CCNA Protection of Information Assets Questions

Encryption only reduces risk if the key is protected independently of the ciphertext and the host that processes it. A plaintext key file on the same application server means a single compromise exposes both data and key, nullifying the protection. Proper key management places keys in a dedicated key management system or hardware security module with strict access controls, separation from data, and documented lifecycle procedures.

The auditor should first determine if compensating controls exist to mitigate the vulnerability, because the presence of effective compensating controls may reduce the residual risk to an acceptable level even without patching. This step gathers evidence before concluding on the adequacy of risk treatment. Only after understanding the control environment can the auditor assess whether the lack of patching and risk acceptance constitutes a significant finding.

Water sprinklers are inappropriate for rooms housing energized IT equipment because discharge can destroy hardware and interrupt operations far beyond the fire itself. A clean agent or pre-action system provides suppression while minimizing collateral damage. Because management's justification rests only on the absence of prior activations, the auditor should recommend replacing the suppression method rather than merely inspecting or accepting it.

The RPO defines the maximum tolerable data loss, and the transaction log interval determines how much committed data could be lost in a failure. With log backups every 15 minutes, the system can lose up to 15 minutes of transactions, which exceeds the 5-minute objective. The auditor should report this mismatch between configured backup frequency and the stated business requirement.

The observation describes excessive entitlements combined with no formal role lifecycle, which is a least-privilege and access governance failure. Role-based access control aligns permissions to job duties, and documented request, approval, and periodic recertification provide the accountability and review evidence the auditor expects. Detective monitoring, user acknowledgments, and stronger authentication do not correct or govern the underlying entitlements.

The two most significant risks of relying solely on network DLP are that data copied to removable media may not be detected and that encrypted data traversing the network may not be inspected. Network DLP monitors data in motion across network boundaries but lacks visibility into endpoint actions like USB copying and often cannot decrypt traffic without interception. Endpoint DLP complements network DLP by monitoring data at the endpoint, closing these gaps.

The most significant risk is unauthorized access to sensitive information because late recertifications and failure to promptly remove terminated employees' access increase the window for misuse. Without compensating controls, this directly threatens data confidentiality. Thus, C is correct.

PIA aims to identify and mitigate privacy risks early in the project lifecycle.

In a flood-prone region, the dominant threats are water ingress and loss of standby power during the same event. Detection limited to the subfloor leaves overhead leaks unseen, and below-grade generators and fuel can be inundated precisely when they are needed. Both findings undermine continuity for the facility as a whole, whereas the suppression agent, floor rating, and badge access described are appropriate controls.

Effective classification depends on two foundational elements: an accountable owner for each information asset and a documented mapping from classification levels to specific handling requirements. Ownership drives consistent labeling and review, while the mapping translates labels into enforceable controls. Absent either element, business units interpret classification differently, which explains the inconsistency the auditor observed.

The RPO of 5 minutes means the organization can tolerate losing at most 5 minutes of data. Transaction log backups every 15 minutes create a potential 15-minute data loss window, exceeding the RPO. The auditor should recommend increasing the frequency of transaction log backups to 5 minutes or less to meet the stated recovery objective.

The exposure is that unencrypted media leaves the controlled environment in the hands of personnel who have not been screened. Because the confidentiality risk travels with the data, the durable fix is to make the data unreadable to anyone who gains possession of the tape. Encryption at the source neutralizes the threat regardless of courier behavior, while insurance, counting, and dual custody only address custody or recovery.

The primary objective of a penetration test is to identify vulnerabilities that could be exploited by an attacker, simulating real-world attack techniques to uncover weaknesses before malicious actors do. While penetration tests can inform control validation and compliance, their core purpose is offensive discovery of exploitable weaknesses, which then feeds remediation and risk management. This distinguishes them from vulnerability scans, which are automated and broader but less deep.

The most significant risk is unauthorized access to sensitive data due to excessive privileges, because the absence of manager confirmation means access rights may persist after role changes or terminations, accumulating unnecessary entitlements. Annual reviews by the application owner alone, without manager validation, fail to verify that each user still requires access for their current duties. This directly enables the accumulation of excessive privileges, which is the primary threat to data confidentiality in a financial application.

A DLP solution that only monitors the email gateway has a fundamental coverage gap: any data leaving through endpoints—USB drives, printing, cloud sync, or non-email network protocols—is invisible. Management's assumption that all sensitive data leaves via email is unverified and likely incorrect, so the auditor should flag the absence of endpoint agents as the most significant risk to the control objective.

The propped door is an active physical access control failure exposing the server cage to unauthorized entry. The auditor should first ensure the exposure is contained through immediate securing of the door and interim compensating measures such as monitoring, then pursue repair and accountability. Reporting alone or focusing on discipline or repair scheduling does not protect the assets during the outage.

The lack of certificate revocation validation means the RADIUS server will accept revoked certificates, allowing devices or users whose certificates have been revoked to authenticate. This defeats a key control of PKI-based authentication, as revocation is how compromised or expired credentials are invalidated. The most likely consequence is unauthorized network access by a revoked certificate holder.

Third-party assurance is only valid for the period it covers. A SOC 2 Type II report ending 14 months ago, with no bridge letter explaining the intervening period, leaves the auditor without evidence that controls operated effectively during the current period. The correct conclusion is that assurance is inadequate, and the auditor should pursue a current report, a bridge letter, or alternative procedures before relying on the provider.

Strong encryption depends on keeping the key outside the reach of anyone who can access the ciphertext. When the key file sits on the database server and is readable by the database administrator, the separation of duties that gives encryption its value disappears, and a single compromised account yields both data and key. The auditor should conclude that confidentiality protection is defeated and recommend a dedicated key-management capability such as a hardware security module.

Tabletop exercises are primarily designed to validate and practice the incident response plan by walking participants through simulated scenarios, which reveals whether employees understand their roles, responsibilities, and decision-making authority during an incident. Without them, the most significant risk is that staff will be unprepared and confused when a real incident occurs, leading to delayed or ineffective response.

The configuration described makes repeated lockouts easy to trigger and requires security staff to re-enroll affected users, which can deny access to legitimate personnel and create an administrative bottleneck. That operational and availability exposure is more significant than general biometric tuning questions such as false acceptance rate, skin variability, or the absence of a second factor, none of which are uniquely highlighted by the configuration as described.

If tabletop exercises only cover malware outbreaks, the incident response plan may not be validated against other relevant incident types such as ransomware, insider threats, DDoS, or data breaches. The greatest concern is that the IR plan has untested gaps for scenarios the organization is likely to face. This is a coverage and validation issue, not a frequency or capability issue.

Under the IaaS shared responsibility model, the provider secures the underlying infrastructure while the customer remains accountable for the guest operating system, applications, data, and identities. The auditor must therefore establish exactly where the responsibility boundary lies and obtain independent assurance, such as a SOC 2 Type II report, that the provider's controls operated effectively over time. Together these give the organization a reliable basis for relying on the provider.

Using the same encryption key for all customer data at rest creates a single point of failure: if that key is compromised, all encrypted data becomes exposed. This is the primary concern because it violates the principle of key separation and significantly amplifies the impact of a key breach. While other issues like performance or compliance may exist, the immediate and severe risk is the potential for mass data exposure.

The high training completion rate (95%) but high phishing failure rate (30%) indicates that the current training is not effectively translating into practical skills. Therefore, the most appropriate recommendation is to revise the content to focus on practical phishing recognition, making it more hands-on and relevant. This addresses the root cause: the training may be too theoretical or not engaging enough to change behavior.

The most significant risk is that a single volume failure could destroy both the database and its transaction log backups, eliminating any possibility of recovery. While RPO and RTO are important, the fundamental flaw is the lack of separation between production data and backups, which violates the principle of not storing backups on the same media as the data they protect. This configuration exposes the organization to catastrophic data loss.

To judge whether DLP stops sensitive records from leaving, the auditor must confirm the rules reflect the bank's data classifications and workflows, and that generated alerts are investigated and resolved through a defined incident process. These two factors together establish that the control both detects the right events and triggers action. Platform patching, endpoint encryption, and vendor certifications address adjacent concerns but not the operational effectiveness of the DLP control itself.

A classification scheme only produces security value when each asset is labeled and the label drives the handling rules. Without classification recorded in the inventory, owners cannot determine which baseline applies, so encryption, access restrictions, and disposal methods are chosen inconsistently. The policy becomes documentation rather than an operating control, and the auditor cannot trace requirements to implementation.

Individual accounts with privilege escalation ensure that every administrative action is tied to a unique user identity, which is the only way to preserve a reliable, attributable audit trail. Shared accounts inherently destroy accountability because the log records the account, not the person. Privilege escalation (e.g., sudo, just-in-time elevation) grants elevated rights only when needed, so the audit trail captures who performed each privileged action.

EAP-MD5 is a legacy EAP method that authenticates only the client to the server, not the server to the client. Without mutual authentication, an attacker can deploy a rogue access point to impersonate the legitimate network, capture the client's MD5-hashed credentials, and crack them offline. Enabling EAP-MD5 on a RADIUS server for WPA3-Enterprise therefore introduces a serious credential theft vector.

Storing backup media in the same physical location as the production system creates a single point of failure. A disaster such as a fire or flood could destroy both the original data and the backups, rendering recovery impossible. Best practice requires that backups be stored offsite or in a geographically separate location to ensure availability and support disaster recovery objectives.

The propped NOC door bypasses the badge-controlled entry and permits unauthenticated physical access to critical systems. The auditor's role is to document the condition, articulate the risk, and recommend remediation rather than to fix it personally or ignore it. Proposing an unrelated upgrade at the main entrance would not address the observed weakness, so reporting the finding with a targeted recommendation is the appropriate response.

The primary purpose of an information security policy is to communicate management's commitment, intent, and direction for information security across the organization. It is a high-level governance document that establishes the mandate from which standards, procedures, and guidelines flow. It is not intended to be technically prescriptive or operational.

Physical access to core transaction systems is a foundational control, and a door propped open removes that barrier entirely, allowing anyone nearby to reach the servers. Because physical proximity enables direct compromise, theft, or sabotage that logical controls cannot prevent, this observation carries the greatest risk. Missing logs, undocumented moves, and the absence of a mantrap are lesser issues by comparison.

Effective segmentation depends on preventing corporate systems from initiating sessions with control devices and on keeping the boundary rule set as narrow as operations allow. Direct reachability from engineering workstations to programmable logic controllers defeats the zone design, and a broad set of open ports gives attackers multiple paths into the ICS environment. Together these findings show that the firewall exists in name only and does not enforce the intended separation.

A risk-based patching process prioritizes critical patches for immediate deployment while allowing less critical patches to undergo standard testing. This balances security needs with operational stability, addressing the policy violation without sacrificing testing entirely. The auditor should recommend this approach because it aligns with industry best practices (e.g., NIST, ISO 27001) and enables faster remediation of high-risk vulnerabilities.