CCNA Security and Risk Management Questions

The Sarbanes-Oxley Act (SOX) mandates that public companies establish and maintain internal controls over financial reporting. IT General Controls (ITGC) are foundational to this, ensuring the integrity, reliability, and security of the information systems that process financial data. These controls, encompassing areas like access management, change management, and operations, directly support the accuracy of financial statements, which is a core requirement of SOX Sections 302 and 404. Without robust ITGC, the reliability of financial data cannot be assured.

Protecting stored cardholder data is precisely what PCI DSS Requirement 3 mandates, making this the correct answer. This requirement specifically addresses data at rest, compelling organizations to render cardholder data unreadable through methods such as strong encryption, truncation, masking, or tokenization when it is stored on systems, databases, or other media, thereby minimizing its value if a breach occurs.

Confidentiality is the core principle that ensures information is not disclosed to unauthorized individuals, entities, or processes. It involves protecting sensitive data from being viewed or accessed by those without the proper clearance or need-to-know. Encryption, access controls, and proper data handling policies are primary mechanisms used to uphold confidentiality, directly addressing the prevention of unauthorized disclosure.

The Maximum Tolerable Period of Disruption (MTPD), also known as Maximum Tolerable Downtime (MTD), is the absolute longest period a business process or function can be inoperative before experiencing unacceptable consequences. This critical metric, determined during a Business Impact Analysis (BIA), establishes the ultimate deadline for recovery, guiding the prioritization of resources and recovery strategies to prevent severe organizational harm.

A Business Associate Agreement (BAA) is a legally mandated contract under HIPAA that must be established between a covered entity and its business associates before Protected Health Information (PHI) is shared. This agreement obligates the business associate to implement specific administrative, physical, and technical safeguards to protect PHI, adhering to the HIPAA Security and Privacy Rules. The BAA ensures accountability and extends the covered entity's compliance responsibilities to third parties handling PHI on its behalf, making it the correct and essential mechanism for such sharing.

A policy is a mandatory, high-level statement approved by management, articulating the organization's strategic intent and overarching requirements for information security. It establishes the fundamental rules and direction for protecting assets, often driven by legal, regulatory, or business imperatives, without specifying technical details. Policies are foundational, setting the broad scope and purpose of security efforts across the enterprise.

This value correctly represents the Annualized Loss Expectancy (ALE), which is a key metric in quantitative risk analysis. It is calculated by multiplying the Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO). Assuming an SLE of $15,000 and an ARO of 0.5 (meaning the event is expected to occur once every two years), the ALE is $15,000 * 0.5 = $7,500. This figure quantifies the expected financial loss from a specific risk over a one-year period, informing cost-benefit analyses for security controls.

Consent is a fundamental lawful basis where the data subject explicitly and unambiguously agrees to the processing of their personal data for a specific purpose. For consent to be valid, it must be freely given, specific, informed, and an unambiguous indication of the data subject's wishes, often requiring a clear affirmative action. This places control directly with the individual.

The primary objective of a Business Impact Analysis (BIA) is to identify and prioritize the organization's critical business processes. By distinguishing core operations from non-essential ones, the BIA allows planners to allocate recovery resources effectively and establish realistic recovery timelines. Without this inventory, the BCP cannot target the most vital survival functions of the enterprise.

A reciprocal agreement is a mutual arrangement between two organizations, often competitors or peers, to provide each other with backup facilities, equipment, or resources in the event of a disaster. This type of agreement directly addresses the concept of 'an agreement with' another entity to ensure business continuity, leveraging shared risk and resources rather than dedicated, pre-built recovery sites.

This sequence precisely matches the four canons of the (ISC)² Code of Ethics, which are hierarchically ordered to guide cybersecurity professionals. The primary responsibility is to protect society, followed by acting honorably, providing diligent service to principals, and finally advancing the profession. This specific order reflects the increasing scope of responsibility, from global impact to individual professional growth, making it the correct representation of the ethical framework.

Consent is a valid lawful basis under GDPR Article 6(1)(a) when the data subject has given their explicit agreement to the processing of their personal data for one or more specific purposes. For consent to be valid, it must be freely given, specific, informed, and unambiguous, signified by a clear affirmative action. Furthermore, the data subject must be able to withdraw their consent as easily as they gave it, and the controller must be able to demonstrate that consent was obtained.

This is the correct answer because it represents the first and highest priority canon in the (ISC)² Code of Ethics. It mandates that certified professionals prioritize the safety, welfare, and security of the public, critical systems, and shared resources above all other considerations. This overarching responsibility ensures that individual or organizational interests never compromise the broader societal well-being or the integrity of essential information technology infrastructure.

This option correctly calculates the Annual Loss Expectancy (ALE) by first determining the Single Loss Expectancy (SLE) and then multiplying it by the Annualized Rate of Occurrence (ARO). The SLE is derived from the Asset Value ($50,000) multiplied by the Exposure Factor (0.4), resulting in $20,000. Subsequently, multiplying this SLE by the ARO (0.5) yields the correct ALE of $10,000, representing the expected financial loss from this specific risk over a year.

Non-repudiation provides irrefutable proof that a specific action or event has occurred and that a particular entity was responsible for it, preventing them from later denying their involvement. This is typically achieved through robust audit trails, digital signatures, and secure logging mechanisms that cryptographically link an action to a user. Therefore, it directly addresses the requirement to prevent users from disclaiming responsibility for their actions within an access control system.

This value represents the Annualized Loss Expectancy (ALE), which is derived by multiplying the Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO). Given an SLE of $50,000 and an ARO of 0.2 (meaning a 20% chance of the event occurring annually), the correct ALE calculation is $50,000 * 0.2, resulting in $10,000. This figure quantifies the expected financial loss from a specific risk over a one-year period.

A security policy is a high-level, mandatory statement issued by management that defines the organization's overall security objectives and requirements. This statement clearly dictates a non-negotiable requirement for all employees, establishing a foundational security control to protect organizational assets. It addresses *what* is required for security, without specifying the technical implementation details.

Vital interests is a lawful basis under GDPR Article 6(1)(d) that permits the processing of personal data when it is necessary to protect the life of the data subject or another natural person. This basis is typically invoked in emergency situations where obtaining consent is impossible or impractical, such as medical emergencies, humanitarian crises, or public health threats. It represents a very high threshold and is generally reserved for situations involving a serious threat to life or physical integrity, making it a basis of last resort rather than routine processing.

In a qualitative risk assessment, "High risk" is assigned when both the likelihood of a threat event occurring and the potential impact of that event on organizational assets or operations are rated as high or critical. This combination signifies a significant exposure that demands immediate attention and substantial resource allocation for mitigation, as the potential for severe damage is both probable and substantial.

Authorization is the critical component of the AAA framework responsible for determining what actions an authenticated user or system is permitted to perform on a resource. After identity verification, authorization mechanisms consult policies and access control lists (ACLs) to decide "what you are allowed to do," granting or denying specific privileges based on the user's role, group membership, or other attributes. This directly addresses the question of defining permissions.

A hot site is a fully operational, mirrored facility that replicates the primary production environment with identical hardware, software, and up-to-date data, often synchronized in real-time. This comprehensive setup allows for immediate failover in the event of a disaster, ensuring minimal data loss and near-zero downtime. A hot site achieves the lowest Recovery Time Objective (RTO) and Recovery Point Objective (RPO), making it the optimal choice for critical applications requiring continuous availability and rapid business continuity.

Accepting the risk means consciously deciding to take no action to reduce the likelihood or impact of a risk, and instead bearing the potential consequences if the risk materializes. This strategy is economically sound and appropriate when the cost of implementing any other risk response, such as mitigation or transfer, is greater than the potential financial loss that would be incurred if the risk event occurs. For high-likelihood, low-impact risks where response costs exceed potential losses, acceptance is the most pragmatic and cost-effective approach.

Developing recovery strategies is the direct and logical next step after completing a Business Impact Analysis (BIA). The BIA identifies critical business functions, their Recovery Time Objectives (RTOs), and Recovery Point Objectives (RPOs), essentially defining *what* needs to be recovered and *how quickly*. Based on these findings, the organization then determines the *how* by selecting and designing appropriate recovery strategies, such as hot sites, warm sites, or reciprocal agreements, to meet those defined objectives.

The Maximum Tolerable Period of Disruption (MTPD) represents the absolute longest time a business process or function can be inoperative before the organization experiences unacceptable consequences, such as significant financial loss, regulatory penalties, or irreparable reputational damage. It is a critical business-driven metric established during the BIA, defining the ultimate threshold for downtime that the business can endure without suffering severe harm. All recovery objectives, including RTO, must be set to ensure MTPD is not exceeded.

This option correctly calculates the Annualized Loss Expectancy (ALE) by first determining the Single Loss Expectancy (SLE) and then multiplying it by the Annualized Rate of Occurrence (ARO). The SLE is derived from the Asset Value ($50,000) multiplied by the Exposure Factor (0.4), resulting in $20,000. Multiplying this SLE by the ARO of 2 yields an ALE of $40,000, representing the expected financial loss from this specific risk over a year.

This sequence accurately represents the correct hierarchical order of the (ISC)² Code of Ethics Canons. "Protect Society, the Commonwealth, and the Infrastructure" is the foundational and highest-priority canon, followed by "Act honorably, honestly, justly, responsibly, and legally," then "Provide diligent and competent service to principals and the profession," and finally, "Advance and protect the profession."

According to the company's qualitative risk analysis matrix, a risk score of 20 exceeds the established threshold of 15, which delineates the boundary for 'High' risk. This indicates that any risk with a numerical assessment equal to or greater than 15 is categorized into the 'High' severity level. Consequently, a score of 20 directly and correctly maps to a 'High' risk classification within this framework.

This sequence correctly represents the foundational AAA framework. Authentication verifies the user's identity, establishing 'who you are.' Subsequently, Authorization determines the specific resources or actions the authenticated user is permitted to access, defining 'what you can do.' Finally, Accounting meticulously logs all user activities and resource consumption, providing a record of 'what you did' for auditing and accountability.

A procedure is a mandatory, detailed set of step-by-step instructions that describes *how* to perform a specific task or process consistently and securely. It outlines the exact actions to be taken, the order in which they should occur, and often specifies roles, responsibilities, and tools required. Procedures ensure uniformity, repeatability, and compliance with established policies and standards, directly addressing the need for explicit operational guidance for security functions.

The primary purpose of a Business Associate Agreement (BAA) is to contractually obligate the business associate to comply with the applicable provisions of the HIPAA Privacy and Security Rules. This legally binding agreement ensures that the business associate implements appropriate administrative, physical, and technical safeguards to protect Protected Health Information (PHI), reports breaches, and limits PHI use and disclosure to only what is necessary for the services provided, thereby extending the chain of trust.

A Business Associate Agreement (BAA) is a legally required contract under HIPAA that must be in place before a Covered Entity (like a hospital) shares Protected Health Information (PHI) with a Business Associate (like a billing company). This agreement outlines the permissible uses and disclosures of PHI by the Business Associate and mandates their compliance with HIPAA's Security and Privacy Rules, ensuring appropriate safeguards are maintained. It establishes the responsibilities and liabilities of both parties regarding PHI protection.

Risk mitigation involves implementing specific security controls and countermeasures to actively reduce the likelihood of a risk occurring or to lessen its potential impact. For a high-impact risk, this means taking proactive steps, such as strengthening defenses, improving processes, or deploying new technologies, to bring the risk level down to an acceptable threshold. It is a primary and responsible strategy when the activity causing the risk cannot be avoided.

The canon to "Protect society, the common good, necessary public trust and confidence, and the infrastructure" is unequivocally the first and highest priority within the (ISC)² Code of Ethics. This principle mandates that all cybersecurity professionals prioritize the safety, welfare, and security of the public above all other considerations. It encompasses safeguarding critical infrastructure, protecting sensitive data, and ensuring the reliability of information systems, establishing a clear ethical imperative that supersedes individual, organizational, or professional interests.

Residual risk is the specific level of risk that persists within an organization or system even after all planned and implemented risk mitigation strategies, controls, and countermeasures have been applied. It represents the remaining exposure that management has either consciously accepted or has been unable to further reduce through cost-effective means. This is the risk an organization must live with, requiring continuous monitoring and potential future reassessment.

A risk score of 20, calculated as the product of a high likelihood (e.g., 4 on a 5-point scale) and a very high impact (e.g., 5 on a 5-point scale), correctly places the risk in the "High" category. In a qualitative risk matrix, the "High" range typically encompasses scores from approximately 15 to 25, signifying a significant probability of occurrence combined with substantial potential negative consequences that demand immediate attention and mitigation strategies.

Under GDPR Article 33(1), a data controller must notify the competent supervisory authority of a personal data breach "without undue delay" and, where feasible, not later than 72 hours after becoming aware of it. This strict timeframe is critical for enabling authorities to assess the breach's impact and advise on necessary mitigation steps promptly. Failure to adhere to this 72-hour deadline without proper justification can lead to significant penalties under the regulation.

"Protect society, the common good, and the public trust" is unequivocally the highest priority canon in the ISC2 Code of Ethics, serving as the foundational principle for all cybersecurity professionals. This canon mandates that all actions and decisions must prioritize the safety, welfare, and confidence of the public, ensuring that information systems and data are secured to prevent harm to individuals, organizations, and critical infrastructure. This overarching responsibility guides all other ethical considerations, making it the correct answer.

Risk avoidance is a strategy where an organization eliminates a particular risk entirely by choosing not to engage in the activity or process that gives rise to it. This approach completely removes the potential for the risk event to occur, rather than merely reducing its likelihood or impact. It is typically employed when the potential consequences of a risk are deemed unacceptable and cannot be effectively managed through other means.

Encryption directly addresses confidentiality by transforming plaintext data into an unreadable ciphertext using a cryptographic algorithm and a secret key. This process ensures that even if unauthorized individuals gain access to the encrypted data, they cannot decipher its content without the correct decryption key. Consequently, encryption effectively prevents unauthorized disclosure of sensitive information, making it the primary control for upholding the confidentiality of data both at rest and in transit.

After implementing security controls, the inherent risk (high likelihood, potentially high impact) is expected to be reduced to a more acceptable level. "Medium likelihood, medium impact" represents a plausible and common outcome of effective risk mitigation strategies, where controls successfully diminish the probability of the event occurring and/or lessen its potential consequences. This remaining risk, after controls are applied, is precisely what is defined as residual risk, indicating a successful but not absolute reduction from the initial state.

ITIL (Information Technology Infrastructure Library) is a widely adopted framework providing best practices for IT service management (ITSM). It specifically guides organizations through the entire service lifecycle, encompassing Service Strategy, Design, Transition, Operation, and Continual Service Improvement, making it ideal for managing the full journey of IT services.

GDPR Article 33 mandates that in the event of a personal data breach, the data controller must notify the relevant supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of it. This notification is required unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. The notification must include details such as the nature of the breach, categories of data subjects and records concerned, and the likely consequences.

Risk acceptance is a deliberate decision by an organization to acknowledge and bear the potential consequences of a specific risk, often when the cost or effort of implementing other response strategies outweighs the potential impact. This strategy is typically documented, and the organization may establish a contingency plan or simply monitor the risk without further action.

This option directly corresponds to PCI DSS Requirement 4: 'Encrypt transmission of cardholder data across open, public networks.' This foundational requirement mandates the use of strong cryptography and security protocols, such as TLS 1.2 or higher, to protect cardholder data during transit over untrusted networks, preventing interception and unauthorized disclosure. It is one of the 12 high-level requirements.

This fundamental GDPR right allows data subjects to request the deletion or removal of their personal data without undue delay under specific circumstances. These conditions include when the data is no longer necessary for the purpose for which it was collected, when consent is withdrawn, or when the data has been unlawfully processed. However, this right is not absolute and can be overridden by legal obligations or public interest considerations.

Audit logs meticulously record system events, user activities, and changes, often including source IP, user ID, and a precise timestamp. When properly secured against tampering, these immutable records serve as irrefutable evidence of who performed what action and when, making it difficult for an individual to deny their involvement in a specific event. This comprehensive logging provides a verifiable trail for accountability.

A procedure is a detailed, step-by-step document that outlines how to perform a specific task, such as securely configuring a server. It translates standards and policies into actionable steps. This matches the administrator's need for precise instructions, making it the correct choice.

This option correctly defines the Recovery Time Objective (RTO) as the maximum acceptable downtime of 4 hours, meaning services must be restored within this period. Simultaneously, the Recovery Point Objective (RPO) of 15 minutes specifies that the maximum tolerable data loss is 15 minutes, ensuring recent data is preserved. These values precisely align with the assumed business requirements for both service availability and data integrity, making it the optimal disaster recovery strategy.

The primary goal of a Business Impact Analysis (BIA) is to systematically identify and quantify the potential impacts of business disruptions and, crucially, to determine the Maximum Acceptable Outage (MAO), also known as Maximum Tolerable Downtime (MTD), for each critical business process. This analysis establishes the absolute longest period a business function can be unavailable before suffering unacceptable consequences, thereby setting critical recovery time objectives (RTOs) that guide subsequent disaster recovery planning and resource allocation.

This is the correct distinction. Policies are formal, high-level statements that mandate specific actions or behaviors, establishing compulsory rules that all relevant parties must adhere to, with non-compliance typically incurring disciplinary or legal consequences. In contrast, guidelines provide recommended best practices, suggestions, or advisory information designed to assist individuals in making informed decisions or performing tasks, but they are not strictly enforced. This fundamental difference in obligation and enforceability is key to their purpose within an organization's governance framework.

Outsourcing transfers the operational risk to the third-party provider, who is contractually obligated to meet performance and security requirements. The organization retains some residual risk, but the primary responsibility shifts, which is a form of risk transfer. Thus, this action is correct.

Confidentiality's primary purpose is to safeguard sensitive information from unauthorized disclosure or access. This involves implementing controls such as encryption, robust access control mechanisms, and the principle of least privilege to ensure that only authorized individuals or systems can view or obtain specific data. Its core objective is to maintain the secrecy and privacy of information, preventing its exposure to those without a legitimate need-to-know.

This statement precisely defines the Cardholder Data Environment (CDE) according to PCI DSS. It includes all system components, applications, and network devices that directly store, process, or transmit cardholder data, as well as any system that could impact the security of the CDE. This comprehensive definition ensures that all relevant assets handling sensitive payment information are brought under the stringent security controls mandated by the standard.

ISO/IEC 27001 is a globally recognized standard that specifies the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). It provides security auditors with a structured, risk-based framework to evaluate an organization's overall security governance, risk management, and control objectives.

The BIA quantifies how long each critical process can be unavailable before unacceptable impact, producing the maximum tolerable downtime that shapes recovery time objectives and continuity strategies. This directly satisfies the objective of prioritising recovery efforts by business impact.

ITIL (Information Technology Infrastructure Library) is the most appropriate choice as it provides a detailed, practical framework of best practices for IT service management (ITSM). It encompasses the entire service lifecycle, from strategy and design to transition, operation, and continual service improvement, ensuring that IT services are aligned with business needs and deliver value. ITIL's focus on service delivery, customer experience, and value co-creation makes it ideal for governing IT services.

An information security policy is a high-level document that expresses management's intent to protect information assets, assigns roles and responsibilities, and aligns with frameworks like ISO/IEC 27001. It requires executive approval and sets the foundation for all other security documents. This scenario matches that definition exactly, making it the correct choice.

Under SOX, the integrity and reliability of financial reporting systems are paramount. A robust change management process for financial systems is a critical IT General Control (ITGC) because it ensures that all modifications to these systems are authorized, tested, and documented, preventing unauthorized changes that could compromise financial data accuracy. This control directly supports the reliability of financial statements by maintaining the stability and correctness of the applications processing financial transactions.

This option correctly calculates the Annualized Loss Expectancy (ALE) using the formula ALE = SLE × ARO. With an Asset Value (AV) of $500,000 and an Exposure Factor (EF) of 0.20, the Single Loss Expectancy (SLE) is $100,000. Multiplying this SLE by the Annualized Rate of Occurrence (ARO) of 0.10 yields the correct annualized risk value of $10,000.

Purchasing cyber insurance is a classic example of risk transfer. This strategy involves shifting the financial responsibility for potential losses, such as those arising from data breaches, ransomware attacks, or business interruption, to a third party—the insurance provider. While the underlying operational risk itself still exists, the financial impact on the company is significantly reduced, as the insurer assumes the cost of recovery, legal fees, and other covered damages. This allows the organization to mitigate the severe financial consequences of a cyber incident without eliminating the threat entirely.

A cloud service provider that hosts electronic Protected Health Information (ePHI) on behalf of a covered entity is unequivocally a Business Associate under HIPAA. By storing or processing ePHI, the CSP creates, receives, maintains, or transmits this data, making them directly subject to HIPAA's Security Rule and certain aspects of the Privacy Rule. A Business Associate Agreement (BAA) is mandatory to define their responsibilities and ensure appropriate safeguards are in place for the ePHI.

A hot site's defining characteristic is its immediate operational readiness. This means all necessary computing hardware, including servers, storage, and end-user workstations, must be pre-installed, configured, and often pre-loaded with essential operating systems and applications. This readiness minimizes recovery time objectives (RTO) by eliminating the need for hardware procurement and setup during a crisis, allowing for rapid business resumption.

Article 33(1) of the GDPR requires data controllers to notify the competent supervisory authority "without undue delay and, where feasible, not later than 72 hours after having become aware of it." This timeframe applies specifically when the personal data breach is likely to result in a risk to the rights and freedoms of natural persons, ensuring prompt action to mitigate potential harm and facilitate regulatory oversight.

This is the correct Annualized Loss Expectancy (ALE), derived from accurately applying the quantitative risk analysis formula. First, the Single Loss Expectancy (SLE) is calculated as the Asset Value ($100,000) multiplied by the Exposure Factor (0.4), yielding $40,000. This SLE is then correctly multiplied by the Annualized Rate of Occurrence (2) to determine the total expected financial loss over a year, which is $80,000.

The General Data Protection Regulation (GDPR) explicitly mandates that organizations report personal data breaches to the relevant supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of it. This strict timeline applies unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. It also requires notification to affected data subjects if the breach poses a high risk.

Risk transfer is a strategic approach where the financial liability or responsibility for a specific risk is contractually shifted to a third party. This does not eliminate the underlying risk event itself, but rather reallocates the potential financial impact or operational burden. Common methods include purchasing insurance policies, outsourcing functions to vendors who assume associated risks, or incorporating indemnification clauses into service level agreements, thereby protecting the organization from direct financial loss.

A hot site is a fully operational and configured disaster recovery facility, mirroring the primary site with all necessary hardware, software, and up-to-date data. It is designed for immediate activation, allowing critical business operations to resume within hours or even minutes, minimizing downtime and data loss. This level of readiness is crucial for systems with very low recovery time objectives (RTOs).

The AAA (Authentication, Authorization, and Accounting) framework is the fundamental model for implementing access control systems, directly addressing the core requirements for managing user access. Authentication verifies a user's identity, ensuring only legitimate entities can attempt access to resources. Authorization then determines what specific actions the authenticated user is permitted to perform, based on defined policies and privileges. Finally, Accounting tracks user activities and resource consumption, providing an essential audit trail for accountability, billing, and compliance purposes.

The CIA triad fundamentally defines the three paramount objectives that information security strives to achieve: Confidentiality, Integrity, and Availability. This foundational model provides a universal language and framework for understanding, categorizing, and prioritizing security goals across all aspects of information systems and data protection.