CCNA Security Questions

If the root CA certificate is missing from the Trusted Root Certification Authorities store, the browser cannot build a chain of trust to the site's certificate, producing an untrusted warning. Since the clock and network are fine, removal of the root certificate is the most likely cause. Reinstalling the root CA or using a trusted root update resolves the issue.

Secure erase or overwriting writes patterns across the entire drive, making the original data unrecoverable while leaving the drive functional for donation. This satisfies both the security and reuse requirements. It is the appropriate sanitization method when the hardware will remain in service elsewhere.

An on-path attack often involves a self-signed or rogue CA certificate to intercept TLS traffic. Inspecting the certificate chain will reveal if the certificate is not issued by a trusted CA, confirming interception. This is the most direct evidence of an on-path attack, as the attacker must present a certificate to decrypt traffic, and it will not be trusted by the user's device.

WPA3-Personal with Simultaneous Authentication of Equals replaces the WPA2 pre-shared key handshake with a password-authenticated key exchange, protecting the wireless traffic and preventing offline dictionary attacks. It keeps a single shared passphrase for employees while encrypting each session, directly addressing the open, unencrypted break-room network described.

Overwriting every sector of a magnetic hard disk with random data destroys the original bit patterns, and multiple passes add assurance. This sanitizes the drive while leaving it functional for internal reuse, which matches the requirement to remove customer records and keep the laptops in service. It is the appropriate method for spinning magnetic media.

When MFA is enforced, an attacker who cannot replay the password may steal an authenticated session cookie and present it from another location, bypassing the need to re-authenticate. Two successful logins from distant countries within minutes, with a valid complex password and no travel, match session hijacking rather than password compromise or normal behavior.

BitLocker provides full volume encryption for Windows 11, protecting data at rest so a removed drive cannot be read on another system. Enabling it on the OS drive with a TPM satisfies the requirement to render cardholder data unreadable if the disk is physically stolen. It is the built-in Windows feature that directly addresses this scenario.

Biometric authentication uses a fingerprint, face, or other physical trait as a factor. When used as part of MFA or as a strong authenticator on mobile devices, it makes stolen passwords insufficient for access. It directly reduces the risk of credential theft because the attacker cannot easily replicate the biometric factor.

A failing CMOS battery commonly causes the system clock to reset and can also affect power management, sometimes leading to battery charging issues. Since the laptop is plugged into a good outlet, the CMOS battery is a logical first check. Replacing it often resolves both symptoms. This is the correct answer because the clock reset is a classic indicator of a dead CMOS battery.

Random-looking domains queried at regular short intervals, combined with small outbound transfers, match DNS tunneling used by malware to reach a command-and-control server. Because DNS is normally allowed through firewalls, attackers encode data in queries and responses. The absence of a logged-in user and the automated cadence point to a compromised host rather than legitimate activity.

DNS poisoning corrupts the DNS resolver's cache so that legitimate domain names resolve to attacker-controlled IP addresses. Since DHCP and Group Policy are unchanged, the redirection of banking domains to an unknown server strongly indicates that the DNS cache has been poisoned. This allows the attacker to redirect users to malicious sites without altering client configuration.