CCNA Governance, Risk, and Compliance Questions

HIPAA requires audit controls that record and examine activity in information systems containing or using electronic protected health information (ePHI). Application-level logging that captures user identity, timestamp, and the specific records accessed directly satisfies this. Storing logs securely ensures integrity and availability for audits. This is the most precise control for auditing access to PHI.

A SOC 2 Type II report is issued by an independent auditor after testing whether controls were designed appropriately and operated effectively throughout a defined period, which is exactly the assurance enterprise customers seek when evaluating a cloud provider's security and availability posture.

Data creation is the lifecycle phase where new data is generated, captured or acquired, establishing the asset before any classification or protection controls apply. It satisfies the stem's requirement to identify genuine lifecycle phases within a data lifecycle management programme.

PCI DSS scoping begins with identifying all system components that store, process, or transmit CHD or SAD, as well as those that could impact the security of the CDE. This includes connected systems and security-impacting systems. Without this inventory, the scope cannot be accurately defined, and the assessment will be incomplete. This is the foundational step mandated by PCI DSS.

Contractual audit rights, notification obligations, and requirements for independent assurance such as SOC 2 reports give the bank ongoing visibility into vendor control status between assessments. These provisions create enforceable expectations and information flow, so the bank learns of control changes or incidents without waiting for the next scheduled review, which is exactly the continuous oversight the examiner seeks.

SLE equals asset value ($50,000) multiplied by exposure factor (0.80), giving $40,000. ALE is SLE multiplied by ARO (0.5), yielding $20,000. This quantifies expected annual loss for the payment card server, satisfying the quantitative assessment requirement.

Periodic on-site assessments allow the organization to directly verify the vendor's security controls, practices, and compliance with contractual requirements. They provide firsthand evidence and can uncover issues not visible in documentation. This method is effective for ongoing monitoring, especially for critical vendors, and complements other oversight activities.

Risk transfer involves shifting the financial impact of a risk to a third party, such as an insurance company. Purchasing cyber insurance is a classic example of risk transfer. The organization retains the risk but transfers the potential financial loss to the insurer, which aligns with the risk owner's decision in this scenario.

Policy sits at the top of the hierarchy, establishing mandatory high-level intent, followed by standards that specify enforceable requirements. Guidelines then offer non-mandatory recommendations, and procedures come last, detailing the step-by-step actions needed to implement the higher-level directives. This ordering satisfies the stem's highest-to-lowest constraint.

A Privacy Impact Assessment identifies what personal data is processed, why, and where risks arise, giving the documented basis for designing controls before processing begins. Conducting it first satisfies the privacy-by-design requirement to embed protection at the earliest stage of any EU personal-data initiative.

Privacy by design mandates data minimisation: collecting only what the application's function requires limits exposure and compliance risk at source. This is a structural safeguard embedded in design, unlike consent notices or retention policies applied after collection.

Purchasing cyber insurance shifts the financial consequence of a data breach to an insurer rather than eliminating or reducing the risk itself. This is risk transfer, matching the treatment plan's intent to cover potential breach costs through a third party.

The NIST Risk Management Framework prescribes a continuous, iterative cycle — Prepare, Categorise, Select, Implement, Assess, Authorise and Monitor — so risk identification, assessment and response recur throughout the system lifecycle rather than as a one-off exercise.

Virtual patching reduces the likelihood or impact of exploitation by blocking attack vectors, even without a vendor patch. This is a form of risk mitigation because it lowers the risk to an acceptable level through compensating controls. It does not eliminate the vulnerability but manages it effectively.

Continuous control monitoring automatically collects and evaluates configuration and log evidence from the systems enforcing each control, providing near-real-time assurance that controls operate as intended across the entire period. This directly answers the regulator's demand for evidence of sustained effectiveness and is far stronger than periodic screenshots that capture only a single moment.

A SOC 2 Type II report covers an audit period, not a single point in time, so it evidences that controls were designed and actually operated effectively throughout that window. This lets the analyst judge sustained control performance rather than relying on a Type I snapshot.

A SOC 2 Type II report covers the design and operating effectiveness of controls over a defined review period, using the Trust Services Criteria. Because it tests controls across time rather than a single moment, it gives regulators and customers independently validated evidence that controls operated effectively throughout the period, matching the stated objective.

A procedure sits below policy and standard in the hierarchy, translating them into detailed, sequential steps for a specific task. It tells staff exactly how to perform the activity, unlike policy, which states intent and mandatory requirements.

A formal assessment and authorization process, such as an Authority to Operate review, produces exactly the artifacts described: approved security requirements, the assessment scope and methods, testing dates, findings, and documented exceptions with risk acceptance. It establishes accountability by naming the authorizing official, which is why it directly satisfies a regulator asking for traceable governance evidence.

Access review logs directly evidence periodic recertification of user permissions, satisfying HIPAA's access control and audit requirements for ePHI. Unlike configuration screenshots or policy documents, these logs prove ongoing enforcement through documented reviewer decisions and timestamps, demonstrating that least-privilege access is actively maintained rather than merely defined.

HIPAA's patient right to inspect and obtain a copy of their medical records maps directly to the right to access. It lets individuals obtain their own data, distinct from rectification, erasure or portability, satisfying the requirement that records be made available on request.

FAIR derives annualised loss expectancy by multiplying loss event frequency by loss magnitude, so 4 × $25,000 yields $100,000. This satisfies the stem's requirement to quantify ALE from the supplied LEF and LM values, giving the expected yearly loss the organisation faces from that risk scenario.

A SOC 2 Type II report must be current and scoped to the relevant service to provide assurance. An outdated report covering a different service is insufficient. Requesting an updated report or performing an on-site assessment ensures the organization obtains accurate, relevant information about the provider's controls, enabling informed risk decisions and compliance with due diligence requirements.

FAIR is a quantitative risk analysis framework that expresses risk in financial terms by modeling loss event frequency and loss magnitude. It enables the CISO to prioritize investments based on monetary impact, aligning with the goal of expressing risk in monetary terms. Unlike qualitative approaches, FAIR provides defensible, data-driven estimates for enterprise risk management.

Requirement 10 depends on audit logs being captured and retained centrally for correlation and review. The proportion of in-scope systems forwarding logs to the central platform directly measures coverage of that control, exposing any system whose logs remain local and therefore unmonitored.

A right-to-audit clause contractually grants the company the ability to assess the vendor's controls directly, compensating for the missing SOC 2 report. Since the vendor handles sensitive customer data, on-site assessment provides independent verification that a self-completed questionnaire alone cannot.

Merger and acquisition integration begins with due diligence on the acquired environment so leadership understands inherited risk, control gaps, and remediation cost before merging identities or networks. Assessing the identity provider, endpoint management, and network controls first produces the risk picture that drives integration sequencing, budget, and acceptance decisions, preventing the parent from unknowingly absorbing compromised or unmanaged assets.

Guidelines provide discretionary recommendations, whereas procedures are mandatory step-by-step instructions that must be followed. This distinction satisfies the stem's requirement for a key difference: guidelines advise on achieving objectives, while procedures enforce specific actions, making compliance compulsory rather than optional within a security framework.

Data localization laws require data to remain within the jurisdiction's borders. Deploying dedicated in-country infrastructure and enforcing the firm's global security baselines satisfies the legal requirement without compromising security consistency. This approach directly addresses the sovereignty mandate while allowing the organization to maintain its standard controls, monitoring, and hardening practices across all environments.

Multiplying SLE by ARO gives $5,000 × 0.2 = $1,000, the annualised loss expectancy. This satisfies the stem's requirement to quantify expected yearly loss from the server risk, expressing exposure as a single monetary figure rather than a frequency or per-incident cost.

Threat event frequency (TEF) quantifies how often a threat agent is likely to act against an asset within a given period, directly answering the stem's requirement for probable frequency of action on a vulnerability. It sits alongside vulnerability and loss magnitude as a core FAIR factor, distinct from contact frequency or probability of action.

Adding controls to lower residual risk below the risk appetite is risk mitigation: the organisation reduces likelihood or impact rather than avoiding, transferring or accepting the risk. The risk owner's proposal modifies the risk itself, matching mitigation.

A SOC 2 Type II opinion covers control operating effectiveness over a defined period, so the auditor needs evidence gathered continuously, not at a single point. Timestamped logs, ticket histories, change records, and monitoring artifacts spanning the full window demonstrate that controls such as access review, change approval, and incident handling actually ran as described throughout the period.

A SIEM system continuously ingests and correlates log data from cardholder-data environment systems, generating real-time alerts against PCI DSS controls such as access monitoring, file integrity and log review. This satisfies the stem's continuous compliance monitoring requirement, unlike point-in-time assessment tools that only snapshot posture periodically.

Privacy by design means data protection controls are built into system architecture and business processes from the outset, not bolted on afterwards. Embedding them at design time satisfies GDPR's requirement that protection be integral to processing, covering minimisation, purpose limitation and default settings.

A security policy defines mandatory controls and the formal exception process, so it governs deviations from the encryption-at-rest requirement. It specifies who may approve exceptions, the compensating controls and review periods needed, satisfying the stem's constraint that an exception be authorised rather than informally granted by the business unit.

Article 35(7)(a) of GDPR requires the data protection impact assessment to contain a systematic description of the processing operations and the purposes of the processing. This is a mandatory DPIA content element, so describing operations and purposes satisfies that requirement.

FAIR quantifies risk in monetary terms by modelling loss event frequency and loss magnitude, producing annualised loss exposure. This contrasts with qualitative heat maps that rank risks ordinally, and enables cost-benefit and ROI comparisons of proposed security controls.

NIST SP 800-171 assessments permit a score below 110 only when the contractor documents the deficiencies in a System Security Plan and a Plan of Action with defined milestones, resources, and completion dates. This is the accepted path to demonstrate compliance intent and qualify for award while remediation proceeds, so documenting both artifacts is the required action.

NIST SP 800-171 defines the SSP as the document that describes how the organization meets each of the 110 security requirements. It includes descriptions of implemented controls, identifies any requirements not yet met, and outlines remediation plans. The SSP is a key deliverable for compliance and is often required for contracts involving CUI. It provides a clear picture of the security posture.

During Risk Response, NIST SP 800-37 emphasizes selecting, tailoring, and implementing controls. Mapping those controls to architectural components ensures that risk responses are not abstract but are embedded in the system's design. This documentation also facilitates continuous monitoring and change management. It directly supports integration into enterprise architecture by showing where each control resides.

Acceptance is the deliberate decision to retain a risk after evaluating treatment options, usually with formal documentation and senior sign-off. Leadership judged the loss unacceptable but found no cost-effective control, kept the essential activity running, recorded the rationale, obtained board approval, and set a review date. Those actions are the defining characteristics of a formally accepted risk rather than avoidance, transference, or mitigation.

MTTR measures the elapsed time from incident detection to containment, directly quantifying response speed. Other metrics such as MTTD address detection latency, so MTTR is the precise indicator of how quickly the team contains a detected incident.

Assessment failures most often stem from missing or stale evidence rather than absent controls, so maintaining current artifacts that demonstrate each requirement operates within the defined system boundary directly addresses the root cause and lets assessors verify implementation without relying on interviews alone.

SCCs are pre-approved contractual terms adopted by the European Commission that provide appropriate safeguards for international data transfers when the destination country lacks an adequacy decision. Pairing them with a transfer impact assessment satisfies the Schrems II requirement to evaluate local surveillance laws. Because the vendor lacks Data Privacy Framework certification, SCCs are the correct lawful transfer mechanism here.

ISO/IEC 27001 clause 9.3 requires top management to review the ISMS at planned intervals, and documented minutes showing inputs, decisions, and actions are the expected evidence. These records demonstrate that leadership evaluated performance, risks, and opportunities and directed changes. Providing them directly satisfies the auditor's request for management review evidence.

A DPIA is a GDPR requirement when processing is likely to result in a high risk to data subjects' rights, especially for large-scale or systematic processing. It identifies and mitigates privacy risks before implementation, ensuring accountability and compliance by design. This is the foundational step before deploying technical controls.

Customer PII governed by legal requirements warrants restricted classification because unauthorised disclosure triggers regulatory penalties and contractual breach. Restricted is reserved for data whose exposure causes severe legal, financial or reputational harm, unlike internal or public tiers.

Compliance maps to mandated frameworks and regulations, so meeting them satisfies an external minimum threshold. Security pursues defence against evolving threats beyond that floor, adopting controls and practices that exceed regulatory requirements because attackers are not bound by the same baseline.

Data minimization under GDPR requires that personal data be adequate, relevant, and limited to what is necessary for the purposes for which it is processed. Collecting only necessary data directly implements this principle. This approach reduces privacy risks and is a core requirement of GDPR Article 5(1)(c).

SOX focuses on the accuracy and reliability of financial reporting and the effectiveness of internal controls over financial reporting for publicly traded companies. This directly matches the financial institution's compliance obligation, distinguishing it from regulations centred on privacy or payment card data.

Failed login attempts per hour is a leading indicator of credential-stuffing or brute-force activity, rising before a successful compromise. Monitoring this rate provides early warning of authentication attacks, letting the security manager intervene before an account is breached.

A documented business justification records why the policy cannot be met and what compensating value the exception delivers. It satisfies the need for an auditable, defensible reason before approvers authorise deviation from the standard control.

ALE is calculated as single loss expectancy multiplied by annualized rate of occurrence: $2,000,000 × 0.25 = $500,000. This figure represents the expected average annual loss from the ransomware risk and is the value the board should use for budgeting risk treatment decisions. It is the correct quantitative output for this scenario.

The subcontractor stores data but sits outside the provider's direct audit scope, so its controls are unverified. A right-to-audit clause extending to subcontractors gives the security team contractual authority to assess that storage environment, closing the assurance gap the procurement team identified.

Continuous monitoring ensures that the vendor maintains the agreed-upon security controls and promptly identifies changes that could introduce new risks. It can include periodic reassessments, security ratings, and monitoring for breaches. This is a best practice because risk is not static; a vendor's posture can change due to incidents, mergers, or control failures. Ongoing monitoring supports timely risk mitigation.

Extending the right-to-audit clause to subcontractors gives the organisation contractual visibility and audit reach into fourth parties, satisfying the stem's requirement to manage risk beyond direct suppliers. Without this flow-down, subcontractor controls remain unverified, so fourth-party exposure cannot be assessed or enforced.

A cloud provider's history of security incidents and their willingness to disclose them is a direct indicator of their security posture. If the provider has a pattern of breaches or lacks transparency, the likelihood of a future breach increases. This factor is critical in assessing the probability of a data breach, as it reflects the provider's operational security maturity and incident response effectiveness.

The EU-US Data Privacy Framework requires the receiving organization to self-certify to the US Department of Commerce and appear on the official Data Privacy Framework List. Only then can EU personal data flow to that importer without SCCs or a derogation. Confirming active certification status is the mandatory prerequisite step before the transfer can lawfully occur.

Written security policies are documented, approved management directives that auditors accept as evidence of intended control design and governance. This satisfies the stem's acceptable-evidence criterion because they demonstrate the organisation's stated requirements, though they show intent rather than proving the controls actually operate.

A formal communication plan ensures timely, accurate, and approved messaging to external stakeholders such as customers, regulators, and media. Predefined templates and contact lists speed up response, while approval workflows prevent unauthorized disclosures. This directly fills the gap in the incident response plan and aligns with best practices for breach notification and reputational management.

A communication plan defines who communicates what, when, and to whom during an incident. Its primary purpose is to manage information flow to internal and external stakeholders, maintain trust, and meet legal obligations. This reduces confusion and helps control the narrative, which is critical for incident response.

A SOC 2 Type II report tests control design and operating effectiveness across a defined audit period, giving an independent, time-spanning view. Penetration tests and questionnaires are point-in-time or self-reported, so only the Type II report meets the stem's requirement for comprehensive evidence over time.

Standard Contractual Clauses are pre-approved contractual terms that create enforceable obligations on the data importer, and after the Schrems II ruling they must be paired with a transfer impact assessment of the destination country's laws plus supplementary technical or organizational measures when needed. This combination directly satisfies the requirement for enforceable importer obligations and a documented assessment.

PCI DSS requires strong cryptography and security protocols to safeguard cardholder data during transmission over open, public networks. TLS 1.2 or higher with strong cipher suites and proper certificate validation satisfies that requirement. This directly addresses the scenario's transmission concern and is a standard, auditable control for protecting data in transit between the customer browser, application, and payment processor.

Automated compliance auditing tools continuously evaluate configurations against benchmarks and frameworks, generating evidence and alerts without manual review cycles. This satisfies the requirement for continuous monitoring rather than periodic point-in-time assessment, enabling prompt detection of drift or non-compliance across the estate.

The right to object lets individuals halt processing based on legitimate interests or direct marketing, and controllers must honour it unless they demonstrate compelling grounds. Auditors expect documented workflows and records proving this GDPR right can be exercised and enforced.

Under the HIPAA Security Rule, unique user identification is a required implementation specification for access control (45 CFR §164.312(a)(2)(i)). It mandates that each user accessing ePHI be assigned a unique identifier to track activity and enforce accountability. This is not optional; it must be implemented to comply with the rule, making it the correct choice for this scenario.