CCNA Information Security Programme Questions

Employee role, past click rates, and current threat landscape help tailor simulations for effectiveness and relevance.

Leading indicators predict future security performance, and phishing click rate is a proactive measure that can be improved before a breach occurs.

Vendor tiering should be based on the risk they pose. Data access and service criticality directly affect organizational risk.

Reporting to the board or a senior executive not directly responsible for IT operations ensures independence and reduces conflicts of interest.

Security champions are advocates embedded in development teams to help integrate security into the development lifecycle, promoting secure development practices.

A SOC focuses on monitoring, detection, and response. Vulnerability management and identity management are separate functions.

Leading indicators predict future performance. Phishing click rate and knowledge assessment scores measure current behavior and knowledge, which can predict future incidents.

CIS Controls v8 are organized into Implementation Groups (IG1, IG2, IG3) and provide a prioritized, threat-informed set of controls.

CIS Controls v8 defines Implementation Group 1 (IG1) as the basic set of controls for small businesses with limited resources. IG1 is designed to be the minimum standard and should be implemented first.

Requiring the vendor to manage its sub-suppliers through contractual flow-down ensures the organization's risk requirements extend throughout the supply chain.

Vulnerability management includes scanning for vulnerabilities and remediation (patching).

Vendor tiering is typically based on the sensitivity of data the vendor accesses and the criticality of the service they provide. These factors determine the risk level and required controls.

Breach avoidance value quantifies the financial impact of prevented incidents, providing a direct link between security investment and risk reduction, which is compelling to the board.

Leading indicators measure proactive security posture; access review completion rate indicates how well entitlements are managed.

The SOC core functions include monitoring security events, detecting threats, and responding to incidents. Vulnerability management and security architecture are typically separate functions, though they may interact with the SOC.

NIST SP 800-53 is a comprehensive catalog of controls organized into families, commonly used by US federal agencies and many private organizations.

Phishing click rate is a leading indicator that measures user awareness and predicts future compromise risk.

Industry benchmarks indicate that mature security programs allocate 10-15% of IT budget to security. 12% falls within this range, suggesting a mature program.

Compensating controls require formal acceptance of the residual risk and approval by management to ensure accountability.

A SOC's core functions are monitoring for threats and responding to incidents. Vulnerability management and architecture are separate functions.

The board needs high-level, strategic metrics. Percentage of systems patched within SLA provides a clear, concise view of vulnerability management status, which is critical for risk reduction.

Breach avoidance value, compliance cost avoidance, and operational efficiency gains are direct, quantifiable benefits that resonate with executives.

Prioritizing critical controls first ensures the most important risks are addressed before less critical ones.

Security champions are volunteers within development teams who promote security best practices and facilitate communication between security and development.

Executives respond to financial justification. ROI based on breach avoidance demonstrates value in monetary terms.

Firewalls are a network security control that filter traffic based on rules.

Leading indicators predict future security outcomes. Access review completion rates indicate how well access controls are managed, which reduces risk of unauthorized access.

Reporting to the board or a risk committee provides independent oversight and reduces conflicts inherent in reporting to IT or operations.

A TPRM program includes onboarding risk assessment, ongoing monitoring, and exit procedures to manage risks throughout the vendor lifecycle.

ROI calculations, such as breach avoidance value, show financial benefit and resonate with the board.

Onboarding assessment should evaluate inherent risk (data access) and security capabilities (certifications).

The sensitivity of data accessed and the criticality of the service to operations are primary risk factors for vendor prioritization.

Lagging indicators measure past events. Mean time to detect (MTTD) is a lagging indicator because it reflects historical detection efficiency.

Defense-in-depth uses multiple layers of controls. Network segmentation, IDS, and encryption provide preventive, detective, and corrective layers at different points.

The organization should require the vendor to contractually manage nth-party risks, as the organization's data is still at risk.

Leading indicators are proactive measures that predict future performance. Patch compliance is a leading indicator because it shows current security posture that influences future incidents.

Leading indicators, such as the percentage of systems with known vulnerabilities patched within the SLA, provide early warning of potential issues. Patch compliance is a proactive measure that reduces risk.

Contractual security requirements (Option B) are essential because they legally bind the vendor to specific security controls, data protection obligations, and compliance standards. Without these enforceable clauses in the contract, the organization has no formal recourse if the vendor suffers a breach or fails to meet security expectations. This is a foundational element of any third-party risk management program, as it sets the baseline for acceptable risk transfer and due care.

Security champions are embedded in teams and receive specialized training, enabling them to advocate security practices.

CIS Controls v8 uses Implementation Groups to help organizations prioritize controls based on their maturity and risk.

Defense-in-depth uses multiple layers of security controls. Network segmentation limits lateral movement, and endpoint detection provides visibility at the host level.

A balanced dashboard should include both leading and lagging indicators to show current effectiveness and past outcomes.

Data access and service criticality are primary factors for tiering vendors.

The Identification and Authentication (IA) family in NIST SP 800-53 covers user identification, authentication, and credential management.

Compensating controls provide an alternative means of mitigating risk when the primary control is not feasible.

Nth-party risk refers to risks from suppliers of your suppliers, which can be overlooked.

A sustained downward trend in click rate over time indicates improved awareness and behavior, while single-click rate or reported emails may vary.

Defense-in-depth uses multiple layers of controls; here, network segmentation (preventive), IDS (detective), and incident response plan (corrective) cover different stages.

Role-based training targets specific risks relevant to each job function, making the training more practical and memorable.

The CIS Controls v8 are organized into three Implementation Groups (IG1, IG2, IG3) to guide organizations in prioritizing controls based on their risk profile and security maturity. NIST SP 800-53 and ISO 27001 use different categorizations.

Mature IAM includes lifecycle management (provisioning/de-provisioning), role-based access control (RBAC), and periodic access reviews to ensure least privilege.

Leading indicators predict future performance; phishing click rate and patch compliance are proactive measures.

Services include external consultants and managed security services, not personnel or technology purchases.

Role-based training tailors content to specific job functions, making it more relevant and effective than generic training. Developers need secure coding, executives need social engineering awareness, and all staff need basic awareness.

The vendor's access to sensitive data and the criticality of the service to business operations are the primary factors for tiering, as they directly impact risk exposure.

TPRM includes onboarding risk assessment, contract security requirements, and ongoing monitoring.

OKRs should be measurable and tied to security outcomes.

Executives need high-level summary metrics. Breach count is a lagging indicator that directly communicates security effectiveness to the board.

Reporting to the board of directors or a board committee ensures security has a direct voice at the highest level, avoiding conflicts with IT or business operations.

Security budgets typically include personnel costs (salaries) and technology costs (tools, software). Training and licensing are also common but may be subsumed under personnel or technology.

The first step is to perform a risk assessment based on the vendor's data access and service criticality to determine the appropriate level of due diligence. This aligns with the NIST framework for third-party risk management.

Applying critical controls first, such as those from the CIS Critical Security Controls, ensures that the most impactful controls are implemented early to reduce risk.

TPRM includes onboarding risk assessment, ongoing monitoring, and exit procedures for a complete lifecycle.

A mature program typically invests 10-15% of IT budget. The key driver is the organization's risk appetite and compliance requirements, not just revenue percentage.

A SOC includes monitoring, detection, and response capabilities. Security awareness training is not a SOC function; it is part of the awareness program.

Security champions act as liaisons, promoting secure coding practices and facilitating communication between security and development, thereby integrating security earlier.

Security champions act as advocates within teams, promoting security practices and bridging the gap between security and development.

Phishing click rate and patch compliance are proactive measures that predict future risk, unlike breach count and MTTD which are lagging.

Role-based training tailors content to specific job functions, making it more relevant and effective.

The security architect designs and reviews security architecture to ensure it aligns with business requirements and security standards.

Lagging indicators measure past performance or outcomes. Number of data breaches and mean time to respond (MTTR) are outcome and efficiency metrics that reflect past events. Patch compliance and phishing click rate are leading indicators.

The security architect designs security structures and ensures controls are integrated into systems and networks.

Developers need secure coding training to address vulnerabilities in code they write. Role-based training ensures relevance and effectiveness.

Leading indicators are proactive measures that predict future performance. Phishing click rate is a leading indicator because it measures current user behavior that can be improved before an incident occurs.

Reporting to the CEO or board provides independence from operational pressures, allowing the CISO to enforce security without conflict of interest. Reporting to the CIO can create conflicts, as security may be subordinated to IT goals. Reporting to legal or risk committees may lack operational authority.