CCNA Protection of Information Assets Questions

SCCs are the European Commission's approved contractual template that imposes GDPR-equivalent safeguards on a data importer in a third country lacking an adequacy decision. They provide the lawful transfer mechanism the privacy program requires for such restricted jurisdictions.

Before judging the any-any port 443 rule as a finding, the auditor must establish whether a documented business justification exists. Determining intent and approval first distinguishes an authorised exception from an undocumented, unjustified exposure, directing subsequent audit action appropriately.

Without system owner approval, privileged access bypasses the authorisation control that ensures rights are granted only when a legitimate business need exists. This is the most serious finding because unapproved rights enable unauthorised changes and cannot be traced to an accountable approver.

A privacy impact assessment systematically examines a processing activity to identify privacy risks and recommend mitigations before harm occurs. This proactive risk identification and treatment is its primary purpose, distinguishing it from breach response, consent collection or regulatory notification.

A propped door during a vendor visit directly compromises the physical access control boundary and allows unescorted or unauthorized entry into the area housing critical transaction systems. Unlike the other observations, this is an active control failure occurring in real time that exposes the most sensitive assets. Vendor visits are a known risk period, and the door being held open means the access control system is not actually enforcing who enters the server room, making this the most significant weakness observed.

A management VLAN that can reach both the cardholder data environment and the corporate network, with administrative protocols permitted to any host, creates a bridge that defeats the purpose of segmentation. The intended isolation no longer holds because an attacker compromising a management workstation could pivot between environments, so the auditor should conclude the control objective is not met.

Video surveillance that covers only the main corridor leaves the loading dock and other sensitive areas unmonitored, creating blind spots where unauthorized activity could occur undetected. Because the loading dock is already identified as an uncontrolled entry point, the absence of camera coverage there compounds the risk. The auditor should report the incomplete CCTV coverage as a control weakness that limits detection and investigation capability.

Shared administrative accounts mean activity cannot be attributed to a named individual, so the audit trail cannot support investigation, least-privilege enforcement or disciplinary action. This loss of individual accountability is the most significant concern because it undermines every other administrative control.

Clearly defined roles and responsibilities assign each team member specific duties during an incident, preventing duplicated effort, gaps and confusion under pressure. This structure is essential for the plan to execute coordinated containment, eradication and recovery actions.

A propped door bypasses the biometric access control, allowing anyone to enter without authentication. This is a clear physical security weakness that undermines the entire access control objective. The auditor should document it as a finding because it represents a real risk of unauthorized access. Observing and reporting the issue is the appropriate audit action, not ignoring or downplaying it.

A SIEM's detection capability depends on the breadth and timeliness of the data it ingests. If critical systems such as firewalls, domain controllers, and databases are not forwarding logs, or if ingestion is delayed, the SIEM cannot correlate events or alert on emerging threats in real time. Evaluating log source coverage and ingestion latency is therefore fundamental to assessing whether the SIEM can effectively support incident detection.

A mantrap, or access control vestibule, uses two interlocking doors to ensure that only one person can enter at a time, effectively preventing tailgating. Tailgating is a common physical security breach where an unauthorized person follows an authorized person through a secure door. Given that the data center uses smart cards and PINs, the next logical enhancement is to control physical passage to prevent unauthorized entry via tailgating, which is a critical control for high-security areas.

Each firewall rule must map to a documented business need; rules lacking justification are candidates for removal, reducing attack surface. This satisfies the stem's rule-review element by confirming every permitted flow is authorised rather than merely technically functional.

Any-to-any internal-to-Internet access grants unrestricted egress, enabling data exfiltration and command-and-control. Restricting to specific IP addresses and ports enforces least privilege while preserving the justified business need, satisfying the stem's requirement for a more granular, auditable rule set.

EDR effectiveness depends heavily on current detection logic. If agents do not receive automatic updates to signatures and behavioral models, they will fail to recognize new malware variants and evolving attack techniques. Automatic updating ensures the endpoint can detect threats that emerge after deployment. Without it, the organization retains coverage only for known, older threats, which materially weakens the control's ability to reduce malicious code risk.

Documented risk acceptance approved by the system owner and CISO evidences that the business knowingly accepted the unpatched vulnerabilities within its risk appetite. Reviewing that documentation lets the auditor evaluate whether acceptance was authorised, justified and consistent with policy.

A break-glass procedure grants emergency access under predefined conditions with logging, then mandates post-event review to validate and revoke it. This restores the missing segregation between request and approval by introducing independent retrospective scrutiny, mitigating the risk created when the system owner alone both requests and approves.

Shared accounts destroy individual accountability, so non-repudiation requires attributing each privileged action to a named person. PAM with session recording achieves this by brokering access through unique credentials while capturing activity, letting administrators act without sharing passwords and enabling forensic attribution.

Successful phishing attacks measure actual security outcomes rather than activity. Completion rates and quiz scores reflect attendance, not behaviour change; a sustained fall in employees falling for simulated or real phishing demonstrates the training altered real-world susceptibility, which is the program's purpose.

Periodic access recertification requires managers to confirm each user's rights remain necessary, catching privilege creep, transfers and stale accounts that accumulate over time. It directly satisfies the requirement that access rights stay appropriate, which provisioning-time approvals alone cannot guarantee.

CRLs are the mechanism relying parties use to learn that a certificate is revoked. If they are stale, a compromised certificate's serial number is absent, so systems continue trusting it and attackers can still authenticate or decrypt traffic until the CRL is refreshed.

An HSM generates, stores and uses keys inside tamper-resistant hardware, so plaintext key material never enters general memory or storage. This satisfies the programme's core requirement to protect keys from extraction, unlike software storage or file-based encryption, where compromise of the host exposes the keys.

When an application maintains its own credential store, corporate password complexity, lockout, rotation, and expiry settings are not automatically inherited, and accounts are not disabled when the employee leaves or transfers. The directory's joiner-mover-leaver process no longer governs access, so orphaned and excessive rights accumulate silently. This is the most material concern because it breaks centralized identity governance for a financially sensitive system.

Keeping the hypervisor patched is critical because VM escape vulnerabilities are often due to bugs in the hypervisor code. Patches address known exploits that could allow an attacker to break out of a VM and compromise the host. This is a fundamental security practice for any software, and especially for the hypervisor, which is the foundation of the virtualized environment. Regular patching reduces the attack surface and mitigates known escape techniques.

Weekly CRL publication creates a window in which a revoked certificate remains absent from the list, so relying parties continue to treat it as valid. Until the next update, compromised or misissued certificates can still authenticate, undermining the PKI's revocation assurance.

Recording where PII resides, both in systems and physical premises, is essential because privacy obligations attach to every storage location. Without this, the institution cannot scope subject access requests, cross-border transfer restrictions or breach notification, leaving copies of personal data unaccounted for during compliance assessments.

Secure key storage in a hardware security module protects keys at rest within tamper-resistant hardware, preventing extraction or disclosure. Since compromise of the key itself defeats every cryptographic protection built upon it, this control is the most critical safeguard.

Quarterly recertification forces managers to confirm each user's continued business need for financial application access, catching privilege creep and stale entitlements between joiner-mover-leaver events. This directly satisfies the stem's requirement for controls ensuring access remains appropriate over time.

Recertification forces managers to periodically revalidate each user's entitlements against current job duties, catching privilege creep and stale accounts created by transfers or role changes. This directly satisfies the control objective of confirming access remains appropriate for users' roles.

A mantrap admits one person at a time through interlocking doors, so a second individual cannot follow on the first person's valid credential. This physically enforces single-person entry, directly preventing the unauthorised tailgating the stem asks about.

The core weakness is that terminated users retain working credentials that the RADIUS server accepts. An ex-employee who remembers those credentials can pass 802.1X authentication and reach internal network resources as an authorized user. This is a logical access failure, and it directly enables unauthorized entry into the protected environment through the wireless infrastructure.

Verifying formal risk acceptance and compensating controls confirms the residual risk is documented, authorised by accountable management and mitigated, satisfying the auditor's duty to ensure the unfixed vulnerability is consciously owned rather than silently ignored before decommissioning.

A shared Layer 2 domain means hosts in the corporate VLAN and the CDE can communicate at the data-link layer, bypassing the firewall that was intended to be the sole control point. An attacker on a compromised workstation could reach CDE hosts directly via ARP and MAC-level traffic, defeating the segmentation the organization believes is in place. This is the most severe issue because the compensating control does not actually enforce the separation it claims to provide.

Elevating the data center floor above the expected flood level is a preventive physical control that directly reduces the risk of floodwater reaching the equipment. By placing the data center on a higher floor or raising the entire facility, water from a flood would need to rise significantly before affecting operations. This is the most effective way to mitigate flood risk, as it addresses the threat at its source by keeping water out.

Unannounced inspections provide direct, first-hand evidence of whether sensitive documents and media are actually secured when staff leave workstations, satisfying the need to verify real compliance rather than assumed adherence. Announced checks or policy reviews only confirm intent, not operational practice.

The any-any rule grants broad internal-to-DMZ access with no business justification, violating least privilege and expanding the attack surface. Removing it and verifying no impact eliminates the exposure while confirming that no legitimate dependency remains.

Successful phishing attacks measure actual user behaviour under real adversarial conditions, directly evidencing whether awareness training changed outcomes. Completion rates and quiz scores reflect attendance, not resistance, so a sustained reduction in successful phishing satisfies the stem's effectiveness indicator by demonstrating transferred vigilance rather than passive knowledge.

A rule permitting any service from the Internet to the internal network exposes every internal host and port to unrestricted external access, effectively bypassing perimeter segmentation. This is the most severe finding because it enables broad exploitation, far exceeding risks from individual permissive rules.

The hypervisor management interface is a high-value target because it controls the entire virtual infrastructure. If an attacker accesses it with default credentials, they can potentially shut down, modify, or create virtual machines, and even move laterally to other systems. This could lead to a complete compromise of all hosted workloads, data breaches, and service outages. This is the most critical risk because it affects the entire virtual environment, not just a single VM.

Security awareness training addresses the human behaviour behind documents left on desks, teaching staff classification handling and the clean desk requirement. It complements procedural controls by changing the culture that causes the exposure the auditor observed.

Pseudonymisation replaces direct identifiers but retains a key enabling re-identification, so the data remains personal data under GDPR and its protections still apply. This limits the control: it reduces risk but does not remove the organisation's compliance obligations.

Centralised management and monitoring consolidates privileged accounts into a controlled vault, enabling credential checkout, session recording and anomaly detection. This directly addresses the core PAM objective of curbing unmonitored, standing administrative access across the estate.

Signature files that are 47 days stale mean newly discovered malware families and variants cannot be detected by the endpoint control. This directly defeats the preventive purpose of the anti-malware solution and represents a material gap in the protection of information assets. The auditor should report this as the primary concern because it exposes the organization to known, circulating threats.

A mantrap permits only one person through an interlocking door sequence at a time, physically preventing an unauthorised individual from following an authenticated person. This directly satisfies the stem's constraint by eliminating the single-entry tailgating vector that badge readers alone cannot address.

A tabletop exercise walks participants through a simulated incident, testing decision-making, roles, communication and plan completeness without production disruption. This validates the IR plan's effectiveness against the stem's requirement, unlike reviewing documentation, which only confirms the plan exists.

Chain-of-custody logs with signed handoffs demonstrate that the sealed containers were tracked from pickup to delivery, providing direct evidence that physical protection was maintained during transit. This is the strongest audit evidence available for the transit leg of the media lifecycle, since the auditor can trace each tape shipment and confirm no unaccounted gaps or broken seals occurred.

Segmentation places enforcement points between network zones, so a compromised host cannot freely reach other systems. This directly satisfies the containment constraint: it restricts lateral movement, limiting blast radius and buying incident responders time before the attacker pivots to critical assets.

Storing keys alongside ciphertext collapses the two-party separation encryption depends on: anyone gaining server access obtains both data and keys, rendering encryption ineffective. This defeats HIPAA's safe harbour premise, which assumes keys remain protected and separate, so a single compromise exposes all protected health information.

A mantrap with interlocking doors physically admits one person per cycle, so a second individual cannot follow through before the first door closes. This directly satisfies the stem's requirement to prevent unauthorised tailgating, unlike detective controls such as CCTV, which record the breach only after entry has occurred.

Because inline prevention sits directly in the traffic path, a misclassified signature, a capacity limit, or a hardware fault can drop legitimate sessions for every user behind it. Availability of business services becomes dependent on the IPS tuning and resilience. This is the most significant operational risk and explains why fail-open design, bypass, and staged tuning are essential before enforcement mode is enabled.

If the retention period is shorter than the investigation window defined by policy, evidence required to investigate incidents will be unavailable. Detection may occur, but without 90 days of logs the team cannot reconstruct the scope, timeline, or root cause of events that surface late. This is a direct conflict between a configured control and a documented requirement, making it the most concerning finding because it undermines incident response and forensic capability.

Managers rubber-stamping approvals defeats the review's purpose: recertification exists to confirm each user's access still matches current job requirements. Without that verification, excessive or stale entitlements persist, violating least privilege and undermining the control's effectiveness. This directly addresses the stem's concern about review effectiveness, unlike process timing or documentation issues.

Absent formal requests or approvals, no record exists linking an account to an authoriser or business justification. This defeats accountability and non-repudiation, leaving the auditor unable to reconstruct who granted access, when, or why — undermining investigation, disciplinary action and regulatory evidence.

Allowing RDP from any source IP exposes the server to brute-force attacks, credential stuffing, and exploitation of RDP vulnerabilities. The most appropriate recommendation is to restrict access to known trusted IPs or require users to connect via VPN, which adds an authentication layer. This reduces the attack surface and aligns with the principle of least privilege. It directly addresses the risk of unauthorized access.

Recertification only reduces excessive access if identified changes are actually revoked or modified. Without an execution process, managers' quarterly confirmations produce no remediation, leaving inappropriate rights intact indefinitely — defeating the control's purpose and exposing the financial application to unauthorised transactions.

Shared credentials remove the unique user identifier that links an action to a person, so no one can be held answerable for privileged changes. This directly undermines the accountability principle the audit is testing, since attribution becomes impossible when several administrators use one login.

Without enrollment or inspection, the hospital cannot enforce encryption, remote wipe, or data-retention controls on personally owned devices. Clinical data cached locally on an unmanaged laptop or tablet survives the end of employment, and the organization has no technical means to erase it. This loss of control over protected health information is the most significant exposure because it creates both regulatory breach liability and direct patient-privacy harm.

Without supervision, drives could be diverted, swapped, or only partially destroyed, and without certificates there is no evidence that destruction occurred. This combination eliminates accountability and leaves the organization unable to demonstrate compliance with data disposal requirements. For media containing customer financial records, the auditor should report the lack of oversight and documentation as the most important weakness because it directly threatens data confidentiality.

Incorporating lessons learned from tabletop exercises demonstrates a functioning feedback loop: identified gaps are remediated and the plan evolves. This evidences continuous improvement and validates that the IR plan adapts to discovered weaknesses, the strongest indicator of effectiveness.

Session recording and monitoring create attributable, tamper-evident evidence of every privileged action, deterring misuse and enabling detection after the fact. This satisfies the stem's prevention-of-misuse constraint by removing the anonymity that privileged accounts otherwise grant, since administrators know their sessions are captured and reviewed.

Where testing causes patches to breach the seven-day SLA, documented risk acceptance transfers accountability to business owners for the residual exposure during the delay. This satisfies the stem's compliance gap by ensuring deviations are formally acknowledged rather than silently tolerated, without abandoning the testing control.

The policy establishes tiers but omits the operational requirements that make classification meaningful. Without defined retention, handling, and labeling rules, employees cannot apply consistent protection, and reliance on individual judgment creates unacceptable variability. The auditor should recommend that management complete the policy by specifying these requirements for each tier, which provides a basis for later technical enforcement and monitoring.

The first step is to close the channel that bypasses the existing control. If personal webmail is blocked at the web gateway and DLP coverage is extended to web and other egress paths, employees can no longer trivially circumvent the appliance. This addresses the root cause by eliminating the unmonitored path, after which additional inspection technologies can be layered in as needed. It also aligns with a defense-in-depth approach that does not rely on a single inspection point.

A detection control is only effective if its output leads to timely investigation and response. Routing alerts to a queue that is actively monitored and acted upon closes the loop between detection and response, ensuring that a hash mismatch actually triggers investigation. Without this, even a technically perfect integrity check produces no security value because no one responds.

During transit, tapes are outside the physically protected data center, so the primary risk is loss, theft, or substitution. A chain-of-custody log with tamper-evident seals and dual custody provides detective and preventive assurance that media were not accessed or swapped. This directly addresses the in-transit exposure and complements encryption by ensuring the physical media remain accounted for.

Any-to-any rules bypass least privilege, so the auditor must first establish why each exists. Obtaining business justification determines whether the rule is genuinely required, enabling informed decisions to tighten, replace or remove it rather than blindly deleting needed connectivity.

Unannounced walkthroughs provide direct, contemporaneous evidence of actual workspace conditions, since staff cannot tidy desks in advance. This tests real compliance with the clean desk policy, unlike interviews or policy reviews that only confirm awareness or documentation.

Cleaning supplies and spare hardware in the same cabinet introduce chemical vapors, dust, physical impact, and possible liquid spills that can corrupt magnetic tape media. This is a direct threat to the recoverability of the organization's backup data. The auditor should report that media lack proper environmental controls and are exposed to contaminants and physical hazards, which jeopardizes restoration when it is needed most.

Audit logging records every authentication and authorisation event, including failed attempts, giving the auditor an independent trail to detect unauthorised access after the fact. This directly satisfies the stem's requirement for a detective control, unlike preventive measures such as passwords or Microsoft Entra ID conditional access, which block access but cannot reveal that an intrusion occurred.

Awareness programmes aim to change behaviour, so fewer successful phishing attacks demonstrates that staff actually recognise and resist real threats. This outcome metric reflects genuine risk reduction, unlike completion rates or quiz scores, which measure attendance rather than effectiveness.

Provisioning-time detection can fail if the tool is bypassed, if roles change later, or if emergency access is granted outside the workflow. Testing a sample of recently provisioned users verifies whether the control actually prevented conflicting combinations in practice. This substantive test provides evidence that the designed control operated on real transactions, complementing a review of the ruleset and revealing gaps between policy and execution.

Before concluding that a control failure exists, the auditor must establish whether those endpoints are still active and what protection they actually have. The 40 devices may be decommissioned, in storage, or covered by an alternate solution, in which case the finding changes significantly. Confirming asset status and compensating controls is the appropriate first step to validate the observation and avoid reporting an inaccurate finding.

Segmenting the cardholder data environment from corporate systems isolates it behind controlled conduits, so only that zone falls within PCI DSS assessment boundaries. This directly satisfies the stem's requirement by shrinking the systems, networks and business processes requiring validation, lowering audit effort and residual risk exposure.

Unpatched critical vulnerabilities accepted for six months require documented risk acceptance and compensating controls. Examining these satisfies the stem's constraint by verifying that the business impact assessment was formally approved and that residual risk is mitigated, rather than merely deferred.

The rule permits unrestricted access to Microsoft SQL on TCP port 1433, a severe exposure. Validating business justification before recommending removal or IP restriction is proportionate: the auditor confirms whether the documented temporary need still exists, then addresses the actual risk rather than assuming misuse.