CCNA Security Principles Questions

Risk mitigation applies controls that lower either the likelihood or the impact of a threat exploiting a vulnerability. It differs from avoidance, transference and acceptance, which respectively eliminate the activity, shift the loss, or retain the exposure.

Confidential data demands need-to-know handling, so restricting access to authorised personnel only enforces least privilege and prevents unauthorised disclosure. This complements the encryption mandate by controlling who may reach the data at all, satisfying the policy's confidentiality requirement beyond cryptographic protection alone.

Redundant servers let a service continue functioning when one fails, directly satisfying the requirement that services remain operational despite failure. Availability is the principle concerned with uptime and continuous access, so eliminating single points of failure protects it rather than integrity, confidentiality or non-repudiation.

Digital signatures use asymmetric cryptography to verify that software updates remain unaltered, detecting any modification between publisher and recipient. This directly addresses integrity, the CIA component concerned with data remaining accurate and trustworthy, rather than confidentiality or availability.

A digital signature uses the sender's private key to create a cryptographic hash of the message, letting the recipient verify the data was not altered and binding the sender to it. This satisfies the stem's requirement for both integrity and non-repudiation, since only the private key holder could have produced that signature.

Confidentiality ensures that information is not disclosed to unauthorized individuals, entities, or processes. Encrypting patient records at rest and in transit, combined with role-based access controls, directly prevents unauthorized viewing or exposure of sensitive health data. This aligns with the architect's goal of protecting patient information from improper disclosure, making confidentiality the principle being addressed.

Confidentiality ensures that information is not disclosed to unauthorized individuals. By restricting access to only authorized clinicians and logging all access, the organization is protecting patient records from unauthorized disclosure. The logging supports auditability but the core principle is confidentiality, as it directly prevents unauthorized viewing of sensitive data.

Separation of duties divides a critical task among multiple people so that no single individual can complete it without detection or collusion. Here, creating a vendor payment and approving it are deliberately assigned to two different employees, preventing one person from initiating and authorizing a fraudulent payment. This directly matches the policy's intent and is a classic detective and preventive administrative control in financial and security operations.

Risk is the combination of a vulnerability (the known server flaw), a threat (the actor who could exploit it) and the resulting potential for loss. Neither element alone constitutes risk; their pairing with impact is what the stem describes, making risk the accurate term rather than vulnerability or threat in isolation.

A vulnerability is an inherent weakness or flaw in a system, configuration or process that a threat actor could exploit to cause harm. It is distinct from a threat (the potential actor or event) and from risk, which combines likelihood and impact.

Confidentiality directly prevents unauthorised disclosure, ensuring data is readable only by approved parties. It is the principle that satisfies the stem's requirement that data cannot be accessed by unauthorised individuals, distinct from integrity, which protects accuracy, and availability, which protects timely access.

A smart card is a physical token you must possess and present, making it something you have. That possession factor satisfies the stem's Type 2 constraint, distinguishing it from knowledge (Type 1) and biometric (Type 3) authentication.

Restricted classification applies to information whose disclosure would cause catastrophic harm, demanding the strictest controls. It sits above Confidential, Internal and Public in sensitivity, so it satisfies the stem's requirement for the highest protection level reserved for catastrophic-impact data.

Digital signatures verify that data has not been altered in transit and authenticate the signer, directly detecting unauthorised modification. This satisfies the stem's integrity-control criterion because any change to the signed content invalidates the signature, unlike confidentiality controls such as encryption.

Multi-factor authentication requires two or more distinct credential categories: something you know (the password) plus something you possess (the one-time passcode generated by the mobile authenticator app). Because the factors span separate categories rather than repeating one, the login satisfies the stem's definition of MFA.

Accepting the risk means the organisation acknowledges the legacy system's unpatched exposure and consciously chooses to tolerate it because continued operation outweighs the potential loss. No control is applied to reduce it; the residual risk is formally retained.

Names and addresses alone are ordinary PII, but pairing them with Social Security numbers creates data that enables identity theft and financial fraud. That combination meets the definition of sensitive PII, so the breach compromised sensitive PII rather than merely personal or public information.

Patching known vulnerabilities removes an existing weakness an attacker could exploit, reducing the likelihood of a successful compromise. This is risk mitigation because it lowers inherent risk before any incident occurs, satisfying the stem's requirement for an action that reduces risk rather than transferring, avoiding or accepting it.

Eliminating the activity that introduces the risk, such as removing the vulnerable component.

Encryption at rest transforms stored data into ciphertext using a cryptographic key, so stolen media reveals nothing usable without that key. This directly satisfies the hospital's requirement and supports the confidentiality objective of the CIA triad. It is a preventive, technical control applied to the data itself rather than to physical access or user behaviour.

Full-disk encryption renders stored data unreadable without the decryption key, so a stolen laptop's contents cannot be disclosed. This directly protects confidentiality, the CIA element concerned with preventing unauthorised disclosure, rather than integrity or availability.

Assigning the Confidential label is itself the act of data classification, which then drives the mandated encryption controls. Classification categorises information by sensitivity so that handling requirements, such as encryption at rest and in transit, are applied proportionately.

A smart card supplies a possession factor, something the user has, while the PIN supplies a knowledge factor, something the user knows. Combining them pairs two genuinely distinct categories, which is what multi-factor authentication demands; two knowledge factors alone would not qualify.

Multi-factor authentication requires factors from different categories: something you have, know, or are. A smart card (possession) plus a fingerprint scan (inherence) combines two distinct categories, satisfying the requirement. Two passwords or two biometrics would not qualify.

The MTD is determined by analyzing the business impact of downtime. This includes financial losses, regulatory penalties, reputational damage, and operational disruptions. By understanding the consequences of unavailability, the manager can establish how long the organization can survive without the database. This business impact analysis is the foundation for setting MTD, which then drives the RTO and recovery strategies.

Separation of duties ensures that critical tasks are divided among multiple people to prevent fraud and errors. In this scenario, developers write code but cannot deploy it without approval from a separate team. This division prevents a single individual from making unauthorized changes, directly embodying separation of duties.

A load balancer spreads requests across multiple web servers, removing any single point of failure and sustaining service when one node fails. This directly upholds availability, ensuring authorised users retain timely access to systems and data.

The (ISC)² Code of Ethics orders its canons so that protecting society, the common good, public trust and the infrastructure ranks first, above duties to principals, the profession and colleagues. This canon therefore takes precedence when obligations conflict, satisfying the stem's highest-priority requirement.

A vulnerability is a weakness that could be exploited; an unlocked server room door is a physical weakness allowing unauthorised access to hardware. It is not a threat (an actor or event) nor a risk (likelihood combined with impact), so it fits the stem's request for a vulnerability example.

An acceptable use policy is a management directive that defines how employees may use organizational assets, and it is enforced through acknowledgment and disciplinary process. It governs behavior through rules rather than through hardware or software, which places it squarely in the administrative category. Signing the policy also establishes awareness and accountability, reinforcing its administrative nature within the security program.

Digital signatures verify that database records or transactions have not been altered after signing, directly satisfying the integrity requirement. Any modification invalidates the signature, providing cryptographic tamper detection rather than mere access control. This mechanism detects unauthorised changes, unlike confidentiality or availability controls.

Likelihood is a key factor in risk assessment. It estimates the probability that a threat will exploit a vulnerability. Here, the existence of a known exploit and internet exposure increases the likelihood of exploitation. Risk is often calculated as likelihood times impact, so likelihood is directly involved in determining the level of risk.

Multi-factor authentication requires two or more different factor types, such as something you know and something you have. A password is knowledge, and a code sent to a registered phone is possession of that device. Combining them satisfies the definition, so this proposal correctly illustrates multi-factor authentication.

Due care means taking reasonable, ongoing steps to protect assets, and regularly updating antivirus software demonstrates continuous diligence against known malware. It satisfies the stem by showing sustained protective action rather than a one-off measure, distinguishing due care from mere policy documentation or due diligence assessment.

A retina scan measures a physiological characteristic of the user's body, which is inherent and therefore a Type 3 inherence factor. It is not something the user knows or possesses, so it satisfies the requirement for an inherence-based example.

Availability ensures systems and data remain accessible to authorised users when required. Redundant internet connections and load balancers remove single points of failure, maintaining web service access during DDoS traffic floods. Confidentiality and integrity address disclosure and modification respectively, not uptime.

Confidentiality ensures that information is not disclosed to unauthorized individuals, entities, or processes. In this scenario, restricting patient record access to authorized clinicians directly addresses preventing unauthorized disclosure, which is the core goal of confidentiality. The integrity and availability aspects are separate concerns; the question specifically asks about preventing unauthorized disclosure, making confidentiality the correct principle.

Availability ensures systems and data remain accessible to authorized users when needed. Rate limiting preserves checkout responsiveness for real customers by throttling bot traffic that would otherwise consume server capacity, directly protecting the ability of legitimate buyers to complete purchases. This is the primary principle at stake because the scenario is about sustained access to the storefront, not about keeping review data secret or unaltered.

Type 3 authentication verifies something the user is, through inherence factors such as fingerprints, iris patterns or facial geometry. The stem explicitly requires something the user 'is', ruling out Type 1 (knowledge) and Type 2 (ownership) factors. Biometrics therefore satisfy the high-security facility's requirement.

A preventive control stops an unwanted event before it occurs. Automatically disabling accounts on the last working day prevents the former employee from authenticating at all, closing off the possibility of unauthorized access. Because the control acts in advance of any attempted misuse, it is preventive in nature, even though it also supports other goals such as audit compliance.

Top secret is the highest classification tier, so it mandates the strongest controls: strict need-to-know access, enhanced encryption, and rigorous handling procedures. Lower tiers such as confidential or internal permit weaker safeguards, so this level satisfies the stem's requirement for maximum protection.

Risk likelihood is the probability or frequency that a threat will exploit a vulnerability and cause harm within a defined period. By estimating how often an attack is likely to succeed in a year, the firm is directly quantifying likelihood, which is one of the two core dimensions of risk alongside impact. This estimate then feeds into risk analysis and prioritization, making it the concept the firm is measuring.

Customer PII uniquely identifies individuals and, if disclosed, enables identity theft and triggers breach-notification and privacy-law duties. That harm potential places it at Confidential or higher, satisfying the policy's requirement to protect data whose exposure causes legal, financial or reputational damage to individuals and the organisation.

Senior leadership and the board own risk appetite and strategic direction because they are accountable to stakeholders and can commit resources across the organization. A security policy that assigns this responsibility at the executive or board level ensures security decisions align with business objectives and regulatory obligations. This is a core governance function rather than a day-to-day operational task.

A hash only proves integrity relative to the hash value being trusted. If the attacker can alter the website, they can substitute a malicious patch and publish its matching hash, so the verification succeeds against a fraudulent reference. Without a trusted, independent distribution channel or a digital signature tied to a trusted certificate, the hash provides no assurance of origin.

Due diligence is the investigation and verification of a vendor's security posture, finances and background before contractual commitment. Performing this check after a breach satisfies the stem's requirement to assess risk prior to signing, distinguishing it from due care, which is ongoing maintenance of that obligation.

Accountability ties each action performed on patient records back to a specific authenticated identity, which is exactly what traceability of modifications requires. Because access is granted only to authenticated clinical staff and every change is logged against that identity, the hospital can both restrict viewing to authorized personnel and later determine who altered a record. It is the principle that makes the other controls enforceable.

Due diligence is the investigation and verification a company performs on a prospective vendor before contracting, assessing risks, finances, and compliance. The background check gathers evidence to inform the decision, matching the definition of due diligence rather than post-contract monitoring or contractual obligation.

Least privilege dictates that users should have only the permissions required to complete their tasks, no more. This minimizes the attack surface and reduces the potential damage from accidental or malicious actions. Granting minimum access is the core definition of least privilege, making this a correct characteristic.

Redundant servers with automated failover keep the website reachable when a server fails, so uptime is maintained rather than data secrecy or integrity. This directly satisfies the stem's accessibility-during-outage constraint, which maps to the availability principle of the CIA triad.

Type 1 factors are knowledge-based, covering passwords, PINs and passphrases that a user memorises. This matches the stem's requirement for something the user knows, distinguishing it from Type 2 (something possessed) and Type 3 (something inherent).

Possession factors are physical items the user has, including smart cards, hardware tokens, and registered mobile devices. Pairing a possession factor with a knowledge factor such as a PIN satisfies multi-factor authentication because the two factors come from different categories. Possession factors resist password guessing and replay because the attacker must also obtain the physical item. This is a standard factor category in authentication frameworks.

Due diligence is the ongoing investigation and verification a company performs before entering an agreement or hiring, such as background checks, to identify risks. It satisfies the stem by demonstrating reasonable care before employment. Due care would instead describe the ongoing protective actions taken afterwards.

Risk acceptance is a documented decision to tolerate a risk without applying further controls, typically when the cost of treatment exceeds the potential loss. It is one of the recognised risk management strategies alongside transfer, mitigation and avoidance, satisfying the question's requirement to identify them.

Medical records qualify as sensitive PII because they contain health data, a special category requiring heightened protection under most privacy frameworks. This satisfies the stem's sensitivity constraint, distinguishing them from ordinary identifiers such as names or email addresses, which alone lack the elevated risk profile that triggers stricter handling obligations.

Data minimization means collecting and retaining only the personal data actually needed for a stated purpose. By keeping just the last four digits for customer reference and deleting the full card number after authorization, the retailer reduces the volume of sensitive data at risk and limits potential harm from a breach. This directly matches the principle of not holding more information than necessary.

A smart card is a possession factor and a biometric is an inherence factor, so pairing them combines two genuinely different factor categories. This is stronger than combining two knowledge factors or a knowledge factor with a possession factor, satisfying the requirement for the strongest combination.

Security governance ensures that information security activities support and align with the organization's business goals. By aligning security strategy with business objectives, governance helps prioritize security investments and ensures that security enables rather than hinders business operations. This is a primary objective because it directs how security is managed to deliver value and manage risk in line with the organization's mission.

Confidentiality ensures information is not disclosed to unauthorized individuals. By restricting access to patient records to authorized staff only, the administrator directly protects the data from unauthorized viewing. This aligns with the principle of confidentiality, which is a core component of the CIA triad and a fundamental security objective.

Due care is the ongoing practice of applying controls, while due diligence is the investigative and verification activity that precedes and validates them. The option correctly separates implementation from risk investigation and control verification, matching the governance distinction the question demands.

Due diligence is the investigative process of verifying a provider's claims before contracting, exactly matching the site visits, certification reviews and reference checks described. It satisfies the stem's requirement to assess risk through pre-engagement scrutiny rather than transferring, avoiding or accepting it.

A hacker group is an external threat actor with the intent and capability to exploit vulnerabilities. In risk management, a threat is any circumstance or event with the potential to cause harm. This group represents a threat because it actively seeks to compromise systems, and its existence is independent of any specific weakness in the CRM.

Implementing access controls directly reduces the likelihood of unauthorised actions by enforcing least privilege, satisfying the stem's requirement for risk mitigation. Rather than transferring or accepting risk, it lowers inherent exposure through preventive technical controls such as role-based access assignments in Microsoft Entra ID.

A digital signature verifies that the update has not been altered after signing, because any modification invalidates the hash encrypted with the signer's private key. This detects tampering, satisfying integrity; authenticity of the sender is a related but separate assurance.

Restricted data demands the strongest controls because it carries the greatest potential harm if disclosed, satisfying the stem's requirement for the highest protection level. Public, Internal, and Confidential each warrant progressively less stringent safeguards, so Restricted sits at the top of this four-tier classification scheme.

Correct. Smart card is a possession factor.

Government intelligence material is classified at the highest tier because unauthorised disclosure causes exceptional damage to national security. Its handling mandates the strictest controls, so it belongs in the restricted or top secret category rather than internal or public.

Risk is a function of likelihood and impact. Here, likelihood is high, but the backup reduces the impact from severe to moderate. The residual risk is therefore moderate. This classification acknowledges both the high likelihood and the mitigating effect of the backup, resulting in a balanced risk rating that reflects the remaining exposure.

Encrypting backup tapes renders the data unreadable without the appropriate keys, even if the physical media is lost or stolen. This directly satisfies the requirement that unauthorized parties cannot read the data. Therefore, encryption is the correct control for protecting data at rest on transported media in this scenario.

Hashing detects unauthorised file modification because any change to the file's contents produces a different hash value, so comparison against the stored baseline reveals tampering. This directly satisfies the stem's requirement to detect unauthorised changes to critical files, supporting integrity rather than confidentiality or availability.

Due diligence is the pre-contract investigation of a vendor's controls, plans and personnel, gathering evidence before commitment. Audits and penetration tests examine an existing relationship, whereas due diligence satisfies the consultant's need to assess risk prior to signing.

Risk acceptance means deliberately acknowledging a residual risk and proceeding without further controls because the upgrade cost exceeds the potential impact. This matches the stem's scenario of tolerating a known vulnerable software version rather than mitigating, transferring or avoiding it.

Type 3 authentication relies on something you are — a biometric trait. A retina scan measures a physiological characteristic unique to the individual, satisfying that category rather than knowledge (Type 1) or possession (Type 2).

Due diligence is the investigation and verification of a vendor's controls before contracting, covering certification review, background checks and site visits. These activities assess the vendor's actual security posture, satisfying the evaluation described in the scenario.

File integrity monitoring detects unauthorised changes to critical files by comparing hashes against a known baseline. This directly addresses integrity, ensuring data and system files remain unaltered and trustworthy, rather than focusing on confidentiality or availability.