CCNA Security Concepts Questions

A digital signature is generated using the sender's private key, which only they possess, so they cannot later deny creating it. Verification with the corresponding public key provides non-repudiation, the specific property the stem requires.

A man-in-the-middle attack places the adversary between two communicating parties, relaying traffic while altering its contents before forwarding, which matches the stem's interception plus modification. The attacker typically achieves this position through ARP spoofing, rogue Wi-Fi access points or DNS poisoning, breaking both confidentiality and integrity.

A distributed denial-of-service attack floods the web server with traffic from many compromised devices, exhausting its capacity so legitimate users cannot connect. The stem's defining constraint — numerous geographically dispersed sources overwhelming one target — distinguishes DDoS from a single-source DoS, which one host alone generates.

The email spoofs a trusted bank, demands urgent verification and harvests credentials via a link, matching phishing's social-engineering mechanism. It satisfies the stem's constraints: forged sender identity, urgency pressure and a credential-capture link, distinguishing it from technical exploits that need no user interaction.

Installation is the stage where the attacker establishes persistence on the victim system. Modifying registry keys to ensure the malware runs on startup is a classic installation technique. The sandbox behavior of modifying registry keys aligns with maintaining access after the initial compromise.

A vulnerability is a weakness or flaw in a system that can be exploited by a threat. The unpatched Apache Struts vulnerability is a specific software weakness that could allow an attacker to compromise the server. This term accurately describes the condition of the unpatched software.

Remote-access trojans install a backdoor that grants the attacker interactive control of the workstation, satisfying the stem's "allows remote control" constraint. This unauthorised access is the defining behavioural characteristic distinguishing a RAT from payloads that merely download or self-replicate, so it matches the classification requirement directly.

A man-in-the-middle attack satisfies the interception-and-modification constraint: the adversary covertly relays traffic between two endpoints, terminating each side's session so both devices believe they communicate directly. Sitting inline on the path, the attacker can read and alter data in transit undetected, matching the stem's silent modification of communications.

PCI DSS applies because the stem specifies credit card payments and cardholder data protection. It is the payment card industry standard that mandates controls such as encryption, access restriction and network monitoring for any entity storing, processing or transmitting cardholder data, directly satisfying the stated compliance requirement.

HIPAA, the Health Insurance Portability and Accountability Act, sets the US legal requirements for safeguarding protected health information held by covered entities and their business associates. Its Privacy and Security Rules specifically govern electronic health records, matching the scenario's demand for a US health-data framework.

Parameterized queries, also called prepared statements, separate SQL code from data by sending the query structure and parameters separately. The database treats parameters as data, not executable code, which prevents SQL injection even if the input contains malicious characters. This directly meets the requirement.

A worm self-replicates and propagates across networks autonomously, requiring no user interaction or host file, unlike viruses that need a carrier. This satisfies the stem's constraint of spreading without user action, and its rapid, uncontrolled replication consumes bandwidth, directly causing the network congestion described.

Vulnerability scanning actively probes target systems with crafted packets to identify known weaknesses, generating detectable traffic that a firewall can block. This satisfies the stem's requirement to prevent active reconnaissance, since scanning directly interacts with the target rather than gathering data passively from public sources.

A dropper is code whose purpose is to install or download malware onto a target. The macro document fits this role: it executes on open and fetches a second-stage payload, establishing the infection. Classifying it as a dropper correctly describes its function in the attack chain rather than the payload it delivers.

ARP spoofing sends forged Address Resolution Protocol replies, binding the attacker's MAC address to a legitimate user's IP address within the victim's cache. This satisfies the stem's requirement for both MAC and IP impersonation, enabling traffic interception or man-in-the-middle positioning on the local subnet.

Multiplying likelihood (0.5) by impact ($200,000) yields $100,000, the quantitative risk value the analyst must report. This satisfies the stem's single-step calculation, giving the expected loss figure that feeds directly into the risk register and subsequent prioritisation decisions.

Lateral movement refers to the techniques an attacker uses to move through a network after initial compromise, seeking additional access and privileges. In this scenario, the attacker moved from the compromised web server to other systems, which is lateral movement. This phase often involves credential dumping, remote execution, and internal reconnaissance.

Exploitation is the phase where the attacker leverages a vulnerability to gain access, such as exploiting a browser flaw when the user visits a malicious site. In this scenario, the malicious website exploits the browser vulnerability, which is the defining action of the Exploitation phase. This occurs after delivery and before installation of persistent malware.

Risk quantifies the potential for a threat to exploit a vulnerability, combining the likelihood of that exploitation with the resulting business impact. This matches the stem's definition precisely, distinguishing it from a vulnerability or threat in isolation.

A SYN flood exploits the TCP three-way handshake by sending many SYN packets, often with spoofed sources, without completing the handshake. The server allocates resources for each half-open connection, exhausting its backlog queue. The scenario shows exactly this pattern: many SYNs to multiple ports, no completed handshakes, quickly overwhelming the web server's connection table.

DNS tunneling encodes data in DNS queries and responses, often using TXT records and long encoded subdomains, to exfiltrate data or receive commands. The regular 60-second beaconing and base64 payloads in TXT queries are hallmarks of DNS-based command-and-control, which blends with legitimate DNS traffic and often bypasses egress filtering.

Hashing produces a fixed-length digest that detects any alteration to the document, satisfying the integrity requirement. Signing that hash with the sender's private key lets the recipient verify it using the public key, proving the sender's identity and origin.

A badge reader at the server room door is a preventive physical control because it stops unauthorized individuals from entering before access is granted. It enforces physical access restrictions by requiring a valid credential, thereby reducing the likelihood of unauthorized entry. This aligns with the goal of ensuring only authorized employees can enter, making it a preventive physical control rather than a detective or administrative one.

CVSS (Common Vulnerability Scoring System) provides a numerical score reflecting the severity of a vulnerability based on metrics such as attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. A score of 10.0 indicates maximum severity. The scenario asks what the CVSS score primarily represents, and it is the severity based on technical impact and exploitability.

Shodan passively indexes internet-facing devices, letting the analyst gather intelligence on exposed industrial control systems without directly interacting with them. This satisfies the reconnaissance phase, where adversaries collect target information before exploitation, mapping to the Cyber Kill Chain's first stage and the MITRE ATT&CK discovery tactic.

AES-256 in CBC mode provides confidentiality by encrypting data, and combining it with HMAC-SHA256 provides integrity and authenticity through a keyed hash. This combination is a common approach in protocols like IPsec and TLS. Together they ensure both confidentiality and integrity for data in transit and at rest, satisfying the organization's requirements.

DNS tunneling encodes data within DNS queries and responses, often using long, random-looking subdomains and large TXT records to exfiltrate data or communicate with command-and-control servers. The regular intervals and high volume are typical of automated tunneling tools that bypass network controls by abusing DNS.

Phishing is a social engineering attack that uses fraudulent email impersonating a trusted entity — here the IT department — to trick recipients into clicking links or disclosing credentials. The spoofed sender and urgent password-reset pretext fit phishing exactly, distinguishing it from vishing, smishing or pretexting.

Quantitative risk analysis assigns monetary and numeric values to assets, threat frequency, and vulnerability likelihood to compute metrics like single loss expectancy (SLE) and annualized loss expectancy (ALE). This allows the analyst to justify security spending by comparing expected losses against control costs. For credit card data, the analyst would estimate the value of the data, the probability of a breach, and the potential financial impact.

Confidentiality guards data against disclosure to unauthorised parties, directly satisfying the stem's requirement to prevent unauthorised access. It achieves this through encryption, access controls and classification, unlike Integrity, which addresses unauthorised modification, or Availability, which addresses timely, reliable access for legitimate users.

Integrity ensures that data has not been altered or tampered with. Comparing hash values against a baseline detects any unauthorized changes to critical files, thus verifying integrity. This is a core method for file integrity monitoring (FIM) and directly addresses the integrity pillar of the CIA triad.

Preparation is the first phase of the NIST incident response lifecycle. It involves establishing policies, training staff, acquiring tools, and building communication plans before an incident occurs. This phase ensures the organization is ready to detect and respond effectively, making it a correct component of the lifecycle.

Respond covers the actions taken once a cybersecurity incident is detected, containing its spread and limiting impact through response planning, communications, analysis, mitigation and improvements. It follows Detect and precedes Recover, which restores services, so it directly matches the stem's requirement to limit incident impact.

An IPS inspects packet payloads against signatures and behavioral rules and can actively block or drop malicious traffic in real time. It is placed inline in the traffic path, so it can prevent attacks rather than just detect them. For content inspection with blocking capability, an IPS is the appropriate control.

Deterministic output lets the administrator recompute the digest from the downloaded file and compare it against the vendor's published value; any alteration to the update, however small, yields a different hash, exposing tampering. This satisfies the integrity-verification requirement without needing the vendor's private key or a shared secret.

A mismatched hash directly evidences unauthorised modification of the configuration file, violating integrity. Hashing detects any alteration to data, so comparing the computed digest against the expected baseline value confirms the file's contents changed. Confidentiality and availability remain unaffected, as neither the file's secrecy nor its accessibility is implicated by the discrepancy.

Searching public sources for company information gathers intelligence without touching the target's systems, so no packets reach the organisation and nothing is logged. That absence of direct interaction with the target satisfies the passive reconnaissance constraint in the stem.

A vulnerability is a weakness in a system's configuration or design that a threat could exploit. Directory traversal access outside intended directories is exactly such a flaw, so this term precisely describes the weakness the analyst found.

A Switched Port Analyzer session copies traffic from a source VLAN or interface to a destination port for monitoring. If an attacker with management access creates a SPAN session pointing at their own host, the switch transparently duplicates every frame from the radiology VLAN to that host, matching the observed silent copy of all traffic without disrupting normal forwarding.

AES is a symmetric block cipher using the same secret key for encryption and decryption, satisfying the stem's requirement for a symmetric algorithm. Operating on 128-bit blocks with key sizes of 128, 192, or 256 bits, it contrasts with asymmetric algorithms such as RSA, which use separate public and private keys.

An advanced persistent threat is a well-resourced actor, often state-sponsored, that conducts prolonged campaigns against specific targets. The combination of high skill, significant funding, focus on a defined set of victims, and long-term intellectual property theft matches the APT profile exactly. APTs prioritize stealth and persistence over quick disruption, which is consistent with the described behavior.

Non-repudiation provides cryptographic proof of origin through digital signatures, binding the sender's identity to the message so they cannot later deny sending it. This directly satisfies the scenario's requirement that a user cannot deny having sent an email, unlike confidentiality, integrity or availability goals.

AES-256 uses a single shared secret key for both encryption and decryption, making it symmetric. Asymmetric algorithms such as RSA instead use a public-private key pair. The policy's requirement for AES-256 therefore specifies symmetric encryption, not hashing or asymmetric cryptography.

Searching social media for employee details involves no direct interaction with the target's systems, so nothing is sent that could trigger detection. That absence of engagement with the target's infrastructure is precisely what makes it passive reconnaissance rather than active scanning.

A man-in-the-middle attack places the adversary between client and server, relaying traffic while reading, inserting and modifying messages in both directions. This active interception, rather than passive eavesdropping or denial of service, matches the bidirectional read-write-modify capability described in the scenario.

The email targeted a specific employee while impersonating internal IT, which is spear phishing rather than generic phishing. The captured credentials were then reused to access the corporate VPN, directly constituting credential theft, matching both elements the scenario describes.

Forged ICMP redirects tell a host to send traffic for a destination through a different next hop, which can be the attacker's address. This places the attacker on the path between two hosts and enables interception or alteration. Detection looks for unexpected ICMP redirect messages and hosts accepting redirects when they should not.

Active reconnaissance involves directly interacting with target systems, such as port scanning with tools like Nmap, generating traffic the target can detect. This matches the stem's constraint of using a publicly available tool to scan for open ports and services.

Exploitation is the kill chain phase where the attacker leverages a vulnerability to execute code or gain access. Exploiting the browser plugin vulnerability to gain initial access on the workstation is precisely this phase. The subsequent lateral movement and exfiltration are later phases, but the plugin exploitation itself maps to exploitation, making this the correct mapping.

An intrusion prevention system is a technical control because it uses hardware or software to automatically detect and block malicious network traffic. It enforces security policies through technical mechanisms, such as signature matching or anomaly detection. This falls squarely under technical controls, making it a correct choice for this scenario.

Encryption at rest and in transit renders data unintelligible to anyone lacking the decryption key, directly preventing unauthorised disclosure. This satisfies the stem's constraint of preventing unauthorised access, which maps to confidentiality within the CIA triad. Integrity concerns alteration, and availability concerns uptime, neither of which encryption primarily delivers.

Incomplete TCP handshakes across many internal hosts on port 443 indicate a SYN scan probing for live services. This is active reconnaissance: the attacker sends packets directly to targets, unlike passive monitoring, and the half-open connections reveal port scanning behaviour.

GDPR imposes strict rules on transferring personal data outside the EU/EEA. The scenario highlights that data is stored in multiple countries, which triggers the need to ensure adequate safeguards such as Standard Contractual Clauses or adequacy decisions. This principle directly addresses the legality of transferring EU citizens' data to other jurisdictions, making it the most relevant GDPR principle in this scenario.

Phishing fits because the attacker uses a fraudulent email impersonating the IT department to trick employees into revealing credentials via a deceptive link. This satisfies the scenario's defining constraint: mass, electronic, credential-harvesting deception. Unlike spear phishing, it is not individually researched, and unlike vishing or smishing, the channel is email, matching the stem exactly.

The Respond function covers the actions taken once an incident is detected, containing its impact and stopping the ongoing attack. Identify, Protect, Detect and Recover address other phases, so Respond satisfies the stem's requirement to halt active compromise.

GDPR directly governs the protection of EU citizens' personal data, satisfying the stem's regulatory privacy requirement. It imposes binding obligations on organisations processing that data, regardless of where the organisation is established, making it the applicable compliance framework rather than a security control or technical standard.

The CA is the trusted third party within a PKI that issues digital certificates, binding a public key to a verified identity, and validates those certificates through its registration and revocation processes. This satisfies the stem's requirement for trusted certificate issuance and validation.

Command and control (C2) describes the communication channel between malware and its operator. A domain generation algorithm produces many possible domain names that the malware queries to find an active C2 server, making it harder for defenders to block a single domain. The scenario explicitly mentions contacting command-and-control servers, so this capability is best described as command and control. It is the correct term for the malware's remote communication mechanism.

A virus is a self-replicating malware type that attaches to legitimate files or executables, spreading when those hosts run. It satisfies the stem's requirement for a common malware category, distinct from standalone threats such as worms or trojans. Microsoft Entra ID documentation and standard security curricula classify viruses among the core malware families.

Hashing is deterministic, so the analyst recomputes the digest of the downloaded file using the same algorithm and compares it against the publisher's supplied value; any mismatch proves the file was altered in transit or storage.

The CIA triad is exactly what the CISO describes: confidentiality, integrity, and availability are the three foundational objectives of information security. Administrative, physical, and technical controls are implemented specifically to protect these three properties of information assets. This aligns with the Cisco CyberOps objective of understanding the core security principles that guide the design of a security program.

Reviewing LinkedIn profiles gathers employee names, roles and technologies without touching the target's systems, so no packets reach the organisation. This indirect, non-intrusive collection satisfies the stem's passive-reconnaissance constraint, unlike scanning or banner grabbing, which generate detectable traffic.

PCI DSS is the payment card industry standard governing organisations that store, process or transmit cardholder data. Its twelve requirements mandate controls such as encryption, access restriction and network monitoring, directly satisfying the stem's cardholder data protection obligation.

A known software vulnerability is a documented weakness in software code that attackers can exploit. The outdated Apache version contains a published remote code execution flaw, which matches this definition. The analyst should classify it as a known vulnerability and prioritize patching or upgrading, consistent with vulnerability management practices in the CyberOps Security Concepts domain.

TLS encrypts data in transit using symmetric and asymmetric methods.

Phishing uses fraudulent emails impersonating a trusted entity, such as the IT department, to trick recipients into clicking links and surrendering credentials. This matches the stem's constraint of a spoofed internal email harvesting login details.

PCI DSS is the Payment Card Industry Data Security Standard, mandated for any organisation that stores, processes or transmits cardholder data. The stem's credit card handling constraint maps directly to this standard, unlike HIPAA (health) or GDPR (personal data).

Port scanning actively probes target hosts to discover open ports and running services, generating traffic that touches the target directly, which defines active reconnaissance. It contrasts with passive techniques such as searching public records or monitoring traffic, where the attacker never interacts with the target's systems.