CCNA Security Policies and Procedures Questions

A write-blocker prevents modification of the source disk during acquisition, and hashing before and after imaging proves the copy is bit-for-bit identical. Comparing the two hashes verifies integrity, satisfying the requirement to preserve admissible evidence from the compromised workstation.

A procedure is a detailed, mandatory, step-by-step document describing how to perform a specific task, exactly matching the account deprovisioning instructions. Procedures are operational, reference specific systems, and are commonly used during audits to demonstrate consistent execution. Because the document dictates the exact sequence of actions and is mandatory, it is correctly classified as a security procedure.

Integrity ensures that log data remains complete and unaltered from the moment it is collected. Controls such as write-once storage, cryptographic hashing, or centralized log servers with restricted permissions preserve integrity so administrators cannot quietly modify or delete entries. This directly satisfies the requirement that logs remain trustworthy evidence throughout a seven-year retention period.

Documenting the date, time and signature of every handler creates an unbroken chain of custody record, proving who possessed the drive and when, which satisfies the requirement to demonstrate the evidence was not tampered with from seizure to presentation.

A workable classification policy must state how each level is marked and how it must be stored, transmitted, and destroyed. Without labeling conventions, users cannot tell which rules apply, and without handling rules the classification has no operational effect. These elements translate an abstract label into concrete daily behavior, which is what makes the policy enforceable and auditable across departments.

Quantitative risk assessment expresses risk in monetary terms, calculating potential loss values from asset value, exposure factor and annualised rate of occurrence. Assigning a monetary value to potential losses is precisely this method's defining characteristic.

Triage validates whether the alert is a genuine attack or a false positive and assigns severity before escalation or containment. Acting on unverified SIEM data risks wasted effort or disrupting legitimate activity, so initial triage must precede deeper investigation, containment, or notification.

Post-Incident Activity covers the lessons-learned meeting and revision of the incident response plan, closing the loop after eradication and recovery. It is the final NIST SP 800-61 Rev 2 phase, distinct from preparation, detection and analysis, and containment, eradication and recovery.

STIX provides a standardised schema for describing indicators, malware and campaigns, while TAXII defines the transport for exchanging that content between systems. Together they satisfy the requirement to correlate network logs with threat intelligence, since the escalated C2 alert's indicators can be ingested in a machine-readable, vendor-neutral form.

Data classification defines the level of protection required. Public data is intended for unrestricted access and does not contain sensitive information, so encryption at rest is not mandated. Applying unnecessary controls increases cost and complexity without adding security value. The principle is to match controls to the classification, ensuring that resources are allocated appropriately and that handling procedures remain consistent with the data's sensitivity.

Qualitative assessments express likelihood and impact using descriptive ordinal scales, such as high, medium, and low, rather than monetary values. This ranking approach suits vendor evaluation where precise financial figures are unavailable, satisfying the stem's requirement for a typical qualitative characteristic.

Preparation is the first NIST SP 800-61 Rev 2 phase, covering creation of the incident response plan, team structure, tools and training before any incident occurs. It directly satisfies the stem's requirement for the phase where planning and team assembly happen.

PCI DSS is a mandatory framework of requirements and control objectives that applies to any entity storing, processing, or transmitting cardholder data. It defines what must be achieved, such as encrypting transmission of cardholder data over open networks, while leaving implementation choices to the organization. This matches the scenario's need to confirm compliance before an assessment.

The chain of custody form records each transfer, handler, timestamp and storage location of evidence. Completing it during collection creates the auditable trail proving the evidence was never tampered with, which is required for it to be admissible.

Tier 1 handles alert monitoring and initial triage, validating whether an alert is a true positive and gathering basic evidence before escalation. Deep malware reverse engineering and enterprise-wide containment decisions belong to Tier 2 or Tier 3, so basic investigation is the correct scope.

Forensic analysis of compromised systems involves deep-diving into artefacts, memory, and disk images to determine attacker techniques and scope. This is a Tier 3 activity because it requires advanced expertise beyond Tier 1 triage or Tier 2 escalation, satisfying the advanced threat analysis requirement.

Quantitative risk assessment assigns numerical values to both likelihood and impact, satisfying the stem's requirement for numeric scoring. Unlike qualitative methods, which use descriptive scales such as high, medium or low, it enables arithmetic calculation of expected loss and direct cost-benefit comparison of controls.

NIST SP 800-63B advises against arbitrary password expiration because it leads to weaker passwords and user frustration. Instead, it recommends a minimum length of 8 characters (preferably more) and checking new passwords against a list of compromised or common passwords. This approach improves security by preventing easily guessed passwords and reducing the need for frequent changes, which often result in incremental variations that attackers can predict.

Severity classification with escalation and notification criteria ensures incidents of similar impact are handled consistently and that the right stakeholders, including legal and executive management, are informed on time. This directly supports the scenario's need for consistent handling and provides auditors with a measurable decision framework. Without it, response effort and notifications become arbitrary.

PCI DSS Requirement 3 mandates protection of stored cardholder data. Tokenization replaces the PAN with a surrogate value, so the actual PAN is not stored in the cardholder data environment, directly satisfying the requirement. It reduces scope and is a recognized method for protecting stored cardholder data under PCI DSS.

Eradication removes the malware and recovery restores systems from clean backups, both grouped with containment in this single NIST SP 800-61 Rev 2 phase. The stem's containment-then-eradicate-then-restore sequence therefore maps directly onto it, not onto post-incident activity.

Residual risk is the exposure that persists once security controls have been applied, directly matching the stem's requirement for risk remaining after implementation. Inherent risk exists before controls; residual risk is what survives them, and it must be accepted, transferred, mitigated further, or avoided through risk management decisions.

Detection and Analysis covers monitoring, alert triage and initial validation, so the analyst's first assessment of the suspicious download sits here. It precedes containment, meaning triage data gathered now determines whether the incident escalates to the containment, eradication and recovery phase.

An effective AUP must outline the consequences of violating the policy, which may include disciplinary action, termination, or legal action. This element deters misuse and ensures consistent enforcement. It also protects the organization legally by establishing that violations are taken seriously. Thus, consequences are an essential component of an AUP.

A chain-of-custody log records every individual who handled, transferred or accessed the evidence, with timestamps and signatures. This continuous audit trail satisfies the admissibility constraint by proving the evidence was never tampered with between seizure and courtroom presentation.

An Acceptable Use Policy defines permitted and forbidden employee behaviour on organisational systems. Prohibiting use of company resources for illegal activities is a core AUP clause, establishing legal boundaries and enabling disciplinary action, directly satisfying the typical AUP content requirement.

Legal counsel determines whether legal notification requirements apply, as they interpret breach-notification statutes and regulations governing PII. This satisfies the scenario's constraint: assessing statutory obligations after a PII breach. Security analysts and incident handlers identify and contain the incident, but only legal counsel can judge mandatory disclosure duties to customers, regulators, or authorities.

Malware analysis identifies the ransomware variant's behaviour, indicators, and capabilities, while correlating with other alerts reveals infection scope and lateral movement. This combination is the appropriate Tier 2 next step before escalation, satisfying the need to characterise a suspected new ransomware variant.

Defining metrics that measure IR effectiveness belongs to Post-Incident Activity, quantifying detection, response and recovery performance after the event. This satisfies the phase's purpose of evaluating what occurred rather than preparing for or containing an incident.

This is correct because a BCP must clearly assign roles and responsibilities so that team members know what to do during a disruption. Without defined roles, recovery efforts can stall due to confusion or duplication. The scenario identifies missing components, and role clarity is a fundamental part of any effective continuity plan.

A shared static credential used for automation cannot be attributed to a specific person, is rarely rotated, and often spreads across scripts and configuration files where it can be harvested. If compromised, it grants persistent privileged access with no MFA and no clear accountability, making containment difficult. This combination of anonymity, persistence, and wide exposure represents the greater risk.

NIST SP 800-61 Rev 2 orders the incident response lifecycle as Preparation; Detection and Analysis; Containment, Eradication and Recovery; then Post-Incident Activity. This sequence reflects the standard's four-phase structure, with lessons learned occurring only after recovery completes.

Detection and Analysis covers initial triage, validating alerts and deciding whether an event meets the incident criteria before escalating to containment. This satisfies the stem's requirement, since qualification happens during that phase rather than Preparation, Containment Eradication and Recovery, or Post-Incident Activity.

Centralizing logs on a hardened server with restricted access, combined with integrity measures such as hashing or write-once storage, preserves both trustworthiness and availability. If the source host is compromised or destroyed, the copies remain intact for examination. This design also supports retention policies and search during audits, directly meeting the regulator's expectation that records can be produced reliably.

NIST SP 800-53, 'Security and Privacy Controls for Information Systems and Organizations,' provides a comprehensive catalog of security and privacy controls. It is the primary source for federal agencies and many private organizations to select and implement controls. In this scenario, the retail company needs a control catalog, making SP 800-53 the correct reference.

TAXII provides the transport mechanism for exchanging cyber threat intelligence over HTTPS, supporting both structured indicators and full reports through its collections and channels model. It satisfies the ISAC sharing requirement by enabling automated, bidirectional exchange between members, complementing STIX's data representation with the delivery protocol needed for programmatic sharing.