Free ISC CC Practice Exam with Questions & Answers

IPv6 was introduced primarily due toIPv4 address exhaustion, enabling vastly expanded address space.

Defense in depth uses multiple layers of controls—administrative, technical, and physical—so that failure of one layer does not compromise security.

VLANslogically separate networks at Layer 2 while sharing the same physical infrastructure.

White-box testing involves examining an application’s internal structure, including source code, logic paths, and configurations, to identify vulnerabilities and security weaknesses. Testers have full knowledge of the system and can analyze how data flows and how controls are implemented.

This testing approach is effective for identifying issues such as insecure coding practices, logic flaws, and hard-coded credentials. Black-box testing does not involve source code access, functional testing validates behavior, and user acceptance testing focuses on business requirements.

White-box testing is commonly used in secure code reviews, static application security testing (SAST), and DevSecOps pipelines. Security standards strongly recommend white-box techniques for early vulnerability detection.

During the detection and analysis phase, incidents are identified, triaged, categorized, and prioritized based on impact and urgency. This ensures resources are allocated appropriately.

In access control models, asubjectis an active entity that requests access to a resource. In this scenario, Derrick is the subject because he is the user initiating an action—logging into a system and attempting to read a file. Subjects can be users, processes, or systems acting on behalf of users.

Anobject, by contrast, is a passive entity that is being accessed, such as a file, database, printer, or network resource. The file Derrick wants to read is the object. Access control systems evaluate whether a subject has the appropriate permissions to perform an action (such as read, write, or execute) on an object.

This subject-object relationship is foundational to many security models, including discretionary access control (DAC), mandatory access control (MAC), and role-based access control (RBAC). Proper identification of subjects is essential for authentication, authorization, auditing, and accountability. By clearly defining who the subject is, organizations can enforce least privilege, track user actions, and maintain strong security governance across systems.

An Intrusion Detection System (IDS) consists of three fundamental functional components: information sources, analysis engines, and response mechanisms. Information sources collect data such as network packets, logs, or system events. Analysis engines evaluate this data to detect suspicious behavior. Response components generate alerts or notifications.

While IDS systems typically do not block traffic (unlike IPS), they still perform response actions such as logging, alerting, and triggering workflows.

All three components work together to detect and report security incidents. This architecture is well documented in NIST intrusion detection guidance and forms the basis of both host-based and network-based IDS solutions.

Ransomware affects victims’ files primarily byencryptingthem, rendering the data inaccessible without a decryption key. Attackers then demand a ransom in exchange for restoring access.

While modern ransomware may also steal data, encryption is the defining characteristic of ransomware attacks. Destroying or selling files is not the primary mechanism.

Strong backups, access controls, and endpoint protection are key defenses against ransomware, as emphasized by NIST and CIS.

The four primary risk response strategies areaccept, avoid, mitigate (reduce), and transfer. Monitoring is an ongoing activity, not a formal risk treatment option.

Disaster Recovery Planning focuses on restoringIT systems, infrastructure, and communicationsafter a disruption. Business Continuity Planning focuses onmaintaining critical business functionsduring and after incidents, often using alternative processes.

BCP is broader than DRP and includes people, processes, facilities, and third parties, while DRP is IT-centric. Both plans complement each other but serve different purposes.