CCNA Security Principles Questions

Confidentiality ensures information is disclosed only to authorised parties, typically enforced through encryption, access controls and classification. It forms one of the three pillars the policy must address, directly satisfying the stem's requirement for a core CIA triad component.

A fingerprint scan is a biometric characteristic, placing it in Type 3 "something you are". It satisfies the stem's requirement for a Type 3 factor because the trait is inherent to the individual, unlike possession tokens or memorised passwords.

Separation of duties ensures that a critical task is divided among multiple people so that no single individual can complete it without oversight. By requiring code to be reviewed and approved by a different team member and denying developers direct production write access, the company prevents one person from both authoring and deploying changes. This directly enforces separation of duties in the software deployment process.

Confidentiality directly addresses preventing unauthorised disclosure, which is the exact control objective stated in the stem. Encryption, access controls and data classification enforce confidentiality by restricting data access to authorised parties only. Integrity would concern unauthorised modification, and availability would concern timely access, neither of which matches the disclosure constraint.

Signing with a private key and verifying with the corresponding public key proves the patch originated from the vendor and was not altered. This provides non-repudiation because the vendor cannot deny signing it, and integrity because any modification invalidates the signature. Thus it correctly describes the security property.

Sensitive PII covers data elements whose exposure causes heightened harm, such as social security numbers and medical records, which is precisely what the stem lists. Ordinary PII alone would not capture the elevated protection these identifiers and health data demand under privacy principles.

Availability ensures that systems and data are accessible to authorized users when needed. Ransomware encryption makes the file servers unusable, and restoring from offline backups taken the previous night returns the data and services to operation. This directly addresses the availability objective by minimizing downtime and data loss. Offline backups are especially valuable because they are not reachable by the malware, so they remain a reliable recovery source.

A digital signature uses the publisher's private key to sign the update, and verification with the corresponding public key confirms both origin and that the package was not altered. This satisfies the stem's integrity requirement by detecting any tampering before deployment.

Deactivating a badge prevents the terminated employee from using it to gain entry, which is the goal of a preventive control. It stops the unauthorized action before it occurs. While it also supports other control categories, the immediate effect is to block access, making preventive the best classification for this scenario.

An unpatched web server is a weakness in the system that could be exploited, which is a vulnerability. It is a condition internal to the organization that increases the likelihood of a successful attack. Threats are potential causes of harm, while vulnerabilities are flaws or gaps. Missing a security update is a classic example of a vulnerability because it represents an exposure that attackers can leverage.

Version control tracks every change to configuration files, creating an auditable record that detects unauthorised or accidental modification. This directly strengthens integrity, since the stem's constraint is ensuring files remain accurate and unaltered, not restricting who may read them.

The stem states the organisation already classifies data as confidential and mandates encryption at rest and in transit for that level. Selecting confidential matches the label the scenario itself applies, satisfying the stated classification requirement rather than inventing a different tier.

Modifying a payroll database alters stored data, so its accuracy and trustworthiness are directly threatened. Integrity guarantees data remains unaltered by unauthorised parties; confidentiality concerns disclosure and availability concerns access, neither of which the modification attempt targets.

Declining the vendor eliminates the activity entirely, so the identified risk no longer exists. This satisfies the stem's scenario by removing the exposure rather than transferring it via insurance, mitigating it with controls, or accepting it.

Least privilege means granting users only the minimum access rights necessary to perform their job functions. Since the nurses only need clinical treatment notes, removing their access to billing records directly applies this principle and reduces the risk of unauthorized data exposure. It is the most appropriate control for restricting access based on job duties in this scenario.

Least privilege grants users only the minimum access necessary for their job function and only for as long as it is needed. Restricting the payroll administrator to the salary records her role requires, gated by approval and time windows, is a textbook application. Logging the action adds accountability and supports later review of whether that minimum access was appropriate.

Access control lists restrict database access to authorised identities, enforcing least privilege so only approved users reach customer PII. This satisfies the stem's confidentiality requirement by preventing unauthorised disclosure, unlike integrity-focused controls such as hashing or digital signatures.

Geographically dispersed redundant servers plus load balancing keep services reachable despite outages or attacks, directly satisfying the availability concern named in the stem. This redundancy addresses uptime rather than confidentiality or integrity, which encryption and hashing would respectively protect.

Purchasing cyber insurance shifts the financial consequence of a breach to the insurer, which is the defining mechanism of risk transfer. The organisation retains the threat itself but transfers the monetary liability, directly satisfying the stem's scenario of covering potential breach losses rather than avoiding, mitigating or accepting the risk.

Hashing produces a fixed-length digest from the transmitted data; any alteration changes the digest entirely, so comparing sender and receiver hashes detects tampering. This satisfies the stem's integrity requirement. Encryption provides confidentiality rather than modification detection, and checksums are weaker against deliberate changes.

The (ISC)² Code of Ethics places the safety and welfare of society, the public trust, and the infrastructure above all other obligations. Duties to principals and employers rank lower, so protecting society takes precedence when interests conflict.

Integrity ensures data is not modified or destroyed in an unauthorized manner. Hashing produces a digest that changes if even one bit is altered, and digital signatures bind the sender's identity to the data, so any tampering is detectable. In this scenario the healthcare provider's specific goal is to prevent and detect unauthorized alteration of patient records, which is exactly the integrity objective of the CIA triad.

A Social Security Number uniquely identifies an individual and is issued by the US government, so its exposure can directly enable identity theft. That inherent identifiability is what classifies it as Sensitive PII rather than ordinary personal data.

Encryption such as TLS renders intercepted traffic unreadable to eavesdroppers, directly enforcing confidentiality. This principle guarantees data is disclosed only to authorised parties, matching the requirement that transmitted data cannot be read by unauthorised parties.

Redundant servers directly sustain availability by eliminating single points of failure: if one server fails, others continue serving requests, so the service remains accessible. This satisfies the stem's availability constraint through hardware duplication, unlike logical controls such as backups or access policies, which address integrity or confidentiality instead.

Risk acceptance is a deliberate treatment choice where the organization decides the potential loss is tolerable and documents that decision. It is one of the standard risk treatment options, along with avoidance, mitigation, and transfer. Therefore, accepting and documenting the risk is a correct example.

Encryption at rest and in transit is the prescribed handling control for the Confidential classification, matching the stem's stated requirement exactly. Confidential data demands the strongest protective measures, whereas lower tiers such as Public or Internal do not mandate encryption in both states.

Availability ensures that systems and data are accessible to authorized users when needed. Here, the power failure caused servers to shut down and data to become unavailable, directly violating availability. The UPS and generator were intended to maintain availability, but their failure resulted in a loss of access to critical data, making this the most directly compromised principle.

Risk mitigation reduces the likelihood or impact of a threat through controls. Deploying a firewall and intrusion detection system applies preventive and detective controls that lower breach probability, rather than transferring, avoiding or accepting the risk.

A vulnerability is a weakness or flaw in a system that can be exploited by a threat. In this case, the unpatched software is the vulnerability. The attacker (threat) exploited this weakness to gain access and deploy malware. This is the correct definition and role of the vulnerability in the incident. It is the specific flaw that allowed the breach to occur.

A vulnerability is a weakness in a system, process, or control that a threat can exploit to cause harm. An unpatched web server is a textbook vulnerability: it is a defect in the environment, not an actor and not a measure of loss. Classifying it correctly lets the organisation prioritise patching and track the exposure until it is remediated.

Risk transfer shifts the financial consequence of a risk to a third party. Purchasing cyber insurance means the insurer absorbs potential breach losses, satisfying the stem's requirement for risk transfer, whereas patching, avoiding the vendor or accepting the exposure would not shift that financial burden.

Risk is the term combining the likelihood that a threat exploits a vulnerability with the resulting harm to an asset, satisfying the stem's definition. Threat alone denotes the potential cause, vulnerability the weakness, and exposure the susceptibility, none of which express probability multiplied by impact.

The smart card supplies a possession factor and the PIN supplies a knowledge factor, so two distinct factor types are combined. That combination satisfies the definition of multi-factor authentication rather than single-factor or same-category authentication.

Risk management is the ongoing process of identifying, assessing, and treating risk to an acceptable level. The scenario describes exactly that cycle: valuing the asset, identifying threats and vulnerabilities, evaluating business impact, and selecting controls to reduce risk. Risk treatment options include mitigation, transfer, avoidance, and acceptance. Because the team is deciding which safeguards to apply based on assessed risk, the activity is risk management rather than a single control or one-time audit.

The (ISC)² Code of Ethics canon places the safety and welfare of society and the common good above all else, including duties owed to an employer. Protecting society therefore takes precedence when the two obligations conflict, satisfying the stem's precedence requirement.

The (ISC)² Code of Ethics orders its canons so that the safety and welfare of society outranks all other duties, including obligations to principals or employers. Protecting society, the common good and the public trust therefore sits at the highest priority, satisfying the stem's demand for the top-ranked obligation.

Load balancing distributes incoming traffic across multiple servers, preventing any single node from being overwhelmed during a volumetric flood. This directly satisfies the stem's requirement to reduce DDoS risk by absorbing and spreading attack traffic, maintaining availability even when request volume spikes far beyond what one server could handle alone.

Preventive controls aim to stop security incidents before they occur. The security guard checking badges at the entrance prevents unauthorized individuals from entering the premises. This is a physical preventive control. By verifying identity before allowing access, it directly stops potential security breaches.

Encryption of data at rest renders stored customer data unreadable without the correct cryptographic keys, directly satisfying the confidentiality requirement. If disks or backups are stolen, ciphertext remains protected, unlike plaintext storage. This control addresses the stem's constraint by preventing unauthorised disclosure of data while it resides on storage media.

Due diligence is the investigation and verification of a vendor's security controls, financial standing and background before entering a contract. The stem describes exactly that: assessing controls and performing background checks on a prospective processor. It satisfies the pre-engagement evaluation constraint, distinguishing it from ongoing monitoring or contractual enforcement.

Hashing produces a fixed-length digest from the transmitted data; any modification changes the digest, so the recipient can verify the data arrived unaltered. This directly satisfies the requirement to detect alteration during transmission, which is the integrity principle.

Risk transference shifts the financial impact of a risk to a third party, such as an insurance company. By purchasing cyber insurance, the organization transfers some of the financial risk of a data breach to the insurer. This is a classic example of risk transference.

Confidentiality directly prevents unauthorised disclosure by restricting data access to approved parties only. It is the CIA principle concerned with secrecy, unlike integrity (unauthorised modification) or availability (timely access). This satisfies the stem's requirement that data is not disclosed to unauthorised individuals.

Defense in depth is a layered security approach where multiple controls are used to protect assets. By deploying firewalls, intrusion detection systems, and endpoint protection, the organization creates overlapping defenses that reduce the likelihood of a single point of failure. This directly exemplifies the defense-in-depth principle, which is a core security strategy.

Non-repudiation provides irrefutable evidence that a specific identity performed a specific action, so the clinician cannot credibly deny approving the order. Digital signatures and tamper-evident audit logs bound to the clinician's authenticated identity deliver this proof. The legal team wants documented assurance of authorship and approval, which is precisely what non-repudiation supplies in a dispute.

Revoking access rights is the administrative control that directly removes the contractor's ability to authenticate and reach internal repositories once the engagement ends. Timely offboarding, including disabling accounts and removing group memberships, closes the window in which former credentials remain usable. This matches the scenario because the goal is to prevent a dismissed contractor from using issued credentials, which only revocation accomplishes.

Data minimization means collecting and retaining only the data necessary for a specific purpose. Not storing the CVV after authorization reduces the amount of sensitive data at risk and aligns with the principle of limiting data retention to what is needed. This directly matches the architect's recommendation to avoid storing a sensitive element once it is no longer required.

Separation of duties divides a critical task among multiple people so that no single individual can complete it alone, reducing the risk of fraud or error. Requiring one employee to create and another to approve the wire transfer directly implements this principle. It ensures that a single person cannot both initiate and authorize a high-risk financial action.

Redundant servers directly satisfy the availability requirement by eliminating single points of failure: if one server fails, another continues serving requests, so the service remains accessible. Unlike confidentiality or integrity controls, redundancy targets uptime specifically, matching the stem's availability constraint through failover rather than prevention of unauthorised access or data alteration.

A customer database is an information asset: it holds valuable data the organisation must protect, and it carries risk exposure if compromised, lost or corrupted. Risk assessments inventory such assets before identifying threats and vulnerabilities, making the database a legitimate asset in this scenario.

A fingerprint is something you are (inherence), while a password is something you know (knowledge). Pairing them spans two separate factor categories, satisfying true multi-factor authentication. Two biometrics, or two passwords, would not qualify as genuine multi-factor.

Medical records combine health information with identifying details, forming sensitive PII whose exposure causes harm or discrimination. Unlike names or email addresses alone, health data attracts stricter legal protection, making it the sensitive category here.

Confidentiality ensures information is not disclosed to unauthorized individuals, entities, or processes. Restricting patient record access to on-shift nurses and physicians directly limits disclosure to authorized parties, which is the core of confidentiality. This scenario is about preventing unauthorized viewing, not about keeping data accurate or available, so confidentiality is the principle being enforced.

A smart card is a possession factor (something the user has), and a PIN is a knowledge factor (something the user knows). Combining these two satisfies the requirement of using something the user knows and something the user has. This is a classic example of multi-factor authentication that strengthens identity verification by requiring two different types of credentials.

Due care is the minimum standard of care an organisation must exercise, while due diligence is the ongoing investigation and assessment underpinning it. This distinction separates the duty itself from the research activity that informs it.

A smart card is something the user possesses, which defines a Type 2 possession factor. It is not a knowledge factor (Type 1) nor an inherence factor (Type 3), so it satisfies the question's requirement for a possession-based example.

Need to know means access to information is granted only to those who require it to perform their duties. The two former employees no longer work in finance, so they have no business need for ledger access, yet their permissions persist. The failure to remove access when the need ended is the essence of a need-to-know violation and a common audit finding.

A PIN code is something you know, which is the defining characteristic of a Type 1 authentication factor. Type 1 factors rely on knowledge, distinguishing them from Type 2 (possession) and Type 3 (inherence) factors.

A vulnerability is a weakness in a system that can be exploited by a threat. The SQL injection flaw is a specific weakness in the web application's code that allows attackers to manipulate database queries. It is the vulnerability that, if exploited, could lead to data breaches. Thus, the flaw itself is correctly termed a vulnerability.

Hashing produces a fixed-length digest that changes if even one bit of the file is modified, so recomputing and comparing it detects tampering. This directly satisfies the integrity goal of ensuring the downloaded file has not been altered in transit or at rest.

Multi-factor authentication combines two or more different authentication factor categories: something you know (the password) and something you are (the fingerprint). Because the factors span knowledge and inherence, rather than two instances of the same category, this satisfies the stem's requirement for both a password and a biometric scan.

A password plus an SMS one-time code combines two different authentication factors: something you know and something you possess. This satisfies the stem's requirement for multi-factor authentication on remote access, since possession of the registered phone is needed alongside the password.

The ISC2 Code of Ethics orders canons so that protect society, the common good, and the public trust ranks first, ahead of duties to principals and peers. Handling names, addresses and Social Security numbers therefore falls under this highest-priority canon.

Confidentiality ensures data is readable only by authorised parties. Encryption at rest protects stored data and encryption in transit protects data on the wire, so both controls prevent unauthorised disclosure — the specific CIA principle the organisation is addressing.

Assigning the 'Confidential' label is itself the act of categorising data by sensitivity, which is data classification. Encryption at rest and in transit are the handling controls that the classification drives, not the classification itself, so the label satisfies the scenario's requirement.

The (ISC)² Code of Ethics canon ordering places the safety and welfare of society first, ahead of duties to principals, the profession, and colleagues. Protecting society therefore holds the highest priority, satisfying the stem's request for the top-ranked principle.

A digital signature is generated from a hash of the message encrypted with the sender's private key, so the recipient can verify integrity and confirm the content was not altered in transit, satisfying the tamper-detection requirement.

Hashing produces a fixed-length digest from input data; any alteration to that input yields a different digest, so recomputing and comparing hashes detects modification. This one-way property provides integrity verification, unlike encryption, which provides confidentiality by making data unreadable.

Accepting the residual exposure because remediation cost outweighs potential loss is risk acceptance — the organisation acknowledges the threat and deliberately retains it. This differs from mitigation, transfer or avoidance, which alter or shift the risk instead.

A threat is any potential cause of an unwanted incident that could exploit a vulnerability and cause harm to assets. Threats can be natural (e.g., floods), human (e.g., hackers), or environmental. This definition is correct because it captures the external or internal actor or event that can act upon a vulnerability. Risk arises when a threat exploits a vulnerability, so this statement accurately describes a threat.

A password is something you know, while an SMS one-time code is delivered to something you possess, the enrolled phone. Combining two distinct factor categories satisfies multi-factor authentication, whereas two passwords or two possession tokens would not.

Risk acceptance is a valid treatment: the organisation acknowledges the risk and proceeds without action, typically when exposure falls within tolerance or mitigation costs exceed potential impact. It sits alongside avoidance, transfer and mitigation as recognised responses.

Sensitive PII is data that, if disclosed, could cause harm or enable identity theft. Medical records uniquely combine health information with identifiers, so their exposure triggers legal, privacy and discrimination risks. Names or email addresses alone lack that harm potential, making medical records the sensitive category.

Due care means implementing reasonable security measures to protect data, satisfying the question's focus on the purpose of due care. It reflects the ongoing obligation to identify risks and apply proportionate controls, distinguishing it from due diligence, which concerns the investigation and assessment of those risks before action.