CCNA Security Principles Questions

A digital signature uses asymmetric cryptography: the signer's private key creates a hash-based value that any verifier can check with the public key. Altering the document invalidates that value, directly satisfying the requirement to detect changes since signing.

Password is a knowledge factor (Type 1). Combining it with a possession factor like a smart card meets the definition of MFA.

Non-repudiation ensures that a party cannot deny the authenticity of their signature on a document or the sending of a message. By signing the wire transfer with a private key, the sender cannot later claim they did not authorize it. This directly supports non-repudiation, which is crucial for financial transactions to prevent fraud and disputes.

A hardware OTP token is a physical device issued to the user, so presenting its generated code demonstrates possession. That tangible-device characteristic is precisely what qualifies it as a Type 2 factor rather than knowledge or inherence.

The Code of Ethics ranks obligations to the public above duties to clients and employers. Protecting society, the common good, public trust and the infrastructure is the paramount imperative, so it takes precedence over all other canons when interests conflict.

Risk acceptance means acknowledging a risk and choosing to bear its potential impact without further mitigation, which matches the decision to tolerate the unpatched legacy system because isolation and compensating controls reduce exposure to an acceptable level.

A threat is any potential cause of an unwanted incident that could harm an asset. In risk management, threat is a core component because risk exists only when there is a threat that can exploit a vulnerability. Without a threat, a vulnerability alone does not create risk. Therefore, threat directly contributes to risk and is one of the correct elements.

Redundant servers with immediate failover keep services accessible when one server fails, directly addressing the availability principle. Availability ensures authorised users can access systems and data when required, which is precisely the uptime guarantee the redundant design delivers.

Prompt disclosure to the vendor lets the flaw be fixed before attackers exploit it, upholding the canon to advance the profession and protect the public. This satisfies the stem's requirement for an action aligned with the (ISC)² Code's canons.

Accepting the risk means the organisation acknowledges the vulnerability but chooses to tolerate it because remediation costs outweigh the potential financial loss. This deliberate decision to absorb the residual risk, rather than mitigate, transfer or avoid it, is the defining characteristic of risk acceptance within the risk management process.

Due diligence is the systematic investigation a company performs before engaging a provider, covering security controls, compliance certifications and risk posture. It directly satisfies the stem's requirement to thoroughly investigate the provider's practices and standards conformance, distinguishing it from ongoing monitoring or contractual assurance obtained after selection.

Data classification assigns sensitivity labels that directly dictate which security controls apply, satisfying the stem's requirement for a primary goal. By categorising information according to its value and sensitivity, organisations can apply proportionate protection, ensuring Microsoft Entra ID access policies and encryption align with each data type's risk profile.

Medical records are sensitive PII because they combine an identifier with health data, revealing diagnoses, treatments or conditions. This falls within special-category data under GDPR and triggers stricter handling than ordinary personal data, satisfying the stem's requirement for sensitive rather than generic PII.

Confidentiality directly addresses unauthorised disclosure, ensuring information remains accessible only to those with legitimate access rights. This satisfies the stem's requirement by naming the specific security objective that prevents exposure of data to unauthorised parties, distinguishing it from integrity (unauthorised modification) and availability (disruption of access).

Encryption at rest and in transit renders data unreadable to unauthorised parties, directly preventing disclosure. Confidentiality is the CIA principle concerned with restricting data access to approved subjects, so encrypting sensitive data satisfies that constraint rather than integrity or availability.

Risk acceptance means acknowledging a risk and choosing to bear the potential loss rather than mitigate it. The organisation identified the vulnerability but declined to patch it because of downtime concerns, deliberately retaining the exposure, which matches acceptance rather than avoidance, transference or mitigation.

Confidentiality ensures information is not disclosed to unauthorized individuals, which directly matches the requirement that only authorized clinicians can read patient records. Protecting data in storage and transit through encryption and access controls is the classic application of this principle, so it is the correct choice for this scenario.

Redundant servers and failover maintain uptime when a component or power source fails, directly preserving access to systems and data. Availability is the CIA goal concerned with ensuring authorised users can reach resources when required.