CC Exam Dumps - ISC certification Questions and Answers

Integrity applies broadly—to data, systems, processes, and organizational operations—ensuring accuracy, completeness, and trustworthiness.

A breach occurs when unauthorized access results in the disclosure, theft, or loss of sensitive data. An intrusion may not always result in data loss, but a breach does.

The Disaster Recovery Plan (DRP) contains step-by-step technical procedures to restore IT systems, data, and infrastructure after a disruptive event. While the BCP focuses on maintaining operations, the DRP focuses onrestoration.

Firewalls control and filter network traffic based on security rules to prevent unauthorized access. While they may monitor traffic, their primary function is enforcing access control at network boundaries.

SSH uses TCP port 22 by default and provides encrypted remote administration. Telnet (23) and FTP (21) are insecure alternatives.

A zero-day vulnerability cannot be detected during a routine vulnerability assessment because it is unknown to vendors and security tools at the time of discovery. Vulnerability scanners rely on known signatures and disclosures.

Kernel flaws, buffer overflows, and permission misconfigurations are commonly identified through scans, audits, and configuration reviews.

Zero-day vulnerabilities require behavioral analysis, threat intelligence, or exploitation before detection. This is why defense-in-depth and monitoring are essential complements to vulnerability scanning.

Security frameworks emphasize that vulnerability assessments alone cannot detect unknown threats.

GDPR directly addresses privacy, while FIPS and MOUs can also relate to privacy controls and data handling requirements.

Transport Layer Security (TLS) helps mitigateman-in-the-middle (MITM) attacksby providing encryption, authentication, and integrity protection for data transmitted between communicating systems. TLS ensures that data exchanged between a client and server cannot be intercepted, modified, or read by unauthorized third parties.

TLS uses digital certificates and public key cryptography to authenticate servers (and sometimes clients), preventing attackers from impersonating legitimate endpoints. It also encrypts session data using symmetric encryption, protecting confidentiality even if traffic is captured.

TLS does not prevent application-layer attacks such as XSS or SQL injection, which are caused by insecure application logic. It also does not address social engineering, which targets human behavior rather than network protocols.

Because MITM attacks exploit unencrypted or improperly authenticated connections, TLS is a primary defense recommended by NIST and all modern security standards for protecting data in transit.

ThePrinciple of Least Privilegeensures users, applications, and systems have only the minimum permissions necessary to perform their duties. This reduces the attack surface and limits potential damage if credentials are compromised.

A protocol analyzer, also known as a packet sniffer, captures and inspects network traffic flowing across a network segment. If traffic is unencrypted, protocol analyzers can intercept sensitive information such as usernames, passwords, session tokens, and application data.

Log servers store logs, network scanners identify hosts and services, and firewalls filter traffic based on rules. Only protocol analyzers are designed to capture and inspect packet contents.

This capability makes protocol analyzers valuable for troubleshooting and for attackers conducting eavesdropping attacks. Encryption protocols such as TLS are critical defenses against this risk.