CCNA Cbrops Security Concepts Questions

A digital signature is created with the sender's private key and verified with their public key, so successful verification proves origin and confirms the message was not altered in transit. This delivers both authentication and integrity, matching the stem's requirements.

HIPAA's Security Rule treats encryption of electronic protected health information as an addressable implementation specification, protecting confidentiality and integrity during storage and transmission. It satisfies the stem's ePHI protection constraint, alongside access controls and audit logging required for compliance.

AES is a symmetric block cipher whose confidentiality guarantee renders intercepted ciphertext unreadable without the shared key, satisfying the stem's interception constraint. Symmetric encryption suits bulk data protection, whereas asymmetric algorithms are typically reserved for key exchange and digital signatures.

A vulnerability is a flaw or weakness in a system that can be exploited to violate security. In this scenario, the attacker gained access by exploiting a weakness, such as an unpatched service or misconfiguration. This definition correctly describes the role of a vulnerability in the incident.

Flooding authentication with repeated failed logins from one external IP exhausts server resources until it stops responding, which is the defining effect of a Denial of Service attack. The stem's unresponsive authentication server confirms availability, not confidentiality, is the target.

A keylogger is malware that records every keystroke typed on a compromised host, typically storing or transmitting them to the attacker. Capturing keystrokes is its sole defining capability, so it matches the described tool exactly.

Man-in-the-Middle attacks satisfy the on-path interception constraint: the adversary inserts themselves between two communicating devices, relaying and altering traffic without either party detecting it. Unlike passive sniffing, which only copies packets, MitM actively modifies data in transit, matching the stem's intercepted and modified communications.

AES is the only symmetric block cipher listed, satisfying the data-at-rest requirement. It encrypts and decrypts with one shared key, unlike RSA and ECC, which are asymmetric. AES-256 offers strong resistance to brute-force attacks and is the standard choice for protecting stored data.

Symmetric encryption relies on one shared secret key for both encryption and decryption, whereas asymmetric encryption uses a mathematically linked key pair: a public key to encrypt and a private key to decrypt. This directly satisfies the stem's request for the primary distinction between the two encryption schemes.

BEC is a sophisticated scam where attackers impersonate executives or trusted partners to trick employees into transferring funds or revealing sensitive information. The scenario describes a spoofed CEO email requesting an urgent wire transfer, which is a classic BEC attack. The mismatched Reply-To and credential-harvesting link further support this classification.

A Trojan is malware that disguises itself as legitimate software or a benign file to trick users into executing it. In this case, the executable appears to be a PDF but actually performs malicious actions like encrypting files. This deception is the defining characteristic of a Trojan, which often delivers ransomware or other payloads.

An advanced persistent threat often involves stealthy, prolonged access to a network to steal data over time. The scenario describes data exfiltration using an encrypted channel during non-business hours, which aligns with APT tactics. APTs aim to maintain persistence and exfiltrate sensitive information without detection, making this the most likely threat type.

AES is a symmetric block cipher, so encryption and decryption share one secret key. This satisfies the stem's same-key requirement, and symmetric ciphers process data far faster than asymmetric algorithms such as RSA, which rely on computationally expensive modular arithmetic.

A Trojan disguises itself as legitimate software, so the victim must execute or install it before it runs. That dependency on the user launching the file satisfies the stem's user-interaction requirement, unlike worms, which self-propagate across networks without any user action.

High entropy in a file section indicates compressed or encrypted data, which is typical of packed malware. Packers compress or encrypt the original code to evade signature detection, and the unpacking stub restores it at runtime. The high-entropy section is a strong static indicator that the executable is packed or encrypted.

A stolen laptop containing sensitive customer data represents a physical asset loss enabling data exposure, which falls under threat classification in risk models. The threat is the potential actor or event exploiting the missing device's unencrypted data, satisfying the scenario's requirement to categorise the incident as a threat rather than a vulnerability or exploit.

Unsanitized input creates injection vulnerabilities such as cross-site scripting, and unapproved browser extensions add untrusted code to endpoints. Together these weaknesses enlarge the attack surface, giving threat actors more paths to exploit. The architect's findings describe exploitable vulnerabilities rather than a specific attack technique or a compliance gap.

Risk mitigation involves applying controls to reduce the likelihood or impact of a vulnerability. Given the high CVSS score and exposure, patching or implementing a web application firewall is necessary. Mitigation is the most appropriate response to protect sensitive data and maintain compliance.

ARP spoofing lets an attacker send forged ARP replies, poisoning victims' caches so traffic is redirected through the attacker's machine. Positioned between two communicating hosts, the attacker relays traffic while reading or altering it, producing a man-in-the-middle condition.

Bollards are physical barriers that prevent vehicles from ramming into a building or accessing restricted areas. They are tangible structures designed to deter or block physical threats, which makes them a classic physical control. In a data center, bollards help protect the facility from vehicle-borne attacks and accidental damage. This option is correct because it directly addresses physical access and protection of the premises.

HIPAA safeguards protected health information, a subset of personal data, through its Privacy and Security Rules. It satisfies the compliance constraint by mandating administrative, physical and technical safeguards for individually identifiable health data, making it a framework specifically designed to protect personal information rather than general security controls.

A SYN flood sends numerous TCP SYN packets to open ports without completing the three-way handshake, exhausting the server's connection backlog. The scenario describes exactly this: multiple SYNs to different ports from one source with no completed handshakes. This matches the classic half-open connection pattern used to deny service to legitimate users.

Network segmentation divides a network into isolated zones and enforces traffic controls between them. By restricting traffic from the web tier to the database tier, the team limits lateral movement, so a compromised web server cannot freely reach the database. This directly matches the described control and its purpose.

A vulnerability is precisely a weakness or flaw in a system that an attacker could exploit to violate confidentiality, integrity or availability; this definition distinguishes it from a threat, which is the potential cause of harm.

Ransomware encryption renders files unreadable, directly denying legitimate access to data and systems. Availability is the CIA element concerned with ensuring authorised users can access resources when required, so encryption that blocks access satisfies the stem's constraint of disrupted data access. Confidentiality and integrity remain intact; the data is neither exposed nor altered.

The NIST Cybersecurity Framework is structured around the five core functions: Identify, Protect, Detect, Respond, and Recover. No other framework in the stem's list uses this exact function set, so it directly matches the required structure.

Passive reconnaissance relies on publicly available sources without directly interacting with the target's systems, so no packets reach the organisation's infrastructure. LinkedIn and Google searches match this exactly, satisfying the stem's constraint of gathering employee and structural details covertly, leaving no trace in the target's logs.

Email filtering inspects incoming messages and blocks those containing known malicious attachments, URLs, or sender reputations. This directly reduces the volume of phishing emails reaching user inboxes, lowering the chance of a successful attack. It is a preventive control that operates before the user interacts with the message, making it a core component of anti-phishing defense in depth.

Detection and analysis is the phase where analysts validate whether an incident occurred, determine its scope, and identify affected systems and data. The analyst's goal of understanding which systems were compromised and what data was accessed aligns directly with this phase. This step precedes containment and eradication and is critical for making informed decisions about subsequent response actions.

Risk is a function of likelihood and impact. The probability that a threat actor will exploit a weakness in the application or its cloud infrastructure directly contributes to the overall risk level. Without considering likelihood, the analyst cannot estimate how probable a loss event is. This factor is a core component of risk assessment in the Security Concepts domain.

DNS poisoning corrupts a resolver's cache with forged records, so subsequent queries return the attacker's IP address and redirect victims. This matches the stem exactly: fake entries inserted into the cache, sending users to a malicious site.

A digital certificate binds a public key to a verified identity by having a trusted certificate authority digitally sign the certificate, which contains the subject's public key and identifying details. This binding lets relying parties confirm the key genuinely belongs to the claimed entity, preventing impersonation and enabling trusted encryption and authentication.

Integrity guarantees data remains accurate and unaltered unless changed by authorised parties. Hashing, checksums and digital signatures detect unauthorised modification, directly satisfying the requirement that data cannot be modified by unauthorised parties, unlike confidentiality or availability controls.

GDPR is the EU regulation governing protection of personal data of EU citizens, imposing lawful processing, consent and breach-notification duties. It directly satisfies the stem's requirement for a compliance framework relevant to safeguarding EU citizens' personal data.

Post-incident activity is the final phase of the NIST SP 800-61 lifecycle, where the team reviews what happened, identifies the root cause, documents lessons learned, and updates procedures. Adding this phase directly fills the gap because root cause analysis is a core activity of the post-incident review, not of containment, eradication, or recovery.

A vulnerability is a weakness in a system or application that an attacker could exploit. The SQL injection flaw is precisely such a weakness in the web application, making it the vulnerability element of this risk scenario.

Active reconnaissance involves directly interacting with targets, such as scanning IP ranges to elicit responses revealing live hosts and services. This matches the stem's constraint: the attacker's scanning traffic touches the target, unlike passive reconnaissance, which only observes third-party data.

PCI DSS is the payment-card industry standard governing storage, transmission and access to cardholder data, so it uniquely satisfies the stem's cardholder-data protection constraint. Other frameworks address health information, financial reporting or general security controls rather than card data specifically.

A TCP SYN flood sends many SYN packets with spoofed sources. The server allocates resources for each half-open connection and waits for the final ACK that never arrives, exhausting the connection table and denying service to legitimate users. This exactly matches the observed SYN volume, spoofed IPs, and full connection table, making it the correct classification.

Remote code execution occurs when an attacker can execute arbitrary code on a remote server, often by exploiting a vulnerability in a web application. The scenario describes a crafted HTTP request that causes the server to execute arbitrary code, which is the definition of RCE. This is a severe vulnerability that can lead to full system compromise. Thus, RCE is the correct answer.

Fileless malware resides in memory, often using PowerShell, reflective DLL injection, or process hollowing, and leaves little or no trace on disk. It typically injects into legitimate processes to evade detection. The scenario matches these characteristics: no file on disk, memory-resident, and process injection, without self-replication to other systems.

Implementing access controls directly satisfies the stem's requirement to reduce risk by limiting who can reach systems and data. Authentication, authorisation and least-privilege enforcement, typically via Microsoft Entra ID, shrink the attack surface and block unauthorised actions, lowering both likelihood and impact of a breach.

The Registration Authority verifies subscriber identity and approves or rejects certificate requests before forwarding them to the Certificate Authority for issuance. It is a core PKI component, separating identity vetting from certificate signing so the CA is not exposed to untrusted request traffic.

A vulnerability is precisely a weakness or flaw in a system, application, or configuration that a threat actor could exploit to compromise confidentiality, integrity, or availability. This directly matches the stem's requirement for a term describing an exploitable weakness, distinguishing it from a threat (the potential attacker) or risk (the likelihood of exploitation).

Hashing produces a fixed-length digest from file contents; recomputing it and comparing against the published value reveals any alteration, satisfying the stem's integrity-verification constraint. Encryption provides confidentiality and digital signatures provide authenticity, neither directly detecting transit modification.

Exploitation is the phase where the attacker leverages a vulnerability to gain access to the target system. In this scenario, the attacker exploits a vulnerability in a public-facing web server to execute arbitrary code, which is a classic example of exploitation. This phase directly follows delivery and precedes installation of persistent access.

Ransomware encrypts victim files using symmetric or hybrid cryptography, rendering data inaccessible until a decryption key is supplied. This directly matches the stem's constraint of encryption plus payment demand, distinguishing it from worms, trojans or spyware, which do not extort via cryptographic locking.

Windows Management Instrumentation allows attackers to create permanent event subscriptions that execute code when triggered, without dropping a traditional executable. Because WMI is a legitimate management component, the malicious subscription can blend into normal activity. EDR products monitor WMI activity, including __EventFilter and CommandLineEventConsumer creation, to catch this common fileless persistence mechanism, so the analyst should expect this coverage.

Ransomware encrypts victim files and demands payment for the decryption key, matching the stem's description exactly. Unlike worms, which self-propagate across networks, or trojans, which disguise themselves as legitimate software, ransomware's defining mechanism is cryptographic extortion of data access.

A vulnerability is a weakness; a threat is the actor or event that exploits it; risk is the resulting potential for loss. This option correctly chains the three, matching the stem's request for their relationship rather than treating them as interchangeable.

DNS tunneling encapsulates command-and-control traffic within DNS queries and responses, often to domains controlled by an attacker. Repeated resolution of malicious domains is a strong indicator of this behavior. The scenario describes the workstation repeatedly resolving domain names for known malicious C2 servers, which aligns with DNS tunneling used by malware to exfiltrate data or receive instructions.

The high volume of unique, algorithmically generated subdomains combined with large TXT responses is characteristic of DNS tunneling, where an attacker encodes data or commands inside DNS queries and responses to bypass egress filtering. Legitimate DNS rarely produces this pattern, so the analyst should treat this host as compromised and begin containment.

3DES (Triple Data Encryption Standard) is a symmetric block cipher that applies DES three times with different keys. It is used for bulk data encryption, though it is slower than AES. It is still considered acceptable in some legacy systems. The scenario asks for symmetric algorithms, and 3DES is symmetric and designed for bulk encryption.

Dynamic analysis involves executing malware in a controlled environment, such as a sandbox, and observing its behavior, including process creation, network traffic, and file system changes. The analyst's observations of mutex creation, outbound connections, and registry modification are classic dynamic indicators. This approach reveals runtime actions that static analysis might miss due to obfuscation or packing.

A SYN flood is a type of denial-of-service attack where the attacker sends many SYN packets with spoofed source IP addresses. The server allocates resources for each half-open connection, eventually exhausting its connection table and preventing legitimate users from connecting. The scenario matches this exactly: spoofed SYNs, full connection table, and denial of service.

A digital signature uses the sender's private key to sign a message hash, letting the recipient verify integrity via the public key and providing non-repudiation, since only the sender could have produced that signature. This satisfies both the tamper-detection and non-deniability requirements.

Searching LinkedIn for employee information gathers publicly available data without directly touching the target's systems, so no traffic reaches company infrastructure. This indirect, non-intrusive collection is passive reconnaissance, unlike active scanning or enumeration, which would interact with and potentially alert the target.

A DDoS attack floods the web server with traffic from many compromised hosts, exhausting its resources so legitimate users cannot connect. This matches the scenario's constraint of multiple compromised systems overwhelming one target, distinguishing it from a single-source DoS attack.

Integrity ensures that data is not modified by unauthorized parties. TLS uses message authentication codes and encryption to detect tampering, thereby preserving integrity of data in transit. The scenario explicitly states the requirement to prevent unauthorized alteration, which directly maps to the integrity principle of the CIA triad.

Exploiting vulnerabilities lets the worm propagate autonomously across networks, satisfying the stem's requirement for self-replication without user interaction. Unlike viruses, which need a host file or user action to execute, worms spread directly between systems, making this a defining characteristic of worm behaviour during malware analysis.

The sender signs with their private key, so verification requires the mathematically paired public key. This satisfies the authenticity and integrity constraint: only the matching public key validates the signature, confirming the update originated from the holder of the private key and was not altered.

A SYN flood exploits the TCP three-way handshake by sending many SYN packets, often with spoofed source addresses, so the target allocates resources for half-open connections and never receives the final ACK. The scenario describes exactly this: spoofed source IPs, SYN segments to many ports, and no completed handshakes, exhausting the target's connection table.

A SYN flood is a denial-of-service attack where the attacker sends many TCP SYN requests with spoofed source IPs, causing the target to allocate resources for half-open connections. The lack of ACKs and use of spoofed sources match this pattern. The goal is to exhaust the target's connection table, preventing legitimate connections.

The file uses a .docx extension to appear harmless, but its magic number shows it is a Windows Portable Executable. This masquerading technique tricks users into opening what they believe is a document, potentially executing malicious code. The mismatch between the file extension and its actual header is a strong indicator of disguised malware delivered via email attachment.

Symmetric encryption satisfies the single-key constraint by using one shared secret for both encryption and decryption, as with AES. This contrasts with asymmetric algorithms such as RSA, which employ a public key to encrypt and a mathematically related private key to decrypt, requiring two distinct keys.

Rate limiting caps requests per source within a time window, throttling the high-volume login attempts the stem describes. This directly addresses the brute force constraint by slowing credential guessing, making automated attacks impractical without blocking legitimate users.

A worm self-replicates and propagates across networks autonomously, exploiting vulnerabilities or weak credentials without requiring a user to open a file or click a link. This matches the stem's constraint of spreading without user intervention, unlike viruses, which need host execution.

A vulnerability assessment systematically scans and evaluates systems to discover weaknesses, then ranks them by severity and potential impact. It does not exploit flaws or simulate an active adversary, but it provides the inventory needed to plan remediation. In this scenario, the analyst would use tools such as vulnerability scanners to produce a prioritized list that helps the CIO allocate patching resources efficiently.

Active reconnaissance involves directly interacting with the target to gather information, such as port scanning, which generates traffic and can be detected. Vulnerability scanning tools probing open ports are actively engaging the network, distinguishing this from passive reconnaissance.

The Protect function covers safeguards that limit or contain the impact of a cybersecurity event, including access control, awareness training, data security and protective technology. Developing and implementing these safeguards to ensure delivery of critical infrastructure services is its stated purpose.

A man-in-the-middle attack places the adversary inline between client and server, letting them relay and alter transmitted data while both endpoints believe they communicate directly. This interception plus undetected modification is precisely the behaviour described in the scenario.

Need to know restricts access to information only to individuals who require it to perform their specific duties. In this scenario, employees should only access data necessary for their current project tasks, aligning with the need-to-know principle. It ensures that even if an employee had access to other projects previously, that access is revoked when no longer needed.

Sending TCP SYN packets to many destination IP addresses on the same port, without completing the three-way handshake, is classic TCP SYN scanning. The goal is to discover which hosts have port 445 (SMB) open. The broad destination range indicates host discovery across a subnet, which matches reconnaissance behavior often performed by worms or scanning malware.

Confidentiality guarantees data is readable only by authorised parties. Intercepting and reading encrypted traffic without authorisation exposes the plaintext content to an unintended party, so the confidentiality element of the CIA triad is the one primarily compromised.

DGA malware generates many pseudo-random domain names to avoid static blocklists and to locate its C2 server. The short TTLs and high volume of unique, random-looking queries from one host strongly indicate DGA activity. The host is likely attempting to resolve one of the domains that the attacker has registered to establish C2.