CCNA Compliance Maintenance Questions

MCQhard

During a routine audit of a federal system's continuous monitoring program, the auditor finds that the 'Security Control Assessment' results are three years old. What is the non-compliance violation?

A.Failure to perform annual control testing as part of continuous monitoring.

B.The organization failed to report the breach to the US-CERT.

C.The system failed to undergo a full re-accreditation.

D.The System Security Plan (SSP) was not updated in the FISMA database.

AnswerA

Ongoing authorization relies on periodic testing to ensure controls remain effective over time.

Why this answer

NIST SP 800-37 R2 requires that security controls are monitored and assessed frequently enough to maintain an ongoing authorization.

Practice this question →

MCQmedium

You are configuring a SIEM (e.g., Splunk) for continuous monitoring. You need to alert when a firewall configuration changes. What is the most important log source for this requirement?

A.Domain controller event logs.

B.Firewall audit/management logs.

C.DHCP server logs.

D.Endpoint antivirus logs.

AnswerB

These logs specifically record who made changes to the security ruleset.

Why this answer

Firewall configuration logs provide the audit trail necessary to detect changes to security policy parameters.

Practice this question →

Multi-Selecthard

Which THREE of the following items should be evaluated when performing a security impact analysis for a proposed system change?

Select 3 answers

A.Whether the change negatively impacts existing security controls.

B.The expected cost savings from the change.

C.The color scheme of the new user interface.

D.Whether additional testing or assessment is required.

E.Whether the system's risk rating will increase.

AnswersA, D, E

Assessing the impact on existing controls is the core of the analysis.

Why this answer

The change's impact on security controls, the risk level of the system, and the requirement for re-testing are critical evaluation points.

Practice this question →

MCQmedium

A cloud environment uses AWS Config to maintain compliance. You need to ensure that all S3 buckets are private. Which AWS Config feature should you configure to automatically remediate non-compliant buckets?

A.AWS Config Remediation Actions.

B.AWS CloudTrail Event Selectors.

C.AWS Config Aggregators.

D.AWS Config Conformance Packs.

AnswerA

Remediation actions allow the execution of Systems Manager documents to fix non-compliant configurations.

Why this answer

AWS Config Rules combined with Systems Manager Automation documents allow for automated remediation of non-compliant resources.

Practice this question →

Multi-Selecthard

Which THREE of the following are valid methods of verifying that security controls are functioning as intended during continuous monitoring?

Select 3 answers

A.Running automated configuration compliance scans.

B.Interviewing the system users about their productivity.

C.Reviewing system and audit logs.

D.Asking the vendor if the product is secure.

E.Performing physical inspections of the server room.

AnswersA, C, E

Scanning provides objective evidence of the current configuration state.

Why this answer

Validation can occur through automated scans, manual audit/inspection, and the review of system logs.

Practice this question →

MCQeasy

What is the primary function of a Security Content Automation Protocol (SCAP) tool in a continuous monitoring program?

A.To provide encrypted tunnels for administrative access.

B.To monitor network traffic for anomalous behavior.

C.To automate the assessment of security configurations against benchmarks.

D.To manage the lifecycle of cryptographic keys.

AnswerC

SCAP is designed to enable automated vulnerability and configuration compliance checking.

Why this answer

SCAP provides a standardized way to automate the assessment of system security configurations against established benchmarks.

Practice this question →

MCQeasy

In the context of configuration management for compliance, what is the primary purpose of a Configuration Baseline?

A.To automate the deployment of new software patches.

B.To document the approved security configuration of a system.

C.To identify all users with administrative privileges.

D.To serve as a temporary backup for system files.

AnswerB

The baseline defines the standard, secure configuration that is periodically verified.

Why this answer

A baseline provides a documented, approved state of a system that serves as a reference point for future changes.

Practice this question →

MCQhard

You are overseeing the decommissioning of a legacy database server holding PII. Per NIST SP 800-88 guidelines, which method ensures the media is sanitized to a level where the data cannot be recovered even with laboratory techniques?

A.Clear the file system using a standard OS format command.

B.Destroy the hard drive via shredding or incineration.

C.Overwrite the drive once with zeros.

D.Purge the data using a cryptographic erase (CE) method.

AnswerB

Destroy renders the target data recovery infeasible using state-of-the-art laboratory techniques.

Why this answer

According to NIST SP 800-88, destroying the physical media is the only method that prevents recovery from laboratory-grade forensic tools.

Practice this question →

MCQhard

A system has received an Authority to Operate (ATO) with conditions. As the GRC officer, how do you handle these conditions in the continuous monitoring phase?

A.Document them in the System Security Plan (SSP) as 'accepted risks'.

B.Ignore them until the next major system upgrade.

C.Incorporate them into the POA&M and track remediation progress.

D.Submit a request to the AO to remove the conditions without changes.

AnswerC

The POA&M is the formal mechanism for tracking the resolution of security deficiencies associated with an ATO.

Why this answer

Conditions attached to an ATO represent known risks that must be tracked and mitigated through the POA&M to transition to full, unconditioned authorization.

Practice this question →

Multi-Selecthard

Which THREE actions are required when preparing to decommission a system that stored 'Classified' information?

Select 3 answers

A.Move the system to a secure storage area for indefinite holding.

B.Create a certificate of destruction for audit purposes.

C.Physically destroy the storage media.

D.Reformat the drive for reuse in a non-sensitive project.

E.Remove the system from the active asset inventory.

AnswersB, C, E

A certificate provides formal evidence that the sanitization/destruction occurred.

Why this answer

Sanitizing the media, updating the inventory, and documenting the destruction process are all critical steps for classified systems.

Practice this question →

Multi-Selectmedium

Which TWO of the following are common challenges when implementing continuous monitoring in a legacy environment?

Select 2 answers

A.The system is too new for security researchers to find bugs.

B.High risk of system instability during patch deployment.

C.Lack of modern API support for automated monitoring tools.

D.The system automatically updates its own firmware daily.

E.Too much disk space available for logging.

AnswersB, C

Legacy systems are often brittle, making automated patching risky.

Why this answer

Legacy systems often lack support for modern automation tools and are difficult to patch without downtime.

Practice this question →

MCQeasy

Which document is primarily used to track and manage changes to security controls under the continuous monitoring strategy?

A.Plan of Action and Milestones (POA&M).

B.System Security Plan (SSP).

C.Risk Assessment Report (RAR).

D.Authority to Operate (ATO).

AnswerA

The POA&M is used to track the progress of remediating identified security weaknesses.

Why this answer

The Plan of Action and Milestones (POA&M) is the standard document used to track the remediation of security control deficiencies.

Practice this question →

Multi-Selectmedium

Which TWO of the following documents should be updated during the continuous monitoring phase when a system configuration is changed?

Select 2 answers

A.The vendor's hardware sales catalog.

B.System Security Plan (SSP).

C.Employee Handbook.

D.Configuration Baseline document.

E.Corporate financial statements.

AnswersB, D

The SSP must always reflect the current state of the system.

Why this answer

The System Security Plan and the associated configuration baselines must be kept current to reflect the system's actual state.

Practice this question →

MCQmedium

Your organization uses Tenable.io for continuous monitoring of vulnerability status. You notice that several high-severity vulnerabilities remain 'open' despite being marked as 'patched' in your configuration management database. What is the most likely cause?

A.The Nessus scanner plugin needs an update to recognize the patch.

B.The scan policy is set to 'Discovery' instead of 'Audit'.

C.The scan agent was decommissioned prematurely.

D.The vulnerability scan was not performed after the patch was applied.

AnswerD

Continuous monitoring requires validation scans to confirm patch effectiveness before updating the compliance status.

Why this answer

This discrepancy indicates a failure in the synchronization between the patch management process and the vulnerability management detection phase.

Practice this question →

MCQhard

You are implementing 'decommissioning' procedures for a virtual machine (VM) in a cloud environment. What is the final step you must take to ensure compliance with data privacy regulations after the data has been deleted?

A.Delete the VM snapshot from the management console.

B.Revoke the access rights of the VM administrator.

C.Shut down the VM and wait for the provider to recycle the hardware.

D.Perform a cryptographic erase by deleting the associated encryption keys.

AnswerD

Cryptographic erase is a standard, compliant way to sanitize data in cloud environments where physical destruction is not possible.

Why this answer

Deleting the VM is not enough; you must verify that the underlying storage blocks have been properly sanitized or that the keys used to encrypt the data have been destroyed.

Practice this question →

MCQmedium

A vulnerability scan identifies a 'missing patch' on a server. You discover that the patch cannot be applied due to compatibility issues with a critical legacy application. What is the correct compliance management action?

A.Request an exemption from the CISO without providing documentation.

B.Ignore the vulnerability as it cannot be fixed.

C.Implement and document compensating controls.

D.Disconnect the server from the network permanently.

AnswerC

Compensating controls are required when the primary control (patching) is not feasible.

Why this answer

When a patch cannot be applied, compensating controls must be implemented and documented to mitigate the risk.

Practice this question →

MCQmedium

You are performing a configuration audit on a Linux server. Which file would you examine to ensure that the SSH daemon is not allowing root login?

A./etc/hosts.allow

B./etc/shadow

C./etc/passwd

D./etc/ssh/sshd_config

AnswerD

The sshd_config file is the standard configuration file for the SSH daemon.

Why this answer

The sshd_config file contains the 'PermitRootLogin' directive which must be set to 'no' for compliance.

Practice this question →

Multi-Selecthard

Which THREE of the following represent 'compensating controls' that might be used when a specific security control cannot be implemented exactly as required?

Select 3 answers

A.Segmenting the system into a separate, isolated network zone.

B.Providing the system administrator with a larger office.

C.Implementing enhanced logging and monitoring of the affected component.

D.Installing a new air conditioning unit in the server room.

E.Requiring multi-factor authentication for all administrative access.

AnswersA, C, E

Isolation limits the blast radius of a vulnerability.

Why this answer

Compensating controls provide an alternative way to achieve the security objective; examples include increased monitoring, network isolation, or enhanced access auditing.

Practice this question →

Multi-Selectmedium

Which TWO of the following entities are typically responsible for maintaining compliance in a cloud environment under a shared responsibility model?

Select 2 answers

A.The hardware manufacturer.

B.The local internet service provider.

C.The end-user of the application.

D.The cloud service provider (CSP).

E.The cloud customer.

AnswersD, E

The CSP is responsible for security of the cloud (infrastructure).

Why this answer

Security in the cloud is a shared endeavor where the provider covers the infrastructure and the customer covers the configuration and data.

Practice this question →

MCQeasy

You are managing a system under NIST SP 800-37 R2. During the ongoing authorization phase, you notice a significant change in the system's security posture due to a recent software update. What is the most appropriate next step in the continuous monitoring process?

A.Immediately decommission the system.

B.Update the System Security Plan (SSP) and submit for re-certification.

C.Wait until the annual assessment cycle to review the change.

D.Perform a security impact analysis on the change.

AnswerD

A security impact analysis determines if the change affects the existing security control baseline.

Why this answer

Continuous monitoring requires assessing the impact of changes to determine if the authorization remains valid.

Practice this question →

MCQhard

Your organization is transitioning to a 'Continuous Authorization' model. Which component is critical to ensuring that the security control baseline remains effective despite frequent DevOps releases?

A.Daily vulnerability scanning of the production environment.

B.Automated security regression testing in the CI/CD pipeline.

C.Annual penetration testing of the application.

D.Manual sign-off by the CISO before every code commit.

AnswerB

This ensures that existing security controls are not broken by new code releases.

Why this answer

Automated security testing in the CI/CD pipeline ensures that security controls are validated with every deployment, maintaining the baseline.

Practice this question →

MCQhard

You are defining the continuous monitoring frequency for a high-impact system. According to NIST guidance, what factors should most influence the selection of assessment frequency?

A.The availability of security personnel to perform the tests.

B.The vendor's recommendation for maintenance windows.

C.The criticality of the system and the level of change in the environment.

D.The total number of users accessing the system.

AnswerC

Higher criticality and higher environmental volatility demand more frequent monitoring to maintain security posture.

Why this answer

NIST guidance suggests that the frequency of monitoring should be based on the risk level of the system and the volatility of the environment.

Practice this question →

Multi-Selectmedium

Which TWO of the following are considered essential elements of an effective continuous monitoring program?

Select 2 answers

A.A complete physical audit of all hardware every week.

B.Requiring all users to change passwords daily.

C.Outsourcing all security monitoring to a third party.

D.A formal process for tracking and remediating vulnerabilities.

E.Automated security configuration assessment tools.

AnswersD, E

Tracking (POA&M) is essential to ensure findings are addressed.

Why this answer

Continuous monitoring relies on both the automated collection of data and the procedural management of security findings.

Practice this question →

MCQmedium

You are using Microsoft Endpoint Configuration Manager (MECM) to enforce compliance. You need to verify if specific registry keys are set correctly across all workstations. Which feature should you use?

A.Configuration Items (CIs).

B.Application Catalog.

C.Client Health Reports.

D.Software Metering.

AnswerA

CIs allow you to define and monitor specific registry keys for compliance.

Why this answer

Configuration Items (CIs) in MECM allow you to define settings and verify compliance across client systems.

Practice this question →

MCQeasy

When decommissioning an IT asset that stores sensitive information, which of the following is the most important step before releasing the hardware for disposal?

A.Sanitize the storage media according to an approved standard.

B.Update the asset inventory list.

C.Remove the BIOS password.

D.Format the primary operating system partition.

E.Deactivate the user accounts associated with the system.

AnswerA

Sanitization is the only method to ensure data is permanently removed before the hardware leaves organizational control.

Why this answer

Sanitizing the media is the most critical step to prevent unauthorized access to data remaining on the physical hardware.

Practice this question →

MCQeasy

Which of the following activities is a core component of the 'Ongoing Authorization' process?

A.Periodically reviewing security assessment results.

B.Performing a full system re-installation annually.

C.Changing the system administrator's password every month.

D.Increasing the budget for information security.

AnswerA

Continuous monitoring and the review of assessment results are fundamental to maintaining an active ATO.

Why this answer

Maintaining the authorization requires continuous assessment of the system's security posture to ensure it remains within an acceptable risk level.

Practice this question →