ISC2 CC — Certified in Cybersecurity

Question 1

A small marketing firm identifies a risk that an internal wiki server could briefly go offline during rare regional power flickers. After analysis, the team determines the likelihood is low, the impact is minimal (a few minutes of downtime for a non-critical tool), and the cost of adding a backup power supply far exceeds any potential loss. Management decides to take no further action and simply live with the possibility. Which risk treatment approach does this decision represent?

Accepted Answer

Risk acceptance

Answer

Risk mitigation

Answer

Risk transference

Answer

Risk avoidance

Question 2

A system administrator built all company web servers from a documented secure baseline last year. During a recent review, several servers were found running services and settings that no longer match that baseline, even though no approved changes were recorded. What is the BEST way to describe and address this situation?

Accepted Answer

The servers have experienced configuration drift and should be brought back into alignment with the baseline through change management

Answer

The baseline is outdated and should simply be replaced with each server's current settings

Answer

The servers were correctly patched, so no further action is required

Answer

The servers should be immediately wiped and reimaged without investigation

Question 3

An attacker on the same office LAN sends forged replies mapping the default gateway's IP address to the attacker's own MAC address. Nearby workstations update their local tables and begin sending their internet-bound traffic to the attacker's machine instead of the router. Which technique is being used, and at which OSI layer does it operate?

Accepted Answer

ARP cache poisoning, operating at Layer 2 (Data Link)

Answer

DNS poisoning, operating at Layer 7 (Application)

Answer

IP spoofing, operating at Layer 3 (Network)

Answer

SYN flooding, operating at Layer 4 (Transport)

Question 4

Two companies that have never exchanged keys before want to begin sending encrypted messages to each other over the internet. They need a way for each party to share a value that lets the other encrypt data without ever transmitting a secret key that an eavesdropper could capture. Which type of cryptography is designed to solve this problem?

Accepted Answer

Asymmetric (public-key) encryption, where each party publishes a public key and keeps a private key

Answer

Symmetric encryption, where both parties use the same shared secret key

Answer

Hashing, which produces a fixed-length digest of the message

Answer

Steganography, which hides the message inside another file

Question 5

A user connects to their bank's website over public Wi-Fi at a coffee shop. An attacker on the same network positions their device so that all traffic between the user and the bank router passes through the attacker's machine, allowing them to silently read and relay the communication in real time. Which type of attack is being described?

Accepted Answer

On-path (man-in-the-middle) attack

Answer

Distributed denial-of-service (DDoS) attack

Answer

Side-channel attack

Answer

SYN flood attack

Question 6

A new employee is going through onboarding and receives a document that outlines what activities are permitted when using the company's computers, email, and internet connection, along with the consequences for misuse. Which type of policy is the employee reviewing?

Accepted Answer

Acceptable Use Policy (AUP)

Answer

Bring Your Own Device (BYOD) policy

Answer

Change management policy

Answer

Data retention policy

Question 7

An employee logs into the corporate VPN by entering a password and then typing a six-digit code displayed on a physical key fob issued by the company. The security team wants to classify each element used during this login. How should the physical key fob be categorized?

Accepted Answer

Something you have

Answer

Something you know

Answer

Something you are

Answer

Somewhere you are

Question 8

A financial services firm performs nightly backups of its transaction database. During a quarterly review, the security team runs a restore of a backup to a test environment and compares checksums of the restored records against the originals to confirm that no data was altered or corrupted since the backup was taken. Which element of the CIA triad is this activity primarily designed to protect?

Accepted Answer

Integrity

Answer

Availability

Answer

Confidentiality

Answer

Non-repudiation

Question 9

A regional flood forces a retail company to close its main office for several days. Before the disruption, the company had documented alternate work locations, prioritized which business functions must keep running, and identified backup suppliers so it could continue serving customers throughout the outage. Which type of plan primarily provides this capability to keep essential operations running during the disruption?

Accepted Answer

Business continuity (BC) plan

Answer

Disaster recovery (DR) plan

Answer

Incident response (IR) plan

Answer

Change management plan

Question 10

A company created a business continuity plan two years ago. Since then, it has moved several critical applications to a new cloud provider, hired a new operations manager, and changed office locations. During a recent power outage, staff discovered the emergency contact list was outdated and several documented recovery steps referenced systems that no longer exist. What key practice did the organization most likely fail to perform?

Accepted Answer

Regular review and testing of the plan to keep it accurate and current

Answer

A business impact analysis to identify critical processes

Answer

Purchasing cyber insurance to transfer residual risk

Answer

Encrypting the backup files stored with the cloud provider

Question 11

A regional bank is finalizing its business continuity plan (BCP). During a review, a manager notices the plan lists critical processes, recovery priorities, and required resources, but no one is sure how staff, executives, and vendors will be reached and coordinated if the primary office phone and email systems are unavailable during a disruption. Which component should be added to address this gap?

Accepted Answer

A communications plan that defines contact methods, call trees, and alternate channels

Answer

A business impact analysis that recalculates the recovery time objectives

Answer

A vulnerability assessment of the office phone and email servers

Answer

A cyber-insurance policy to transfer the financial cost of the outage

Question 12

During the early stages of building a business continuity program, a company's continuity coordinator is trying to determine, for each business process, the longest period the process can be unavailable before the organization suffers unacceptable or irreversible harm. Which business impact analysis output is the coordinator identifying?

Accepted Answer

Maximum Tolerable Downtime (MTD) for each process

Answer

The recovery procedures documented in the disaster recovery plan

Answer

The composition and roles of the incident response team

Answer

The residual risk remaining after controls are applied

Question 13

A mid-sized logistics company is beginning to develop its business continuity program. The continuity coordinator wants to know which business functions must be restored first after a disruption and how much downtime each function can tolerate before the company suffers unacceptable losses. Which activity should the coordinator perform to obtain this information?

Accepted Answer

Conduct a business impact analysis (BIA)

Answer

Perform a penetration test of critical systems

Answer

Draft the incident response communication plan

Answer

Run a full disaster recovery failover test

Question 14

A company installs a fingerprint scanner at the entrance to its data center. Employees must scan their finger before the physical door will unlock, preventing unauthorized people from walking into the room. When classifying this safeguard by control type, how should the fingerprint scanner best be categorized?

Accepted Answer

A physical control

Answer

An administrative control

Answer

A regulatory control

Answer

A directive control

Question 15

A company allows employees to use their own smartphones and tablets to access corporate email and applications. Management is concerned about protecting company data on these personal devices. Which policy should the organization implement to define the security requirements and responsibilities for using personally owned devices for work?

Accepted Answer

Bring Your Own Device (BYOD) policy

Answer

Acceptable Use Policy (AUP)

Answer

Change Management policy

Answer

Data Retention policy

Question 16

A critical vulnerability is being actively exploited, and the security team must deploy an emergency patch to production servers outside the normal maintenance window. According to sound change management practice, what should the team do to remain compliant while acting quickly?

Accepted Answer

Apply the patch immediately and document the emergency change, then submit it for retroactive review and approval per the emergency change process

Answer

Skip all change management steps because emergencies are exempt from any documentation requirements

Answer

Wait for the next scheduled change advisory board meeting before applying the patch to preserve the normal approval flow

Answer

Apply the patch silently and delete any logs so the unscheduled change does not appear in the audit trail

Question 17

A company's security team notices that sensitive printed documents are frequently left on desks overnight, and unlocked workstations often display confidential information. Which best-practice security policy should the team implement to directly address both issues?

Accepted Answer

A clear-desk and clear-screen policy

Answer

A bring-your-own-device (BYOD) policy

Answer

A change management policy

Answer

An acceptable use policy (AUP)

Question 18

A software team deploys their application on a Platform as a Service (PaaS) offering. The cloud provider manages the operating system, runtime, and underlying infrastructure. During a security review, the team asks which security task remains their responsibility under the shared responsibility model. Which task is the customer responsible for?

Accepted Answer

Protecting the application code and its data

Answer

Applying patches to the host operating system

Answer

Securing the physical data center facilities

Answer

Maintaining the virtualization hypervisor

Question 19

A company migrates its application servers to a public cloud provider using an Infrastructure as a Service (IaaS) model. During a security review, the team debates who is responsible for applying operating system security patches on those virtual machines. According to the shared responsibility model, who is responsible?

Accepted Answer

The customer, because operating system maintenance falls to the customer under IaaS

Answer

The cloud provider, because it owns and maintains all underlying infrastructure

Answer

The cloud provider, because patching is always a provider obligation regardless of service model

Answer

A third-party auditor, because patch validation is an external compliance function

Question 20

A data center entrance requires each employee to swipe an access badge and then enter a personal PIN on a keypad before the door unlocks. From an authentication perspective, what does this configuration provide?

Accepted Answer

Multi-factor authentication combining something you have with something you know

Answer

Single-factor authentication using two something-you-have credentials

Answer

Multi-factor authentication combining something you have with something you are

Answer

Two-step verification that still counts as a single knowledge factor

Question 21

A security analyst maintains a documented list of all approved hardware and software assets connected to the corporate network. During a routine review, the analyst compares a network scan against this list and discovers three devices that are not recorded anywhere. Which configuration management practice made this discovery possible?

Accepted Answer

Maintaining an asset inventory

Answer

Applying a patch management schedule

Answer

Enforcing an acceptable use policy

Answer

Performing secure data destruction

Question 22

At a small marketing firm, employees store project files on a shared server. When Maria creates a document, she alone decides which coworkers can read or edit it, and she can grant or revoke that access at any time through the file's permission settings. Which access control model does this arrangement best illustrate?

Accepted Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Answer

Role-Based Access Control (RBAC)

Answer

Rule-Based Access Control

Question 23

At a design firm, each project lead can decide who may open, edit, or share the files they create in a shared collaboration platform. There are no organization-wide classification labels; access is entirely at the file creator's discretion. Which access control model is in use?

Accepted Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Answer

Role-Based Access Control (RBAC)

Answer

Rule-Based Access Control on the network firewall

Question 24

A company is rolling out a new data governance program. Before staff can determine which storage, encryption, and sharing rules apply to a given file, what must first be assigned to that data?

Accepted Answer

A classification level based on the data's sensitivity

Answer

A retention schedule specifying its deletion date

Answer

A secure destruction method for end-of-life disposal

Answer

An encryption key generated for the file owner

Question 25

A company stores customer records in a cloud provider's encrypted storage service. When a contract ends, the company must ensure the data is unrecoverable, but it has no physical access to the provider's drives, which are shared with other tenants. Which secure destruction method is most appropriate in this situation?

Accepted Answer

Crypto-shredding by destroying the encryption keys

Answer

Degauss the storage media used by the provider

Answer

Physically shred the hard drives holding the data

Answer

Overwrite the files once with random data

Question 26

A company recently completed classifying all of its data into categories such as Public, Internal, and Confidential. A security analyst notices that employees still routinely email Confidential files without encryption because they cannot tell which files are sensitive. Which action would MOST directly address this problem?

Accepted Answer

Apply labels to the classified data so its sensitivity is clearly marked

Answer

Create a longer data retention schedule for Confidential records

Answer

Degauss the storage media holding the Confidential files

Answer

Reduce the number of classification categories to just two

Question 27

A junior database administrator is assigned to run weekly backup jobs on the company's customer database. When IT provisions the account, they grant it full administrative rights to the entire database server, including the ability to modify schemas, delete tables, and manage other user accounts. Which security principle has been violated?

Accepted Answer

Least privilege

Answer

Defense in depth

Answer

Non-repudiation

Answer

Availability

Question 28

A retail company's public website suddenly becomes unreachable. Monitoring shows the web servers are receiving an overwhelming volume of traffic from thousands of different IP addresses across the globe, consuming all available bandwidth and connection capacity so legitimate customers cannot load the site. What type of attack is most likely occurring?

Accepted Answer

Distributed denial-of-service (DDoS) attack

Answer

On-path (man-in-the-middle) attack

Answer

Side-channel attack

Answer

SQL injection attack

Question 29

A company is retiring a batch of solid-state drives (SSDs) that stored confidential customer data. A technician plans to run a strong magnetic degausser over the drives to ensure the data cannot be recovered before disposal. Why is this approach flawed for these devices?

Accepted Answer

Degaussing relies on altering magnetic fields, but SSDs store data in flash memory chips, so degaussing will not reliably erase the data

Answer

Degaussing is only effective when the drives are powered on and actively spinning

Answer

Degaussing permanently encrypts the data rather than destroying it, leaving it recoverable with the key

Answer

Degaussing works fine on SSDs but must be repeated at least seven times to meet standards

Question 30

A company is retiring a batch of old magnetic hard drives that stored sensitive financial records. The drives will be sent to an off-site recycling vendor, and management wants to ensure the data cannot be recovered before the drives leave the building. Which method most reliably renders the data on these magnetic drives unrecoverable?

Accepted Answer

Degaussing each drive to disrupt its magnetic fields

Answer

Deleting all files and emptying the recycle bin on each drive

Answer

Reformatting each drive with a standard quick format

Answer

Renaming and encrypting the folders that contain the records

Question 31

A company runs a public-facing web server that customers access from the internet. The security team wants to allow this inbound public access while ensuring that if the web server is compromised, an attacker cannot directly reach the internal corporate network where sensitive databases and employee workstations reside. Which network design best meets this goal?

Accepted Answer

Place the web server in a DMZ segment between two firewall boundaries, isolating it from the internal network

Answer

Place the web server directly on the internal LAN and rely on host-based antivirus

Answer

Assign the web server a public IP and connect it directly to the internet with no firewall

Answer

Install a VPN client on the web server so remote users connect through an encrypted tunnel

Question 32

A company's users report that when they type their bank's URL into their browsers, they are redirected to a look-alike website that steals credentials. Investigation reveals that the resolver has cached forged records mapping the legitimate domain name to an attacker-controlled IP address. Which type of attack does this describe?

Accepted Answer

DNS cache poisoning

Answer

SYN flood

Answer

Side-channel timing analysis

Answer

Privilege escalation

Question 33

A network administrator is troubleshooting name-resolution failures on a workstation. Using a packet capture tool, she notices the workstation's DNS lookup requests are being sent to the resolver. Which transport protocol and default port are typically used for these standard DNS query requests?

Accepted Answer

UDP over port 53

Answer

TCP over port 443

Answer

TCP over port 25

Answer

UDP over port 161

Question 34

A backup administrator at a mid-sized firm follows a document titled 'Nightly Backup Restoration' that lists the exact, ordered steps for restoring data from tape: log into the backup console, select the recovery point, mount the target volume, and verify checksums. New staff are expected to follow this document exactly, with no deviation. Within the firm's governance hierarchy, what type of document is this?

Accepted Answer

A procedure

Answer

A policy

Answer

A standard

Answer

A guideline

Question 35

A regional flood destroys a company's primary data center. The business continuity team has already shifted critical customer-facing operations to a manual workaround so orders can still be taken. Now leadership wants to restore the full IT environment at the alternate site and bring systems back to normal. Which plan governs this specific effort to rebuild and restore the technology environment?

Accepted Answer

The disaster recovery (DR) plan

Answer

The business continuity (BC) plan

Answer

The incident response (IR) plan

Answer

The business impact analysis (BIA)

Question 36

A company's data retention policy states that customer support email records must be kept for exactly three years, after which they are no longer needed for legal or business purposes. A batch of support emails has now reached the four-year mark and is still sitting in the archive system. According to good data handling practice, what should happen to these records?

Accepted Answer

They should be securely destroyed because they have exceeded the defined retention period

Answer

They should be kept indefinitely in case they are ever needed in the future

Answer

They should be re-encrypted and moved to a hotter storage tier for faster access

Answer

They should be relabeled as public data since they are now old

Question 37

A financial analyst receives an email that appears to come from the CFO instructing an urgent wire transfer. Before acting, the analyst wants assurance that the message genuinely originated from the CFO and was not sent by an impersonator. Which security concept most directly addresses this need?

Accepted Answer

Authenticity

Answer

Availability

Answer

Confidentiality

Answer

Least privilege

Question 38

A financial controller must send quarterly reports to external auditors by email. Management requires proof that each report genuinely came from the controller and was not altered in transit, and the controller should not be able to later deny sending it. Which cryptographic technique best satisfies these requirements?

Accepted Answer

Applying a digital signature using the controller's private key

Answer

Encrypting the report with a shared symmetric key known to both parties

Answer

Hashing the report and attaching the hash value to the email

Answer

Encrypting the report with the auditors' public key

Question 39

A field technician carries customer records on a USB flash drive between client sites. Management is concerned that if the drive is lost or stolen, the records could be read by an unauthorized person. Which control most directly protects the confidentiality of the data stored on the drive?

Accepted Answer

Apply full-drive encryption to the USB device so the data is unreadable without the key

Answer

Generate a hash of each file so tampering can be detected later

Answer

Configure a TLS connection when the technician uploads files to the server

Answer

Label the drive as 'Confidential' before it leaves the office

Question 40

A sales representative loses a company laptop on a train. The laptop's entire drive was protected with full-disk encryption, and no data was accessible to whoever finds it. Which element of the CIA triad did the encryption primarily preserve in this incident?

Accepted Answer

Confidentiality

Answer

Integrity

Answer

Availability

Answer

Non-repudiation

Question 41

A company has two branch offices that need to exchange sensitive internal data over the public internet. Management wants all traffic between the two office networks to be automatically encrypted without requiring individual employees to configure anything on their workstations. Which solution best meets this requirement?

Accepted Answer

Deploy a site-to-site VPN between the gateways at each office

Answer

Install a host-based firewall on every workstation in both offices

Answer

Require each employee to launch a client-based VPN before accessing office resources

Answer

Place both office networks in a shared DMZ segment

Question 42

A cybersecurity analyst discovers that a critical vulnerability was never remediated before a compliance deadline. Their manager instructs them to alter the audit report to indicate the issue was fixed, arguing it will 'protect the company's reputation.' Under the ISC2 Code of Ethics, what is the most appropriate action for the analyst?

Accepted Answer

Refuse to falsify the report and act honestly, protecting the profession and the public interest

Answer

Comply with the manager's request, since following organizational directives takes priority over personal judgment

Answer

Alter the report but keep private notes documenting the true findings for personal protection

Answer

Quietly delete the audit records so no inaccurate information is formally recorded

Question 43

A data center operations manager is reviewing safeguards for the server room. She wants to ensure that a small electrical fire would not destroy servers and cause an extended outage of critical services. She decides to install an automated clean-agent fire suppression system. Which element of the CIA triad is this control primarily intended to protect?

Accepted Answer

Availability

Answer

Confidentiality

Answer

Integrity

Answer

Non-repudiation

Question 44

A company installs a network firewall that automatically inspects and blocks malicious inbound traffic based on configured rules. When categorizing this safeguard for a risk assessment report, which type of security control does the firewall represent?

Accepted Answer

Technical control

Answer

Administrative control

Answer

Physical control

Answer

Compensating policy

Question 45

A network technician is reviewing firewall logs and notices inbound connection attempts to TCP port 21 on a server that hosts file transfers. Which protocol is most likely being used on this port?

Accepted Answer

FTP (File Transfer Protocol)

Answer

SSH (Secure Shell)

Answer

Telnet

Answer

SNMP (Simple Network Management Protocol)

Question 46

A logistics company distributes its critical tracking application across data centers in three different regions. When one region suffered a complete power failure, customers experienced no service disruption because traffic was automatically routed to the other two regions. In risk management terms, what has the company primarily accomplished by using this multi-region design?

Accepted Answer

It reduced the impact of a regional outage on business operations

Answer

It eliminated the threat of power failures entirely

Answer

It transferred the risk to the data center providers

Answer

It reduced the likelihood that a power failure will occur

Question 47

A systems administrator is deploying 50 new web servers. To ensure every server starts with the same approved, hardened settings — including disabled unnecessary services, applied patches, and standardized configurations — the administrator builds a single approved image and uses it for all deployments. What configuration management practice is the administrator using?

Accepted Answer

Establishing a secure baseline (gold image)

Answer

Performing a vulnerability scan

Answer

Conducting a penetration test

Answer

Applying data classification labels

Question 48

A financial firm's security manager introduces a policy requiring all employees who handle wire transfers to take at least one consecutive week of vacation each year, during which another employee performs their duties. The goal is to expose any fraudulent activity that might be hidden by the primary employee. What type of security control is this mandatory vacation policy?

Accepted Answer

Administrative control

Answer

Technical control

Answer

Physical control

Answer

Compensating technical control

Question 49

A visitor arrives at a corporate lobby and the security guard checks the visitor's government-issued ID against a pre-approved appointment list before allowing entry. Which combination of access control characteristics best describes what the guard is providing at this checkpoint?

Accepted Answer

A physical, preventive control performing identification and authorization of the subject

Answer

A logical, detective control performing accountability of the subject

Answer

A physical, corrective control performing encryption of the object

Answer

A logical, deterrent control performing non-repudiation of the transaction

Question 50

A finance team shares a single login for the accounts-payable system so that any of the four clerks can approve payments quickly. After a fraudulent payment is discovered, management cannot determine which clerk approved it because all activity was logged under the shared account. Which security concept was most directly undermined by using the shared account?

Accepted Answer

Non-repudiation

Answer

Availability

Answer

Confidentiality

Answer

Defense in depth

Question 51

A systems administrator downloads a firmware update and wants to confirm the file was not altered during transfer. The vendor publishes a SHA-256 value alongside the download. After downloading, the administrator computes the SHA-256 of the local file and compares it to the published value. What security goal does this process primarily support?

Accepted Answer

Integrity — confirming the file has not been changed

Answer

Confidentiality — keeping the file contents secret

Answer

Availability — ensuring the file can always be downloaded

Answer

Non-repudiation — proving who created the file

Question 52

A regional clinic must protect patient health records. The clinic's compliance officer notes two governing documents: a national healthcare data-protection statute passed by the legislature that mandates breach notification, and the clinic's own internal document requiring staff to lock workstations when unattended. If the clinic fails to comply with the national statute, which consequence is MOST likely, and how should these two documents be classified?

Accepted Answer

The statute is a law whose violation can bring legal penalties; the internal document is a policy that carries only internal disciplinary consequences

Answer

Both documents are laws, so violating either results in government fines and criminal charges

Answer

The statute is a standard and the internal document is a regulation, both enforced by the clinic's management

Answer

Both documents are internal policies, so failure to comply is handled entirely through HR disciplinary action

Question 53

A hospital discovers that a patient's electronic medication record was altered without authorization, causing an incorrect dosage to be recommended. The clinical team is most concerned that the data displayed to physicians can no longer be trusted as accurate and unmodified. Which element of the CIA triad has been most directly compromised in this incident?

Accepted Answer

Integrity

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 54

A new information security manager is organizing the company's governance documents. She finds a document that states: 'All employee passwords must be at least 14 characters long, contain three character types, and expire every 90 days.' Which type of governance document is this?

Accepted Answer

A standard, because it defines mandatory, specific requirements

Answer

A policy, because it reflects management's high-level intent

Answer

A procedure, because it lists step-by-step instructions

Answer

A guideline, because it offers optional recommendations

Question 55

A network administrator is configuring firewall rules for a company's public-facing web server that must serve encrypted web pages to customers over the internet. Which port must the administrator allow through the firewall to permit this encrypted web traffic?

Accepted Answer

TCP port 443

Answer

TCP port 80

Answer

TCP port 22

Answer

UDP port 161

Question 56

A company migrates several application servers to a public cloud provider using an Infrastructure as a Service (IaaS) model. During a security review, the team debates who is accountable for various layers of the environment. Under the shared responsibility model, which task remains the responsibility of the cloud service provider?

Accepted Answer

Securing the physical data center facilities and underlying host hardware

Answer

Configuring the guest operating system firewall rules on each virtual machine

Answer

Managing identity and access permissions for the company's application users

Answer

Encrypting the data the company stores within its virtual machines

Question 57

A network administrator wants to deploy a device that will monitor traffic on the internal network and generate alerts when it detects suspicious activity or known attack signatures. Management is concerned about accidentally blocking legitimate business traffic, so the device must NOT interfere with or drop any packets. Which technology best meets this requirement?

Accepted Answer

An intrusion detection system (IDS)

Answer

An intrusion prevention system (IPS)

Answer

A stateful packet-filtering firewall

Answer

A network address translation (NAT) gateway

Question 58

A small company has 40 internal workstations that all use private IP addresses. The office has only one public IP address assigned by its ISP, yet all 40 workstations can browse the internet simultaneously. Which technology on the company's router makes this possible?

Accepted Answer

Network Address Translation (NAT)

Answer

Virtual Private Network (VPN)

Answer

Intrusion Prevention System (IPS)

Answer

Domain Name System (DNS)

Question 59

A network administrator wants a device that not only detects malicious traffic patterns but also automatically blocks the offending packets before they reach internal servers. The device must be placed inline in the traffic path. Which technology best meets this requirement?

Accepted Answer

An Intrusion Prevention System (IPS)

Answer

An Intrusion Detection System (IDS)

Answer

A network tap sending copies to a SIEM

Answer

A honeypot placed in the DMZ

Question 60

A network administrator is assigning IP addresses for an internal office LAN that will not be directly routable on the public internet. Which of the following addresses falls within a private (non-routable) IPv4 range suitable for this internal network?

Accepted Answer

10.14.200.5

Answer

8.8.8.8

Answer

172.60.10.15

Answer

192.0.2.10

Question 61

A network administrator is documenting the addressing scheme for a new office. The organization is migrating from IPv4 to IPv6 to support address exhaustion concerns. When explaining the difference to junior staff, what is the correct address length of an IPv6 address?

Accepted Answer

128 bits

Answer

32 bits

Answer

64 bits

Answer

256 bits

Question 62

A network engineer is planning a migration from IPv4 to IPv6 for a growing organization. Management asks what the primary driver was for developing IPv6 in the first place. Which answer best explains the fundamental reason IPv6 was created?

Accepted Answer

To provide a vastly larger address space that solves IPv4 address exhaustion

Answer

To replace TCP with a faster connection-oriented transport protocol

Answer

To eliminate the need for firewalls by encrypting all traffic by default

Answer

To reduce the OSI model from seven layers to four layers

Question 63

A security analyst at a mid-sized firm notices an unusual spike in outbound network traffic from an internal database server late at night. She reviews the SIEM alerts, correlates the logs, and confirms that the traffic matches known data-exfiltration patterns. She has not yet isolated the server or removed any malware. According to the incident response process, which phase is the analyst currently performing?

Accepted Answer

Detection and analysis

Answer

Containment

Answer

Eradication

Answer

Recovery

Question 64

A company has just finished containing and recovering from a phishing-based email compromise. The incident response team reconvenes to review how the incident was handled, document what worked and what didn't, and recommend updates to the response plan and employee training. Which phase of the incident response process are they performing?

Accepted Answer

Post-incident activity (lessons learned)

Answer

Detection and analysis

Answer

Containment

Answer

Preparation

ISC2 CC — Certified in Cybersecurity (CC) full-length practice exam

How this timed CC mock exam works

What your CC results show

How to get the most out of it

Ready for the full CC mock exam?