CCNA Securing Assets Questions

Full-disk encryption protects data at rest by rendering the storage unreadable without the decryption key, directly mitigating physical theft or disk imaging. If the drive is removed, the ciphertext is useless without proper key material. This control specifically addresses the threat of stolen or copied storage media containing payment card data, making it the right choice for the scenario.

BitLocker encrypts fixed drives with AES, rendering data unreadable without the recovery key or TPM-bound authentication. This directly satisfies the physical access constraint: if a device is stolen or its drive removed, the attacker cannot read the volume offline. Enforcing it across all fixed drives closes the gap left by unencrypted secondary partitions.

Restricting write access to the service binary folder prevents attackers from planting malicious DLLs that the service might load.

Tamper protection is a feature in many EDR solutions that prevents local administrators from disabling or modifying the agent. It enforces protection at the kernel level, ensuring the agent remains active even if an administrator attempts to stop its services or modify its files. This directly addresses the requirement.

The netstat -ano command displays active network connections along with the owning process ID (PID) and the executable name. By running this on the workstation, the analyst can correlate the remote IP and port to the PID, then use Task Manager or tasklist to identify the process. This is a quick and built-in way to map connections to processes.

Firewall logs record outbound connections to cloud provider CIDR blocks, exposing shadow assets by destination IP rather than domain name. This satisfies the audit's detection requirement even when DNS is encrypted or bypassed, complementing domain-based methods.

Discretionary access control is characterized by object owners or administrators assigning permissions directly to named users and groups on each resource, as seen with NTFS access control lists. The described payroll folder configuration, where specific HR members are granted read and others are denied, is the classic discretionary model in action on a Windows file server.

These files record authentication events such as successful and failed logins, sudo usage, and su attempts. They are the primary source for detecting unauthorized access and privilege escalation on Linux. Collecting them centrally enables correlation and alerting on suspicious authentication patterns, making them a top priority for security monitoring.

Disabling unnecessary services is a fundamental step in reducing the attack surface. Telnet and FTP are insecure protocols that transmit data in cleartext and are often targeted by attackers. Turning them off eliminates potential entry points and aligns with the principle of least functionality.

Discovery scanning establishes what is actually reachable, while procurement and billing records reveal assets that may be offline, unlisted, or newly provisioned. Reconciling the two produces a defensible baseline inventory with ownership and classification data that can be maintained. This is the foundational first step before controls can be scoped to specific assets.

The existence of public exploit code significantly increases the risk of exploitation.

Patch recency reflects maintenance hygiene, not business impact. Criticality criteria should measure consequence of loss — revenue dependence, regulatory scope, data sensitivity, or process dependency. A recently patched asset can still be business-critical, so last-patched date cannot determine criticality and must be excluded from the definition.

Kernel-level visibility allows the EDR agent to monitor low-level system activity, such as system calls and process creation, which is essential for detecting advanced threats that may evade user-mode hooks. This deep visibility is critical for effective detection of malicious behavior on endpoints.

Removable media is a common initial infection vector for air-gapped or segmented ICS environments, as seen in historical incidents that spread via USB drives. Disabling mass storage and permitting only approved, scanned devices blocks that path while still allowing necessary firmware or configuration transfers through controlled media. This control directly reduces attack surface on engineering workstations without affecting PLC communications, making it appropriate for the baseline.

This preserves the required legacy protocol for the single approved peer while shrinking exposure to only that host. Enabling SMB signing raises the bar against relay and tampering attempts, and SMB auditing gives the SOC visibility into anomalous SMBv1 sessions. Together these act as compensating controls consistent with a documented, time-boxed exception.

An admission controller that verifies signatures and immutable digests ensures the exact scanned image is the one that runs. If an attacker swaps the image tag or tampers with the registry content, the signature or digest check fails and the pod is rejected. This directly closes the gap between scanning in CI and execution in the cluster, addressing post-scan tampering and tag mutation.

Host Management lists every endpoint with the Falcon sensor installed and its current connectivity and prevention status, so missing or non-reporting agents are immediately visible. This directly satisfies the requirement to confirm all endpoints are running and reporting correctly.

Segmenting the workstation VLAN from the PACS archive VLAN with deny-by-default firewall rules directly blocks the east-west path the attacker used to pivot. Only explicitly approved flows, such as the DICOM ports required by imaging modalities, are permitted. This containment control limits blast radius regardless of how the workstation was initially compromised, making it the most direct mitigation for lateral movement to the archive.

Hosting the primary e-commerce database with stored credit card data satisfies the Critical criterion through regulatory and financial exposure. Compromise triggers PCI DSS breach obligations, customer notification costs and direct fraud liability, so the asset demands the highest protection tier.

Endpoint isolation via the EDR console immediately severs the laptop's network communication while preserving the agent's management channel for investigation. This contains the active command-and-control traffic fastest, satisfying the stem's requirement for the most immediate containment action.

A CMDB records each asset plus its dependencies and relationships, so impact analysis and change planning draw on accurate linkage data rather than isolated device lists. This directly satisfies the stem's requirement for good inventory management practise by keeping the inventory current, complete and relationship-aware.

Password complexity is configured under Account Policies > Password Policy within Security Settings, reached via Computer Configuration > Policies > Windows Settings. This is the CIS Benchmark path where the 'Password must meet complexity requirements' setting is enforced for local accounts.

File system permissions directly enforce access control by defining which users or groups may read, write, or execute a given resource. This satisfies the stem's requirement for an access control implementation, since permissions are a discretionary mechanism restricting subject actions on objects within the operating system itself.

Encrypting the backup image with keys not stored alongside it means a stolen copy is unreadable, and tightening share permissions limits who can obtain the image in the first place. This directly targets the stated exposure of unencrypted backups on a shared share. It protects the data even after it leaves the hardened host, which is the scenario's key concern.

Restricting access to only those roles with a business need limits insider and lateral-movement exposure, and comprehensive access logging gives the SOC the ability to detect anomalous reads or bulk exports. Together these controls support both prevention and detection for the most sensitive assets. They align with standard handling requirements for the top classification tier.

Customer account numbers combined with Social Security numbers are regulated personally identifiable information whose disclosure causes severe harm, financial fraud, and regulatory penalties. This data clearly warrants a Confidential classification with encryption, strict access control, and monitoring. It is the best example of an asset requiring the highest sensitivity handling in a financial services risk assessment.

NetFlow records capture flow metadata — source, destination, ports, and byte counts — for every connection leaving the perimeter, revealing the beaconing pattern to random external addresses. This flow-level evidence identifies the botnet's command-and-control endpoints before host-level artefacts are collected.

WDAC is a Windows feature that enforces application control by allowing only trusted, signed code to run, based on policies defined by the organization. It can be configured to permit approved developer tools while blocking unauthorized executables, providing strong protection against untrusted code. This directly meets the requirement to control application execution without granting bypass rights.

This removes the static plaintext secret from the file system and introduces brokered, auditable retrieval, which is a recognized compensating control when native modern authentication is unavailable. The backup platform still obtains valid credentials to run jobs, so functionality is preserved while the exposure of a long-lived plaintext secret is reduced and access is logged through the broker.

The netstat utility with the -a, -n, -o, and -b switches lists all active connections and listening ports in numeric form, includes the owning process ID, and resolves the executable name responsible for each connection. This directly preserves the mapping between live network sockets and the processes that own them, which is exactly the volatile state requested before containment destroys it.

Recording both the business owner, who is accountable for the asset, and the technical custodian, who operates it, along with current contact details, gives responders an immediate escalation path. This is the only element that directly answers who to call, who can authorize disruptive containment actions, and who can interpret the asset's business impact during an active incident.

An IAM role attached to the instance profile supplies temporary credentials via instance metadata, and scoping the policy to the bucket ARN enforces least privilege. This satisfies the stem's constraint: the EC2 instance can only access that specific S3 bucket.

Checking `nessuscli agent status` confirms whether the agent has successfully linked to its manager, since an unlinked or offline agent never reports plugin and asset data. This directly addresses the stem's constraint: endpoints absent from Asset Inventory despite installation, isolating link-state failure before investigating scanning or licensing.

EDR continuously collects endpoint telemetry — process, file, registry and network activity — then applies behavioural analytics to detect malicious patterns, enabling automated containment such as isolating a host or killing a process. This satisfies the stem's requirement for both ongoing monitoring and automated threat response, distinguishing it from signature-only antivirus.

Delegating only the specific Active Directory permissions needed for password reset and account unlock on the appropriate Organizational Units grants the helpdesk technicians exactly the rights required to perform their job. Removing them from the local Administrators group eliminates unnecessary full control over the HR file server, directly enforcing least privilege while preserving operational capability.

Automated discovery tools help ensure that new assets are detected promptly, reducing the risk of unmanaged devices. They can also identify changes to existing assets, such as software updates or configuration changes, keeping the inventory current. This is a foundational practice for maintaining an accurate asset inventory.

SMB signing provides integrity and authentication for SMB packets, preventing an attacker from intercepting and altering data in transit. Without it, a malicious actor on the network path can modify file contents or commands, leading to data tampering or privilege escalation. This directly threatens the confidentiality and integrity of PII stored on the server.

The XSS on the public login page is the highest risk because it is exploitable by any internet user without authentication. Even though it is medium severity, its public exposure and potential for credential theft make it more urgent than an RCE that is not externally reachable. Risk prioritization considers exploitability and exposure.

netstat -ano displays active network connections along with the process ID (PID) that owns each connection. The analyst can then map the PID to a process name using Task Manager or tasklist. This directly identifies the process responsible for the C2 communication, making it the most appropriate tool for this scenario.

The 'lsof -i :8443' command lists open files associated with Internet sockets on port 8443, including the process name, PID, and user. It is a standard, reliable way to map a listening port to its owning process on Linux. This directly answers the analyst's need to identify the process bound to the unexpected port and assess whether it is authorized.

The -A INPUT appends a rule to the inbound chain, -s 192.168.10.0/24 matches the source subnet, and -j DROP discards matching packets. Together they block all incoming traffic from that subnet, satisfying the stated requirement.

A central database holding both PII and credit card data warrants 'High' criticality because compromise triggers regulatory breach notification, financial penalties and identity theft risk. Its confidentiality, integrity and availability requirements exceed those of internal or public assets, matching the highest classification tier.

Applying the highest classification label and restricting access is a conservative, risk-based approach that prevents potential data exposure while awaiting formal classification. Since the server stores ePHI, it likely warrants a high classification, and this action ensures immediate protection without delaying the classification process.

X-Frame-Options: DENY instructs the browser to refuse rendering the page inside any frame or iframe, blocking the framing technique clickjacking relies on. This directly satisfies the stem's requirement to mitigate clickjacking, unlike headers such as Content-Security-Policy alone or X-Content-Type-Options.

Event ID 4740 is logged on domain controllers when a user account is locked out, capturing the target username and caller computer name. Filtering on this ID directly satisfies the stem's requirement to trigger on account lockout, unlike authentication failure events such as 4625, which record individual failed logons rather than the lockout itself.

Recording both successful and failed authentication attempts reveals brute-force attacks, credential stuffing, and unauthorised access, while establishing an audit trail for compliance. This satisfies the stem's requirement to detect malicious activity and meet regulatory logging obligations on the database.

Disabling unused modules removes unnecessary attack surface from the web service itself, eliminating known vectors such as WebDAV exploitation and directory listing information disclosure. This directly satisfies endpoint hardening of the service rather than host or network controls.

Assets that handle regulated data and directly support revenue are high criticality because their compromise can cause regulatory penalties, financial loss, and reputational damage. This criterion ties classification to business impact and legal obligations, which is the correct basis for prioritizing security controls and monitoring.

Just-in-time elevation removes standing administrative rights and grants them only when a task is approved and for a limited window. A stolen credential therefore yields little value outside that window, directly shrinking the blast radius. It also creates an approval and audit trail that ties each elevation to a business justification, which supports both containment and after-action review.

The ss -tulpn flags list TCP and UDP listening sockets with numeric ports and owning process names, giving exactly the port-to-process mapping needed to identify and disable unused services during hardening. It supersedes the deprecated netstat for this purpose.

RCE on an internet-facing application allows unauthenticated attackers to execute arbitrary code remotely, typically yielding full host compromise. Its external exposure and direct exploitation path make it the highest-severity finding, demanding immediate remediation ahead of lesser vulnerabilities.

Removing unnecessary packages and services directly reduces the attack surface by eliminating potential vulnerabilities. If a service is not needed for the server's role, it should be disabled or uninstalled. This aligns with the principle of least functionality and is a core hardening practice.

Rapid authentication across 20 distinct workstations within five minutes exceeds any plausible human interaction pattern, signalling automated credential reuse typical of lateral movement. This satisfies the scenario's requirement for a behavioural indicator by exposing anomalous breadth of host access, which Microsoft Entra ID sign-in logs would surface as correlated risk detections.

rsyslog is the standard Linux logging daemon that forwards local system and application logs to a remote centralised server. Configuring it satisfies the baseline requirement to ship operating system logs off-host for retention and correlation.