CCNA Information Technology and Security Questions

A primary function of an Architecture Review Board (ARB) is to evaluate solution architectures for security risks prior to implementation. This proactive review ensures that security controls are embedded in the design phase, reducing the likelihood of vulnerabilities being introduced into production systems.

The risk management policy is the authoritative document that establishes the organization's overall approach to risk management, including the principles, roles, responsibilities, and processes for risk assessment, treatment, and reporting. It sets the governance framework and mandates how risk activities must be conducted across the IT environment, ensuring consistency and alignment with business objectives.

IoT devices often have limited security features and may lack the ability to receive firmware updates, making them vulnerable and expanding the attack surface.

Connecting ICS to the corporate network expands the attack surface, allowing threats from the IT network to reach OT systems, potentially leading to safety incidents.

Risk treatment means selecting and applying controls that change the likelihood or impact of an identified risk. Enforcing least privilege and monitoring database activity directly reduce the chance of unauthorized access, which is the likelihood dimension in the register. Re-scoring, escalation and insurance are assessment, governance and transfer activities that leave the underlying exposure unchanged.

In hybrid IAM, the greatest risks arise from controls that grant or preserve broad access without adequate oversight. Excessive standing privileges on service accounts enable attackers to move laterally and persist, while synchronization failures can leave active cloud credentials for users who should no longer have access. Both directly undermine the principle of least privilege and are often missed because they sit between on-premises and cloud governance processes.

The primary purpose of a risk register is to serve as a central repository for documenting and tracking all identified risks, their assessments (including likelihood and impact), and the corresponding risk response strategies. This ensures that risk management activities are transparent, auditable, and actionable throughout the risk lifecycle, aligning with the ISACA CRISC framework.

IEC 62443 is the international standard series specifically designed for industrial automation and control systems (IACS) security. It provides a framework for securing IACS across the entire lifecycle, including risk assessment, system design, and operational security, with roles defined for asset owners, system integrators, and product suppliers. It is the de facto standard for OT/ICS security.

The insurer needs to know which systems support which business processes before deciding on treatment, and that dependency mapping is the core purpose of the IDENTIFY function's Asset Management category. Governance sets direction, PROTECT enforces controls, and DETECT finds events, but none of those produces the asset-to-process inventory that leadership explicitly requested.

Data classification and data sovereignty are concerns about how data is categorized, where it resides, and which legal/regulatory jurisdictions govern it — all of which are addressed in the data architecture layer. This layer defines data models, ownership, retention, classification schemes, and cross-border data flow rules. Risk related to sovereignty (e.g., GDPR data residency) is fundamentally a data architecture design issue.

The NIST Cybersecurity Framework's Identify function includes categories such as Asset Management, Business Environment, Governance, Risk Assessment, and Risk Management Strategy. Risk assessment is explicitly a key component of Identify because understanding organizational risk is foundational to prioritizing cybersecurity activities. It is listed under ID.RA in the framework core.

The most effective way to reduce data leakage from lost or stolen BYOD devices is to enforce encryption and enable remote wipe through MDM. This ensures that even if the device is compromised, the data remains protected or can be erased. Other controls are helpful but do not provide the same direct technical mitigation.

Data architecture defines how data is stored, processed, and transmitted, including encryption policies. To ensure data encryption at rest (e.g., AES-256 for stored CRM records) and in transit (e.g., TLS 1.2/1.3 for API calls), the risk manager must evaluate the data architecture layer, which specifies encryption standards, key management, and data flow controls.

The ARB must ensure that security risks are identified and mitigated before implementation. A threat model systematically identifies potential threats (e.g., STRIDE) and maps them to security controls, ensuring that sensitive data is protected against attacks like injection, disclosure, or tampering. Without this review, the architecture could be deployed with unaddressed vulnerabilities.

Model bias leading to unfair lending practices is the most likely risk to cause regulatory penalties because credit scoring is heavily regulated under fair lending laws such as the Equal Credit Opportunity Act (ECOA) and Fair Housing Act. If an AI/ML model uses demographic data and produces disparate impact on protected classes, regulators can impose fines, sanctions, and enforcement actions. Unlike data privacy or model drift, bias directly violates anti-discrimination statutes, making it a legal compliance issue with immediate regulatory consequences.

Immutable backups are the most effective control because they cannot be altered or deleted for a set period, ensuring a clean recovery point even if ransomware compromises the network. Other controls like network access controls, encryption, or backup frequency do not prevent backups from being encrypted or deleted by ransomware.

The core issue is a mismatch between the business-required recovery time objective and what the current DR strategy can deliver. The risk practitioner must first document and escalate this gap so the business owner can make an informed risk decision. Directly purchasing technology or rewriting the objective without approval would circumvent governance.

Connecting ICS/OT systems to the corporate IT network exposes previously isolated OT devices to the corporate attack surface, allowing threats that compromise IT to pivot into OT. This expansion of the attack surface is the primary risk of IT/OT convergence because OT systems often lack security controls and cannot be easily patched. The other options are secondary or not risks at all.

The primary risk an Architecture Review Board should consider is the exposure of sensitive customer data through unauthenticated APIs, because this represents a direct, high-impact security and compliance risk (data breach, regulatory penalties, reputational damage). ARBs focus on risks that threaten confidentiality, integrity, and availability of critical assets, and unauthenticated API access to sensitive data is a classic OWASP API Security Top 10 issue.

Cyber insurance premiums are most significantly influenced by the organization's security controls and incident history, because insurers underwrite based on the likelihood and severity of a claim. Strong controls (MFA, EDR, backups, segmentation) and a clean incident history reduce perceived risk and lower premiums; poor controls and prior breaches raise them.

SAST integrated into the build process is the most effective for early risk identification because it analyzes code before it is deployed, providing immediate feedback to developers. This shift-left approach reduces the cost and effort of fixing vulnerabilities later. Other practices like DAST, manual reviews, or RASP occur later or are less scalable for continuous integration.

The risk register is the central repository within an IT risk management programme that formally documents identified risks, their assessed likelihood, and potential impact. It serves as the authoritative record for tracking risk ownership, mitigation status, and residual risk levels, enabling ongoing monitoring and reporting. Without a risk register, an organization cannot systematically manage or communicate its risk posture.

The most effective control for ensuring container images are free from known vulnerabilities before deployment is to integrate image scanning into the CI/CD pipeline. This allows automated detection and blocking of vulnerable images at build time. Runtime monitoring, network policies, and service meshes address other security aspects but do not meet the pre-deployment vulnerability assurance requirement.

Centralizing PHI in hospital-controlled infrastructure while presenting only a remote display is the most effective way to keep protected health information off unmanaged endpoints. Virtual desktop infrastructure with drive and clipboard redirection disabled preserves clinical workflow yet blocks the common exfiltration paths of copy, print, and local save. Endpoint-centric alternatives leave PHI resident outside the compliance boundary and are far harder to govern.

COBIT 2019's EDM03 — Ensure Risk Optimization is the governance objective that ensures enterprise risk management activities are aligned with business objectives by evaluating, directing, and monitoring risk appetite, tolerance, and capacity. It is the EDM domain objective specifically focused on risk optimization, making it the correct answer for the board's assurance need described.

EDM03 — Ensure Risk Optimization is the governance objective that addresses risk management evaluation, direction, and monitoring.

Quantum computers capable of breaking RSA-2048 are not expected within the next few years, so the primary consideration is the timeline for quantum advantage to prioritize migration efforts.

The best response is to obtain assurance through contractual audit rights or independent attestations like SOC 2 Type II. This directly addresses the lack of visibility into the provider's controls, which is critical for data integrity and compliance. Other options either accept the risk without assurance, implement costly redundancies that do not solve the problem, or transfer financial risk without addressing the control gap.

When a penetration test identifies plaintext storage of authentication tokens in shared application storage, the root cause is insecure secret handling on the endpoint. Moving tokens into the platform's hardware-backed keystore binds them to the application and blocks other apps from reading them. Certificate pinning, insurance, and root detection either address different threats or fail to remove the vulnerability, so remediation of the storage design is the correct response.

Network segmentation with strict firewall rules is the most effective mitigation because it isolates the POS environment from other networks, preventing attackers from pivoting from compromised workstations or guest Wi-Fi. This aligns with PCI DSS requirements and reduces the scope of compliance. Other controls like encryption, IDS, or MFA are valuable but do not address the fundamental risk of a flat network.

The NIST Cybersecurity Framework's Protect function (PR) covers the safeguards needed to ensure delivery of critical infrastructure services — including access control, awareness training, data security, information protection processes, maintenance, and protective technology. It is the function that directly addresses preventive controls.

COBIT 2019's EDM03 — Ensure Risk Optimization is the governance process specifically focused on ensuring that IT-related risk is identified, assessed, and managed within the enterprise's risk appetite. It is part of the Evaluate, Direct, and Monitor (EDM) domain, which is the governance domain.

Integrating SAST into the CI pipeline allows security checks to run automatically with every code commit, giving developers immediate feedback on vulnerabilities. This shifts security left, enabling fixes during development when they are cheapest and fastest to resolve. Other practices like penetration testing, training, and DAST are valuable but do not provide the same early, continuous, code-level risk detection.

IEC 62443 is a series of standards specifically designed for the security of Industrial Automation and Control Systems (IACS). It addresses cybersecurity requirements to protect these systems from cyber threats. Identification and authentication control (B) is a foundational requirement, ensuring that only authorized users and devices can access the system, which is critical for preventing unauthorized access to industrial processes.

When processing EU citizens' personal data in the cloud, the most critical risk is data sovereignty and cross-border transfer restrictions under GDPR. The regulation limits transfers of personal data outside the EU/EEA unless adequate safeguards (e.g., Standard Contractual Clauses, adequacy decisions) are in place. A CSP may store or replicate data in regions the organization did not intend, creating legal exposure that outweighs the other technical risks.

A comprehensive inventory of cryptographic assets and dependencies is essential to identify all systems, applications, and data that rely on current cryptographic algorithms (e.g., RSA, ECDSA, Diffie-Hellman). Without this inventory, the organization cannot prioritize migration efforts, assess impact, or ensure that no legacy cryptographic dependency is overlooked during the transition to post-quantum algorithms.

A risk assessment methodology is an essential component of a risk management policy because it defines the standardized approach for identifying, analyzing, and evaluating IT risks. Without a prescribed methodology, risk assessments would be inconsistent, making it impossible to compare risks across the organization or to align them with the risk appetite. The policy must mandate a repeatable process, such as NIST SP 800-30 or ISO 31010, to ensure objectivity and defensibility in risk decisions.

For a SaaS provider handling customer data, the most reliable assurance comes from an independent audit of controls over time. A SOC 2 Type II report provides exactly that, covering relevant trust services criteria. Other sources are either self-reported, point-in-time, or not designed for comprehensive risk assessment.

When AI/ML models drive decisions subject to regulatory oversight (e.g., credit, hiring, healthcare), explainability is the primary concern because regulators and affected individuals must understand how a decision was reached. Without explainability, the organization cannot demonstrate compliance with laws like GDPR Article 22 (right to explanation) or fair lending regulations, and cannot defend decisions in audits or disputes.

The identified risk is the lack of disaster recovery for a single-region cloud deployment. The best mitigation is to deploy across multiple cloud regions with automated failover, which directly addresses the availability and resilience gap by ensuring the application survives a regional outage. This is a preventive/architectural control that reduces both likelihood and impact of downtime.

EDM03 — Ensure Risk Optimization is the COBIT 2019 governance objective specifically designed to ensure that the enterprise's risk appetite and risk tolerance are defined, communicated, and understood, and that risk is managed within those boundaries. It focuses on aligning risk management with enterprise objectives and ensuring that residual risk is acceptable.

Data sovereignty is a key concern in cloud computing risk because data may be stored in jurisdictions with different privacy laws. This means that data could be subject to legal requirements that conflict with the organization's own compliance obligations, such as GDPR or HIPAA.

IoT devices are frequently constrained by cost, size, and power, which limits CPU, memory, and battery. This directly restricts their ability to run strong encryption, host-based firewalls, secure boot, or frequent patching, expanding the attack surface. Limited processing power is therefore a structural characteristic that elevates cybersecurity risk.

The risk register is the central repository for documenting identified risks, their assessed impact and likelihood, and the corresponding treatment plans (e.g., mitigate, accept, transfer, avoid). Its primary purpose is to provide a structured, living record that enables ongoing tracking, prioritization, and management of risk treatment activities throughout the IT risk management lifecycle.

Third-party remote access creates standing privileged exposure that must be constrained technically, not just contractually. Privileged access management with just-in-time elevation, credential vaulting, session brokering, and recording limits vendor reach to approved windows and produces attributable evidence. Policy signatures, standing admin accounts, and insurance certificates leave the actual access path uncontrolled.

Integrating OT and IT networks creates a new attack path from the IT network to the OT network. Since OT systems often lack modern security controls and run legacy protocols (e.g., Modbus, DNP3), an attacker who compromises the IT network can pivot into the OT environment, potentially disrupting physical processes. This risk is prioritized because it introduces a direct, high-impact threat to safety and availability that did not exist before the integration.

Implementing encryption at rest and in transit is the best risk response because it directly mitigates the risk of plaintext data exposure. It acts as a compensating control that can be applied without major changes to the legacy application, protecting sensitive data until decommissioning. This approach balances risk reduction with operational continuity, unlike acceptance, transfer, or avoidance which either leave the risk or disrupt business.

IoT medical devices dramatically expand the attack surface because each device is a potential entry point, often with weak default credentials, unpatched firmware, and limited security controls. In a hospital, this expansion is the most concerning risk because it multiplies exposure across the network.

Multi-factor authentication (MFA) is the most effective control to reduce the risk of unauthorized access from compromised credentials because it requires an additional factor that an attacker is unlikely to possess. Password policies, training, and account lockout are useful but do not prevent access when valid credentials are stolen and used. MFA directly addresses the risk by adding a barrier that cannot be overcome with the password alone.

A risk management policy establishes the principles, objectives, and responsibilities for risk management, providing a foundation for all other risk management activities.

Improving identification of exploitable vulnerabilities on internet-facing services requires seeing the full external attack surface and knowing which findings matter. Continuous external attack surface scanning discovers and inventories exposed assets, including unknown ones, while threat intelligence correlation prioritizes vulnerabilities that attackers are actively exploiting, focusing remediation where it reduces real risk.

The root cause of the incidents is that access rights are not updated when employees change roles. The most effective control is to automate the synchronization of role changes from HR to the IAM system, ensuring timely revocation of old access and assignment of new access. This preventive control addresses the issue at the source and reduces reliance on periodic reviews.

The risk is availability degradation caused by disproportionate consumption from one partner. Enforcing per-partner rate limits and quotas at the gateway constrains each consumer, and circuit breakers prevent overload from propagating into core banking. Contractual caps, mutual TLS and response encryption address expectations, authentication and confidentiality respectively, none of which stop a single partner from exhausting shared capacity.

An organization's cybersecurity maturity and incident history (C) is the most direct factor influencing cyber insurance premiums because insurers assess the likelihood and potential cost of a claim based on the organization's security controls, past breaches, and risk management practices. A mature security posture with few incidents lowers the perceived risk and therefore the premium.

The first step is to inventory all cryptographic systems to understand where quantum-vulnerable algorithms are used, enabling a migration plan.

SOC 2 Type II reports are point-in-time documents that cover only the stated audit period. When the report is stale, the risk practitioner needs evidence of controls during the gap. A bridge or gap letter is the standard mechanism for that period, supplemented by review of changes and incidents, allowing an informed residual risk determination.

Credential theft defeats knowledge-based authentication regardless of password strength, so the strongest mitigation changes the authentication factor itself. Phishing-resistant FIDO2 authentication uses origin-bound public-key cryptography, meaning stolen passwords or relayed phishing sessions cannot authenticate. Complexity rules, lockout, and awareness training are useful supporting controls but do not break the theft-to-access path.

Because service credits only refund fees and cannot restore lost orders, the organization retains the operational impact of a vendor outage. A documented and tested business continuity plan with a manual fallback directly reduces that impact by keeping order processing alive, whereas contract changes, assurance reports, and insurance all leave the business unable to operate during the outage.

A SIEM is only as reliable as the events it receives, so the priority is ensuring those events are authentic and consistently time-stamped. Protecting log sources and the transport path against tampering, and synchronizing clocks, prevents attackers from hiding activity or fabricating evidence. Volume, tuning, and packet capture all matter operationally but none of them restores confidence in data that could have been altered.

The two controls that actually prevent privileged client data from being exposed when a personal device is lost or compromised are escrowed full-device encryption and MDM with remote wipe plus containerization. Together they protect data at rest and allow selective removal of firm data, while the other choices are policy, perimeter, or financial measures that do not stop the leakage scenario.

Annualized Loss Expectancy (ALE) is calculated as Loss Event Frequency (LEF) multiplied by Loss Magnitude (LM). Here, LEF = 0.2 per year and LM = $5,000,000, so ALE = 0.2 × $5,000,000 = $1,000,000. This represents the expected annualized financial loss from the ransomware scenario.

Misconfigured cloud storage most often results in data exposure through overly permissive access policies and goes unnoticed due to insufficient logging and monitoring. These two risks directly affect confidentiality and the ability to detect and respond to incidents. Other options are either less directly related to misconfiguration or are not security risks in the same sense.

The HIPAA Security Rule is built on a risk management framework, and its first required implementation specification is an accurate and thorough risk analysis. Before selecting encryption, access controls, or contracts, the organization must identify and evaluate the risks to electronic PHI. That analysis then informs the selection of reasonable and appropriate safeguards for the portal.

IEC 62443 requires segmentation of OT networks into zones and conduits to isolate critical control systems from less trusted networks and control communication flows. This is a foundational security requirement because it limits the blast radius of a cyber incident and enforces access controls between different security levels.