CCNA Crisc It Security Questions

The Identify function covers risk assessment and management, and the Protect function involves safeguards that are assessed for effectiveness.

EDM03 — Ensure Risk Optimization is the governance objective that addresses risk management evaluation, direction, and monitoring.

Quantum computers capable of breaking RSA-2048 are not expected within the next few years, so the primary consideration is the timeline for quantum advantage to prioritize migration efforts.

Convergence increases attack paths, legacy OT devices lack security, and attacks can have physical safety consequences.

The Protect function (PR) is defined as developing and implementing appropriate safeguards to ensure delivery of critical infrastructure services.

EDM03 (Ensure Risk Optimization) is the COBIT 2019 process that evaluates, directs, and monitors risk management to optimize risk exposure.

Data security, identity management, and compliance are typically customer responsibilities, while physical security is the provider's. Misunderstanding these can lead to gaps.

IEC 62443 is a series of standards specifically designed for the security of Industrial Automation and Control Systems (IACS). It addresses cybersecurity requirements to protect these systems from cyber threats. Identification and authentication control (B) is a foundational requirement, ensuring that only authorized users and devices can access the system, which is critical for preventing unauthorized access to industrial processes.

In the shared responsibility model, the customer is responsible for data classification and access controls. Data sovereignty is a key concern when processing EU personal data, as the CSP may store data in jurisdictions that do not provide equivalent protection. The risk manager must ensure contractual and technical measures align with GDPR requirements.

Multi-tenancy isolation concerns include the risk of hypervisor vulnerabilities allowing tenants to access each other's data (A) and the risk of misconfiguration leading to data exposure (B). Vendor lock-in (C) is not about isolation; data sovereignty (D) is about geographic location; shared responsibility (E) is about roles.

Option A is correct because a comprehensive inventory of cryptographic assets and dependencies is essential to identify all systems, applications, and data that rely on current cryptographic algorithms (e.g., RSA, ECDSA, Diffie-Hellman). Without this inventory, the organization cannot prioritize migration efforts, assess impact, or ensure that no legacy cryptographic dependency is overlooked during the transition to post-quantum algorithms.

A risk assessment methodology is an essential component of a risk management policy because it defines the standardized approach for identifying, analyzing, and evaluating IT risks. Without a prescribed methodology, risk assessments would be inconsistent, making it impossible to compare risks across the organization or to align them with the risk appetite. The policy must mandate a repeatable process, such as NIST SP 800-30 or ISO 31010, to ensure objectivity and defensibility in risk decisions.

Regulated decisions often require explainability to ensure compliance and auditability, which can be challenging with complex AI/ML models.

The risk of a single region failure can be mitigated by implementing a multi-region deployment with failover. This aligns with high availability and disaster recovery best practices.

EDM03 — Ensure Risk Optimization is the COBIT 2019 governance objective specifically designed to ensure that the enterprise's risk appetite and risk tolerance are defined, communicated, and understood, and that risk is managed within those boundaries. It focuses on aligning risk management with enterprise objectives and ensuring that residual risk is acceptable.

Data sovereignty refers to legal requirements that data be stored and processed within certain geographic boundaries. Cloud providers may store data in multiple jurisdictions, leading to compliance risks if data crosses borders without authorization.

IoT devices often have limited processing power and cannot run standard security software, making them vulnerable to attacks.

The risk register is the central repository for documenting identified risks, their assessed impact and likelihood, and the corresponding treatment plans (e.g., mitigate, accept, transfer, avoid). Its primary purpose is to provide a structured, living record that enables ongoing tracking, prioritization, and management of risk treatment activities throughout the IT risk management lifecycle.

Integrating OT and IT networks creates a new attack path from the IT network to the OT network. Since OT systems often lack modern security controls and run legacy protocols (e.g., Modbus, DNP3), an attacker who compromises the IT network can pivot into the OT environment, potentially disrupting physical processes. This risk is prioritized because it introduces a direct, high-impact threat to safety and availability that did not exist before the integration.

IoT devices expand the attack surface, and many medical devices have weak security, making them easy targets for attackers to gain network access.

A risk management policy establishes the principles, objectives, and responsibilities for risk management, providing a foundation for all other risk management activities.

IEC 62443 is a comprehensive standard covering security management, system design, and component requirements. It requires risk assessment, defense-in-depth (zones and conduits), and secure development lifecycle.

Insurance premiums are heavily influenced by the organization's risk profile, including its security posture. A strong security posture reduces perceived risk and thus premiums.

The first step is to inventory all cryptographic systems to understand where quantum-vulnerable algorithms are used, enabling a migration plan.

Attack path expansion allows attackers to move from IT to OT. Legacy systems often have weak security. Both are primary risks.

The ARB reviews solution architectures to identify and address security risks before implementation, ensuring alignment with the organization's risk appetite.

The NIST CSF core functions include Identify, Protect, Detect, Respond, and Recover. Identify and Protect are two of them.

ALE = LEF * LM = 0.2 * $5,000,000 = $1,000,000.

IEC 62443 requires segmentation of OT networks into zones and conduits to isolate critical control systems from less trusted networks and control communication flows. This is a foundational security requirement because it limits the blast radius of a cyber incident and enforces access controls between different security levels.

FAIR calculates loss magnitude using loss event frequency and loss magnitude (monetary impact). The probable financial loss is derived from these factors.