CCNA Information Security Programme Questions

Lagging indicators reflect past incidents or performance. Breach count and mean time to detect (MTTD) are outcome-based metrics that show what has already happened.

A SOC is responsible for monitoring, detecting, and responding to security incidents.

Defense-in-depth requires multiple layers; input validation prevents injection attacks, and access control ensures least privilege.

Reporting to the CEO or board ensures the CISO has the authority and independence to influence security strategy without conflicting priorities from IT operations.

IG1 is the basic set of cyber hygiene controls designed for organizations with limited resources.

CIS Controls v8 explicitly defines implementation groups to help organizations prioritize controls based on their risk profile and resources.

Leading indicators like patch compliance and MTTD provide forward-looking insight and operational efficiency, while lagging indicators like breach count show past impact. A balanced scorecard should include both.

Tier 2 SOC analysts are primarily responsible for deep-dive analysis of alerts escalated from Tier 1, using threat intelligence, log correlation, and forensic techniques to determine if an alert represents a genuine security incident. They possess the technical expertise to differentiate false positives from true positives by examining raw packet captures, endpoint artifacts, and SIEM event details that Tier 1 analysts may lack the context or authority to investigate fully.

Vendor tiering categorizes vendors based on the criticality of services and data access to determine the appropriate level of due diligence and monitoring. This ensures resources are focused on high-risk vendors.

Leading indicators predict future incidents. Patch compliance, access review completion, and phishing click rate are proactive measures.

The primary purpose is to change employee behavior to reduce human-related security risks, such as phishing susceptibility.

Defense-in-depth uses multiple layers of security. Firewall (network), antivirus (host), encryption (data), and security awareness (human) provide overlapping layers.

Access Control (AC) and Identification and Authentication (IA) are the primary families governing access management.

IG1 consists of essential controls (e.g., inventory, malware defenses) that address the most common attacks, including ransomware.

Reporting to the CEO or Board gives the CISO independence from IT and better alignment with business strategy.

Security champions need dedicated time, training, and management support to be effective. Champions act as liaisons between security and development.

CIS Controls v8 organizes controls into Implementation Groups (IG1, IG2, IG3) to guide prioritization. NIST SP 800-53 uses families, and ISO 27001 uses Annex A controls.

Leading indicators are proactive measures. Phishing click rate predicts future breaches, and patch compliance indicates current vulnerability posture. Breach count and MTTD are lagging, and number of security tools is not a performance metric.

Leading indicators like phishing click rate and patch compliance are actionable and forward-looking, suitable for board-level oversight.

The security architect designs and reviews the security architecture, ensuring it meets business needs and security requirements. Other roles focus on operations, analysis, or awareness.

The security architect designs the security architecture, ensuring that security controls are integrated into systems and networks.

The CIS Controls v8 framework is uniquely structured around Implementation Groups (IG1, IG2, IG3) to provide a prioritized, risk-based approach to security control implementation. IG1 represents basic cyber hygiene for organizations with limited resources, IG2 adds more advanced controls for those with moderate risk, and IG3 includes comprehensive controls for high-risk environments. This tiered structure directly aligns with the CISM focus on aligning security controls with business risk and resource constraints.

C-suite executives need high-level strategic insights, not operational details. Top risks and key metrics (e.g., risk posture, critical incidents) are suitable for a dashboard.

Defense-in-depth (option D) is the correct approach because it implements multiple, overlapping layers of security controls (e.g., firewalls, IDS/IPS, endpoint protection, access controls) so that if one layer fails or is bypassed, subsequent layers continue to provide protection. This layered strategy reduces the likelihood of a single point of failure compromising the entire security posture, aligning with the CISM principle of risk mitigation through redundancy.

Vulnerability management includes regular scanning and a prioritization process to remediate based on risk. Patching is part of remediation, but scanning and prioritization are foundational.

The security architect designs and oversees the implementation of security architecture.

Mean time to remediate critical vulnerabilities directly measures risk reduction, as faster remediation lowers exposure.

Nth-party risk refers to risks from suppliers of your suppliers. Contractual requirements that cascade down the supply chain are essential to manage this risk.

Compensating controls are alternative measures that provide equivalent protection when a primary control cannot be implemented. Multi-factor authentication can compensate for weak passwords, and enhanced monitoring can compensate for missing patch on legacy systems.

Best practice for a mature security program is to allocate 10-15% of the IT budget to security. For a $10 million IT budget, that is $1 million to $1.5 million.

Compensating controls provide alternative protection when a primary control cannot be applied. Network segmentation limits the blast radius and reduces the attack surface until patching can occur.

Vulnerability management aims to identify, classify, and remediate vulnerabilities to reduce the attack surface.

A balanced scorecard includes leading indicators (like patch compliance) and lagging indicators (like MTTD) to provide a comprehensive view.

The provider's certifications and independent audits provide objective evidence of security controls, which is critical for trust.

For vendors handling sensitive customer data, the contract must include security requirements such as data protection clauses, incident notification timelines, and the right to audit. This ensures contractual enforceability of security controls.

Security analysts are responsible for alert triage and investigation.

Benchmarking against industry standards (0.2-0.5% of revenue) and showing the gap provides a compelling case.

Leading indicators predict future performance; patch compliance measures proactive risk reduction.

Security champions serve as liaisons, promoting security practices and facilitating communication between security and development teams.

The first step in incident response is to investigate and confirm the alert (triage) to avoid acting on false positives.

Security champions act as liaisons within development teams, promoting security best practices and improving collaboration.

The security scorecard with overall risk level is the most appropriate metric for a one-page executive summary because it provides a high-level, aggregated view of the organization's security posture. Executives need a concise, actionable summary that distills complex security data into a single risk indicator, enabling quick decision-making without technical details.

Developers need specialized training on secure coding practices to reduce vulnerabilities in applications.

A security champions programme embeds security advocates within development teams to promote secure practices, improve communication, and embed security into daily work, rather than incident response or policy enforcement.

Phishing click rate is a leading indicator because it predicts future incidents by measuring current behavior.

CIS Controls v8 defines Implementation Groups (IG1, IG2, IG3) that prioritize controls based on organizational maturity, starting with the most foundational and critical controls.

Security champions act as liaisons in development teams, promoting security practices and facilitating communication with the security team.

The security architect designs the overall security structure, including policies, technologies, and controls. Other roles focus on operations, analysis, or governance.

Leading indicators are proactive and predictive. Phishing click rate (user behavior) and patch compliance (vulnerability management) are leading indicators.

Prioritizing critical controls first, especially those that address the most significant risks and are business-enabling, aligns with defense-in-depth and risk-based decision making.

Leading indicators are proactive; patch compliance reflects current security posture, and access review completion indicates governance effectiveness.

Low detection time but high response time indicates that while alerts are generated quickly, the response process is slow due to inefficiencies in triage or remediation.

The SOC's primary objectives include monitoring, detection, and response to security incidents. Risk assessment is typically a GRC function, and policy creation is a governance function.

A risk assessment is performed to understand the risks before defining contract requirements and ongoing monitoring.

Progressive difficulty and remediation training for clickers helps users learn while minimizing negative impact on productivity.

Managing nth-party risk requires understanding the cloud provider's supply chain. Contractual requirements for the provider to manage their subcontractors and regular audits help mitigate downstream risks.

Critical controls that address the most significant risks should be implemented first.

Database activity monitoring (DAM) can detect unauthorized access or exfiltration attempts, providing visibility and alerting without impacting performance. Encryption at rest is preferred, but DAM is a compensating control when encryption is not feasible.

Nth-party risk requires understanding the provider's subcontractors; requiring disclosure and assessment of their vendors is key.

Reporting to the CEO or board of directors ensures the information security function operates independently from operational and IT management, preventing conflicts of interest where security decisions could be overridden by cost or performance pressures. This structure aligns with the CISM principle that the CISO must have sufficient authority to enforce security policies across the entire organization without reporting to a function that may prioritize other objectives over security.

Role-based training ensures that each group receives content relevant to their responsibilities.

Security champions embed security advocates within development teams to promote secure practices.

CIS Controls v8 defines three implementation groups: IG1 (basic cyber hygiene), IG2 (intermediate), and IG3 (advanced) based on organization size and risk.

Leading indicators are proactive measures that predict future performance; phishing click rate reflects current behavior that influences future security incidents.

To manage nth-party risk, the programme should require vendors to disclose their subcontractors, include contractual clauses flowing down security requirements, and have the right to audit subcontractors. Assessing all suppliers' suppliers is impractical; focusing on high-risk vendors is more feasible.

Role-based training tailors content to job functions, and phishing simulations with remediation training reinforce learning.

A one-page dashboard for the C-suite should include both leading and lagging indicators that provide a high-level view of security posture, such as patch compliance (leading) and mean time to detect (lagging).

Encryption is a fundamental control for protecting data at rest. While DLP and access controls are important, encryption provides direct confidentiality protection.

Data access and service criticality directly affect the potential impact of a vendor compromise.

Presenting the return on investment (ROI) by quantifying avoided breach costs and compliance savings provides a business case for budget increases.

Developers need secure coding and threat modeling to build secure applications.

Phishing simulations and role-based training are core components of awareness programs. Penetration testing is a technical assessment, vulnerability scanning is technical, and security architecture is a design function.

Leading indicators predict future performance. Patch compliance measures proactive security posture.