CCNA Security Operations and Administration Questions

The 3-2-1 rule is a foundational data backup strategy that mandates maintaining three total copies of data, stored on two different types of media (e.g., disk and tape), with one copy located offsite to protect against site-level disasters. This directly matches the policy described, making option C correct.

CCTV (Closed-Circuit Television) is a physical security control because it involves cameras and recording equipment that monitor and deter physical access to facilities. It is a detective and deterrent control that operates in the physical domain, not the logical or network domain.

To restore the server to its state on Tuesday night, you need the full backup from Sunday and the incremental backups from Monday and Tuesday. Incremental backups only capture changes since the last backup (full or incremental), so you must restore them in sequence: full backup first, then Monday's incremental, then Tuesday's incremental. This requires three backup sets total, making option D correct.

A differential backup copies all data that has changed since the last full backup, regardless of any intermediate backups. This means each differential backup grows in size as it accumulates all changes made since the last full backup, making it distinct from incremental backups which only capture changes since the last backup of any type.

The incident count metric directly captures the occurrence of a security event—multiple failed logins followed by a successful login from an unusual IP—as a discrete security incident. This metric is used to track the number of such events over time, enabling trend analysis and resource allocation for incident response. It is the most appropriate measure for logging and reporting this specific sequence of authentication anomalies.

Option B is correct because hourly incremental backups ensure that data loss is limited to at most one hour (meeting the 1-hour RPO), while the weekly full backup combined with the incremental chain allows restoration within the 4-hour RTO, assuming the restore process is optimized. Incremental backups capture only changes since the last backup, reducing storage and backup time, which is critical for meeting tight RPOs.

Media handling policies require that portable media be sanitised before disposal to prevent data leakage. Hard drives should be wiped or destroyed.

Full disk encryption (FDE) is the most effective control because it renders data unreadable at rest on the entire drive, including the operating system, swap files, and temporary files. Without the decryption key (e.g., a pre-boot PIN or TPM-bound key), an attacker cannot access any data even if the laptop is physically removed. This directly addresses the threat of data exposure from loss or theft, unlike controls that only limit access or track the device.

A time-delay alarm is the best control because it directly addresses the root cause—employees propping the door open—by alerting security or triggering a response if the door remains open beyond a preset interval (e.g., 10–30 seconds). This maintains the integrity of the mantrap, which is designed to prevent tailgating and unauthorized access by ensuring only one person enters at a time. Unlike passive measures, the alarm provides immediate feedback and deterrence against the unsafe behavior.

The change should be halted and the CAB reconvened to reassess the change given the new information.

The Acceptable Use Policy (AUP) defines the rules and guidelines for using an organization's IT resources, including prohibited behaviors like password sharing. This policy sets the overall acceptable behavior framework, whereas a Password Policy specifically governs password creation, complexity, and rotation rules, not the act of sharing. Therefore, a prohibition on sharing passwords falls under the AUP because it addresses user conduct rather than technical password parameters.

The first step is to assess the risk and prioritise based on exploitability and asset criticality. A CVSS 9.8 vulnerability is critical, so immediate action is needed, but the administrator should evaluate compensating controls before applying the patch.

A clean desk policy requires that sensitive information, including passwords, be secured and not left visible.

After CAB approval, the next step is to test the change in a staging environment that mirrors production. This validates the firewall rule change does not introduce security gaps or performance issues before deployment. Testing in staging ensures the rule syntax, order, and interaction with existing rules are correct, preventing unintended access or denial of service.

An Acceptable Use Policy (AUP) defines the rules and guidelines for using corporate IT resources, including email and internet. It specifies permitted and prohibited activities, such as personal browsing, sending sensitive data, or accessing inappropriate content, ensuring employees understand their responsibilities. This policy directly addresses the company's goal of educating employees on proper usage, unlike other policies that focus on data classification, remote connectivity, or authentication.

A baseline configuration in configuration management defines a known, secure, and consistent state for a system at a specific point in time. This baseline serves as the foundation for all subsequent changes, ensuring that systems are deployed with hardened settings and that any deviations can be detected and remediated. It directly supports security operations by enforcing minimum security standards and simplifying compliance auditing.

The described strategy backs up all data on Sunday (a full backup) and then on other days backs up only data that has changed since the last full backup. This is the defining characteristic of a differential backup: it always references the most recent full backup, not the previous day's backup. Unlike incremental backups, differential backups do not reset the archive bit after each run, so each differential backup grows in size until the next full backup.

Average time to patch critical vulnerabilities (Mean Time to Patch, MTTP) directly measures the speed of remediation, which is a key indicator of patching effectiveness. Patch compliance rate quantifies the percentage of systems that have the required patches installed, reflecting coverage and adherence to policy. Both metrics provide actionable data on the patching process's efficiency and completeness.

The standard change management process begins with submitting a change request, followed by impact assessment, CAB approval, testing, implementation, and finally post-implementation review.

Configuration management includes automated scanning (e.g., SCAP) to detect deviations. Implementing such scans in the staging environment would catch deviations before production.

A mantrap is specifically designed to prevent tailgating by using a small vestibule with two interlocking doors. Only one door can open at a time, and the system typically requires authentication (e.g., badge or biometric) to proceed, ensuring that only one authorized person enters per cycle. This physical barrier directly blocks unauthorized individuals from following an authorized user through a single entry point.

The scenario describes a user logging in from an unauthorized location (foreign country) at an unusual time (3:00 AM) without remote access authorization. This directly violates the remote access policy, which defines who can connect remotely, from where, and under what conditions. The policy typically specifies allowed authentication methods (e.g., VPN with multi-factor authentication), permitted IP ranges, and time-of-day restrictions to prevent unauthorized external connections.

A key performance indicator (KPI) measures the performance of a process or activity. Patch compliance rates are common KPIs for patch management, indicating how well the organization is meeting patching objectives.

This requirement is an administrative control because it is a policy mandate that defines rules and procedures for handling sensitive data. Administrative controls are management directives, such as security policies, standards, and guidelines, that govern behavior and processes. The encryption itself is a technical control, but the requirement to encrypt is a policy statement, which falls under administrative controls.

A mantrap is a small room with two doors where the first door must close before the second opens, preventing tailgating.

The employee should not attempt to force the door; instead, they should use the intercom to contact security for assistance.

A CMDB is a repository that stores information about configuration items (CIs) and their relationships. Option C is correct because relationships between CIs are fundamental to understanding how changes affect the IT infrastructure. Option E is correct because hardware inventory details like serial numbers are typical attributes stored for each CI, enabling asset tracking and impact analysis.

The policy requires all employees to use a password manager and enable multi-factor authentication, which directly governs the creation, storage, and authentication strength of user credentials. This is the core function of a password policy, as defined in security frameworks like NIST SP 800-53 (IA-5) and ISO 27001 (A.9.2.1). It specifically addresses password complexity, rotation, and MFA enforcement, not data classification or access methods.

Biometric readers and mantraps provide strong authentication and access control.

A description of the change is essential because it provides a clear, documented account of what will be modified, including systems, configurations, or procedures affected. Without a precise description, the change cannot be properly reviewed, approved, or audited, violating the principle of change traceability.

Phishing is the primary vector for credential theft, as attackers use deceptive emails or messages to trick users into revealing usernames and passwords. Training users to recognize phishing attempts—such as spoofed sender addresses, suspicious URLs, and urgent language—directly mitigates this risk by preventing credential disclosure at the point of attack. Unlike other topics, phishing awareness specifically targets the social engineering techniques most commonly used to steal credentials.

License type and number of licenses are critical for ensuring compliance with software licensing agreements and avoiding legal or financial penalties. Tracking these allows the organization to verify that the number of installed copies does not exceed the purchased licenses, which is a core requirement of software asset management (SAM).

A mantrap is a physical security control that uses a small room with two interlocking doors to prevent tailgating and unauthorized entry. It ensures that only one authenticated person can pass through at a time, providing a critical layer of defense at the main entrance of a data center.

An acceptable use policy (AUP) for personal devices (BYOD) must include authentication requirements like password complexity and multifactor authentication to ensure that only authorized users can access corporate resources from potentially untrusted endpoints. This directly addresses the security risk of unauthorized access via personal devices, which is a primary concern in BYOD environments.

C is correct because configuration management involves establishing and maintaining consistent baseline configurations for systems, such as using a hardened OS image, and then monitoring for deviations using tools like SCAP (Security Content Automation Protocol). SCAP enables automated vulnerability scanning and compliance checking against defined security baselines, ensuring servers remain in a known secure state before and after deployment.

Option B is correct because recognizing phishing emails is a core security awareness training topic that teaches users to identify social engineering attempts, such as spoofed sender addresses, suspicious links, and urgent language. This training reduces the risk of credential theft and malware installation, which are common attack vectors in organizations.

Option B is correct because using a configuration management tool (e.g., Ansible, Puppet, Chef) to deploy a hardened image automatically ensures that every new server is built from a pre-defined, secure baseline without relying on manual steps. This enforces consistency and prevents configuration drift from the moment of deployment, which is the most effective control for ensuring compliance with hardening standards.

Patch prioritization should consider both the severity of the vulnerability (CVSS score) and the criticality of the asset being patched. A high CVSS score on a critical asset poses the greatest risk.

After CAB approval, the next step is to test the change in a staging environment to validate its functionality and identify potential issues before production deployment. This aligns with standard change management processes (e.g., ITIL) where testing follows approval to ensure the change does not disrupt operations. Immediate implementation without testing would bypass risk mitigation, making D the correct answer.

SCAP (Security Content Automation Protocol) scanners are specifically designed to automate the verification of system configurations against a defined baseline, such as a hardened image or a security policy. They use standardized checklists (e.g., XCCDF, OVAL) to detect deviations, making them the ideal tool for this task. Unlike vulnerability scanners, SCAP scanners focus on configuration compliance rather than known vulnerabilities.

A differential backup copies all data that has changed since the last full backup, regardless of any intermediate backups. This means each differential backup grows in size as it accumulates all changes made since the last full backup, making it distinct from incremental backups which only capture changes since the last backup of any type.

A differential backup copies all data changed since the last full backup. Therefore, to restore data on Thursday, you need the last full backup (Sunday) and the most recent differential backup (Thursday), which contains all changes from Sunday through Thursday. This totals two backups.

A WAF can apply a virtual patch by inspecting HTTP/HTTPS traffic and blocking exploit attempts against the unpatched vulnerability. This provides a compensating control at the application layer without modifying the vulnerable server, allowing the server to remain operational while mitigating the risk.

Phishing emails often contain urgent or threatening language to prompt immediate action. While other indicators like misspellings can be present, the most reliable is the use of urgency or threats, which is a common social engineering tactic.

The 3-2-1 backup rule is a foundational data protection strategy: maintain three copies of your data (one primary and two backups), store them on two different media types (e.g., disk and tape, or local SSD and cloud object storage), and ensure at least one copy is stored offsite to protect against site-level disasters. Option C correctly captures this: three copies, two media types, one offsite.

When a patch deployment causes system instability, the immediate priority is to restore service stability by executing the pre-approved rollback procedure. The change management plan already includes this procedure, so no new approvals are needed; acting quickly minimizes downtime and risk.

A mantrap is a physical security control consisting of two interlocking doors that create a small vestibule. Only one door can be opened at a time, preventing an unauthorized person from following an authorized person through a single entry point (tailgating). This design forces each individual to be authenticated before the second door unlocks, ensuring only one person passes per authentication event.

Option A is correct because the 3-2-1 rule requires at least two different media types (e.g., tape and disk, or disk and cloud) to mitigate the risk of a single media failure or vulnerability. This ensures that if one media type becomes corrupted or obsolete, the other remains viable for recovery.

SIEM (Security Information and Event Management) systems can collect and correlate logs from various sources. When configured with rules to detect configuration changes, such as modifications to registry keys or system files, a SIEM can generate alerts on unauthorized changes.

Option B is correct because documenting findings and updating processes is a fundamental part of the change management lifecycle. It ensures that the security vulnerability is formally recorded, root causes are analyzed, and preventive measures are incorporated into future changes. This aligns with the post-implementation review (PIR) phase, where lessons learned are captured to improve security operations and administration.

Option A is correct because patch prioritization based on CVSS score and asset criticality ensures that resources are allocated to the most impactful vulnerabilities first. CVSS provides a standardized severity rating (0-10), while asset criticality accounts for the business value and exposure of the system, enabling risk-based decision-making rather than a one-size-fits-all approach.

The 3-2-1 rule requires three copies, two different media types, and one offsite copy.

The first step when an unauthorized configuration change is detected is to investigate the change to determine its source and impact. This aligns with the incident response process, where initial assessment (identification and scoping) precedes containment or remediation. Without investigation, reverting or disabling could destroy forensic evidence or disrupt legitimate services.

To improve patch compliance, prioritize patching based on vulnerability criticality to address highest risk first.

To meet a short RTO, backup frequency should be high and restoration quick, so frequent backups to fast media are needed.

Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time, indicating how far back in time the data must be restored to resume operations after a disaster. It directly drives backup frequency and replication intervals, such as setting a 15-minute RPO requiring transaction log backups every 15 minutes in SQL Server or continuous data replication in a SAN environment.

Failure to test patches in a staging environment can lead to instability when deployed to production.

A post-implementation review is a valid step in the change management process because it evaluates whether the change met its objectives, identifies any issues, and captures lessons learned. This review typically occurs after the change has been implemented and verified, ensuring that the change was successful and that any unintended consequences are documented.

The 3-2-1 backup rule mandates at least three copies of the data (one primary and two backups) to ensure redundancy against failures. Option D directly states this requirement, which is the '3' in the rule.

The primary goal is to reduce user susceptibility, so tracking the number of employees who click on simulated phishing links directly measures behavior change.

A Configuration Management Database (CMDB) stores details about hardware assets and their relationships.

A clean desk policy is a physical security control designed to prevent unauthorized access to sensitive information by ensuring that documents, devices, and media are securely stored when not in use. By reducing the visibility of confidential data, it directly mitigates the risk of data breaches from shoulder surfing, theft, or accidental exposure. This aligns with the principle of least exposure and supports compliance with data protection frameworks like GDPR or HIPAA.

A differential backup copies all data that has changed since the last full backup, regardless of any intermediate incremental backups. This means each differential backup grows in size as it accumulates all changes made after the last full backup, making it distinct from incremental backups which only capture changes since the last backup of any type.

A clean desk policy is a physical security control that requires employees to clear their workstations of sensitive documents, removable media, and devices at the end of each work session. By mandating that external devices like USB drives or peripherals be stored securely, it directly reduces the risk of unauthorized devices being connected to workstations. This policy complements technical controls like device control policies (e.g., Windows Group Policy for USB restrictions) by addressing the human factor.

Option A is correct because the change was already approved by the CAB, and the rollback plan is a pre-approved contingency within the original change request. Executing the rollback immediately restores service stability, and scheduling a post-implementation review (PIR) captures lessons learned and ensures compliance with the change management policy. This aligns with ITIL best practices, where rollback is part of the implementation plan and does not require a new change request.

The 3-2-1 backup rule requires three copies of the data (one primary and two backups), stored on two different media types (e.g., disk and tape, or local disk and cloud storage), with one copy kept offsite. Option D is correct because using two different media types ensures that a failure or vulnerability affecting one medium (e.g., ransomware encrypting a disk array) does not compromise the other copy. This diversity is a core principle of the rule, reducing the risk of simultaneous data loss.

SIEM alerts on configuration changes from baseline are a form of deviation detection, which is part of configuration management.

Even though the asset criticality is low, the high CVSS score and active exploitation increase the risk. The patch should be prioritized and deployed through the change management process.

This is a classic example of phishing, a broad category of social engineering attacks where attackers send deceptive emails to trick recipients into revealing sensitive information or performing actions like wire transfers. The email's suspicious domain and poor grammar are telltale signs of a generic phishing attempt, as it is not specifically tailored to the employee or the CEO's identity.

A change request must include a rollback plan to ensure that if the change fails or causes unexpected issues, the system can be safely restored to its previous state. Without a documented rollback procedure, the change introduces unacceptable operational risk, making it a valid reason for the CAB to deny approval.

A configuration management database (CMDB) is a centralized repository that stores information about configuration items (CIs) and their relationships. Its primary purpose is to provide a single source of truth for managing IT assets, dependencies, and their interconnections, which is foundational for change management, incident management, and impact analysis.

Physical destruction (e.g., shredding, crushing) ensures that the storage media is no longer usable and data recovery is virtually impossible. Degaussing may destroy magnetic media but is less effective on SSDs. Overwriting requires multiple passes and may not be effective on all media types.

RPO (Recovery Point Objective) defines the maximum acceptable data loss. If the backup is 12 hours old and RPO is 4 hours, the organization has lost 8 hours of data, exceeding the objective.

Biometric readers are a physical security control that authenticates individuals based on unique biological traits (e.g., fingerprints, iris patterns). They prevent unauthorized access by ensuring only enrolled personnel can enter the data center, directly controlling physical entry points.