Try ISC2 CC Certified in Cybersecurity

Q1.An organization experiences a ransomware attack that encrypts all file servers. The security team isolates affected systems and begins recovery from clean backups. Meanwhile, management activates a plan that allows employees to access critical documents from a cloud-based backup service to maintain client deliverables. The plan that allows continued client deliverables is BEST described as part of the:

• A.Disaster recovery plan
• B.Business continuity plan
• C.Incident response plan
• D.Risk management plan

Domain: Security Governance

Q2.A new helpdesk technician joins the IT department. Rather than manually configuring permissions for each system, the administrator assigns the technician to the 'Helpdesk Technician' role, which automatically grants access to the ticketing system, password reset tools, and account unlock functions. When the technician later transfers to the Network Operations team, the administrator removes them from the Helpdesk role and adds them to the Network Operations role. This process demonstrates a key advantage of RBAC, which is:

• A.Preventing all insider threats through mandatory classification labels
• B.Simplifying provisioning and role transitions through role assignment and removal
• C.Allowing individual resource owners to share access at their own discretion
• D.Evaluating multiple contextual attributes and conditions before granting access

Domain: Identity and Access Management (IAM) Concepts

Q3.A manufacturing company identifies a critical vulnerability in its production control system. The vendor will not release a patch for three months. Management decides to implement compensating controls to reduce the risk while also purchasing insurance to cover potential losses. Which risk treatment options are being applied? (Select ALL that apply.)

• A.Risk acceptance
• B.Risk mitigation
• C.Risk transfer
• D.Risk avoidance

Domain: Security Principles

Q4.A development team performs threat modeling on a new web application and identifies that an unauthenticated user could potentially escalate their access to administrator level through a flaw in the session management design. This finding was identified BEFORE any code was written. What is the PRIMARY benefit of discovering this threat at this stage?

• A.It eliminates the need for any penetration testing once the application has been deployed
• B.It allows the design to be corrected before code is written, which costs far less than fixing later
• C.It proves the application is secure by design, so no further security testing will be needed
• D.It satisfies every regulatory compliance requirement that will apply to the finished application code

Domain: Security Operations and Incident Response

Q5.An organization migrates its database to an IaaS cloud environment but fails to apply operating system patches, assuming the cloud provider handles all security. After a breach exploiting an unpatched OS vulnerability, who bears primary responsibility for this failure?

• A.The cloud provider, because they host the infrastructure
• B.The customer, because OS patching is a customer responsibility in IaaS
• C.Both equally, because security is always a shared responsibility
• D.Neither, because the vulnerability was in the OS vendor's code

Domain: Networking and Cloud Security Concepts