CCNA Security Questions

A smart card (something possessed) plus a PIN (something known) combines two different authentication factor categories, which is the definition of multi-factor authentication. Requiring both for building access therefore satisfies the MFA concept the stem describes.

A worm is self-replicating malware that spreads across networks independently, exploiting vulnerabilities or weak credentials to propagate. Unlike viruses, it requires no host file or user action to replicate, which is precisely the defining constraint stated in the stem.

Following an authorised employee through a badge-controlled door without presenting credentials is tailgating, a physical social engineering technique. The stem's unauthorised entry behind a legitimate badge holder matches this definition precisely, distinguishing it from shoulder surfing or dumpster diving.

Full disk encryption protects the entire drive, including the operating system, applications and all stored files, so data remains unreadable if a laptop is stolen. It satisfies the requirement to safeguard customer data on lost devices.

Tailgating occurs when an unauthorised person follows an authorised individual through a secured entry point without presenting credentials. The delivery person gained access solely because the employee held the door, satisfying the stem's scenario of bypassing badge control.

Patching closes the software vulnerabilities that ransomware exploits to gain initial access and propagate. Applying the latest updates directly removes the exposure the stem's attack relies on, making it an effective preventive measure alongside user education and endpoint protection.

Weak encryption for data in transit is a technical weakness in how information is protected, making it exploitable by interception or decryption attacks. It therefore qualifies as a vulnerability under the risk formula, since it is an internal flaw that raises the likelihood of a threat succeeding.

Phishing is a fraudulent email impersonating a trusted entity, such as a bank, that lures the recipient into clicking a link and disclosing credentials. The suspicious sender address and spelling errors are classic phishing indicators, matching the stem's scenario precisely.

Adware specifically injects or displays unwanted advertisements, matching the frequent pop-ups described. Unlike spyware, which covertly gathers data, or a trojan, which masquerades as legitimate software, adware's primary payload is advertising delivery. This directly satisfies the stem's constraint of persistent unwanted pop-up advertisements on the user's computer.

Length defeats brute-force and dictionary attacks far more effectively than complexity alone, while mixing symbols and numbers widens the search space. A passphrase remains memorable yet resists guessing, satisfying the best-practice requirement without relying on predictable substitutions or reused credentials.

Integrity guarantees data remains unaltered unless changed by an authorised process. Because the file was modified without authorisation, its trustworthiness is broken, directly satisfying the scenario's unauthorised-modification constraint. Confidentiality concerns disclosure and availability concerns access, neither of which the stem describes.

Public Wi-Fi carries traffic unencrypted across a shared medium, letting anyone on the same network capture packets with readily available tools. A VPN defeats this by tunnelling traffic through an encrypted channel, so interception yields only ciphertext. This directly addresses the stem's constraint: exposure of transmitted data to nearby attackers.

A password manager generates high-entropy, unique credentials per site and stores them in an encrypted vault unlocked by one master passphrase. This directly counters credential reuse and weak passwords, the primary purpose the question asks for.

Integrity guarantees data remains accurate and unaltered unless changed by an authorised party, directly matching the requirement that unauthorised users cannot modify it. Confidentiality restricts who can read data, and availability ensures timely access, so neither addresses modification.

A certificate validation failure often means the browser cannot confirm it is talking to the real store, which is exactly the condition an on-path attacker creates by inserting themselves between the user and the site. Continuing past the warning can send card details through the attacker's system. Trusting an unvalidated certificate defeats the protection TLS is meant to provide.

A VPN encrypts all traffic between the user's device and the VPN server, creating a protected tunnel that prevents attackers on the public Wi-Fi network from intercepting credentials, messages, or browsing data. This directly satisfies the coffee-shop scenario's constraint: untrusted network traffic requiring confidentiality against local eavesdropping.

Default administrator credentials are publicly known and are a common entry point for attackers to reconfigure the router. Changing the default password to a strong, unique one prevents unauthorized users from accessing the router's management interface and altering security settings. This is a fundamental step in securing any network device and directly reduces the risk of unauthorized access, making it a correct choice.

Hashing is a one-way transformation, so the stored digest cannot be reversed to recover the original password. At login the system hashes the supplied password and compares digests, verifying authenticity without retaining plaintext. This satisfies the stem's requirement of verification without plaintext storage.

A VPN creates an encrypted tunnel between the laptop and the corporate network, protecting payroll data in transit. Certificate-based authentication requires the device to present a valid digital certificate, satisfying the requirement that the device prove its identity before access. Together, encryption and mutual authentication meet both stated conditions, unlike simpler remote-access methods.

Password spraying tries a small number of common passwords against a large set of usernames, hoping to find one account with a weak password while avoiding lockout thresholds tied to a single account. The log's signature, many usernames tried in a short time from one source with no successes yet, matches this technique exactly. It is a low-and-slow credential attack aimed at breadth rather than depth.

Default administrator credentials are publicly documented and are a common way attackers gain control of an access point, then alter its configuration or add rogue access. Changing them to a unique, strong passphrase protects the management interface. WPA3-Personal secures the wireless link, but it does not protect the device's administrative login, so this step directly reduces the risk of unauthorized access to the network.

The 3-2-1 rule specifies exactly three copies of data, stored on two distinct media types, with one copy held offsite. That maps precisely onto the company's stated requirements, whereas other schemes such as 3-2-1-1-0 add offline or verified-restore conditions the stem never mentions.

Security guards monitoring entrances are a physical control: they restrict and observe direct human access to the facility, deterring intrusion and tailgating. This satisfies the requirement by protecting the tangible premises rather than logical systems, data or user behaviour.

Recording symptoms, timestamps, and the state of the machine preserves evidence and supports later analysis of how the infection occurred and what it affected. This documentation is valuable whether the machine is later reimaged or cleaned, and it helps identify other potentially compromised systems. Capturing this information early, before remediation changes the system, is a core incident-handling practice.

A firewall inspects packets against configured rule sets, permitting or denying traffic by source, destination, port and protocol. This directly fulfils the stem's requirement of blocking unauthorised network traffic, since each rule defines precisely which connections may pass the boundary between trusted and untrusted networks.

Combining a smart card (something you have) with a PIN (something you know) satisfies multi-factor authentication by drawing on two distinct credential categories. This pairing meets the stem's requirement for genuine MFA, unlike methods relying on a single factor repeated or two instances of the same category.

MyD0g!sF1d0 combines upper and lower case letters, digits and a symbol across twelve characters, giving far greater brute-force resistance than shorter or single-character-class alternatives. Length plus mixed character classes directly increases the search space an attacker must exhaust.

Multi-factor authentication combines two distinct credential categories: something the employee knows (the password) and something they possess (the one-time code delivered to their phone). This directly satisfies the stem's requirement for both a password and a phone-based code at login, since possession of the registered device supplies the second, independent authentication factor.

Modify allows a user to read, write, edit, and delete files and subfolders, which covers reading and updating customer records. It does not include the change-permissions or take-ownership rights that Full control provides, so the employee cannot alter the folder's access control list. This matches the stated requirement precisely and follows the principle of least privilege for a data-entry role.

A screen lock with a strong PIN or biometrics is the first line of defense against unauthorized physical access. It prevents a thief from unlocking the phone and viewing data or using apps. Most modern phones also encrypt storage by default when a screen lock is set, adding another layer of protection.

Phishing exploits social engineering by masquerading as a trusted entity—here, the user’s bank—to trick the recipient into clicking a fraudulent link. The urgent language and threat of account closure create a false sense of crisis, bypassing rational scrutiny. This satisfies the constraint of unauthorised credential harvesting via deceptive communication, distinguishing it from technical exploits like malware injection.

Phishing is the correct classification because the email impersonates the bank and uses urgency plus a generic greeting to trick the recipient into clicking a link and surrendering credentials. This social-engineering mechanism, delivering a fraudulent lure by email, directly matches the scenario's described threat rather than malware or physical intrusion.

Confidentiality directly satisfies the stem's constraint that data must not be accessed by unauthorised individuals. It achieves this through encryption, access controls and authentication mechanisms, which restrict disclosure to approved parties only. Unlike integrity, which guards against improper modification, confidentiality specifically addresses unauthorised read access.

Worms replicate autonomously across networks by exploiting vulnerabilities, requiring no host file or user action — unlike viruses, which must attach to executable files or documents. This self-propagation mechanism directly satisfies the stem's requirement for a defining worm characteristic, distinguishing it from other malware types such as trojans or ransomware.

A security camera is a physical control that deters intruders and records activity for later investigation. It supports monitoring of who enters the closet and can capture evidence if equipment is tampered with. While it does not block entry by itself, it is a recognized physical security measure that helps protect the equipment in this scenario.

WPA3-Personal uses a shared passphrase, and devices must supply it during association before network access is granted. This directly blocks unauthorized users who do not know the passphrase. It is the standard way to secure a home or small-office wireless network, and it satisfies the goal of preventing unknown devices from joining while still letting visitors connect if the passphrase is shared with them.

Least privilege directly enforces the stem's minimum-permissions constraint: each user receives only the access their job function requires, nothing more. This limits blast radius from compromised accounts or insider misuse, since excess entitlements are never granted in the first place.

A long passphrase of four random words is easy to remember and highly resistant to brute-force and dictionary attacks because of its length and unpredictability. Current guidance from NIST and security experts favors length over complexity, and this passphrase exceeds the 12-character minimum while avoiding common substitutions.

Unique credentials per account limit the damage of a breach: if one service is compromised, attackers cannot replay the same password against the employee's other work systems. This directly reduces credential-stuffing risk and is a foundational authentication practice, making it a correct choice for the policy the new employee must follow.

Shadow IT refers to technology hardware or software used inside an organization without the IT department's knowledge or approval. The personal phone joining the corporate network for non-work purposes, unmanaged and unpatched, is a classic example because IT never sanctioned or configured the device, creating unmonitored risk on the network.

Remote wipe lets the user erase the device over the internet once it is reported lost, removing work data before it can be extracted. Locate services help recover the device or confirm it is gone so a wipe can be triggered. Together they provide a response capability that complements the preventive screen lock, directly addressing the lost-device scenario.

Ransomware encrypts the victim's files using symmetric keys, rendering documents, databases and images inaccessible until decryption occurs. This cryptographic locking is the defining characteristic that distinguishes ransomware from other malware, and it directly satisfies the stem's requirement for a ransomware trait.

Antivirus software detects, blocks and removes known malware through signature and behavioural scanning, with regular updates catching new threats. Installing and maintaining it provides continuous host-level protection, satisfying the malware prevention requirement in the stem.

Pretexting involves inventing a fabricated scenario or false identity to manipulate a victim into complying. Claiming to be a manager from another department establishes that invented pretext, exploiting the employee's deference to authority to obtain an unauthorised password reset.

Enabling two-factor authentication adds a second verification factor beyond the password, so a stolen or guessed credential alone cannot grant access. This directly satisfies the stem's password-security best-practise requirement by mitigating credential compromise, and Microsoft Entra ID supports it natively through Conditional Access and authentication methods policies.

Confidentiality ensures data is disclosed only to authorised users, enforced through encryption, access controls and authentication. This directly matches the stem's requirement that information remains inaccessible to unauthorised parties, distinguishing it from Integrity, which concerns accuracy, and Availability, which concerns timely access.

Least privilege restricts each account to only the permissions its job function demands, nothing more. This directly satisfies the stem's requirement by minimising the attack surface and limiting blast radius if credentials are compromised, since no user holds rights beyond their operational needs.

A Trojan masquerades as legitimate software, so users install it willingly, satisfying the disguise requirement. Unlike viruses or worms, it does not self-replicate; its payload executes through user action, such as running the installer. This matches the stem's constraint of apparent legitimacy concealing malicious behaviour.

A VPN builds an encrypted tunnel between the laptop and the company network, so credentials and files stay unreadable across the untrusted coffee-shop Wi-Fi. This satisfies the secure-access constraint, whereas plain HTTPS or public hotspots leave traffic exposed to interception.

Least privilege means users should have only the minimum access necessary to perform their job. The marketing employee was able to read HR files, which is beyond their required access. This violation of least privilege can lead to data exposure and is a common finding in access control audits.

A threat is any potential cause of harm, such as an attacker or malware, whereas a vulnerability is an existing weakness — an unpatched flaw or misconfiguration — that a threat could exploit. This distinction satisfies the stem's requirement to separate the external danger from the internal condition it acts upon.

A long passphrase of several unrelated words plus a number reaches high length, which is the dominant factor in resisting brute-force attacks. The words are not a common phrase, so dictionary attacks that try famous passphrases fail. Length combined with unpredictability makes this the strongest option against both brute-force and dictionary cracking.

WPA3 encrypts wireless frames between client devices and the access point using SAE, so anyone capturing the radio signals cannot read the customer traffic. It also replaces the weak WPA2 handshake, resisting offline dictionary attacks. Enabling WPA3 with a shared passphrase directly satisfies the goal of stopping outsiders from reading over-the-air data in the coffee shop.

A guest network broadcasts a separate SSID and places visitors on a segmented subnet that is firewalled off from internal resources such as file shares and printers. This directly satisfies the owner's goal because visitors get internet access only, while company data and devices remain unreachable from the guest segment.

Browsers rely on certificates issued by trusted certificate authorities to confirm a site's identity and to establish an encrypted TLS session. When the certificate is expired, self-signed, issued for a different hostname, or chained to an untrusted root, the browser cannot validate it and warns the user. This explanation accurately describes what the warning conveys and why the user should be cautious about entering sensitive data.

Multi-factor authentication demands a second, independent factor beyond the password, so a stolen or guessed credential alone cannot grant access. This directly satisfies the password-security best-practice requirement by neutralising credential theft, replay and brute-force success.

Patches close known vulnerabilities that malware exploits to gain a foothold, so timely updates directly reduce infection risk. Operating system and application updates are a foundational preventive control recommended in every security baseline. For a remote worker without corporate network protections nearby, keeping the endpoint patched is especially important because the device is the last line of defense against exploits delivered through email, downloads, or malicious websites.

Physically destroying the drives, such as by shredding, drilling, or incinerating, makes the data unrecoverable because the storage media is destroyed. This is the most secure method for disposing of drives containing sensitive data, as it eliminates any possibility of data recovery. It directly fulfills the technician's goal of preventing anyone who obtains the drives from accessing the data.

Least privilege grants each user only the access required for their duties. Restricting applications to those needed for a specific role directly enforces that minimum-access principle, satisfying the stem's requirement for actions that align with least privilege.

Keeping the original on a server, one copy on a same-building NAS, and another in the cloud satisfies 3-2-1: three total copies, two distinct storage media or systems, and one held off-site. The cloud copy provides the geographic separation that the NAS alone cannot, protecting against localised loss.

Verifying through an independent, trusted channel such as the official website ensures the user is not interacting with the attacker. This confirms whether the message is legitimate without risking exposure to malicious links or providing information to a fraudster. It is a recommended practice for suspected phishing attempts.

Locking the screen prevents unauthorised individuals from viewing or accessing displayed data, directly supporting confidentiality by restricting information to authorised eyes only. It satisfies the stem's requirement to protect sensitive information from exposure when a workstation is left unattended, aligning with the confidentiality pillar of the CIA triad.

The 3-2-1 rule demands three total copies, two distinct storage media, and one offsite. This option matches all three constraints exactly, ensuring resilience against local hardware failure, media-specific corruption, and site-wide disasters such as fire or flood.

The 3-2-1 rule specifies three copies of data, stored on two different media types, with one copy held offsite. This matches the stem's requirement exactly, providing redundancy against media failure and site-level disasters such as fire or theft.

A vulnerability is an exploitable weakness in a system, whereas a threat is any potential danger or actor that could exploit it. This axis of difference satisfies the stem directly: the weakness versus the danger, not the likelihood or impact of either.

A worm self-replicates across networks without attaching to a host file, satisfying the stem's defining constraint. Unlike viruses, which require a host executable to spread, worms propagate independently via exploits or network shares, consuming bandwidth and executing payloads autonomously. This distinction makes worm the precise match for the scenario described.

A threat is any potential occurrence or actor that could cause harm, whereas a vulnerability is an internal weakness — such as a flaw or misconfiguration — that a threat can exploit. This distinction separates external causes from exploitable conditions, matching the stem's request to differentiate the two terms accurately.

Full disk encryption protects data at rest by encrypting the entire drive, so a thief cannot read sensitive documents without the decryption key. This directly satisfies the constraint that files remain unreadable if the laptop is physically stolen, unlike file-level or password-only protections.

Locking the screen when leaving a desk prevents unauthorised individuals from accessing data or systems on an unattended workstation. This directly addresses physical security by removing the opportunity for shoulder-surfing or walk-up misuse of an open session.

A smart card is a physical token, satisfying something you have, while the PIN is memorised knowledge, satisfying something you know. Combining these two distinct factor categories constitutes multi-factor authentication, exactly as the stem's swipe-then-PIN control requires.

A smart card (something you have) combined with a PIN (something you know) draws on two distinct authentication factors, satisfying multi-factor authentication. Possession of the card alone or knowledge of the PIN alone is insufficient, so both categories must be presented to authenticate.

Refusing a callback number prevents the target from independently verifying the caller's identity, which is exactly what an impostor wants. Requesting a one-time code is a serious red flag because those codes exist to prove possession of the account holder's device, and sharing one can hand over an active session. Together these behaviors indicate an attempt to bypass multifactor authentication.

A VPN encrypts traffic from the laptop to the company gateway, so other users sharing the open wireless link see only ciphertext even if they capture the frames. Because the tunnel is established before the webmail session travels, credentials and content are shielded from local eavesdroppers. This directly addresses the risk of interception on an untrusted network.

ACLs are the standard mechanism for assigning permissions to specific users or groups on file and folder resources. By granting access only to a tax preparers group, the owner enforces authorization so that other employees are denied access to the tax records while remaining able to reach the general office folder, which matches the scenario exactly.

Disabling unused services and ports shrinks the attack surface by removing listening daemons and open sockets that attackers could exploit. This directly satisfies the hardening goal, since every unnecessary service is a potential entry point for exploitation or lateral movement.