the user's workstation
Why wrong: Forensic analysis is a later step in incident response; first, the incident must be declared and the response team mobilized.
B
Reset the user's password and enforce multi-factor authentication
Why wrong: These are remediation steps that would follow the initial incident response actions like containment.
C
Disable the user account immediately
Why wrong: Disabling the account is a containment step that should be part of the incident response plan, but it is not the first process to initiate. First, the incident should be reported and triaged.
D
Initiate the incident response process
The incident response process begins with detection and analysis; this scenario meets the criteria for initiating that process.

Question 2easymultiple choice

An organization wants to ensure that data remains unaltered during transmission over the internet. Which security goal is being addressed?

Trap 1: Non-repudiation

Non-repudiation prevents denial of actions, not data modification.

Trap 2: Availability

Availability ensures data is accessible, not unaltered.

Trap 3: Confidentiality

Confidentiality protects data from unauthorized access, not alteration.

A
Non-repudiation
Why wrong: Non-repudiation prevents denial of actions, not data modification.
B
Availability
Why wrong: Availability ensures data is accessible, not unaltered.
C
Confidentiality
Why wrong: Confidentiality protects data from unauthorized access, not alteration.
D
Integrity
Integrity ensures data is not altered during transmission.

Question 3hardmultiple choice

A security auditor discovers that a user has been granted read and write access to a sensitive file, but the user's job only requires read access. Which access control principle has been violated?

Trap 1: Job rotation

Job rotation is a security practice to rotate roles, not directly related to permission levels.

Trap 2: Need-to-know

Need-to-know is about data access based on necessity, but here the issue is unnecessary write ability.

Trap 3: Separation of duties

Separation of duties divides tasks among multiple people, not about permission levels.

A
Job rotation
Why wrong: Job rotation is a security practice to rotate roles, not directly related to permission levels.
B
Need-to-know
Why wrong: Need-to-know is about data access based on necessity, but here the issue is unnecessary write ability.
C
Separation of duties
Why wrong: Separation of duties divides tasks among multiple people, not about permission levels.
D
Least privilege
Least privilege requires minimal permissions; write access is excessive.

Question 4hardmultiple choice

A company's network uses 802.1X authentication with PEAP-MSCHAPv2 on wired ports. Users report that after a recent switch firmware update, some workstations fail to authenticate intermittently, while others work fine. The authentication server logs show 'Authentication failed: Unknown CA certificate' for affected workstations. What is the most likely cause?

Trap 1: The switch is not forwarding EAP packets properly due to a firmware…

The error message indicates a certificate issue, not packet forwarding.

Trap 2: The RADIUS shared secret was changed during the firmware update

A shared secret mismatch would cause 'Access-Reject' or 'Authentication failed' without certificate-specific errors.

Trap 3: The authentication server (NPS) is overloaded and dropping requests

Overload would cause timeouts, not certificate errors.

A
The switch is now using a different certificate that is not trusted by the clients
The firmware update may have changed the certificate presented by the switch, and clients do not trust it.
B
The switch is not forwarding EAP packets properly due to a firmware bug
Why wrong: The error message indicates a certificate issue, not packet forwarding.
C
The RADIUS shared secret was changed during the firmware update
Why wrong: A shared secret mismatch would cause 'Access-Reject' or 'Authentication failed' without certificate-specific errors.
D
The authentication server (NPS) is overloaded and dropping requests
Why wrong: Overload would cause timeouts, not certificate errors.

Question 5hardmultiple choice

During a security audit, a penetration tester captures network traffic and finds that some packets have the IP ID field set to 0 and the DF (Don't Fragment) flag set. What is this technique attempting to do?

Trap 1: Spoof the source IP address of the attacker's machine

The attacker's IP is not spoofed; the zombie's IP is used.

Trap 2: Launch a denial-of-service attack against the target

Idle scan is not a DoS; it's a stealth scan.

Trap 3: Evade a firewall by fragmenting packets

DF flag prevents fragmentation.

A
Spoof the source IP address of the attacker's machine
Why wrong: The attacker's IP is not spoofed; the zombie's IP is used.
B
Launch a denial-of-service attack against the target
Why wrong: Idle scan is not a DoS; it's a stealth scan.
C
Perform a stealth scan using a zombie host to hide the attacker's identity
Idle scan uses IP ID to map a zombie's activity and infer port states.
D
Evade a firewall by fragmenting packets
Why wrong: DF flag prevents fragmentation.

Question 6easymultiple choice

A security operations team is implementing a new SIEM solution. They want to ensure that logs from all critical systems are collected and analyzed in real time. Which of the following is the MOST important consideration when designing the log collection architecture?

Trap 1: Use a standardized log format for all systems

Standardization helps parsing but is not as critical as ensuring the logs can be collected reliably.

Trap 2: Encrypt all log transmissions in transit

Encryption is a security requirement but does not affect the ability to collect logs.

Trap 3: Define a log retention policy of at least one year

Retention policy is for storage, not for the collection architecture itself.

A
Ensure sufficient network bandwidth and storage capacity
Insufficient bandwidth can cause log loss, and inadequate storage can lead to data being overwritten before analysis.
B
Use a standardized log format for all systems
Why wrong: Standardization helps parsing but is not as critical as ensuring the logs can be collected reliably.
C
Encrypt all log transmissions in transit
Why wrong: Encryption is a security requirement but does not affect the ability to collect logs.
D
Define a log retention policy of at least one year
Why wrong: Retention policy is for storage, not for the collection architecture itself.