CCNA Risk Identification, Monitoring, and Analysis Questions

A risk register is only useful if it reflects current exposure. When a control is deployed, the risk must be reassessed to measure how much likelihood or impact it actually reduced, and the residual rating updated with evidence. This validation step closes the treatment loop and supports accurate reporting to management.

Risk mitigation involves applying controls to reduce the likelihood or impact of a risk to an acceptable level. Implementing input validation and parameterized queries directly addresses the SQL injection vulnerability by preventing malicious SQL from being executed, thereby reducing the risk without eliminating the application's functionality.

Continuous monitoring depends on three reinforcing activities: scheduled collection and review of audit logs, defined metrics with escalation thresholds, and recurring evaluation of the program itself. Together they provide detection, measurable response criteria, and a feedback loop that keeps coverage current. Penetration testing is periodic validation rather than continuous monitoring, and indefinite archiving without analysis adds no detection capability.

Implementing a WAF rule to block exploitation attempts reduces the likelihood or impact of the vulnerability without removing the flaw itself. This is a classic risk mitigation technique, as it applies a compensating control to lower residual risk while the server remains unpatched. Risk mitigation involves taking action to reduce risk to an acceptable level, which is exactly what deploying a WAF signature achieves.

Risk transference is the correct classification because cyber insurance shifts the financial consequences of a data breach to an external insurer. The organization still owns the risk operationally, but the monetary impact is contractually borne by another party. This is a standard risk treatment option alongside avoidance, mitigation, and acceptance, and it is commonly used for low-frequency, high-impact events such as major data breaches.

DNS tunneling encodes data in DNS queries and responses, often generating a high volume of outbound queries to domains that are newly registered or otherwise suspicious. Correlating these two indicators—unusual query volume and suspicious domain characteristics—directly targets the behavior of DNS tunneling, making it the most effective rule for detecting this exfiltration technique.

Detecting attacks that unfold across many packets and sessions requires the IDS to retain and reason about session state. Stateful protocol analysis tracks conversations against expected protocol behavior, enabling recognition of slow scans, evasive fragmentation, and follow-on exploitation that isolated packet inspection would miss. This makes it the appropriate priority for the described scenario.

CIS Benchmarks define Level 1 as a set of configuration settings intended to provide basic security hygiene with minimal impact on business operations. These settings are designed to be easily implemented without causing significant performance degradation or service disruption, making them suitable for most systems. Level 1 focuses on essential security controls that address common vulnerabilities while maintaining system usability.

Exceeding CIS Level 1 password complexity requirements represents a stronger security posture, not a violation. CIS benchmarks define Level 1 as a minimum baseline of essential security controls, and deviations that improve security are acceptable as long as they are documented and formally accepted by management. The key principle is that compliance is measured against the minimum baseline, and stronger configurations are permitted with proper risk acceptance.

When leadership evaluates a risk and consciously decides to continue operating without adding controls because remediation costs outweigh expected losses, the decision is risk acceptance. This must be documented and periodically reviewed so it remains an informed choice. It differs from avoidance, which eliminates the activity, and from transference, which shifts financial impact to another party.

The core risk is that terminated credentials remain usable because deprovisioning depends on manual steps. Linking the identity provider to authoritative HR data automates deactivation and session revocation the moment employment status changes, closing the gap at its source. Complexity policies, MFA, and periodic reviews each reduce some exposure but none prevents a known valid credential from being used after departure.

A false positive occurs when the IDS incorrectly classifies legitimate traffic as malicious, generating an alert for benign activity. This is a common issue after deploying a new IDS with default or overly sensitive signature sets, leading to alert fatigue. The core reasoning is that the IDS's detection logic (e.g., pattern matching or anomaly thresholds) misidentifies normal behavior as an attack.

Detecting unexpected modification of critical system files requires periodic or real-time hashing of those files against a stored known-good baseline. File integrity monitoring, delivered by a host-based intrusion detection agent, performs exactly this function and generates alerts when hashes diverge, which no network sensor, log aggregator, or periodic vulnerability scan accomplishes.

Quantitative risk analysis compares the annual cost of a control with the reduction in annualized loss expectancy it produces. The WAF cuts expected loss by $30,000 while costing $12,000 per year, yielding a positive net benefit of $18,000. That favorable relationship is the basis for recommending implementation; the residual loss simply reflects that no control eliminates risk entirely.