CCNA Security Questions

The 3-2-1 rule specifies exactly three copies of data, stored on two different media types, with one copy held offsite. Option A restates this structure precisely, satisfying all three elements of the rule rather than only part of it.

Adware specifically injects unwanted advertisements and pop-ups into the user's browsing or desktop environment, which directly matches the symptoms described. Unlike ransomware or worms, adware's primary payload is persistent advertising delivery, and the resulting background processes and browser injections also consume CPU and memory, explaining the reported slowdown.

Length alone is insufficient; complexity across character classes defeats dictionary and brute-force attacks. Mixing uppercase, lowercase, digits and symbols expands the search space, satisfying the stem's requirement for a strong password characteristic rather than a weak, easily guessed one.

A security guard is a personnel-based physical control that deters, detects and responds to unauthorised entry at a facility. Guards operate on the physical plane rather than through logical access mechanisms, satisfying the stem's requirement for a physical security control example.

A brute-force attack systematically tries many username and password combinations rapidly from one or more sources, producing exactly the pattern of hundreds of failed logins across many accounts in a short window. The absence of successful logins indicates the guesses have not yet succeeded. This signature distinguishes it from attacks that manipulate trust or intercept traffic.

Combining a password (something known) with a one-time code sent to a mobile phone (something possessed) satisfies two distinct authentication factors, which is precisely what multi-factor authentication requires. The policy's two-step login therefore instantiates MFA rather than single-factor or knowledge-based authentication alone.

Phishing is a broad, untargeted campaign that impersonates a trusted entity, here a bank, to trick recipients into clicking links and disclosing credentials. The misspelled sender domain is a classic spoofing indicator, and the mass, generic nature of the lure distinguishes it from targeted spear phishing.

Overwriting every addressable sector with random data destroys the original contents so they cannot be recovered through normal forensic recovery. Because the procedure leaves the drive functional, it satisfies both requirements: protecting customer records and allowing the hardware to be reused in another department. A full-drive overwrite is the standard sanitization method for magnetic media that will remain in service.

A 14-character passphrase with numbers and symbols combines length with character variety, producing high entropy that resists brute-force and dictionary attacks. This satisfies the stem's best-practise requirement, outperforming short complex strings or single words with trivial substitutions.

Pretexting is a social engineering technique where an attacker invents a fabricated scenario, such as posing as IT support or an auditor, to manipulate a victim into divulging information or performing actions. It relies on human trust rather than technical exploits, matching the stem's social engineering criterion.

An evil twin is a rogue access point that imitates a legitimate hotspot to lure users into connecting, allowing the attacker to intercept or manipulate their traffic. The scenario describes exactly this: a fraudulent access point with an appealing name capturing customer data. It is a wireless-specific attack that exploits users' willingness to join open networks without verifying the hotspot's authenticity.

WPA2-Enterprise uses IEEE 802.1X so each user authenticates with individual credentials validated by a RADIUS server, and the firm can disable just the former contractor's account. The shared passphrase problem disappears because no pre-shared key is distributed to clients. This directly satisfies both requirements: unique per-user credentials and selective, non-disruptive revocation.

A fingerprint scan is a biometric characteristic inherent to the user's body, making it an inherence factor — the "something you are" category. It differs from possession factors such as tokens and knowledge factors such as passwords, matching the stem's requirement for a multi-factor authentication example.

Preventing unauthorized access to information directly satisfies the confidentiality principle, which safeguards data from disclosure to parties lacking authorisation. Unlike integrity, which preserves data accuracy, or availability, which ensures timely access, confidentiality centres on restricting read access through controls such as encryption, access permissions and Microsoft Entra ID authentication policies.

Following the documented verification process, such as calling back a known number or using a shared challenge, confirms the request is genuine before any account change. This counters pretexting and caller ID spoofing while still allowing legitimate urgent requests to be handled. Verification first is the correct sequence for any sensitive account action.

A VPN creates an encrypted tunnel between the laptop and the corporate network, protecting data from being read by others on the coffee shop Wi-Fi. Even if an attacker captures the traffic, it remains encrypted and unreadable. This directly addresses the need to keep transmitted data confidential while using an untrusted network, making it the correct solution.

HTTPS uses TLS to encrypt data exchanged between the browser and the bank's server, and it authenticates the server with a digital certificate. Even on an untrusted public Wi-Fi network, an attacker who captures the traffic sees ciphertext rather than account details. This is why the address beginning with https materially changes the risk compared with a plain HTTP site.

Multi-factor authentication combines something you know (the password) with something you have (the smartphone app generating the one-time code), satisfying the requirement for two distinct credential categories at VPN login. Because the code is time-limited and device-bound, a stolen password alone cannot grant access, which is precisely the layered verification the scenario demands.

A 12-character minimum directly increases the search space an attacker must exhaust, making brute-force and hash-cracking attacks computationally impractical. Length is the dominant factor in password entropy, so this satisfies the stem's requirement for a strong-password characteristic, independent of complexity rules or composition.

A network firewall inspects inbound and outbound packets, applying rules that permit or deny traffic by TCP/UDP port and protocol. This directly satisfies the requirement to filter unauthorised external access at the network perimeter, unlike switches or access points that forward traffic without such policy enforcement.

Worms self-replicate autonomously across networks by exploiting vulnerabilities, requiring no host file or user action. This directly satisfies the stem's comparison: unlike viruses, which need a user to execute an infected file, a worm propagates independently, enabling rapid, self-sustaining spread without human intervention.

Encrypting with the recipient's public key means only the matching private key, held by the auditor, can decrypt the contents. Even if the message is intercepted in transit or lands in the wrong mailbox, the ciphertext is useless without that private key. This is the standard way to guarantee that a specific individual is the only party able to read a file.

A badge reader enforces authentication at the specific point of weakness: the server room door. Only staff with valid badges can enter, and the audit log records who attempted access and when. This directly stops the walk-in intrusion described while also providing accountability, making it the most targeted and immediate fix.

Integrity means data remains unaltered except by authorised action. Although the user was authenticated and had legitimate access, the modification itself was unauthorised, so the file's trustworthiness was compromised. Confidentiality and availability are unaffected, as no data was exposed or made inaccessible.

Full disk encryption renders the entire drive unreadable without the decryption key, so a lost or stolen laptop's data at rest stays protected even if the disk is removed. It covers all files and the operating system, satisfying the requirement without relying on per-file user action.

A biometric door lock restricts entry to a physical space by verifying a fingerprint or iris, so it operates on the tangible premises rather than on data, accounts or logical permissions. That places it squarely within physical security controls, unlike encryption or access lists.

Tailgating occurs when an unauthorised person physically follows an authorised individual through a secured door, exploiting courtesy rather than defeating the badge reader. The stem's badge-less entry behind an employee matches this technique exactly, distinguishing it from phishing or pretexting.

A firewall inspects incoming and outgoing traffic against configured rules, permitting or blocking packets based on source, destination, port and protocol. This filtering enforces the boundary between trusted and untrusted networks, directly fulfilling the stem's stated purpose of preventing unauthorised network access.

A virus inserts its code into legitimate host files, so execution of the infected file triggers replication and further spread. This directly satisfies the stem's requirement for malware that attaches to legitimate files, unlike worms, which self-replicate across networks without a host file.

A guest network with a separate SSID, VLAN, and client isolation allows customers to connect without a password while keeping their traffic and the internal POS network separate. This is the standard method to provide public access without exposing internal resources, and it directly meets both stated requirements.

Mixing uppercase letters, numbers, and symbols increases the search space an attacker must exhaust, directly satisfying the complexity requirement for strong passwords. This character-variety approach makes brute-force and dictionary attacks substantially harder, since each added character class multiplies the possible combinations. It complements length, the other core strength factor.

Avoiding unexpected attachments removes the malware delivery vector entirely, since invoice-themed phishing relies on the user opening the file to execute its payload. This satisfies the stem's suspicious-email constraint without depending on antivirus detection or sender verification, both of which can fail against newly crafted lures.

The ID card supplies something you have, while the PIN supplies something you know. Combining a physical token with memorised secret satisfies two distinct authentication factor categories, which is the two-factor requirement described in the policy.

Least privilege grants users only the minimum access needed for their job tasks, directly satisfying the requirement that employees reach solely the data necessary for their functions. It limits blast radius from compromised or misused accounts.

A smart card (something you have) combined with a PIN (something you know) satisfies multi-factor authentication by drawing on two distinct factor categories. This pairing meets the stem's requirement for MFA, unlike single-category methods such as two passwords, which remain knowledge-based only.

Phishing impersonates a trusted entity by email to trick the recipient into clicking a link and surrendering credentials. The misspelled sender address is the classic spoofing indicator, distinguishing it from malware, which requires execution, or social engineering conducted through other channels.

Ransomware is malware that encrypts a victim's files or locks their system, then demands payment for the decryption key. This extortion mechanism, holding data hostage until a ransom is paid, places it squarely within the malware category the question asks candidates to identify.

Multifactor authentication requires evidence from at least two different categories: something the user knows, something the user has, or something the user is. The password represents knowledge, and the code generated by the mobile app represents possession of the enrolled device. Because the two factors come from different categories, this scenario is a textbook example of multifactor authentication protecting access to the payroll system.

Full disk encryption renders the laptop's stored data unreadable without the decryption key, so a thief who removes the drive cannot access its contents. This directly preserves confidentiality of data at rest, satisfying the scenario's requirement should the device be stolen.

Default credentials are published in manuals and vendor documentation, so anyone with physical or network access to the management interface can authenticate. Replacing the factory username and password with unique, strong values removes that known-entry path and directly closes the risk described. This is the specific remediation for a device that still uses out-of-box login details.

Full disk encryption protects data at rest by encrypting the entire drive, so a lost laptop's contents are unreadable without the decryption key. This directly satisfies the requirement that data on lost laptops cannot be accessed, since the volume stays encrypted even if the device is stolen.

Ransomware encrypts files and appends a distinctive extension such as .locked, then displays a note demanding payment for the decryption key. The rapid spread from one workstation to a shared network folder matches ransomware that enumerates mapped drives and network shares. The vehicle being a found USB drive is a classic delivery method, but the file-renaming and ransom note identify the payload as ransomware.

A software inventory tool discovers and records the applications installed on each managed device, creating a baseline of authorized software. When it detects a new or unapproved application, it can generate an alert. This directly matches the owner's goal of knowing what is installed and being notified of unauthorized installations, making it the best fit for the described requirement.

Adware specifically injects or displays unwanted pop-up advertisements, matching the symptom described after installing the untrusted game. Unlike ransomware, which encrypts files for extortion, or a trojan, which masquerades as legitimate software to deliver payloads, adware's primary function is advertising delivery, satisfying the stem's frequent pop-up constraint.

Non-repudiation provides proof of the origin and integrity of an action so a party cannot later deny performing it. Capturing the identity, timestamp, and prior value of each medication change creates evidence that the pharmacist made the adjustment, which is exactly what the auditors need to trust the record and hold users accountable.

Tailgating occurs when an unauthorised person follows an employee through a secured entrance without presenting credentials. The scenario describes exactly this physical social-engineering technique, where the attacker exploits the employee's authorised badge access rather than defeating the access control system itself.

Combining a knowledge factor (password) with a possession factor (app-generated one-time code) satisfies the stem's two distinct authentication categories. The mobile app produces a time-based code, so compromise of the password alone cannot grant access, meeting the multi-factor requirement.

Integrity concerns unauthorised alteration of data, not its disclosure or availability. Modifying financial records without authorisation corrupts their accuracy and trustworthiness, so this scenario illustrates an integrity breach rather than a confidentiality or availability failure.