CCNA Describe The Concepts Of Security Compliance And Identity Questions

Least privilege means granting users the minimum level of access required. Regular access reviews are a key governance practice to uphold least privilege by detecting and removing excessive permissions.

Microsoft Purview Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and protect sensitive information across various locations, including Microsoft 365 services, endpoints, and non-Microsoft cloud apps. These policies leverage sensitive information types (SITs) to automatically detect patterns like credit card numbers, social security numbers, or health records. Upon detection, DLP enforces protective actions such as blocking sharing, notifying users, or encrypting content to prevent data exfiltration and ensure compliance.

Summarize count() by AlertName and time creates a daily count.

This enforces MFA for external access while allowing internal access without MFA.

Defense in depth is a cybersecurity strategy that employs multiple, overlapping security controls to protect information and systems. This layered approach ensures that if one security mechanism fails or is bypassed, other controls are in place to prevent or detect unauthorized access. The deployment of firewalls and intrusion detection systems, as described, exemplifies this strategy by creating successive barriers against threats.

Correct. Smart card login is authentication; then limiting access to department file shares is authorization.

The shared responsibility model correctly defines the split of security tasks between the cloud provider and the customer based on the service model (IaaS, PaaS, SaaS). In this SaaS example, the provider handles infrastructure, and the customer handles data and access.

Conditional Access can block or allow access based on device compliance status.

A regex pattern can detect the 'EMP-XXXXX' pattern.

Digital signatures achieve non-repudiation by cryptographically binding a sender's identity to a message. The sender uses their unique private key to sign a hash of the document, creating a verifiable digital fingerprint. This signature, which can be validated by anyone with the sender's corresponding public key, provides irrefutable proof of origin and consent, ensuring the sender cannot legitimately deny having sent the message or performed the action.

A sensitivity label, once created and configured, must be explicitly published through a label policy to become active and available for users or automatic application. Without being included in a policy and assigned to specific users or groups, the label remains in a draft state and cannot be applied, either manually or automatically, to documents or emails. This publishing step is critical for the label's operational deployment and is the most common reason for a configured label not being applied.

The 'Verify explicitly' principle is a cornerstone of the Zero Trust model, mandating that every access request to any resource must be fully authenticated, authorized, and validated based on all available contextual signals. This includes user identity, device health, location, service, and data classification, ensuring no implicit trust is ever granted. It requires continuous, real-time evaluation before granting access, regardless of whether the request originates inside or outside the traditional network perimeter.

Zero Trust is the security model that fundamentally assumes no user, device, or application should be automatically trusted, regardless of its location inside or outside the network perimeter. It mandates explicit verification for every access request, ensuring identity and device health are validated before granting access. This model strictly enforces least privilege access and operates under an 'assume breach' mentality, continuously monitoring and re-validating trust throughout a session.

Conditional Access policies evaluate various signals, including user location, device compliance, and sign-in risk, to determine if access should be granted or blocked. A policy configured to restrict access to sensitive documents from untrusted or unapproved geographic locations would explicitly override any inherent sensitivity label permissions, directly causing the user's inability to access the document.

Authorization is the critical security process that determines what an authenticated user is permitted to do or access within a system. After a user successfully authenticates with a smart card, the system consults predefined policies, roles, and permissions to evaluate whether that user has the necessary rights to perform a specific action, such as accessing a particular database. This evaluation directly leads to the decision of whether access is granted or denied.

Conditional Access evaluates signals like device compliance to enforce access controls.

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It excels at collecting security data from diverse sources across an organization's entire digital estate, including Azure, on-premises, and other clouds, through built-in data connectors. Sentinel then uses AI and machine learning to detect, investigate, and respond to threats efficiently, making it ideal for comprehensive security event collection and analysis.

Microsoft Purview Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and automatically protect sensitive information across various locations, including email. They utilize sensitive information types (SITs) to detect specific data patterns, such as credit card numbers, and can enforce actions like blocking email transmission, notifying users, or encrypting content to prevent unauthorized sharing. This capability directly addresses the requirement to detect sensitive data and block its sharing via email.

Single sign-on (SSO) to cloud applications is a core benefit of Microsoft Entra ID, enabling users to authenticate once with their Entra ID credentials and gain seamless access to thousands of integrated Software-as-a-Service (SaaS) applications. This capability significantly enhances user productivity by eliminating the need to remember multiple passwords and repeatedly log in, while also improving security by centralizing identity management. Entra ID acts as the central identity provider, issuing secure tokens after initial authentication.

Purview provides data governance, classification, and lineage.

The Shared Responsibility Model is a fundamental framework in cloud computing that explicitly delineates security obligations between the cloud service provider (CSP) and the customer. The CSP is responsible for the security *of* the cloud, encompassing the underlying infrastructure, physical facilities, and host operating systems. Conversely, the customer is accountable for security *in* the cloud, which includes their data, applications, network configurations, and identity and access management. This model ensures clarity on who manages what aspects of security, varying based on the service model adopted.

You register the SaaS app as an enterprise application and configure SSO.

Zero Trust is a strategic security model predicated on the principle of "never trust, always verify." It fundamentally assumes that a breach is inevitable or has already occurred, requiring explicit verification for every access request, regardless of origin or prior authorization. This model mandates continuous validation of identity, device health, and service context, while enforcing least privilege access to minimize potential damage from successful intrusions.

Data loss prevention (DLP) policies in Microsoft Purview can automatically detect and protect sensitive data like health information.

The identity section with 'type': 'UserAssigned' and a reference to an existing managed identity enables the VM to use that user-assigned managed identity to access Azure resources securely.

Correct. The policy includes these two roles specifically.

Integrity ensures data has not been altered by unauthorized parties. Digital signatures provide a mechanism to detect any changes, thus preserving integrity.

Limit access to only what is needed.

Infrastructure as a Service (IaaS) is the correct choice for migrating existing on-premises workloads to Azure because it provides the most control over the underlying operating systems, applications, and data, closely mirroring an on-premises environment. In IaaS, the customer is responsible for securing the operating system, applications, network configuration, and data, while Azure manages the physical infrastructure, virtualization, and networking fabric. This model facilitates a "lift-and-shift" approach, allowing the CISO to maintain significant security responsibility and control over their familiar stack within the cloud.

Correct. The PowerShell command assigns a sensitivity label to the document.

Zero Trust requires verifying every access request explicitly.

Conditional Access policies are the primary mechanism in Azure AD to enforce specific access requirements, such as multi-factor authentication (MFA), based on various conditions. These policies can be configured to target all users and all cloud apps, requiring MFA for every sign-in attempt to corporate resources. This granular control allows administrators to define precise conditions, like device state, location, or sign-in risk, under which MFA is mandatory, ensuring comprehensive protection for all access.

Confidentiality, a cornerstone of the CIA triad, ensures that information is accessible only to those authorized to view it. This principle directly addresses the company's security measure to limit access to specific employees, preventing unauthorized disclosure of sensitive data. Implementing strong access controls, encryption, and data classification are typical methods to uphold confidentiality, aligning perfectly with the goal of restricting information access.

User account synchronized from on-premises Active Directory.

ResultType 50057 corresponds to 'User account is disabled', so this query identifies sign-in attempts by disabled accounts.

Confidentiality is the fundamental security principle that ensures information is not disclosed to unauthorized individuals, entities, or processes. It directly addresses the requirement of limiting access to customer data only to those who are explicitly authorized, typically through mechanisms like encryption, access control lists (ACLs), and the principle of least privilege. This principle is paramount for protecting sensitive information from unauthorized viewing or exposure, aligning perfectly with the stated security policy.

Integrity ensures data has not been tampered with or corrupted during transit or storage. When a user downloads a software update, comparing its cryptographic hash (e.g., SHA256) with a known, trusted hash value provided by the company directly verifies that the file's contents are exactly as intended. This process specifically confirms the data's integrity, ensuring the downloaded software is free from unauthorized modifications or accidental damage.

Managing user access and classifying data stored within the SaaS application are critical customer responsibilities. The customer defines who can access their organizational data, what permissions they have, and how sensitive that data is, directly impacting data governance and compliance. This ensures that customer-specific information remains secure and properly handled according to internal policies and regulatory mandates.

Encryption is a primary control for ensuring confidentiality by transforming data into an unreadable format, known as ciphertext. This process prevents unauthorized individuals from accessing or understanding the sensitive patient records, even if they manage to intercept or steal the encrypted data. Only authorized parties possessing the correct decryption key can revert the data to its original, readable form, thereby protecting against unauthorized disclosure.

Deploying a mission-critical customer portal across multiple Azure regions with automatic failover directly addresses the 'A' in the CIA triad: Availability. This strategy ensures that the portal remains continuously accessible and operational for authorized users, even if an entire geographic region experiences a catastrophic outage. The primary objective is to minimize downtime and provide uninterrupted service, which is paramount for mission-critical systems.

Zero Trust is a security model fundamentally built on the principle of 'never trust, always verify,' meaning no user, device, or application is implicitly trusted, regardless of its location inside or outside the network perimeter. Every access request is explicitly authenticated, authorized, and continuously validated based on all available data points, including user identity, device health, service, and data classification. This continuous verification ensures that access is granted only when all conditions are met, eliminating implicit trust.

As part of the Platform as a Service (PaaS) offering, Microsoft is fully responsible for managing and patching the underlying operating system and virtual machine infrastructure that hosts Azure App Service instances. This includes applying security updates, hotfixes, and service packs to the host OS to maintain platform security and stability, abstracting this operational burden from the customer. This responsibility ensures the foundational environment upon which customer applications run remains secure.

Microsoft Entra Conditional Access is the service that enforces access policies based on signals like user, device, location, and risk.

Authentication is the foundational security process of verifying an entity's identity, confirming they are who they claim to be. In this scenario, requiring a one-time passcode (OTP) alongside another factor, like a password, establishes multi-factor authentication (MFA). This robust method significantly enhances security by requiring multiple proofs of identity before granting access to a system or resource, directly addressing the company's need to confirm employee identity.

This option accurately describes the combined effect of a typical DLP policy configured for strict enforcement. When sensitive information is detected within the email, the policy's 'Block access' action prevents the email from being delivered to its intended recipients, ensuring data protection. Concurrently, the policy's notification setting ensures that the sender is immediately informed about the policy violation and the reason for the email's blocking, allowing them to understand and rectify the issue.

Accountability is the ability to trace actions and events back to a specific entity, whether a user, process, or system. By meticulously recording access, modifications, and system events, logging creates an indispensable audit trail. This trail enables forensic analysis, compliance verification, and the attribution of responsibility, making it a foundational component for holding individuals and systems accountable for their actions within an organization.

Integrity ensures that data remains unaltered and complete during transmission or storage. When a user verifies that the content of an encrypted email from their bank has not been changed, they are confirming its integrity. This is typically achieved through cryptographic mechanisms like hashing or digital signatures, which detect any unauthorized modification, ensuring the message received is exactly what was sent.

When a user enters credentials to access a financial application, the system performs authentication. This crucial initial step verifies the user's claimed identity by comparing the provided username and password against stored records. Successful authentication confirms 'who' the user is, granting them entry to the system.

This is correct because Microsoft Entra Connect synchronizes on-premises Active Directory with Microsoft Entra ID, enabling SSO through password hash sync or pass-through authentication.

Authorization is the process of granting or denying access to resources based on the authenticated user's permissions. The role check determines if the user is authorized to access the user management page, making this the correct answer.

Selective wipe removes only company data from managed apps.

Cloud Discovery analyzes traffic logs to identify shadow IT.

DLP can scan email content for sensitive info.

Explicit verification is the zero-trust principle that requires verifying every access request as if originating from an untrusted network.

Non-repudiation is the assurance that a party cannot legitimately deny having performed a specific action or sent a particular message. In the context of financial stock trades, a digital signature cryptographically binds the unique identity of the trader (via their private key) to the specific trade instruction. This creates undeniable, legally admissible proof that the trader authorized and executed that particular transaction, preventing them from later disavowing their actions.

Defense in depth is a comprehensive cybersecurity strategy that employs multiple, overlapping security controls to protect assets and data. By deploying a firewall, the company is establishing a perimeter defense, which constitutes one critical layer in a multi-layered security architecture. This approach ensures that if one security control fails or is bypassed, other controls are already in place to prevent or detect an intrusion, significantly enhancing overall resilience against various threats.

Data integrity ensures that information remains accurate, complete, and unaltered throughout its lifecycle, protecting against unauthorized modification or destruction. In this scenario, an attacker directly modified patient diagnoses, which fundamentally compromises the trustworthiness and reliability of the medical records. This unauthorized alteration is a clear violation of the integrity principle, as the data no longer reflects its original, correct state.

Compliance management is the overarching discipline that ensures an organization adheres to external laws, regulations, and internal policies, such as HIPAA. It involves establishing frameworks, implementing controls, conducting risk assessments, monitoring adherence, and maintaining documentation to systematically meet all regulatory requirements and demonstrate due diligence to auditors and regulators.

Just-in-time (JIT) access grants temporary, time-limited elevated permissions to users or systems only when explicitly requested and strictly for the duration required to complete a specific task. This approach minimizes the window of opportunity for misuse or compromise by ensuring that administrative privileges are not persistently held. The scenario directly describes this mechanism of on-demand, temporary access for server administration.

Role groups in Purview grant access to the compliance portal.

Encrypting data during transmission directly ensures that only authorized entities with the correct decryption key can access or read the information. This process transforms plaintext into ciphertext, making it unintelligible to any unauthorized interceptors who might intercept the data in transit. Therefore, the primary objective of such a security policy requirement is to prevent unauthorized disclosure of sensitive data while it traverses networks, directly upholding confidentiality.

Defense in depth is a comprehensive security strategy that layers multiple, independent security controls to protect assets across various domains. This approach ensures that if one security control fails or is bypassed, other controls are still in place to detect, prevent, or mitigate an attack, significantly increasing resilience against diverse threat vectors. It encompasses physical, technical, and administrative safeguards, creating a robust and redundant barrier.

Anomaly detection policies use machine learning to detect unusual user behavior like mass downloads.

Defense in depth fundamentally involves deploying a comprehensive array of security controls across various layers and domains within an IT environment. This layered strategy ensures that if one security control is compromised or bypassed, other independent controls are still in place to detect, prevent, or mitigate the attack. It encompasses physical, technical, and administrative safeguards, creating a resilient security posture that significantly increases the effort and resources required for an attacker to succeed.

Integrity ensures that data has not been tampered with or altered from its original state. Digital signatures achieve this by creating a unique cryptographic hash of the document, which is then encrypted with the sender's private key. Any subsequent modification to the document would result in a different hash value, immediately revealing that the data's integrity has been compromised upon verification.

Sensitivity labels classify and protect data; retention labels enforce retention periods.

Records Management in Microsoft Purview is specifically designed to help organizations meet their legal, regulatory, and business obligations for retaining and disposing of information. It enables the declaration of content as a record, applying immutable retention labels and policies to automatically retain items for a specified period or delete them defensibly when no longer required. This ensures that critical business information is preserved and disposed of according to a defined lifecycle, preventing accidental deletion and supporting compliance audits.

Entitlement Management is a robust capability within Microsoft Entra ID Governance that enables organizations to manage identity and access lifecycle at scale through access packages. It allows for automatic access removal based on various lifecycle events, such as a user's employment status change or removal from a connected organization. This makes it ideal for ensuring access to groups, applications, and SharePoint sites is revoked promptly and automatically when no longer needed, aligning perfectly with the need for automated access removal.

In the Shared Responsibility Model for Infrastructure as a Service (IaaS), Microsoft is solely responsible for the physical security of the underlying data centers. This encompasses safeguarding the physical infrastructure, implementing robust access controls, deploying surveillance systems, and managing environmental factors like power, cooling, and fire suppression. Customers are relieved of these foundational infrastructure concerns, allowing them to focus on their virtualized workloads.

Full disk encryption (FDE) directly addresses confidentiality by rendering all data on a laptop unreadable to unauthorized individuals. If the device is lost or stolen, the encrypted data remains protected, preventing its disclosure without the correct decryption key. This ensures that only authorized users or processes can access and interpret the sensitive information stored on the drive.

The customer retains responsibility for managing user identities, permissions, and authentication to the database.