CCNA Cbrops Security Concepts Questions

A digital signature uses the sender's private key to sign the message, and the recipient verifies it with the sender's public key. This process provides authentication (proving the sender's identity) and integrity (detecting any alteration) because any change to the message invalidates the signature. Hash functions alone provide integrity but not authentication, while PKI is the infrastructure that supports digital signatures but is not the mechanism itself.

HIPAA requires encryption of ePHI, access controls, and audit controls to ensure confidentiality, integrity, and availability of protected health information.

Symmetric encryption, such as AES, provides confidentiality by encrypting data so that only those with the key can read it.

A Denial of Service (DoS) attack aims to make a system or service unavailable by overwhelming it with requests.

Option D is correct because a keylogger is a type of malware specifically designed to capture and record keystrokes on a compromised system. The question directly describes the behavior of capturing keystrokes, which is the primary function of a keylogger, making it the most likely malware in use.

Man-in-the-Middle attacks intercept and alter communications between two parties.

AES is a widely used symmetric encryption algorithm.

Digital signatures provide both data integrity and non-repudiation by using the sender's private key to sign a hash of the document. The recipient verifies the signature with the sender's public key, ensuring the document has not been altered and that the sender cannot deny having signed it.

Symmetric uses one shared key; asymmetric uses a public-private key pair.

The integrity element of the CIA triad ensures that data cannot be modified by unauthorized parties. Integrity mechanisms, such as hashing algorithms (e.g., SHA-256) or digital signatures, detect any unauthorized changes to data in transit or at rest. If an attacker alters a packet or file, the hash value will not match, alerting the system to the breach.

Symmetric encryption uses a single shared key for both operations.

A virus requires user action (e.g., opening an infected file) to execute and spread. A Trojan also relies on user deception to install. Worms spread without user interaction.

The threat is the potential compromise of confidentiality due to physical theft of a device containing sensitive data.

ARP spoofing can be used to perform man-in-the-middle attacks by associating the attacker's MAC address with the IP address of a legitimate host.

The failed attempts indicate an active attempt to exploit a vulnerability (threat), and the unusual location suggests unauthorized access (exploitation).

HIPAA (Health Insurance Portability and Accountability Act) is a U.S. federal law that mandates specific safeguards for protecting individually identifiable health information (PHI). It directly addresses the privacy and security of personal health data, making it a framework specifically designed for protecting personal data in the healthcare context.

A PKI includes a Certificate Authority (CA) that issues certificates, certificates themselves that bind public keys to identities, and a registration authority (RA) that verifies identities. The private key is held by the user, not part of the PKI infrastructure. The CRL is a mechanism but not a core component.

Phishing typically uses deceptive emails and fake websites to trick users into revealing sensitive information.

Spear phishing targets a specific individual with personalized content, often impersonating a trusted source.

A vulnerability is a weakness in a system that can be exploited by a threat.

A ransomware attack encrypts files and demands payment, directly preventing users from accessing their data and systems. This loss of access is a direct impact on Availability, which ensures that information and resources are accessible when needed. The CIA triad's Availability element is most immediately compromised because the organization cannot retrieve or use its encrypted files.

The NIST Cybersecurity Framework is built around these five core functions.

Option C is correct because the security engineer is gathering information from publicly available sources (LinkedIn, Google) without directly interacting with the target's systems. This is the definition of passive reconnaissance, which involves collecting data from open-source intelligence (OSINT) without sending any packets to the target network.

DNS poisoning, also known as DNS cache poisoning, occurs when an attacker inserts forged DNS resource records into a resolver's cache. This causes the resolver to return a malicious IP address for a legitimate domain, redirecting users to an attacker-controlled site without their knowledge.

The primary purpose of a digital certificate in a Public Key Infrastructure (PKI) is to bind a specific public key to a verified identity (such as a person, device, or organization). This binding is achieved through the certificate authority (CA) signing the certificate, which cryptographically asserts that the public key belongs to the named subject. Without this binding, there would be no trusted way to associate a public key with its owner, making secure communications and authentication impossible.

Integrity protects data from unauthorized alteration. Confidentiality prevents disclosure, availability ensures access.

The SQL injection flaw is a vulnerability (weakness). The potential for an attacker to exploit it is a threat. Risk is the likelihood and impact combined.

Active reconnaissance involves direct interaction with the target, such as port scanning and ping sweeps.

PCI DSS (Payment Card Industry Data Security Standard) is designed to secure credit card transactions and protect cardholder data.

Risk mitigation involves implementing controls to reduce risk: patching, access controls, and encryption.

The Registration Authority (RA) is a key component of a PKI because it acts as the intermediary between the user and the Certificate Authority (CA). The RA is responsible for verifying the identity of an entity requesting a digital certificate before the CA issues the certificate, thereby offloading identity proofing tasks from the CA.

A vulnerability is a weakness in a system, such as a missing security patch, misconfiguration, or design flaw, that a threat actor could exploit to compromise confidentiality, integrity, or availability. In the context of the 200-201 exam, this aligns with the core security concept that vulnerabilities are the specific gaps that make an asset susceptible to attack.

Hashing produces a fixed-size hash that changes if the file is modified, allowing integrity verification.

Ransomware is the correct answer because it is specifically designed to encrypt files on a victim's system using a symmetric or asymmetric encryption algorithm (e.g., AES-256, RSA-2048) and then demand a ransom payment, typically in cryptocurrency, in exchange for the decryption key. This type of malware directly targets data availability, a core component of the CIA triad, by rendering files inaccessible until the ransom is paid.

Ransomware encrypts files and demands a ransom for decryption.

Option D is correct because in cybersecurity, a threat (e.g., an attacker) exploits a vulnerability (e.g., an unpatched software flaw) to cause harm, and the likelihood and impact of that exploitation constitute risk. This aligns with the NIST SP 800-30 definition: risk is a function of the likelihood of a threat exploiting a vulnerability and the resulting impact. Without the exploitation of a vulnerability by a threat, there is no risk to the asset.

A digital signature provides both integrity (ensuring the message has not been tampered with) and non-repudiation (preventing the sender from denying they sent it). It works by hashing the message and encrypting that hash with the sender's private key; the recipient verifies the signature using the sender's public key. This cryptographic method uniquely binds the sender to the message, unlike other options that only address one of these requirements.

Passive reconnaissance involves gathering information without directly interacting with the target. WHOIS lookups and searching job postings are passive. Port scanning and social engineering are active.

The correct answer is D (DDoS) because the scenario describes a distributed denial-of-service attack: traffic originates from multiple compromised systems (a botnet) to overwhelm the web server. A DDoS attack is a subtype of DoS that specifically uses multiple sources, making it harder to mitigate than a single-source DoS. The key clue is 'multiple compromised systems,' which directly maps to the distributed nature of a DDoS.

Worms are self-replicating and spread across networks without human intervention. They do not require a host file and often exploit vulnerabilities.

Digital signatures use asymmetric cryptography: the sender's private key signs, the public key verifies.

PCI DSS applies to payment card data; GDPR applies to personal data of EU residents, which may include payment information.

Symmetric encryption uses a single shared key for both encryption and decryption of data. This is the defining characteristic of symmetric algorithms like AES, DES, and 3DES, where the same secret key must be known to both sender and receiver to protect confidentiality.

Implementing account lockout after a few failed attempts prevents further brute force attempts on the same account. Rate limiting restricts the number of requests from a single IP, slowing down the attack.

A worm is a self-replicating malware that spreads automatically across networks, unlike viruses that require a host file.

Active reconnaissance involves direct interaction with the target, such as port scanning, to gather information.

The Protect function supports the ability to limit or contain the impact of a potential cybersecurity event.

Man-in-the-Middle (MitM) attack involves an attacker intercepting and potentially altering communication between two parties without their knowledge.

Confidentiality ensures that data is not disclosed to unauthorized entities. Intercepting and reading traffic violates this principle.

Digital signatures use asymmetric cryptography to provide authentication and non-repudiation, as only the signer's private key can create the signature.

A man-in-the-middle (MITM) attack occurs when an attacker intercepts and alters communications between two parties without their knowledge. The attacker positions themselves between the sender and receiver, capturing, modifying, and then forwarding the data, which directly matches the scenario described.

Hashing creates a fixed-size digest; any change in data changes the hash, verifying integrity.

A DDoS uses multiple sources to flood a target, making it unavailable.

Phishing is a social engineering attack that uses deceptive emails to trick recipients into revealing sensitive information.

A is correct because a trojan is a type of malware that disguises itself as legitimate software to trick users into installing it, and once executed, it often provides unauthorized remote access to the system, commonly through a backdoor. This matches the description of allowing remote control, which is a core characteristic of Remote Access Trojans (RATs).

This scenario describes an attacker intercepting and modifying communications between two devices without their knowledge, which is the defining characteristic of a Man-in-the-Middle (MitM) attack. In a MitM attack, the attacker positions themselves between the two communicating parties, allowing them to eavesdrop, capture, and alter data in transit while both endpoints believe they are communicating directly with each other.

PCI DSS is the Payment Card Industry Data Security Standard, mandatory for entities handling credit card information.

HIPAA governs protected health information (PHI) in the US.

Confidentiality is compromised when data is accessed by unauthorized parties. The attacker captured traffic (unauthorized access to data), which leads to impersonation, but the core violation here is confidentiality because the data was disclosed.

A worm is self-replicating and spreads automatically, unlike a virus which requires a host file.

Active reconnaissance involves direct interaction with the target. Port scanning, ping sweeps, and vulnerability scanning are active methods. Passive reconnaissance includes social engineering, Google searches, and WHOIS lookups.

ARP spoofing is correct because it involves an attacker sending forged ARP messages over a local network to associate their MAC address with the IP address of a legitimate user. This allows the attacker to intercept, modify, or redirect traffic intended for that user, effectively impersonating them at Layer 2.

The risk value is calculated by multiplying the likelihood (0.5) by the impact ($200,000), resulting in $100,000. This is the standard quantitative risk analysis formula used in security assessments to prioritize threats.

Risk is the probability and potential damage from a threat exploiting a vulnerability.

Exploitation uses the vulnerability, lateral movement is installation or command and control, and exfiltration is actions on objectives.

DNS poisoning corrupts DNS resolver caches to redirect traffic to malicious sites.

Hashing ensures integrity (detects changes), and digital signatures (asymmetric) provide authentication and non-repudiation.

Reconnaissance involves gathering information about targets. Shodan is a passive reconnaissance tool that indexes device information without direct interaction.

B is correct because the attack uses email as the delivery vector to trick the recipient into clicking a malicious link and divulging credentials. This matches the definition of phishing, which is a broad social engineering technique that employs deceptive electronic communications (typically email) to steal sensitive information. The email impersonates the IT department to create a false sense of urgency, a hallmark of phishing campaigns.

Confidentiality is the CIA triad element that ensures data is accessible only to authorized users. It is primarily enforced through encryption (e.g., AES-256 for data at rest, TLS 1.3 for data in transit) and access control mechanisms (e.g., RBAC, ACLs). Preventing unauthorized access directly aligns with confidentiality's goal of protecting data from disclosure.

The Respond phase includes activities to contain, mitigate, and respond to incidents.

PCI DSS, HIPAA, and GDPR are well-known compliance frameworks. NIST CSF is a framework but not a compliance standard; ISO 27001 is a standard but the question asks for compliance frameworks.

Hashing produces a fixed-size output regardless of input size, and it is a one-way function, meaning the original data cannot be derived from the hash. These properties allow comparison of hashes to detect changes.

Integrity ensures that data has not been altered. A mismatched hash indicates the file has been modified.