CCNA Security Policies and Procedures Questions

ISO/IEC 27001 specifies requirements for establishing, implementing, maintaining, and continually improving an information security management system, which is exactly what the scenario describes. It is internationally recognized and applicable across jurisdictions, making it suitable for a multinational manufacturer. The standard's management-system approach also supports certification, which provides external validation of the program.

Sandbox detonation executes the sample in an isolated environment, revealing runtime behaviour such as command-and-control callbacks, dropped files and registry persistence that static inspection misses. Correlating those artefacts with other indicators satisfies the Tier 2 requirement for deeper malware analysis and cross-event correlation, exceeding Tier 1 triage scope.

Tier 2 analysts handle escalated alerts requiring deeper forensic analysis, correlating the failed logins with other telemetry to determine scope and intent. This satisfies the scenario's need to validate whether the internal IP indicates compromise rather than routine user error.

Tier 3 analysts handle proactive threat hunting and deep forensic investigation, the highest analytical escalation level. Tier 1 performs triage and monitoring, Tier 2 handles incident response escalation; advanced forensics and hunting sit with Tier 3, matching the responsibilities named in the question.

ISACs are sector-specific non-profit organisations that collect, analyse and share threat intelligence among members within industries such as finance or healthcare. They satisfy the stem's requirement for a sector-focused sharing body, unlike cross-sector or government-led alternatives.

Continuous replication keeps the recovery site synchronized with minimal data loss, meeting the 15-minute RPO. A hot site with automated failover can bring the application online within the 4-hour RTO. This strategy provides the highest availability and is suitable for critical e-commerce. It aligns with both objectives by minimizing downtime and data loss.

MITRE ATT&CK is a curated knowledge base of adversary tactics and techniques derived from real-world observations. It gives defenders a common vocabulary such as initial access, persistence, and credential dumping, letting teams map detections, prioritize coverage, and compare intrusions. The scenario explicitly asks for a framework that describes tactics, techniques, and procedures observed in real intrusions, which is exactly what ATT&CK provides.

Network DLP monitors data in transit across the network perimeter. It can detect and block sensitive information leaving the organization via email, web uploads, or other protocols. This complements endpoint DLP by providing a centralized enforcement point and covering devices that may not have agents installed. Together, they form a layered defense against data exfiltration, as recommended by security best practices.

The control's total annual cost is $35,000, which is lower than the $50,000 ALE, so mitigation yields a positive return and reduces expected loss. This satisfies the risk management principle of selecting treatment where control cost is less than the annualised loss expectancy.

The Acceptable Use Policy defines permitted and prohibited use of corporate resources, including personal email access on a company laptop. The employee's action breaches that policy directly, and the resulting malware infection stems from this specific violation.

Tier 3 analysts perform proactive threat hunting, using advanced analytics and intelligence to find threats evading existing detection. This satisfies the stem's focus on hunting, distinguishing it from Tier 1 triage and Tier 2 escalation duties.

This is correct because data classification assigns labels such as 'Restricted' or 'Internal' based on sensitivity, and each label maps to specific handling, encryption, and access requirements. The policy in the scenario applies stronger controls to more sensitive data, which is the core function of classification. It enables risk-based protection aligned with business and compliance needs.

MISP is an open-source threat intelligence sharing platform where organisations exchange indicators, events and correlated attributes. It satisfies the sharing requirement by providing a common repository and community, complementing the STIX format and TAXII transport protocol named elsewhere.

Risk avoidance eliminates the risk by discontinuing the activity entirely, which matches management stopping the process outright. Unlike mitigation, which reduces likelihood or impact, or transfer, which shifts financial consequence, avoidance removes the exposure at source.

Mitigate reduces risk through controls.

Legal counsel interprets breach notification statutes and contractual obligations, advising when and to whom affected parties and regulators must be told. This satisfies the stem's data breach scenario, since notification deadlines and wording carry legal weight distinct from technical containment or forensic analysis.

Mitigation reduces risk through controls.

Chain-of-custody documentation records every transfer, handler and storage condition of the seized media, proving the evidence was not altered or tampered with. Without this unbroken audit trail, courts may rule the malware artefacts inadmissible, regardless of how technically sound the forensic acquisition itself was.

Detect is the NIST CSF Function that includes activities to identify the occurrence of a cybersecurity event, covering anomalies and events, continuous security monitoring, and detection processes. For the retailer's goal of improving event discovery, Detect is the correct focus because it addresses monitoring, analysis, and timely awareness. Investments in this Function, such as SIEM tuning and endpoint detection, directly strengthen the ability to notice malicious activity quickly.

Restricted data is usually subject to strict access controls, where only individuals with a specific need-to-know and proper approvals can access it. This minimizes the risk of insider threats and accidental exposure. Need-to-know access is a hallmark of handling requirements for the most sensitive data classifications.

Legal hold suspends normal retention and deletion schedules, preserving data that may be relevant to anticipated or active litigation. It satisfies the stem's requirement to prevent destruction of lawsuit-relevant data, unlike spoliation, which describes the improper loss itself. Microsoft Entra ID and Microsoft Purview apply holds to mailboxes, sites and identities.

Preparation is the first phase of the NIST incident response lifecycle. It encompasses establishing an incident response capability, developing plans, training personnel, and conducting exercises. In this scenario, the security manager wants to ensure the team practices and tests capabilities, which is exactly what happens during Preparation. This phase sets the foundation for effective incident handling.

The HIPAA Security Rule sets national standards for protecting electronic protected health information and is organized precisely around administrative, physical, and technical safeguards. It applies to covered entities such as hospitals and to their business associates. The rule requires risk analysis, access controls, audit controls, integrity controls, and transmission security, making it the direct match for the scenario's described obligations.

The CISO owns the risk decision, weighing containment's operational and financial consequences against continued exposure. Isolating a critical server can halt revenue-generating services, so authority rests with the executive accountable for business impact rather than the technical responders.

Confidential data is defined as information whose unauthorized disclosure could cause harm to the organization, such as competitive harm. Strategic pricing information fits this definition because its exposure could damage the company's market position. This classification aligns with the policy's description and ensures appropriate handling controls are applied.

The meeting generates recommendations for policy or procedure changes, such as revised escalation paths, access controls or detection rules. These outputs directly address root causes found during the incident, satisfying the post-incident objective of improving organisational defences.

This is correct because modern guidance favors longer passwords or passphrases over frequent forced changes, which often lead to predictable increments. A 14-character minimum significantly increases resistance to brute-force and credential-stuffing attacks. Removing expiration aligns with NIST guidance that discourages arbitrary rotation, reducing user frustration and weak password patterns.

Enforcing 12-character complexity passwords applies an administrative control that lowers the likelihood of credential compromise, reducing overall risk exposure. This is mitigation, since the organisation acts to reduce risk rather than accept, transfer or avoid it.

Tier 1 performs basic investigation with standard tooling such as SIEM queries and signature lookups, gathering enough evidence to confirm or dismiss an alert before escalating. Deeper forensics and remediation remain Tier 2 or Tier 3 responsibilities.

Hashing the original drive before imaging establishes integrity verification, proving the source was unaltered. This satisfies evidence preservation by enabling later comparison of the forensic image against the original hash, demonstrating the copy is forensically sound and unmodified.

Confidential is a core classification tier, restricting data to authorised personnel only. It sits between internal and secret levels, satisfying the policy's need for a category governing sensitive business or personal information whose disclosure would cause harm.

Multi-factor authentication directly mitigates credential compromise on remote connections, satisfying the policy's need to verify identity before granting access. Requiring MFA for all remote sessions addresses the primary risk that stolen passwords alone could otherwise permit unauthorised entry.

Restricted is the highest classification level in this policy. It is reserved for data that requires the most stringent controls due to regulatory, legal, or business impact. In this scenario, the security team must apply the strongest protections to Restricted data, making it the correct classification for the most stringent requirements and strongest security controls.

Restricted is the highest classification, reserved for data whose unauthorized disclosure would cause severe damage. Proprietary source code fits this category because its leak could destroy competitive advantage. This level typically enforces strict need-to-know access and strong encryption, aligning with the sensitivity of source code.

The CISO owns strategic incident decisions and business-impact assessment, translating technical findings into organisational risk. This role authorises containment, notification and recovery priorities, satisfying the stem's requirement for strategic decision-making authority rather than hands-on triage performed by analysts or the IR lead.

Simulated USB drop tests directly measure whether employees exhibit the risky behavior in a controlled, ethical manner, and the insertion rate becomes a quantitative metric that can be trended across quarters. Combined with targeted training after each test, this approach reduces likelihood by reinforcing awareness. It satisfies both requirements: behavior change through education and a measurable indicator of program effectiveness that management can review.

A security policy is the top-level governance document that states management's intent, scope, and overall security objectives for the organization. Every standard, procedure, and guideline must be consistent with it. Because the scenario requires one high-level document that all subordinate documents conform to, the security policy is the correct authority to treat as the highest-level document.

A hardware or software write blocker intercepts write commands at the interface level, so the imaging tool reads the drive without altering a single sector. This preserves the original media's integrity, satisfying the requirement that evidence remain unmodified during acquisition.

Post-Incident Activity is the final NIST SP 800-61 Rev 2 phase, covering lessons learned reviews and incident response plan updates once containment, eradication and recovery are complete. It satisfies the stem's requirement for the phase where findings feed back into improved procedures, distinguishing it from Detection and Analysis or Containment, Eradication and Recovery.

An Acceptable Use Policy specifies permitted and prohibited behaviour for staff using organisational IT resources, covering internet browsing, email and hardware. It satisfies the stated scope directly, unlike policies addressing data classification, incident response or password construction.

Credit card numbers are sensitive personal data subject to regulations like PCI DSS. They require the highest level of protection, typically Restricted. Encryption and strict access controls are necessary to prevent unauthorized disclosure. The analyst should recommend reclassifying the file and moving it to a secure location with access limited to those with a business need.

The Incident Response Manager leads the incident response process, declares incidents, and coordinates communication among stakeholders. This role aligns with the scenario's description of declaring the incident and ensuring all stakeholders are informed. It is distinct from the tactical Incident Handler role.

STIX provides the structured, machine-readable schema for describing indicators, threat actors and campaigns, while TAXII defines the transport protocol for exchanging that content between parties. Together they satisfy the requirement for standardised, automated threat-intelligence sharing.

Chain of custody requires an unbroken record proving who held the evidence, when, and for what purpose. Documenting date, time, and handler creates this auditable trail, ensuring the drive's integrity can be attested in court and any tampering or gaps are detectable.

Multifactor authentication satisfies the remote access policy by requiring a second verification factor beyond a password, defeating credential theft and replay attacks. Combined with conditional access in Microsoft Entra ID, it enforces sign-in risk evaluation, ensuring only verified identities reach corporate resources over untrusted networks.

NIST SP 800-61 Rev. 2 defines exactly these four phases in this order, beginning with preparation before an incident occurs, then detection and analysis, then containment, eradication, and recovery, and finally post-incident activity. Adopting this structure gives the SOC manager a recognized framework that auditors can map to, and it ensures lessons learned feed back into preparation for continuous improvement.

An Acceptable Use Policy defines permitted employee use of company systems and networks, explicitly prohibiting access to inappropriate websites. It directly governs the behaviour described, making it the policy that addresses misuse of company resources for browsing inappropriate content.

Legal counsel advises on legal obligations to notify affected parties.

The first step in phishing response is to preserve the email as evidence and analyze its headers, URLs, and attachments to confirm malicious intent and identify indicators. This analysis informs subsequent actions such as blocking senders, quarantining similar emails, and notifying affected users. It aligns with standard incident response procedures that prioritize identification and containment planning.

With the alert confirmed as a false positive from an outdated signature, no genuine incident exists, so the analyst closes it and documents the finding. This preserves the audit trail and supports later tuning of the detection signature.

Conducting lessons learned after every incident, even minor ones, helps uncover small gaps or weaknesses that could escalate into major incidents if left unaddressed. This proactive approach improves the overall security posture and prevents future incidents. It also fosters a culture of continuous improvement, where even small incidents are analyzed for root causes and corrective actions.

RBAC enforces least privilege by assigning permissions to roles, not individuals, and users are granted only the roles needed for their job. This limits access to what is required to perform duties. It is a standard method to implement least privilege in applications. The financial application scenario fits RBAC because access can be tied to job functions like teller, auditor, or manager.

The maximum tolerable downtime (MTD) is the longest period that a system can be unavailable before unacceptable consequences occur. In this scenario, the company will lose a key customer if the system is down for more than 4 hours, so the MTD is 4 hours. This is the threshold beyond which the business impact becomes intolerable.

Hashing the original drive before imaging creates a verifiable baseline; any later hash mismatch on the copy proves the data was altered. This satisfies the admissibility constraint by demonstrating the evidence remained unmodified from seizure through analysis.

Restricted is the highest sensitivity tier and is appropriate for regulated data such as payment card numbers, which PCI DSS requires to be encrypted and tightly access-controlled. Applying encryption, least-privilege access, and audit logging aligns with both the classification scheme and regulatory expectations. This combination protects the data and provides the accountability needed if a breach occurs.

STIX (Structured Threat Information Expression) provides a standardised language and serialisation format for structured threat intelligence, covering indicators, campaigns, threat actors and relationships. It satisfies the requirement for a sharing standard that represents structured threat information, unlike transport protocols such as TAXII.

Sound practice is to map each log source to a retention period derived from legal, regulatory, and investigative needs, then centralize storage so logs survive host rebuilds. Central storage with integrity protection, such as write-once or hashed archives, preserves evidentiary value. This approach balances cost with the ability to investigate incidents that may be discovered months after initial activity, and it supports audits by documenting the rationale for each period.

A complete chain of custody requires documented, signed transfers at every handoff. Missing signatures for the IT manager to storage room transfer creates a gap where unauthorized access or tampering could have occurred. This weakens the evidence's admissibility and credibility. In legal proceedings, opposing counsel can argue the evidence was not properly controlled, potentially leading to exclusion or reduced weight.

Technical safeguards under the HIPAA Security Rule specifically include access control, audit controls, integrity controls, person or entity authentication, and transmission security such as encryption. Encryption at rest, role-based access, and audit logging are technology-based mechanisms that protect electronic protected health information. This category directly matches the controls the CISO wants documented for protecting patient records.

Implementing controls to reduce risk.

This is correct because monitoring is legally defensible when employees are clearly informed that corporate systems are subject to monitoring and that they should not expect privacy. This notice, often included in an Acceptable Use Policy or employee handbook, establishes consent and reduces legal risk. Without it, monitoring during an investigation could violate privacy laws or employment agreements.

Deprovisioning is the lifecycle stage that removes or disables access when a user leaves the organization. The account should have been disabled on the employee's last day, but it remained active for 45 days and was used to reach a file server. This directly indicates a breakdown in the termination workflow, such as missing HR-to-IT notifications or absent automated account-disable rules tied to HR status changes.

Tier 1 analysts perform initial triage and basic investigation, validating the alert, gathering preliminary data, and escalating confirmed incidents. This matches the primary responsibility for a potential malware infection, as deeper forensics and remediation belong to Tier 2 or Tier 3.

Memory contents — running processes, network connections, encryption keys — are volatile and lost on power-off. Capturing a live memory image preserves that evidence for analysis, whereas shutting the server down destroys it irrecoverably, so imaging should precede containment.

This is correct because volatile data such as RAM contents and running processes are lost on reboot, so capturing memory and disk images first preserves critical evidence. Documenting the sequence maintains chain of custody. This approach balances the need to restore services with the legal requirement to preserve evidence, which the current policy fails to address.

TAXII defines the application-layer protocol and services for exchanging cyber threat intelligence over HTTPS, carrying STIX-formatted content between parties. It satisfies the ISAC sharing requirement by providing the transport mechanism, whereas STIX supplies the structured data format itself.

A write blocker enforces a hardware or software read-only mount, preventing any modification to the source drive during imaging. This preserves bit-for-bit integrity and maintains the chain of custody, satisfying the legal requirement that evidence remain unaltered and admissible in proceedings.

The Acceptable Use Policy (AUP) defines how employees may use company assets, including computers and networks. It sets expectations for behavior and consequences for violations. In this scenario, the AUP is the document that outlines these rules, making it the correct choice.

A preventive control is designed to stop unwanted actions or events before they occur. By explicitly allowing only HTTP and HTTPS outbound and denying all other traffic, the firewall rule set prevents unauthorized outbound connections. This aligns with the definition of a preventive control, as it blocks potentially malicious or non-compliant traffic from leaving the network.

Confidential is widely used for sensitive personal or business data requiring protection from unauthorized disclosure, and ePHI commonly falls into this tier when an organization uses a three- or four-level scheme. Labeling ePHI as Confidential ensures encryption, access controls, and handling rules apply, and it aligns with HIPAA's expectation that protected health information be safeguarded. It is therefore an appropriate classification label alongside Restricted.

Preparation is the phase where organisations build incident response capability before incidents occur, including developing the plan, defining roles, and conducting exercises. NIST SP 800-61 Rev 2 places plan creation and training squarely here, satisfying the stem's requirement to both develop and exercise the plan ahead of any detection or containment activity.

A zero-day playbook provides predefined steps for containment, such as network segmentation, increased monitoring, and applying vendor-provided mitigations or workarounds. This aligns with NIST SP 800-61's recommendation to have specific procedures for handling incidents when patches are unavailable. It ensures a coordinated and efficient response, reducing the time an attacker has to operate and limiting damage.

RTO is the maximum acceptable time to restore a service after a disruption. It directly defines the target for service restoration, making it the correct metric for the SLA. The manager should specify RTO to ensure the provider commits to a restoration timeframe that meets business needs. This aligns with the scenario's requirement.

Drafting the incident response plan belongs to Preparation: it defines scope, roles, communication paths and playbooks before any incident occurs, satisfying the phase's requirement to establish capability in advance rather than during detection or containment.

A Data Classification Policy defines the sensitivity tiers and mandates the handling controls each tier requires, including encryption at rest and in transit for 'Confidential' data. It is the governing document that translates classification labels into enforceable protection requirements, satisfying the stem's demand that classified data carry specific encryption obligations.