CCNA Information Technology and Security Questions

Testing changes in a non-production environment before deployment is a key preventive control in change management. A high percentage of changes tested indicates that the process is effectively identifying and mitigating potential issues before they affect production. This directly reduces the risk of service disruptions, data corruption, and security vulnerabilities introduced by changes.

Automating access revocation and provisioning based on HR role changes ensures that when an employee moves to a new role, their old access is immediately removed and new access is granted according to the new role. This event-driven approach directly mitigates the risk of excessive access rights, providing timely and consistent enforcement without relying on manual reviews.

Converging ICS with corporate IT dissolves the air gap, letting compromised enterprise credentials or lateral movement reach operational technology. This expanded attack path directly satisfies the stem's convergence scenario, where IT-borne threats can now pivot into production systems, escalating impact from data loss to physical process disruption.

A defined risk assessment methodology supplies common criteria, scales and scoring, so different business units identify and evaluate risks consistently. Without it, assessments vary by assessor and cannot be aggregated, failing the stem's requirement for enterprise-wide consistency in identification and assessment.

RSA-2048 is vulnerable to Shor's algorithm, so a cryptographic inventory identifying where RSA is used, followed by migration planning toward post-quantum algorithms, addresses the harvest-now-decrypt-later threat. This satisfies the stem's urgency requirement, since long-lived encrypted data can be captured today and decrypted later.

A defined cryptoperiod limits the volume of data protected by a single key and bounds the damage if a key is compromised. Scheduled rotation, rekeying, and secure retirement ensure keys do not outlive their intended use, satisfying lifecycle governance requirements and reducing exposure from undetected key compromise.

Container images often include third-party libraries and base images that may have known vulnerabilities. If not scanned and patched regularly, these vulnerabilities can be exploited to compromise the container and potentially the host. This is a significant risk in containerized environments because images are immutable and may be reused across deployments, propagating vulnerabilities.

A risk assessment methodology defines how risks are identified, analysed, evaluated and prioritised, forming the foundation on which the entire IT risk management programme operates. Without it, consistent scoring and treatment decisions across the organisation are impossible.

The click-through rate on simulated phishing campaigns directly measures employee behavior when faced with a phishing attempt. A decreasing trend over time indicates that employees are becoming better at recognizing and avoiding phishing emails, which directly correlates with reduced risk. This metric provides actionable insight into the effectiveness of the training program in changing behavior.

The Protect function covers safeguards that limit or contain the impact of a cybersecurity event, directly supporting delivery of critical services. It spans identity management, access control, awareness training, data security and protective technology, matching the goal of implementing appropriate safeguards.

The Protect function covers safeguards that limit or contain the impact of a cybersecurity event, securing delivery of critical services. It encompasses identity management, access control, data security and protective technology, directly matching the stem's focus on implementing safeguards.

Risk-based prioritization weighs the likelihood of exploitation, drawn from threat intelligence and known exploited vulnerability catalogs, against the business impact of the affected asset. This focuses limited remediation capacity on findings that present real, material risk to the organization, which is the core purpose of vulnerability risk management rather than severity sorting alone.

API gateway logging captures all API calls and responses, enabling continuous monitoring. By defining risk thresholds for anomalous behavior, the organization can detect deviations that indicate increased risk exposure. This approach provides ongoing, automated visibility into third-party API activity, aligning with the requirement for continuous risk monitoring and early warning of potential issues.

Defense in depth assumes the perimeter will eventually be crossed, whether by a compromised workstation, a malicious insider, or lateral movement after a phishing incident. Requiring mutual TLS and token validation on the funds-transfer API ensures that even an attacker already inside the private network cannot invoke transactions without valid credentials and an encrypted channel.

When customer data is processed in a foreign jurisdiction, the most critical initial risk is whether the transfer and storage comply with applicable data protection and privacy regulations, such as GDPR or local banking laws. Non-compliance can result in significant fines, reputational damage, and legal injunctions, making this the primary risk to evaluate before other factors.

Limited firmware update capability means discovered vulnerabilities cannot be remediated, leaving flaws exploitable indefinitely across many vendor devices. This unpatched exposure is the primary risk, since other concerns such as physical tampering or data volume are secondary to permanently unpatchable attack surface.

Multi-tenancy relies on logical isolation mechanisms such as hypervisors, containers, and network segmentation to keep tenants separate. A flaw in these controls can lead to data leakage or cross-tenant attacks, which is a direct and severe risk specific to shared environments. This is the most critical risk because it can compromise confidentiality and integrity of customer data without the organization's direct control.

PII spanning multiple jurisdictions triggers conflicting residency and privacy mandates, so data sovereignty and local regulatory compliance dominate. Where data resides and which laws govern it determine lawful processing, transfer restrictions and breach liability, outweighing other cloud analytics risks.

Manipulating operational parameters can drive actuators, valves or turbines beyond safe limits, producing physical destruction or safety incidents rather than mere data loss. That direct kinetic consequence outranks confidentiality or availability risks when integrating IT with OT for real-time monitoring.

EDM03 — Ensure Risk Optimization sits within the Evaluate, Direct and Monitor domain, giving the governing body explicit accountability for evaluating risk appetite, directing risk responses and monitoring that risk management stays aligned with enterprise objectives, exactly the governance responsibility the scenario demands.

Black-box credit scoring prevents the institution from justifying adverse decisions to regulators, breaching explainability obligations. Addressing this risk directly satisfies the compliance constraint, since undocumented model reasoning cannot be defended during supervisory review or customer appeals.

Public cloud workloads share physical hosts, hypervisors and network fabric with other tenants, so a hypervisor escape, side-channel attack or misconfigured isolation could expose one tenant's data to another. This risk is specific to shared infrastructure and absent from dedicated on-premises hosting.

Hard-coded secrets in images or manifests are easily exposed through image layers, source repositories, or runtime environment variables. In a banking context, exposed API keys could allow attackers to bypass authentication and access customer data. This risk is both highly likely and high impact, and it can be mitigated through secret management tools, image scanning, and secure coding practices, warranting priority in the risk register.

Cyber policies typically exclude physical perils such as power outages without a malicious element, since these are property or business-interruption losses rather than cyber incidents. This exclusion satisfies the stem's requirement by removing non-malicious, non-cyber causes of loss from cover.

Under the shared responsibility model the provider secures the cloud infrastructure, while the customer always owns its data. Classification and access control are therefore customer duties, governing who may reach data and how it is labelled, regardless of the deployment model chosen.

NERC CIP standards mandate controls such as electronic security perimeters, access management and incident reporting for entities operating bulk electric system assets. Their primary objective is protecting the reliability of that system, satisfying the stem's compliance requirement for the power utility.

Cyber insurance policies commonly exclude loss from acts of war, since such catastrophic, state-driven events are deemed uninsurable. A risk manager must recognise this exclusion because it leaves the organisation retaining that risk, requiring separate treatment within the risk register rather than assuming cover.

Confidential computing isolates the payment workload inside a hardware-backed trusted execution environment so that memory contents remain encrypted and inaccessible to the hypervisor, host OS, or cloud operator even while the application actively processes them. This directly satisfies the requirement to protect cardholder data in use, which transport and at-rest encryption cannot achieve.

War and state-sponsored attack exclusions remove cover for precisely the severe, costly incidents many organisations most need to transfer. Reviewing these exclusions satisfies the evaluation criterion of identifying retained risk, because excluded events remain the organisation's financial responsibility.

A SOC 2 Type II report provides an independent auditor's opinion on the design and operating effectiveness of the provider's controls over a period of time. This gives the risk practitioner evidence that controls are not only designed appropriately but have been tested and operated effectively, which directly supports risk assessment and monitoring of the outsourced service.

EPSS estimates the probability that a vulnerability will be exploited in the wild within 30 days, and combining it with asset criticality aligns remediation with actual business risk. CVSS base score alone reflects intrinsic severity, not likelihood of exploitation or business impact. This enhancement directly supports risk-based prioritization, which is a core CRISC objective.

Data classification exists to match protection to impact, so the governing factor is the harm that unauthorized disclosure, modification, or loss would cause to individuals and the institution. Health notes and financial aid records carry regulatory and reputational consequences far beyond their storage cost, and that impact analysis correctly drives the encryption, access, and retention controls.

RBAC with least privilege ensures that staff members are granted only the access necessary to perform their job functions. This limits the potential for unauthorized access and reduces the attack surface. It is a preventive control that directly addresses the risk of internal staff accessing patient data they do not need, and it is a fundamental requirement of many healthcare regulations.

The API gateway is the entry point to internal microservices. If authentication or authorization is weak, a partner or attacker could bypass controls and reach services they should not access, leading to data exposure or system compromise. This is a preventive control gap with direct impact on confidentiality and integrity, making it the most critical risk to address before exposing the gateway externally.

A risk-based prioritization process ensures that remediation efforts focus on vulnerabilities that pose the greatest risk to the business. By factoring in asset criticality, threat intelligence, and exploitability, the organization can allocate resources efficiently and reduce the most significant exposures first. This directly addresses the missing prioritization component and aligns vulnerability management with business risk.

The SD-WAN controller is the central policy and orchestration point; if an attacker gains control through the third-party management plane, they can alter routing, disable encryption, or redirect regulated traffic. This represents a high-impact, high-likelihood risk given the external dependency. It directly threatens confidentiality and integrity of regulated data, making it the most significant risk.

Shor's algorithm lets a sufficiently large quantum computer solve integer factorisation and discrete logarithms in polynomial time, undermining RSA, Diffie-Hellman and ECC — the public-key algorithms protecting key exchange and signatures. Symmetric ciphers like AES are weakened only quadratically by Grover, so they are not the primary risk.

Linking ICS to the corporate network exposes operational technology to threats previously confined to IT, expanding the attack surface across both domains. This satisfies the stem's convergence scenario, where compromised corporate endpoints or lateral movement can now reach industrial control systems directly.

Standing privileged accounts persist indefinitely and are often forgotten, creating a large attack surface. JIT access grants privileges only when needed, for a limited time, with approval and session recording, so dormant entitlements no longer exist. This directly reduces the risk of exploitation of stale or unused privileged accounts by both external attackers and malicious insiders.

Recovery time objective is about elapsed time until service is restored. Automated failover and DNS cutover are usually the longest sequential steps in a cloud recovery, so measuring their end-to-end duration against the documented objective is the most direct validation that the time target is achievable in practice rather than aspirational.

A documented history of previous security incidents directly raises the insurer's assessed loss frequency, increasing the premium. Underwriters price cyber cover on actuarial loss experience, so prior breaches signal elevated recurrence risk and weaker controls, satisfying the stem's requirement to identify the factor that most likely increases the premium charged.

Harvest-now-decrypt-later exposure means encrypted data captured today is at risk once quantum advantage arrives, so migration planning and crypto-agility assessment must start immediately. This satisfies the stem's immediate-action constraint, since inventorying algorithms and enabling rapid substitution takes years.

An automated JML process integrated with HR ensures that account disabling and session revocation occur promptly and consistently when an employee leaves. It reduces the window of exposure caused by manual delays and human error, directly mitigating the risk of unauthorized access by terminated employees. This is the most effective preventive and detective control for the described scenario.

A volumetric DDoS attack aims to saturate the network link. If the attack traffic exceeds the 1 Gbps connection capacity, the link becomes congested, and legitimate traffic cannot pass, causing an outage. The impact is directly determined by whether the attack volume overwhelms the available bandwidth. This makes the connection bandwidth the most important factor in assessing the potential impact.

Data architecture defines how data is stored, processed, and moved across the enterprise. Because it governs data at rest and in motion, classification and encryption controls belong at this layer, directly addressing the storage and processing responsibility in the stem.

Mapping Framework outcomes to enterprise risk processes ties security spending and controls to stated business objectives, letting leadership prioritise investment by impact. This satisfies the integration benefit of aligning cybersecurity activities with what the organisation is trying to achieve.

Loss Magnitude in FAIR represents the total monetary loss an organisation would incur from a single loss event, combining primary and secondary loss forms. It satisfies the stem's quantification constraint by expressing impact in financial terms, distinct from probability or frequency. This makes it the probable financial impact of a cyber incident.

The RPO defines the maximum tolerable data loss. A nightly backup means the organization could lose up to twenty-four hours of transactions, far exceeding the fifteen-minute RPO. This is the most significant finding because the design fundamentally cannot meet the stated business requirement, exposing the organization to unacceptable data loss in a recovery scenario.

A unidirectional gateway permits data to flow only from the ICS outward to corporate IT, physically preventing inbound commands or protocol exploitation. This isolates the unauthenticated legacy protocols while preserving real-time operational data access, satisfying the availability constraint without modifying the control system.

Smart buildings mix devices from many vendors with differing firmware formats and update mechanisms, so no single patching process applies. This diversity makes timely firmware remediation impractical, leaving vulnerabilities unaddressed and directly constituting the update challenge the scenario identifies.

The attack relied on a stolen credential being sufficient to deploy code. Multi-factor authentication means a password alone cannot authenticate, and short-lived, pipeline-scoped tokens limit what a captured token can do, directly breaking the specific path used in this incident. This combination is the most targeted reduction of the demonstrated risk.

Connecting OT to the corporate WAN crosses an electronic security perimeter, so NERC CIP ESP controls—firewalls, access control, monitoring at every boundary—are directly triggered. This is the most significant compliance risk because unsecured routable paths between trusted and untrusted networks breach the standard's core requirement.

NERC CIP requires utilities to identify and protect Critical Cyber Assets supporting the bulk electric system, forming the basis for subsequent controls. This directly satisfies the standard's core obligation to catalogue and secure assets whose compromise could disrupt reliable power delivery.

Automated deprovisioning tied to the HR system ensures that account disablement occurs as soon as a termination is recorded, eliminating the 30-day window. This directly addresses the audit finding by reducing the risk of unauthorized access by former employees. It is a preventive control that is both efficient and auditable, and it aligns with least privilege and timely access revocation principles.

Each connected IoT device adds a potential entry point, so the sheer number of endpoints materially widens the attack surface an adversary can probe. This directly satisfies the scenario's environmental-monitoring deployment, where many low-power sensors often lack hardening, patching or monitoring, multiplying exploitable weaknesses.

SAST analyzes source code for security flaws without executing the program, allowing developers to identify and fix vulnerabilities early in the development phase. Integrating SAST into the CI/CD pipeline before merge ensures that insecure code does not progress to later stages. This is a preventive control that reduces the cost and effort of remediation compared to finding issues in production.

Protect encompasses the safeguards that limit or contain a cybersecurity event's impact, directly satisfying the stem's requirement to ensure delivery of critical infrastructure services. Its categories cover identity management, access control, awareness training, data security, maintenance and protective technology — the controls that actually secure service delivery.

EDM03 addresses risk optimisation within the Evaluate, Direct and Monitor domain, ensuring IT-related risk is identified, assessed and kept within the enterprise's risk appetite. It satisfies the stem's governance objective because EDM03 specifically covers evaluating, directing and monitoring IT risk management.

Compromise of a trusted root CA undermines the entire chain of trust, enabling attackers to issue fraudulent certificates that appear legitimate. This is a catastrophic residual risk because it can affect all certificates issued under that root, including those used for authentication and signing. Even with strong internal controls, reliance on a third-party CA introduces this systemic risk that cannot be fully mitigated by the organization.

PII from multiple jurisdictions triggers conflicting legal requirements about where data may reside and when it may cross borders. Data sovereignty and transfer restrictions therefore dominate the architecture review, since violating them creates regulatory and contractual exposure that other cloud risks do not.

In a multitenant SaaS PACS, the dominant exposure is logical separation failure, so confirming that tenant isolation is enforced and that each tenant's encryption keys are segregated directly mitigates cross-tenant image disclosure. This control targets the actual mechanism by which one customer could read another customer's DICOM objects, making it the most direct risk response for the stated scenario.

NERC CIP requires responsible entities to define and protect an Electronic Security Perimeter enclosing critical cyber assets, controlling all electronic access points into the bulk electric system environment. This is a mandated CIP-005 control, unlike generic measures such as encryption or patching, which are not perimeter-specific.

Under HIPAA, the covered entity remains responsible for PHI even when a business associate handles it. The contract must define when and how the vendor will notify the hospital of a breach and who bears the cost of regulatory penalties and patient notifications. Without these terms, the hospital faces unmitigated financial and reputational risk.

The primary cause of cloud storage exposure is permissive bucket policies or ACLs that grant public or broad access. Enforcing deny-public-access settings and least-privilege identity policies directly prevents unauthorized parties from reading the confidential objects, which is the exact exposure scenario. Encryption complements this but does not substitute for correct access control.

COBIT 2019's EDM03 governance objective sits within the Evaluate, Direct and Monitor domain and explicitly assigns accountability for ensuring risk management is optimised, aligning risk appetite with enterprise objectives. It is the specific objective covering risk optimisation, not risk identification or treatment execution.

Unpatchable, low-power IoT sensors each expose services that attackers can reach, so every added device widens the exploitable footprint. Prioritising this expanded attack surface with unpatched devices addresses the constraint that firmware cannot be remediated easily across the remote facility.

Data residency laws restrict where customer data may be stored and transferred, so a cloud analytics platform spanning jurisdictions risks unlawful cross-border movement of sensitive records. This legal constraint, not generic breach exposure, creates the greatest compliance risk for the institution.

The SOC 2 report addresses the vendor's internal controls, but the missing contractual terms represent unmitigated legal and compliance risk. Amending the contract to add breach notification timelines, data deletion commitments, and audit rights directly addresses those gaps. Reassessing residual risk afterward ensures the risk register reflects the improved control environment and the organization's reduced exposure.

Secure coding training equips developers with the knowledge to avoid common vulnerabilities such as injection and cross-site scripting. When developers understand security principles, they can write more secure code from the start, reducing the need for later fixes. This is a foundational shift-left practice that embeds security into the development process and directly reduces the cost of remediation.

Model bias is the AI/ML risk where training data or algorithm design produces systematically unfair outcomes for particular demographic groups. It directly matches the stem's concern about biased credit-scoring decisions against protected groups, distinguishing it from other risks such as drift, opacity or overfitting.

Establishing the policy first sets risk appetite and governance, then methodology standardises assessment, the register records findings, treatment addresses them, and reporting communicates results. This order ensures each component builds on approved direction rather than ad hoc activity.

FAIR quantifies risk as loss event frequency multiplied by loss magnitude. Loss magnitude estimates the probable financial impact of a breach, covering primary and secondary response, replacement and reputational costs, which is exactly the factor needed for the impact calculation.

TLS encrypts data in transit, directly removing the plain-text exposure over the public network that the ARB flagged. Encryption is a preventive control that reduces likelihood, which suits an architectural review where the risk is interception of credentials or sensitive payloads.

Continuous security monitoring of network traffic directly fulfils the Detect function's requirement to identify cybersecurity events as they occur. Unlike Identify or Protect activities, detection demands ongoing visibility, and traffic monitoring provides the timely anomaly discovery the framework expects, satisfying the stem's mapping of Detect to risk management processes.

Before any controls can be effectively applied, the organization must know where cardholder data is stored, processed, and transmitted in the cloud environment. Data discovery and classification define the scope of PCI DSS compliance and ensure that subsequent controls are applied to the correct assets, preventing gaps or unnecessary effort.