CCNA Cybersecurity Principles And Risk Questions

The perimeter network sits between trusted internal networks and untrusted external ones, so it forms the primary boundary where traffic is filtered and inspected first. Addressing it initially establishes the outermost control before hardening internal segments.

Keeping personal data within the country's borders satisfies the localization requirement, while replicating anonymized or aggregated data allows global analytics without exposing personal information. This architecture respects the legal constraint and supports business processing needs. It separates regulated personal data from derived, non-personal datasets, which is a common pattern for meeting data residency and privacy obligations simultaneously.

Availability ensures timely and reliable access to data by authorized users. Immutable offline backups allow the organization to restore patient records after ransomware encrypts production systems, directly preserving access to care-critical information. This matches the CIO's requirement that records remain available during an incident, making availability the correct principle.

A DDoS attack floods the database with traffic, exhausting resources so legitimate users cannot connect. This directly compromises availability, which concerns ensuring timely and reliable access to data for authorised users, rather than confidentiality or integrity.

A risk matrix is a qualitative tool that maps risks based on likelihood and impact, often using descriptive scales such as low, medium, and high. It helps prioritize risks by categorizing them into different levels of severity. This method relies on expert judgment to assign ratings.

ALE is calculated as SLE x ARO. The SLE is $500,000 x 0.20 = $100,000. Multiplying by the ARO of 3 gives $100,000 x 3 = $300,000. This represents the expected annual loss from DDoS attacks and is the correct quantitative risk value used to justify countermeasure spending.

Mandatory peer review and automated security gates insert a human and machine verification step between a compromised credential and production. Even if an attacker holds valid developer credentials, unreviewed malicious commits cannot merge, directly addressing the scenario's root cause. This is a preventive administrative and technical control combination that constrains the blast radius of credential compromise.

Classification is a governance decision made by the accountable asset owner, who understands the data's value, regulatory scope, and business criticality. Only after the owner assigns a sensitivity and criticality level can the team select a proportionate control set instead of defaulting to the heaviest baseline. This keeps the lighter control decision defensible and auditable.

Firewall configuration is implemented through hardware or software that filters traffic by rule, so enforcement is automated and technology-based. This places it squarely within the technical control category the stem asks for, distinguishing it from administrative and physical controls.

When on-site audits are not permitted, contractual controls such as right-to-audit clauses, security addenda, and requirements for breach notification and data deletion can provide assurance and recourse. This approach addresses the residual risk by legally binding the provider to security obligations without requiring physical access.

Confidentiality ensures information is disclosed only to authorised parties, typically through encryption, access controls and classification. It is one of the three foundational CIA Triad components the stem requests, satisfying the constraint that exactly two listed options are core elements.

Mitigation involves implementing controls to reduce the likelihood or impact of a risk. Since the cost of the control is less than the potential loss, it is cost-effective to implement the control. This aligns with the organization's low risk appetite for PII breaches.

Physical and Environmental Security governs tangible safeguards over facilities and hardware, so it directly satisfies the Annex A requirement for restricting server-room entry. Physical access controls such as locks, badges and surveillance sit in this category, not in logical access or organisational controls, which address user permissions and policy respectively.

A policy is a high-level statement of management intent that outlines the organization's commitment to cybersecurity and sets direction. It does not include detailed procedures or technical configurations. This matches the analyst's need for a document that provides overarching guidance without operational specifics.

The Information Security Policy is the governing document in which top management formally states its commitment to protecting information assets and sets the security objectives for the organisation. It provides the mandate and direction that lower-level standards, procedures and controls must align with.

Impact is the magnitude of harm that can be expected if a threat exploits a vulnerability. In this scenario, the analyst is assessing the potential loss if the trading platform is compromised, which directly relates to impact. Impact is a key factor in risk assessment, along with likelihood.

Acceptance is the deliberate decision to retain a risk after weighing treatment options, and it is valid only when made by an accountable owner with authority. The signed acceptance memo documents that informed decision, making acceptance the correct classification for this unpatched but business-critical application.

Choosing among mitigation, transfer, avoidance, and acceptance is the defining act of risk treatment. Each option is evaluated against cost, feasibility, and the organization's risk appetite, and the selected approach is documented with an accountable owner. Without this explicit selection step, identified risks remain unaddressed and the program cannot demonstrate that exposure was deliberately managed.

The IR family covers incident handling, reporting and response activities, which is exactly what unauthorised data exfiltration triggers. It addresses detection, containment, eradication and recovery from security incidents, satisfying the stem's requirement for the control family governing exfiltration incidents.

NIST SP 800-53 catalogues security and privacy controls that US federal agencies must implement under FISMA, making it the mandated baseline for federal information systems. Its control families map directly to agency authorisation processes such as the RMF.

ALE is calculated as SLE multiplied by ARO, so $250,000 x 4 = $1,000,000. Because the risk appetite caps single-risk ALE at $500,000, this risk breaches the threshold and cannot simply be accepted; the analyst must recommend treatment or escalate for a formal exception.

Cryptographic hashing and digital signatures provide integrity verification, directly countering Tampering by detecting any unauthorised modification of data in transit or at rest. This satisfies the design-phase constraint, where the threat targets data integrity rather than confidentiality or availability, making it the most effective control against that STRIDE category.

ALE is calculated by multiplying single loss expectancy by annualised rate of occurrence: $10,000 × 0.5 = $5,000. This expresses the expected yearly financial loss from the risk, forming the basis for comparing safeguards against their cost.

A vulnerability is a weakness, a threat is something that can exploit it, and risk is the potential for loss when the two intersect with a valuable asset. The unpatched server, the active ransomware group, and the regulated data together define the risk exposure.

Recover directly addresses resilience by restoring impaired capabilities after an incident, satisfying the stem's requirement for critical infrastructure continuity. Within the NIST Cybersecurity Framework, Recover supports timely recovery and service restoration, whereas Identify, Protect, Detect and Respond cover asset mapping, safeguards, monitoring and containment respectively.

Mitigation status records the current state of each agreed control for a logged risk, showing whether treatment is planned, in progress, or complete. A formal Risk Register tracks risk, owner, likelihood, impact and treatment, so mitigation status is a standard field.

Residual risk is what remains after controls are applied, and it never automatically disappears. A medium score still requires an owner, monitoring, and periodic reassessment, especially because EDR effectiveness depends on tuning, coverage, and threat evolution. The register entry should stay open with an updated residual rating.

Acceptance is the deliberate decision to acknowledge a risk and take no action to reduce it, often because the cost of mitigation outweighs the benefit or because no viable control exists. The CIO documents the risk and continues operation, which is a textbook example of risk acceptance.

The control yields a risk reduction of $180,000 per year, the difference between the $240,000 pre-control and $60,000 post-control annualized loss expectancy. Subtracting the $90,000 annual cost leaves a net benefit of $90,000, so the investment is quantitatively justified. This comparison of risk reduction against control cost is the standard cost-benefit basis for the CFO's question.

Least privilege is the principle of granting users only the minimum access rights necessary to perform their job functions. This reduces the attack surface and limits potential damage from accidental or malicious actions. The administrator's goal aligns exactly with this principle.

Data sovereignty holds that data is subject to the laws of the jurisdiction where it is collected or stored, and cross-border transfer restrictions limit movement to countries with adequate protection. The regulation described directly reflects this principle, making it the governing concept for the retailer's compliance obligation.

A risk matrix maps likelihood against impact to produce a single overall risk rating, such as High, Medium, or Low. This directly satisfies the requirement to reflect both the chance of the event and the severity of its consequences, and it supports prioritization and consistent communication.

The organization has a defined policy requiring AES-256 encryption for Confidential data, yet it knowingly continues storing unencrypted tape backups. No compensating control, transfer, or remediation is in place. This is the defining characteristic of risk acceptance: the risk is identified and consciously retained without mitigation, whether formally documented or not. The audit finding confirms the exposure persists despite the stated policy.

Encrypting ePHI at rest with AES-256 ensures that even if physical disks are stolen or improperly accessed, the data remains unreadable without the encryption keys. The HSM protects key material, preventing unauthorized decryption. This directly preserves confidentiality, the property that information is not disclosed to unauthorized individuals or processes, which is the core security objective addressed by encryption at rest.

STRIDE threat modelling requires a data flow diagram, so identifying data flows maps how data moves between components, trust boundaries and processes. This satisfies the stem's requirement by establishing the system model against which each STRIDE category is systematically applied.

Software in MITRE ATT&CK represents the specific tools or malware instances leveraged during an intrusion, satisfying the stem's demand for the "what" of the attack. Unlike Techniques, which describe adversary behaviour, Software maps directly to the actual utility or implant observed, such as a named backdoor or offensive tool.

Granting 'Administrator' rights to a user whose role is routine data entry exceeds what the job requires, directly breaching least privilege. This principle demands each account hold only the minimum access necessary, so excessive standing permissions create unnecessary attack surface and insider-risk exposure.

ALE = SLE × ARO. SLE = AV × EF = 500,000 × 0.40 = 200,000. ALE = 200,000 × 0.2 = 40,000. This correctly applies the exposure factor to the asset value and then multiplies by the annualized rate of occurrence to estimate the expected annual loss.

Encrypting the storage volume with AES-256 and storing keys in an HSM ensures data at rest is unreadable without the key. If the array is stolen, the ciphertext is useless because the HSM remains in the secure facility. This directly addresses the confidentiality objective for data at rest and satisfies the 'Restricted' classification requirement.

Impact describes the potential harm to the organization if the threat event occurs, often rated on an ordinal scale. Together with likelihood, impact forms the two axes of a qualitative risk matrix. This combination lets the team rank risks by relative urgency and focus remediation efforts on the highest-priority items without needing precise financial estimates.

Risk acceptance occurs when an organization acknowledges a risk and decides to retain it without implementing additional controls, often because the cost of mitigation outweighs the benefit or the exposure is temporary. The business owner's decision to tolerate the high likelihood and high impact for two months until decommissioning is a clear example of accepting the risk with a defined time boundary.

Loss Event Frequency derives from Threat Event Frequency and Vulnerability, the two factors determining how often loss events occur. Threat Event Frequency measures how often threat agents act, while Vulnerability expresses the probability those actions result in loss.

A Business Impact Analysis identifies which business processes are most critical by assessing the consequences of their disruption over time. This criticality ranking, expressed through recovery time and recovery point objectives, then drives continuity strategy and resource prioritisation, making process criticality determination its primary objective.

Strategic alignment ensures security initiatives directly support organisational objectives and risk appetite, which is a core governance function. It satisfies the stem's requirement by connecting security strategy to business goals, rather than addressing operational controls or technical implementation tasks.

Mitigation directly lowers likelihood and impact by making encryption of production data harder and restoring services faster. Immutable offline backups defeat ransomware's extortion leverage, segmentation limits lateral spread, and rehearsed recovery sustains clinical availability. This treatment aligns residual risk with the hospital's tolerance while respecting the availability requirement stated in the scenario, making it the most defensible option.

The assurance gap is the absence of independent attestation over confidentiality controls across a period. A SOC 2 Type II covering the confidentiality criterion provides exactly that: tested operating effectiveness of controls protecting data throughout the audit window. It directly complements the existing security and availability coverage and satisfies due diligence for regulated financial data handling.

Mutual TLS requires both client and server to present X.509 certificates, so a service account cannot be impersonated without possessing its private key. This cryptographically binds the identity to the credential, directly countering impersonation, unlike network controls that only restrict reachability.

The Data Owner holds business accountability for a data asset, determining its value and sensitivity, and therefore assigns the appropriate classification level. This decision-making authority, rather than day-to-day handling performed by custodians, satisfies the stem's classification responsibility.

Secure coding practices such as input validation and parameterized queries remove entire vulnerability classes at the source, independent of any network control. Even if the WAF is bypassed or misconfigured, properly coded queries resist injection, giving a genuinely separate layer of protection for the application.

Access control policy is a management-level directive defining who may access which resources and under what conditions, satisfying the NIST administrative control family. It governs behaviour through rules and expectations rather than technical enforcement, unlike logical controls such as firewalls or encryption, and differs from physical safeguards like locks.

Risk transference shifts the financial impact of a risk to a third party, such as an insurance provider. By purchasing cyber insurance, the organization retains the operational risk but transfers the financial consequences of a breach to the insurer. This aligns with the definition of transference in risk treatment.

Acceptance means management acknowledges the residual risk and proceeds without patching, which matches their refusal driven by legacy dependencies. Unlike mitigation, transfer or avoidance, no control change occurs; the risk is formally retained and should be documented in the risk register with an owner.

Risk acceptance occurs when an organization acknowledges a risk and decides to retain it without additional mitigation, typically because the cost of treatment exceeds the benefit or because the system is operationally required. The CISO's documented decision to accept residual risk for the unpatched payroll application matches this treatment exactly.

A documented offboarding procedure is an administrative control that ensures accounts are disabled or removed as part of the termination process. It directly reduces the window in which former employees can authenticate. Because it defines roles, steps, and timing, it addresses the root cause of stale credentials and is the appropriate first control to implement in this scenario.

Qualitative risk assessment ranks likelihood and impact using descriptive labels such as High, Medium, and Low rather than numeric values. This matches the stem's descriptive scales, distinguishing it from quantitative approaches that assign monetary or numerical scores.

Full-disk encryption with AES-256 renders stored data unreadable without the correct key, and an HSM protects key material from extraction. If the physical media is stolen, the attacker lacks the secret needed to decrypt, directly satisfying the requirement for confidentiality of data at rest.

PASTA is a risk-centric, attacker-centric methodology whose stages explicitly incorporate business impact, threat intelligence on adversary capability and intent, and attack surface analysis before producing a prioritized, likelihood-weighted threat model. Stage II defines the technical scope and Stage III decomposes the application, while adversary and threat analysis stages score realistic threat agents. This directly matches the requirement to combine capability, intent, and opportunity against the specific API gateway surface.

A risk matrix is a qualitative tool that maps risks based on likelihood and impact ratings, often using scales like low, medium, and high. It is suitable for a new cloud platform because it allows analysts to prioritize risks without requiring precise quantitative data, facilitating discussion and decision-making.

Identify is the CSF function that develops organizational understanding of systems, assets, data, and capabilities, including business environment, governance, risk assessment, and risk management strategy. It directly answers the CISO's need to know assets and risk appetite before prioritizing security activities, making it the correct function here.

AES-256 is a symmetric block cipher that encrypts data in transit, rendering intercepted traffic unreadable without the key. It directly satisfies the confidentiality constraint by protecting sensitive data from unauthorised disclosure during transmission, unlike hashing or access controls which address different principles.

The NIST CSF provides a common taxonomy of functions, categories, and subcategories that lets technical and executive audiences discuss risk consistently. It is voluntary, widely adopted across industries, and designed to complement other standards, making it ideal for demonstrating program alignment to auditors while communicating with leadership.

An effective risk appetite statement must be actionable, which requires both qualitative framing and quantitative thresholds. For a hospital, that might mean tolerating no more than four hours of downtime for life-critical systems while accepting moderate risk in administrative applications. Without measurable thresholds, decision-makers cannot objectively determine whether a given risk falls inside or outside the organization's willingness to accept it.

Impact measures the potential harm a realised threat would cause, making it a core axis of qualitative risk scoring alongside likelihood. In a basic model, risk is derived by rating impact severity against probability, so impact directly satisfies the stem's requirement for a commonly used calculation factor.