CCNA Control Implementation Questions

PCI DSS Requirement 3 mandates protection of stored cardholder data, including backups. Encrypting backup tapes with strong cryptography renders the data unreadable if tapes are lost or stolen, directly satisfying the requirement. This is a standard practice for media containing sensitive data and is explicitly required for backups unless otherwise secured.

A SPAN port mirrors traffic from the core distribution switch, so the sensor sees both internal east-west flows and external north-south traffic crossing that choke point. Placing it inline or on an access switch would miss one direction, failing the requirement to monitor both.

UBA uses machine learning and analytics to establish baselines of normal user activity and detect deviations that may indicate insider threats. It is a detective control that monitors behavior and generates alerts, directly addressing the requirement to flag anomalous activities.

Least privilege means granting users only the minimum access rights required to perform their tasks. This directly matches the policy requirement. It reduces the risk of insider threats and accidental damage by limiting unnecessary permissions, making it the correct principle.

An alarm system detects and reports intrusions after they occur, providing awareness rather than blocking access. This satisfies the detective classification: it identifies and records security events, unlike preventive controls such as locks or guards that stop incidents.

A password manager generates and stores unique, complex credentials per account, eliminating reuse and enabling long, high-entropy passwords that users need not memorise. This directly satisfies the best-practice requirement for uniqueness and complexity, while reducing the cognitive burden that drives weak or recycled passwords across systems.

Encryption at rest with AES-256 ensures that ePHI stored in the cloud remains unreadable without the decryption keys, directly addressing the risk of media compromise. It is a technical control that protects confidentiality and satisfies HIPAA encryption addressable implementation specifications. This is the most effective control for the stated scenario.

Patches frequently break production workloads, so automated testing in a staging environment validates compatibility before wide deployment. This satisfies the requirement to verify patches against representative systems, catching regressions while preserving availability of critical services.

Input validation ensures that user-supplied data conforms to expected formats, while parameterized queries separate SQL code from data, preventing attackers from altering query logic. This combination directly mitigates SQL injection and is a standard requirement for PCI DSS compliance.

A data classification policy is a documented management directive governing how information is labelled and handled, making it administrative rather than technical or physical. It satisfies the stem's requirement for an example of an administrative security control, since it operates through organisational rules and governance.

Confidential computing uses hardware-based memory encryption to protect data in use within a TEE, and remote attestation verifies the TEE's integrity before releasing secrets. This directly addresses the requirement for confidentiality and integrity of data in use, which traditional encryption at rest and in transit cannot cover. It is a primary control for protecting intellectual property during processing.

To meet HIPAA audit control requirements, each log entry must include sufficient detail to identify who accessed what and when. The date, time, and user ID are fundamental elements that enable traceability and accountability. Without these, logs are of little value for forensic analysis or compliance audits. This detail supports the required monitoring and review of ePHI access.

A centralized KMS with automated rotation and secure backup ensures keys are managed consistently, rotated regularly, and recoverable after a disaster. It provides strong access controls and auditing. This practice meets both security and availability requirements, making it the best choice.

The INPUT chain processes packets whose destination is a local socket on the firewall host itself, exactly matching the stem's requirement to filter traffic destined for the local host. FORWARD handles transit traffic, while OUTPUT governs locally generated packets, so INPUT is the only chain that inspects inbound packets addressed to this machine.

Segmenting POS systems into a dedicated VLAN with strict firewall rules limits communication to only necessary endpoints, such as the payment processor. This reduces the attack surface and helps contain breaches. PCI-DSS requires network segmentation to protect cardholder data environments. This approach is a standard method to achieve isolation while permitting required traffic.

Change management approval enforces documented review, testing and authorisation before production deployment, satisfying the stem's requirement for an administrative control applied beforehand. It ensures the security tool's introduction is assessed for risk, impact and rollback, providing governance oversight that technical safeguards alone cannot deliver.

Configuring password length and lockout thresholds via Group Policy or Local Security Policy enforces restrictions through the operating system's authentication mechanism. This is a technical control because it is implemented in software and automatically enforces the policy without human intervention, directly aligning with the CGRC domain of control implementation.

A CRL Distribution Point publishes the signed list of revoked certificates so relying parties can check revocation status during validation. Configuring it in AD CS satisfies the stem's requirement that compromised certificates be revocable, since revocation only takes effect when clients can retrieve the CRL from that location.

A preventive technical control, such as role-based access control (RBAC) enforced by the application, is designed to stop unauthorized access before it occurs. Since the CISO requires access restrictions based on data sensitivity and user role, and it must be evaluated during design, this aligns with a preventive technical control implemented via access control mechanisms like mandatory access control or attribute-based access control.

A mantrap is a physical control comprising two interlocking doors, admitting one person at a time. It satisfies the stem's requirement to prevent piggybacking by ensuring each individual is authenticated before the second door releases, so an unauthorised follower cannot tailgate through.

Credentialed scans authenticate to the target host, allowing the scanner to read installed patch levels, registry settings and configuration files. This depth reveals missing patches and misconfigurations that unauthenticated scans miss, since those only inspect exposed network services.

Updating the asset inventory database records the server's removal, ensuring the configuration management system reflects reality and no stale entries trigger audits or misdirect incident response. This satisfies the decommissioning requirement to maintain accurate asset visibility, preventing orphaned records that could mask unaccounted sensitive data or obscure accountability during compliance reviews.

dm-crypt is the Linux kernel's native transparent disk-encryption subsystem, and LUKS provides the standard on-disk format and key management on top of it. Together they deliver full disk encryption for a Linux server, meeting the PCI-DSS requirement without third-party software.

A Publisher Rule validates binaries against certificate issuer and product name, so only signed software from the organisation's certificate runs. This satisfies the stem's requirement that only organisation-signed binaries execute, unlike path or hash rules which do not enforce publisher identity.

Physical controls, such as tamper-evident seals, locked cabinets, and surveillance cameras, directly reduce the risk of card skimming and tampering by preventing unauthorized physical access to POS devices. These measures are essential for protecting payment card data and align with PCI DSS requirements for physical security.

The RADIUS server authenticates the supplicant by validating credentials relayed from the authenticator, then returning an Accept or Reject decision. This satisfies 802.1X's requirement for a centralised authentication authority, since the authenticator itself only passes EAP messages and enforces port state, never verifying identity directly.

Pseudonymization replaces identifying information with artificial identifiers, reducing linkability to individuals. GDPR Article 25 explicitly cites pseudonymization as a technique for data protection by design and by default. It allows data to be processed for legitimate purposes while enhancing privacy, making it a direct implementation of the principle. It also supports other GDPR requirements like data minimization and security.

Encryption of data in transit is a technical control because it is enforced by cryptographic mechanisms within systems and protocols, not by administrative policy or physical barriers. This mechanistic enforcement satisfies the stem's requirement for a technical security control.

Full disk encryption (FDE) encrypts the entire volume, including the operating system, database files, and temporary files. If the physical disk is stolen, the data remains unreadable without the decryption key. FDE is specifically designed to mitigate risks associated with physical theft of storage media, aligning with GLBA requirements for protecting customer financial information.

Applying security patches remediates known vulnerabilities in the operating system and installed software. This satisfies the hardening requirement to close exploitable flaws before attackers leverage published CVEs, keeping the server's codebase current against documented threats.

A preventive control, such as input validation, segregation of duties, or authorization checks, stops errors or fraud before they affect the system. It provides reasonable assurance that transactions are authorized and recorded accurately by enforcing rules at the point of entry. This aligns with the CISO's request for assurance in the transaction process.

TLS cipher suites are defined in the server's TLS configuration file, which the daemon reads at startup to restrict the negotiated cipher list. Editing this file directly satisfies the hardening requirement by disabling weak ciphers and permitting only secure ones for every incoming TLS handshake.

An inbound rule permitting TCP port 443 from 0.0.0.0/0 satisfies the requirement to accept HTTPS from any internet source. Security groups are stateful and default-deny all other inbound traffic, so no explicit deny rule is needed; every non-443 packet is dropped automatically.

Patch management closes known software vulnerabilities that malware exploits for initial execution and privilege escalation. By remediating these flaws across endpoints on a defined schedule, it removes the attack surface malware depends on, directly satisfying the endpoint hardening requirement.

S3 Block Public Access overrides bucket policies and ACLs that would otherwise grant public access, acting as the primary account- and bucket-level guardrail. It directly satisfies the requirement to prevent public exposure of the bucket holding sensitive PII.

Storing the BitLocker recovery key in Active Directory ties it to the computer object, letting authorised administrators retrieve it centrally under existing access controls. This satisfies the requirement for secure, recoverable storage rather than local or user-held copies.

VMRC establishes an encrypted TLS session to the ESXi host, protecting console keystrokes and screen data from interception on the management network. This satisfies the requirement to secure virtual machine consoles against eavesdropping, unlike unencrypted browser-based consoles or plain VNC.

TLS 1.3 encrypts the communication channel and includes message authentication codes to detect tampering, directly addressing the HIPAA requirement to guard against unauthorized access to ePHI during transmission. It also supports perfect forward secrecy, which limits the impact of key compromise. This makes it a suitable technical control for transmission security.

Conditional Access evaluates sign-in signals and enforces MFA at authentication time, covering all modern protocols and clients. This satisfies the stem's demand for the most recommended modern authentication control, unlike per-user MFA, which is legacy and cannot apply granular, signal-based conditions.

Recording why each firewall rule exists lets reviewers identify obsolete, redundant, or overly permissive entries during audits and change control. This documented justification supports periodic rule recertification, satisfying the stem's requirement for a recommended firewall rule management practise.

A dedicated Incident Response Team provides the standing capability to detect, triage, and contain security events. Without assigned personnel, response controls cannot be executed, so the IRT is a foundational element of the incident response control set.

Code signing uses a cryptographic signature to verify the integrity and origin of build artifacts. Before deployment, the pipeline verifies the signature against a trusted certificate, ensuring that only approved and unaltered code reaches production. This directly prevents tampering and unauthorized changes, meeting the requirement for integrity in the CI/CD pipeline.

Cameras are a physical security control because they monitor and record the physical environment, deterring and detecting intrusions at a site. They satisfy the stem's requirement for a physical, rather than logical or administrative, safeguard.

A security baseline documents the minimum mandatory configuration settings for systems, translating high-level controls into specific, repeatable implementation requirements. It standardises deployment across the organisation, satisfying the need for consistent control implementation, unlike policies or procedures that state intent without configuration detail.

Separation of duties splits privileged DBA tasks across multiple accounts, so no single compromised credential can both alter data and conceal the change. This administrative control directly limits the blast radius of one hijacked DBA account.

Full-disk encryption protects data at rest by encrypting the entire storage volume, and storing the key in a hardware-backed secure enclave prevents extraction. Remote attestation allows the server to verify the device's integrity state, detecting rooting or jailbreaking. This combination directly satisfies both confidentiality and integrity verification requirements for the mobile banking scenario.

Routing production access through a jump server with MFA enforces a controlled intermediary, so the developer never connects directly to the server. MFA satisfies the stem's highest-security constraint by adding a second authentication factor, while the jump host centralises session logging and restricts the production server's network exposure.

A formal change management process with approval workflows and segregation of duties ensures that changes are authorized, tested, and documented. It prevents unauthorized modifications and provides an audit trail. This control directly meets the requirement by enforcing a structured, accountable change lifecycle.

NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations, provides the comprehensive catalog of controls used in the RMF process. It is the authoritative source for selecting controls based on security categorization. Under FISMA, agencies must use this catalog to implement controls, making it the correct reference for the control implementation phase.

Excluding known safe processes and signers stops the EDR engine from flagging trusted, benign activity, directly reducing false positives. Visibility is preserved because all other process and file behaviour remains monitored, satisfying the stem's balance of low noise and continued detection.

Role-based access control (RBAC) restricts system access to authorized personnel based on their role, satisfying the requirement for access control. Audit logging records user activities, providing accountability and tracking. Together, they meet the CJIS requirements for access control and audit, ensuring only authorized access and activity tracking.