CCNA Logical Security Concepts Questions

Authentication factors are categorized as something you know (password), something you have (token or phone), and something you are (biometrics). A one-time code sent to a mobile phone is considered 'something you have' because access to the phone is required. This question tests the classification of multi-factor authentication components.

Network segmentation, often achieved through VLANs, separates network traffic into distinct broadcast domains. A guest VLAN can be configured with access only to the internet, while internal resources remain on a separate VLAN with restricted access. This question tests the understanding of network segmentation as a logical security control.

User Account Control (UAC) prompts for permission before allowing changes that affect system settings. If the user had denied the UAC prompt, the application would not have been able to modify network settings.

Ransomware encrypts files and demands payment for decryption. This scenario describes classic ransomware behavior, where the user is locked out of their data and a ransom note is displayed.

Logical security controls restrict access to digital resources. For physical access to a server room, a smart card or key fob system provides a good balance of cost and security by requiring something the user possesses. This question tests the understanding of logical versus physical controls and the principle of least cost for basic access control.

USB auto-run devices can bypass authentication and pose a security risk. Disabling auto-run prevents unauthorized access and malware from executing automatically, which is a key security practice.

WPA2 or WPA3 with AES encryption provides strong wireless security. MAC address filtering can be added as an extra layer to restrict which devices can associate. This combination meets both requirements of encryption and device restriction.

Full disk encryption (FDE) encrypts the entire drive, making data unreadable without the decryption key. This protects data in case of theft, as the drive cannot be accessed without proper authentication.

Multifactor authentication requires two or more factors from different categories: something you know (password), something you have (smart card, token), and something you are (biometric). A password plus a one-time code from a hardware token uses two distinct factors, satisfying the policy.

Full disk encryption (FDE) protects all data on the drive by encrypting it, making it unreadable without the decryption key. BitLocker is the native FDE solution in Windows 10 Pro. This question tests the understanding that FDE is the appropriate countermeasure for data theft from stolen devices, as opposed to file-level encryption or access controls.

A VPN creates an encrypted tunnel between a remote user and the internal network, ensuring secure access. This is the standard method for remote employees to connect safely.

EFS (Encrypting File System) ties file encryption to the user's password. When the password is changed without the proper certificate backup, the encryption key may become inaccessible. This question tests the understanding that EFS keys are protected by the user's password and require a backup certificate or recovery agent to avoid data loss after password changes.

Password confidentiality is a core security principle; passwords must be kept secret and not be easily observable. Writing passwords on sticky notes directly violates this by making them visible to anyone nearby. This question tests the understanding of password security best practices and the concept of confidentiality.

NTFS permissions control access at the folder level on the server. Even if share permissions allow access, restrictive NTFS permissions can block a specific user. The technician should check the effective permissions on that folder for the user.

Phishing is a social engineering attack where attackers impersonate a trusted entity to trick victims into revealing sensitive information. The suspicious link is a key indicator. This question tests the ability to recognize phishing attempts based on common characteristics like urgent language and deceptive links.

Application whitelisting allows only pre-approved programs to execute, blocking all others by default. This is the most effective way to prevent unauthorized software installation. Software Restriction Policies or AppLocker in Windows can enforce this.

Account expiration policies can be set to automatically disable accounts after a specified period of inactivity. This enforces the security policy without manual intervention.

The principle of least privilege requires that users have only the access necessary for their job. An inactive account with remote access violates this and also the principle of account lifecycle management. The immediate issue is that the account should have been disabled upon termination.

MAC address filtering restricts network access to devices with approved MAC addresses, providing a basic layer of security. This is a simple way to allow only specific laptops to connect to the file server.

This is a classic whaling attack, a form of phishing that targets high-level executives or impersonates them to trick employees into performing actions like wire transfers. The spoofed email address and urgent request are typical indicators. Whaling is a specific type of social engineering focused on senior staff.

Adware is a type of malware that displays unwanted advertisements and often installs toolbars or other software without user consent. It can significantly degrade system performance. This question tests the ability to identify adware based on symptoms like pop-ups and unauthorized toolbars.

MAC address filtering restricts network access based on the unique hardware identifier of a device's network interface. This is a simple logical security control that can be applied at the network level to allow only known laptops. It is not as strong as certificate-based authentication but directly addresses the requirement.

Full disk encryption (FDE) encrypts the entire drive, making data unreadable without the decryption key. It operates transparently after the user authenticates at boot, meeting the policy requirement. BitLocker is a common implementation for Windows systems.

Phishing attacks use deceptive emails to trick users into revealing sensitive information. The suspicious link and errors indicate a phishing attempt, not a legitimate bank communication.

A zero-day vulnerability is a previously unknown flaw that attackers exploit before a patch is available. Even with recent updates, such vulnerabilities can exist, leading to unauthorized access.

Adding the user to a group with 'Modify' permissions is efficient because it avoids individual permission assignments and follows the principle of group-based access control. This ensures the user can edit files without overcomplicating permissions.

The root cause is that the shared drive access is tied to individual accounts, encouraging sharing. Implementing group-based permissions with proper access control lists (ACLs) allows the company to grant access to a group rather than an individual, eliminating the need to share passwords. Additionally, enforcing a policy of non-repudiation and using audit logs can deter sharing.

This scenario describes classic symptoms of adware or potentially unwanted program (PUP) infection. Adware displays unsolicited advertisements and often installs toolbars; it degrades performance and can be a vector for more serious malware. The correct answer identifies the issue as adware.

BitLocker with a PIN enhances pre-boot authentication by requiring both a TPM (for integrity verification) and a user-entered PIN before the OS loads. This prevents unauthorized access even if the TPM is present. This question tests the understanding of BitLocker's pre-boot authentication options and the role of the TPM.