Try ISC2 CC Certified in Cybersecurity

Q1.An organization experiences a ransomware attack that encrypts all file servers. The security team isolates affected systems and begins recovery from clean backups. Meanwhile, management activates a plan that allows employees to access critical documents from a cloud-based backup service to maintain client deliverables. The plan that allows continued client deliverables is BEST described as part of the:

• A.Disaster recovery plan
• B.Business continuity plan
• C.Incident response plan
• D.Risk management plan

Domain: Security Governance

Q2.A new helpdesk technician joins the IT department. Rather than manually configuring permissions for each system, the administrator assigns the technician to the 'Helpdesk Technician' role, which automatically grants access to the ticketing system, password reset tools, and account unlock functions. When the technician later transfers to the Network Operations team, the administrator removes them from the Helpdesk role and adds them to the Network Operations role. This process demonstrates a key advantage of RBAC, which is:

• A.Preventing all insider threats through mandatory classification labels
• B.Simplifying provisioning and role transitions through role assignment and removal
• C.Allowing resource owners to share access at their discretion
• D.Evaluating multiple contextual attributes before granting access

Domain: IAM Concepts

Q3.A manufacturing company identifies a critical vulnerability in its production control system. The vendor will not release a patch for three months. Management decides to implement compensating controls to reduce the risk while also purchasing insurance to cover potential losses. Which risk treatment options are being applied? (Select ALL that apply.)

• A.Risk acceptance
• B.Risk mitigation
• C.Risk transfer
• D.Risk avoidance

Domain: Security Principles

Q4.A development team performs threat modeling on a new web application and identifies that an unauthenticated user could potentially escalate their access to administrator level through a flaw in the session management design. This finding was identified BEFORE any code was written. What is the PRIMARY benefit of discovering this threat at this stage?

• A.It eliminates the need for penetration testing after deployment
• B.It allows the design to be corrected before code is written, which is more cost-effective than fixing it after deployment
• C.It proves the application is secure and no further testing is needed
• D.It satisfies all regulatory compliance requirements for the application

Domain: Security Operations and IR

Q5.An organization migrates its database to an IaaS cloud environment but fails to apply operating system patches, assuming the cloud provider handles all security. After a breach exploiting an unpatched OS vulnerability, who bears primary responsibility for this failure?

• A.The cloud provider, because they host the infrastructure
• B.The customer, because OS patching is a customer responsibility in IaaS
• C.Both equally, because security is always a shared responsibility
• D.Neither, because the vulnerability was in the OS vendor's code

Domain: Networking and Cloud Security