CCNA Risk Management Questions

Backup and disaster recovery sites may reside in different jurisdictions than the primary data center. If data is replicated to a location with different privacy laws, it could violate data residency requirements. Understanding where backups are stored and how failover works is crucial to ensure compliance even during disruptions. Thus, this factor is critical for a comprehensive data residency risk assessment.

Documenting the vulnerability in the Plan of Action and Milestones (POA&M) directly satisfies the operational constraint of a live production system by formally recording the risk while preventing immediate, uncoordinated changes that could cause unexpected downtime. Because the system is actively processing business transactions, patching or reconfiguration must be carefully scheduled through a structured change management process rather than applied impulsively. Coordinating the remediation plan with the system owner ensures that risk mitigation is balanced against operational availability, maintaining accountability while safely orchestrating the necessary security controls.

Integrating automated Software Composition Analysis (SCA) directly into a CI/CD pipeline satisfies the critical requirement to secure external dependencies within the software supply chain. Because modern applications rely heavily on third-party open-source libraries, SCA tools continuously interrogate manifest files during early build stages, cross-referencing components against vulnerability databases like the National Vulnerability Database. This automated mechanism immediately halts the pipeline upon detecting known Common Vulnerabilities and Exposures, preventing vulnerable code from propagating downstream to production environments.

Supply chain risk extends beyond the prime provider to subcontractors whose personnel, processes, and access may affect the system. The scenario shows the analysis stopped at provider outages, leaving fourth-party dependencies unexamined. Addressing this first closes the most significant analytical gap because subcontractor access to data and facilities can introduce threats the current risk picture entirely omits.

Coalition data sharing is subject to multiple national laws, export controls, and data protection regimes. These legal and regulatory differences directly affect where data can reside, who can access it, and how it can be transmitted. Failing to assess them can result in unlawful data transfers, loss of coalition trust, and mission failure. They are a primary risk factor in multinational environments.

Documented ordinal scales with anchor examples give assessors a shared reference, reducing subjective drift. Calibration exercises further align judgments, so the same scenario maps to the same category. This preserves the qualitative approach while directly fixing the observed inconsistency, which is the specific problem described in the scenario.

Mapping inherited, shared, and customer-owned controls against the provider's FedRAMP or equivalent authorization package lets the ISSEP avoid double-counting controls already assessed by the provider while ensuring customer-owned controls are fully assessed. This directly addresses the Authorizing Official's need to understand residual risk at the boundary between provider and organization.

A manufacturer-signed firmware update replaces the vulnerable TPM firmware while preserving the endorsement key hierarchy and secure-boot chain of trust. This directly remediates the key-injection flaw, which unsigned or third-party flashing could not do safely.

VLAN segmentation addresses the fundamental constraint of flat network architecture by enforcing logical isolation at the data link layer. By restricting broadcast domains and mitigating lateral movement, this approach ensures that traffic from the administrative workstation cannot directly reach the PLC network. This architectural separation provides a robust control mechanism, effectively reducing the attack surface and preventing unauthorised access to sensitive industrial controllers, which is essential for maintaining the integrity and availability of the ICS environment.

Qualitative risk assessment uses descriptive scales (e.g., high, medium, low) based on expert opinion, which introduces subjectivity and makes it challenging to directly compare risks in financial terms. For a payroll system, stakeholders may struggle to justify budget requests without monetary impact figures. This subjectivity and lack of financial quantification are well-known limitations, making this the correct answer.

Raising the threshold makes the system stricter, reducing the likelihood of accepting an impostor (lower FAR) at the cost of rejecting more legitimate travelers (higher FRR). Since the mission priority is minimizing false matches, this is the direct biometric tuning action. The ISSEP should recommend it first because it addresses the stated risk with an existing control, before considering additional layers.

Risk acceptance decisions must be documented with the weakness, compensating controls, and residual risk, and formally accepted by the Authorizing Official who owns that risk. Recording it in the POA&M with a risk acceptance rationale preserves an auditable trail and ensures the decision is made at the correct authority level, making it defensible.

Addressing the absence of an automated security configuration baseline identified during the 'Assess' step requires remediating the deficiency while maintaining alignment with the Risk Management Framework. Updating the System Security Plan (SSP) officially documents the control implementation status, whereas deploying the baseline through Infrastructure-as-Code (IaC) templates directly satisfies the container orchestration layer's technical constraint by programmatically enforcing immutable, repeatable hardening standards across the cloud-native architecture without relying on manual configuration management.

Basic authentication transmits credentials in cleartext, typically encoded as Base64, which lacks cryptographic protection against eavesdropping. By mandating HTTPS/TLS, the system establishes an encrypted tunnel that prevents man-in-the-middle attackers from intercepting sensitive authentication headers during transit. This transition satisfies the fundamental security requirement to ensure confidentiality for credentials, which is inherently compromised when using HTTP. Organisations should further enhance this posture by integrating modern identity providers like Microsoft Entra ID to replace legacy basic authentication methods with secure token-based protocols.

Certificate pinning mitigates Man-in-the-Middle attacks within a service-oriented architecture by hardcoding the expected server public key or certificate hash directly into the client application. This constraint forces the client to reject any connection attempt presenting a fraudulent certificate, even if that certificate is signed by a trusted, yet compromised, Certificate Authority. By bypassing the standard trust chain, the application ensures that only a pre-authorised server identity can establish a secure session, effectively neutralising interception attempts that rely on spoofed credentials.

Risk is a function of likelihood and consequence, so a register without consequence data cannot express risk magnitude. Consequence detail lets the organization rank findings, allocate remediation resources, and give the Authorizing Official the basis needed to judge whether residual risk is tolerable for the mission. It is the element that connects a technical finding to mission impact.

Zero-trust network policies enforce granular, identity-based segmentation that mandates a default-deny posture for all inter-container traffic. By restricting communication to only explicitly authorised flows, this mechanism directly satisfies the requirement to prevent unauthorised network reconnaissance within an Engineered System. Because the policy denies all traffic not specifically permitted, the attacker cannot probe the network topology or discover adjacent services, effectively containing the breach to the compromised container and preventing lateral movement across the segmented environment.

Single Loss Expectancy (SLE) serves as a primary input for quantitative risk analysis by quantifying the monetary impact of a single security incident on a specific asset. By multiplying the asset value by the exposure factor, this metric provides the necessary financial baseline to calculate the Annualised Loss Expectancy. This satisfies the stem’s requirement for quantitative inputs, as it transforms qualitative asset valuations into precise numerical data points that allow organisations to prioritise risk mitigation strategies based on tangible financial exposure.

Qualitative risk assessment relies on expert judgment and descriptive scales like high, medium, and low to evaluate likelihood and impact. This approach is useful when numerical data is scarce or when a quick prioritization is needed. It aligns with the plan's statement and is the defining characteristic of a qualitative method.

Automated security scanning and log aggregation directly satisfy the requirement for real-time visibility under the Risk Management Framework (RMF) Continuous Monitoring (ConMon) constraint. By continuously harvesting system logs, security event data, and configuration states without manual intervention, security teams can dynamically track baseline drift, detect anomalies, and evaluate control efficacy against evolving threat landscapes. This automated telemetry collection enables organisations to maintain an ongoing assessment of security posture, ensuring timely remediation and compliance reporting between formal authorisation cycles.

Applying differential privacy during the training process introduces mathematically bounded noise into the learning algorithm or the gradients, which directly satisfies the constraint of preventing model inversion attacks. By limiting the influence of any single data point on the final model parameters, this engineering control ensures that an attacker cannot reconstruct granular, sensitive training records simply by querying the model or analysing its outputs.

Visualising system architecture through data flow diagrams directly satisfies the core requirement to systematically map trust boundaries, data stores, and external entities within an engineered system. This foundational step exposes architectural attack surfaces by tracking how privileged and unprivileged data traverses system components, enabling security architects to identify trust boundary violations and potential entry points for injection or escalation flaws before code deployment.

Unidirectional gateways utilise hardware-enforced physical constraints, typically using a transmitter on one side and a receiver on the other, to ensure data flows strictly outward from the Operational Technology network to the enterprise IT environment without any return path. This technical mechanism directly satisfies the strict availability and integrity constraints of Industrial Control Systems by completely eliminating the risk of remote network attacks, lateral movement, or malware injection originating from higher-level corporate zones into critical real-time control processes.

Publicly vetted algorithms like AES-256 have undergone extensive cryptanalysis and are mandated for federal systems by FIPS 140-3. Proprietary algorithms lack this scrutiny and may contain undisclosed weaknesses. Requiring a NIST-approved algorithm directly reduces the likelihood of cryptographic compromise and aligns with ISSEP risk mitigation, making it the most appropriate response.

A hybrid approach leverages the speed of qualitative screening while producing defensible, numeric risk values for the highest-impact CUI risks. This aligns with NIST SP 800-30 guidance, which permits combining methods. The ISSEP can then present cost-benefit data for controls, support risk acceptance decisions, and satisfy the contract's expectation of a rigorous, traceable assessment without analyzing every low-risk item quantitatively.

The ISSEP's role is to characterize risk and recommend responses, while the Authorizing Official owns the acceptance decision. Documenting residual risk, proposing compensating controls that reduce exposure during the interim, and presenting options preserves informed decision-making. This approach respects the governance boundary and keeps the system operating while the risk is explicitly managed.

Calculating the Annualised Loss Expectancy requires multiplying the Annualised Rate of Occurrence by the Single Loss Expectancy. By applying the provided values of 0.5 and $100,000 respectively, the resulting product is $50,000. This calculation satisfies the quantitative risk assessment constraint established in the stem, accurately reflecting the expected financial impact over a one-year period for the mission-critical database. This methodology allows security professionals to prioritise resource allocation effectively when managing organisational risk profiles.

Unidirectional gateways permit telemetry to flow out of the control network while physically preventing any inbound path, so exploits cannot traverse the non-standard protocol. Since DPI cannot parse that protocol, hardware-enforced isolation removes the attack vector rather than attempting ineffective inspection.

For federal systems processing CUI, FedRAMP authorization is a prerequisite to ensure the CSP meets required security controls. Data residency also matters because some federal data must remain within specific jurisdictions. Verifying these first prevents selecting a CSP that cannot legally or securely host the data, saving time and avoiding compliance violations.

Transferring risk through insurance or contractual agreements serves as a valid strategy for managing residual risk that remains after implementing technical controls. By shifting the financial or operational burden of a potential security breach to a third party, an organisation satisfies the RMF requirement to address risks that exceed the defined risk appetite. This mechanism provides a formalised method to mitigate the impact of threats that cannot be fully eliminated through internal security measures or Microsoft Entra ID access policies.

Unsigned firmware removes any cryptographic assurance of authenticity or integrity, so a compromised build can be flashed undetected across the sensor array. Because the devices share a common update path, one malicious image propagates systemically, defeating downstream controls and satisfying the stem's highest systemic risk criterion.

Independent assessment artifacts provide objective evidence beyond vendor self-attestation, and an SBOM exposes transitive dependencies, known vulnerabilities, and provenance details. Analyzing both against defined supply chain criteria yields a defensible risk characterization. This combination directly addresses the gap left by a self-signed statement and supports an informed determination before the component enters the boundary.

A system-level risk assessment focuses on the information system's assets, threats, and vulnerabilities, while a facility-level assessment addresses physical and environmental risks. Combining them into one may cause facility-specific threats (e.g., unauthorized access, utility outages) to be under-analyzed because the assessor's attention is on the system. This oversight could leave critical physical controls unaddressed, making this the most significant risk of the proposed approach.

The shared responsibility matrix and SLAs define which security controls the provider manages and which remain with the customer. Risk transfer is limited to the provider's scope; the customer retains accountability for data, identities, and configuration. Reviewing these documents lets the ISSEP accurately map residual risk and avoid assuming that all risk moves to the provider. This is the correct first step for clarifying transferable risk.

Inadequate audit logging prevents the reconstruction of administrative actions, directly violating the accountability constraint inherent in an Engineered System. Without granular records of who accessed the management interface or what cryptographic material was manipulated, an organisation cannot detect unauthorised configuration changes or insider threats. This lack of traceability undermines the integrity of the HSM’s security boundary, rendering it impossible to verify compliance or perform forensic analysis following a suspected compromise of the underlying hardware or the associated Microsoft Entra ID integration.

FIPS 140-3 compliance mandates that any cryptographic module employed within a system must undergo formal validation by an accredited laboratory to ensure it meets rigorous security requirements. By verifying that all modules are explicitly validated against this standard during the design phase, the ISSEP ensures the infrastructure satisfies the constraint of regulatory adherence. This proactive validation prevents the integration of non-compliant components, thereby maintaining the cryptographic integrity and legal conformity required for the cloud environment’s security architecture.

Data residency constraints dictate the physical location of stored information, directly addressing the legal requirement for data sovereignty. Organisations must ensure compliance with regional statutes, such as GDPR, which restrict cross-border transfers. By configuring data residency policies within a cloud environment, administrators maintain control over where information resides, preventing unauthorised jurisdictional exposure. While tools like Microsoft Entra ID manage identity and access, they do not inherently resolve the physical storage constraints imposed by local regulatory frameworks, making geographical placement the primary factor in mitigating legal risk.

Under RMF, new vulnerabilities are handled through continuous monitoring by assessing them against the system's controls, environment, and mission. Because the component is not exposed and no exploit exists, a full reauthorization may not be needed, but the ISSEP must document the evaluation. This preserves the ATO while maintaining risk awareness.

The System Security Plan serves as the foundational repository for security controls, boundary definitions, and functional requirements, directly satisfying the requirement to capture all security mandates for a new system. By consolidating technical specifications and compliance obligations, it provides the ISSEP with the comprehensive baseline necessary to perform a rigorous risk assessment. Reviewing this document ensures that the practitioner identifies all relevant security constraints before evaluating potential vulnerabilities or threats, thereby maintaining alignment with organisational security policies and regulatory standards.

The System Security Plan acts as the foundational repository for documenting the security control baseline selected for an information system. It satisfies the requirement for a primary record by mapping specific controls to organisational requirements and detailing their implementation status throughout the lifecycle. By consolidating these technical and operational details, the document provides the necessary visibility for assessors to verify compliance, ensuring that every control is tracked and managed effectively within the broader risk management framework.

Concept drift occurs when the statistical properties of the target variable change over time, causing the relationship between input data and fraud patterns to degrade. Monitoring performance metrics, such as precision and recall, allows security teams to identify this decay in predictive accuracy. Retraining the model with recent, labelled datasets ensures the algorithm adapts to evolving adversarial behaviours, thereby maintaining the integrity of the fraud detection system and satisfying the requirement for continuous lifecycle management in dynamic environments.

NIST SP 800-37 describes RMF as a disciplined, structured, and flexible process that integrates security, privacy, and risk management activities into the system development life cycle. This integration ensures controls are selected, implemented, assessed, and monitored continuously rather than bolted on after deployment, which is the framework's fundamental purpose.

Blockchain ensures that once data is recorded, it cannot be altered without detection. However, it does not guarantee the accuracy or integrity of data at the point of entry. If an attacker compromises the source system and injects false log entries, those entries will be immutably stored. This is a critical residual risk that the ISSEP must highlight.

Timing attacks exploit variations in the execution duration of cryptographic operations to deduce private key material from a hardware security module. Implementing constant-time cryptographic algorithms ensures that code-signing routines take the exact same amount of time regardless of the specific key bits or input data processed. This direct technical control satisfies the specific constraint of neutralising side-channel attacks by completely eliminating the timing signatures that an attacker attempts to measure and analyse.

A CDS must enforce strict data flow policies to prevent unauthorized transfer of classified or sensitive information. If the CDS cannot inspect content and context, it may allow data that violates releasability rules. This is a critical risk factor because a failure could lead to unintended disclosure to partner nations, compromising national security or coalition trust.

Relying on static credentials introduces severe vulnerability windows if secrets are compromised, whereas enforcing short-lived, dynamically generated credentials directly satisfies the imperative of minimising the lifespan of privileged access within modern secrets management architectures. By programmatically issuing tokens and database credentials with strict, automated time-to-live (TTL) limits—and revoking them immediately after use—the system drastically reduces the dwell time available to an attacker, thereby mitigating the risk profile associated with long-term credential storage.

Reuse of a prior assessment is valid only when the assumptions that shaped it still hold. Differences in architecture, data flows, site connectivity, or threat environment can invalidate findings and recommended controls. Comparing the new deployment against the earlier scope lets the ISSEP identify which portions remain applicable and which must be reassessed for the multi-site context.

A System-Level Risk Assessment evaluates threats, vulnerabilities and impacts against a specific system to produce a risk rating. That rating drives prioritisation and selection of security controls, satisfying the objective of determining risk level and sequencing control implementation.

Establishing the mission, architecture, and boundary is foundational. Without a clear system boundary and understanding of how the C2 system supports the mission, risk cannot be scoped correctly. NIST SP 800-30 and the RMF emphasize this step because threats, vulnerabilities, and impacts are all relative to the system's purpose and interfaces. Omitting it leads to incomplete risk identification and an authorization package that cannot be defended.

Explicit criteria and delegated authority make risk decisions consistent and auditable. Without them, individuals make ad hoc judgments that cannot be compared across the lifecycle or defended to oversight bodies. Defining who may accept which level of risk also prevents unauthorized acceptance and ensures the Authorizing Official retains decisions that exceed delegated thresholds, which is fundamental to a repeatable risk process.

Environmental sensors and hardened circuitry directly mitigate physical fault injection by monitoring operational anomalies such as voltage drops, clock frequency manipulation, and laser exposure. The stem specifies that an attacker successfully bypassed verification using a physical fault injection technique against a hardware-based root of trust. Adding these physical countermeasures satisfies the requirement for real-time tampering detection, as the integrated sensors can instantly trigger a system reset or zeroise sensitive cryptographic material before the manipulated instruction cycle completes.

Aggregation of residual risks is a core ISSEP concern because individually tolerable risks can combine, through shared trust boundaries or common mode failure, into an unacceptable system-level exposure. The scenario shows every entry below tolerance but says nothing about how those residuals interact, so the ISSEP must require that aggregate and cumulative effects be analyzed before accreditation can be justified.

Impact analysis translates exploited vulnerabilities into consequences for mission, operations, assets, and personnel. For a cross-domain connection, impacts may include data spillage, mission degradation, or loss of confidentiality across enclaves. This activity is essential because risk is defined by the combination of likelihood and adverse impact, which the Authorizing Official must weigh.

This directly addresses the missing cryptographic verification, ensuring that only authentic firmware is installed. It is the most effective first step because it closes the vulnerability at its source. The ISSEP should recommend this technical control before considering transfer or acceptance, aligning with the risk management principle of reducing risk to an acceptable level.

The System Security Plan acts as the foundational baseline document that defines the security categorization, boundaries, and operational requirements of an information system, thereby directly identifying the specific security controls that must be implemented. This satisfies the fundamental requirement in the question stem regarding the planning phase of compliance, where the SSP outlines the intended security posture before deficiencies are subsequently tracked and remediated.

Centralising Personally Identifiable Information (PII) within a single repository directly satisfies the architectural constraint of the prompt by creating a concentrated target for attackers. When an ISSEP evaluates a centralised database pattern, the primary vulnerability stems from aggregation: compromising this singular architectural boundary bypasses distributed security controls and exposes the entirety of the sensitive data corpus at once, rather than isolating the blast radius across segmented storage nodes.

Failing to document the security justification during the tailoring process violates foundational Risk Management Framework principles regarding traceability and defensibility. When security controls are modified, removed, or supplemented, assessors and authorizing officials require a formal record explaining the risk-based rationale for these adjustments. Without this documentation, the system lacks the necessary audit trail to verify that residual risk remains within acceptable organisational thresholds, directly undermining the continuous monitoring and authorisation lifecycle mandated by NIST guidelines.

FAR is the probability that the biometric system incorrectly accepts an unauthorized individual. This directly quantifies the risk of a security breach due to false acceptance. By analyzing FAR, the ISSEP can assess the likelihood of unauthorized access and recommend additional controls such as multi-factor authentication or liveness detection to reduce that risk.

Risk acceptance for an accredited system belongs to the Authorizing Official, not the system owner or the ISSEP. The ISSEP's role is to analyze the exposure, document the technical and policy implications of unencrypted classified backups, and present options such as encryption, on-site storage, or a formal risk decision. Escalation preserves the integrity of the authorization process and the chain of accountability.

An abbreviated but documented assessment of the new interface balances schedule constraints with risk management rigor. It identifies threats, vulnerabilities, and impacts specific to the change, and gives the authorizing official the information needed to accept, mitigate, or reject the risk. This approach preserves the integrity of the risk process while accommodating the program timeline. It also creates an auditable record of the decision.

Configuring an authentication service to fail-open during an outage directly prioritises availability over confidentiality and integrity. When the external multi-factor authentication provider becomes unreachable, the access control mechanism defaults to granting entry rather than denying it. Consequently, this circumvents the primary security constraint specified in the stem—the reliance on multifactor verification—thereby removing the second factor entirely and permitting unverified users to authenticate successfully with single-factor credentials or none at all, exposing the system to unauthorised access.

Continuous monitoring under RMF involves ongoing monitoring of security controls, assessing the impact of changes, and providing regular updates to the Authorizing Official. This enables near real-time risk management and supports ongoing authorization. It is the core activity that maintains the ATO.

Network segmentation with industrial firewalls limits lateral movement and blocks unauthorized access to legacy PLCs. Since patching is not possible, isolating the devices reduces exposure to external threats. This is a fundamental compensating control for unpatched ICS components, as it prevents attackers from reaching the PLCs directly.

The SSP is the RMF artifact that documents the authorization boundary, the selected NIST SP 800-53 controls, implementation statements, and the security posture of the system. It is the core document reviewed by the Authorizing Official during Step 4 (Assessment) and Step 5 (Authorization) of the RMF, making it the correct answer for this scenario.

Deploying an authenticated API gateway satisfies the constraint that the underlying vendor-provided API cannot be modified directly by the development team. By placing the vulnerable API behind a reverse proxy or gateway, all incoming requests are intercepted and forced to authenticate via robust protocols such as OAuth 2.0 before reaching the legacy endpoint. This architectural pattern establishes an external security perimeter, effectively remediating the weak authentication flaw at the network and application boundary without requiring access to the proprietary source code.

Multi-tenant cloud environments share underlying physical hardware, CPU caches, and memory buses across distinct tenant boundaries. This infrastructure sharing enables side-channel attacks, such as cache-timing exploits, where a malicious tenant monitors hardware resource contention to infer data belonging to another tenant on the same host. This specific vulnerability directly satisfies the stem's constraint of a risk unique to multi-tenancy, as dedicated single-tenant architectures do not expose workloads to cross-tenant hardware resource sharing.

Data collection without analysis and escalation produces noise, not risk awareness. A defined process ensures that significant changes, such as new vulnerabilities or control failures, are evaluated for impact and communicated to the decision-maker who owns acceptance. This closes the loop between monitoring and governance, which is essential for an accurate and actionable risk picture.

Running the container process as the 'root' user is a critical vulnerability because container runtimes share the host Linux kernel's namespace abstraction by default. If an attacker achieves remote code execution within the container, root privileges inside the container often translate directly to root-level access on the underlying host due to inadequate privilege separation or capability dropping. To satisfy the cloud-native vulnerability assessment requirement for this Engineered System, an ISSEP must identify and remediate this misconfiguration by enforcing non-root execution via the `USER` directive in the Dockerfile or Kubernetes security contexts.

An air gap eliminates direct network connectivity but leaves other vectors. Insiders, compromised software updates, and removable media can introduce malware or exfiltrate data. A full risk assessment must evaluate these threats, along with vulnerabilities in the software and hardware supply chain. The ISSEP should ensure the assessment covers all realistic attack paths, not just network-based ones, to support an accurate risk determination.

Hardcoding API keys within mobile application binaries exposes credentials to static analysis, as compiled code remains accessible to anyone who decompiles the package. Attackers can easily extract these plaintext strings using standard reverse engineering tools, bypassing any obfuscation attempts. This vulnerability directly addresses the constraint of third-party service integration, as compromised keys allow unauthorised access to external resources. Organisations should instead utilise secure identity providers like Microsoft Entra ID or managed key vaults to authenticate requests dynamically rather than embedding static secrets.

The audit shows findings are not consistently reviewed or remediated, indicating missing process ownership and accountability. A formal risk management process with assigned roles, scheduled reviews, and escalation paths directly addresses this root cause. It ensures findings are triaged, prioritized, and tracked to closure, which is the essence of effective continuous monitoring under an ISSEP risk framework.