CCNA Cybersecurity Fundamentals Questions

Forwarding the suspicious email preserves the original headers and URL, which the security team needs to analyze the sender, reply-to, and embedded link. Telling the employee not to click prevents credential compromise. This is the safest first step because it isolates the threat without interacting with it, and it gives responders evidence to determine whether other employees received the same message.

An interface Management Profile defines which administrative protocols (HTTPS, SSH) are permitted on that interface and from which source addresses. Restricting it to trusted management IPs prevents untrusted hosts reaching the management plane, directly reducing reconnaissance and exposure vectors.

Full-disk encryption renders the stored data unreadable without the decryption key, so removing the drive or booting another operating system yields only ciphertext. Pre-boot authentication ensures the key is released only after the user proves identity, protecting against cold-boot and offline attacks. Because the data lives on the local drive and the user works offline, this control directly meets the requirement without depending on network connectivity.

Bot detection and behavioral analysis identifies automated tools by analyzing request patterns, mouse movements, timing, and device fingerprints. Credential stuffing relies on automation, so this feature can distinguish bots from humans and block or challenge suspicious sessions. It is the most appropriate WAF capability for detecting distributed, low-and-slow login attempts that evade simple rate limits.

Traffic logs record every session evaluated against Security policy, including the action applied. A drop or deny generates an entry showing source, destination, application, and the denying rule, so the analyst can confirm exactly which policy blocked the inbound attempt and why.

Verify explicitly is a core Zero Trust principle: every access request is authenticated and authorised using all available telemetry, including user identity, location and device health. Continuous evaluation of these signals replaces implicit network-location trust, satisfying the stem's Zero Trust data and network requirement.

This is correct because in a TCP or UDP header the source IP address identifies the originating host and the source port identifies the originating application socket. Together they pinpoint the internal workstation and the specific process that opened the connection. Examining these fields in the capture directly answers which internal device initiated the traffic.

Encrypting records at rest with separately managed keys means an attacker who compromises the web server gains ciphertext, not readable payment data. This directly reduces impact by protecting the confidentiality of the data even when the host is breached. Separate key management prevents the attacker from simply reading the key from the same server, which is the essence of this control.

The content inspection engine scans email bodies and attachments to detect patterns matching credit card numbers, such as regular expressions or checksum validation. It is the component that actually identifies the sensitive data and feeds that classification to the policy engine. This makes it the correct answer for recognizing the data in question.

Zero-day malware and ransomware delivered via web downloads or email attachments are prevalent vectors that NGFW security subscriptions, such as advanced threat protection and sandboxing, inspect and block. This satisfies the specialised-subscription mitigation the question requires.

A mismatch between the display name and the actual reply-to domain is a strong phishing indicator. Attackers spoof or imitate a trusted colleague so the message looks internal, but replies go to an external address they control. This discrepancy is visible in the message headers and should prompt verification through a separate trusted channel before acting on any request.

Least privilege means giving users the minimum access necessary to do their work. By granting only job-required permissions, the organization reduces the attack surface and limits potential damage from compromised accounts. This practice directly implements the principle and is a fundamental step in access control.

MFA blocks unauthorised access even when an administrator's password is stolen or guessed, because a second factor such as an authenticator app or hardware token is also required. This directly satisfies the stem's focus on administrative access to security infrastructure, where compromised credentials pose the greatest risk.

Authentication verifies that a claimed identity is genuine. The impossible travel alert directly questions whether the user's credentials were used by the legitimate user or an attacker. Investigating authentication logs, MFA prompts, and session tokens is the correct first step to determine if the identity assertion is trustworthy before assuming a breach of other principles.

This is correct because only an actual restore into a functioning environment proves the backups are complete, readable, and sufficient to run the application. It surfaces issues such as missing dependencies, corrupted media, or gaps between backup sets that logs cannot reveal. This is the definitive test of recovery capability and is what auditors expect for critical systems.

App-ID classifies traffic by inspecting application signatures and behaviour, identifying the application even when it is encrypted, obfuscated or running on non-standard ports. This satisfies the requirement to determine the exact application within the HTTPS stream.

Office applications spawning PowerShell is a strong indicator of a malicious macro or exploit, because legitimate Office workflows rarely invoke PowerShell directly. This parent-child process relationship is a common technique in phishing campaigns and should be prioritized as a high-fidelity detection. It helps distinguish malicious script execution from administrative automation.

Inline machine learning inspects traffic directly within the threat prevention profile, blocking previously unseen zero-day exploits before a signature exists. This satisfies the stem's zero-day and multi-stage attack constraint, since static signatures alone cannot catch novel payloads. It complements, rather than replaces, the other selected advanced protections.

Firewall session logs record allowed and denied connections, including source and destination IP addresses, ports, and bytes transferred. Examining these logs can confirm whether the workstation's connection attempts to the malicious IP were permitted and how much data was exchanged. This directly answers the analyst's question about success and data transfer.

Disabling macros by default with a trusted publisher requirement prevents unsigned or malicious macros from running while allowing properly signed business macros. This directly addresses the execution vector without blocking entire file types, balancing security and business need. It is a standard hardening measure in office productivity suites and aligns with least privilege for code execution.

Repeated failed logins from one external IP using common account names such as admin, root, and test is characteristic of automated password guessing or brute force against default accounts. The attacker is trying well-known usernames rather than stolen credential pairs. Because no login succeeded, the activity is still an attempt, and blocking or rate-limiting the source and disabling default accounts are appropriate responses.

A SIEM aggregates logs from disparate sources, correlates events across them, and surfaces incidents for analyst monitoring. This centralisation satisfies the enterprise-wide visibility requirement, unlike point tools that only cover single systems or lack correlation.

Containment is the phase where the analyst takes immediate action to stop the spread of an incident and prevent further damage. Isolating the workstation from the network is a classic containment step. The analyst has already identified the malicious communication and is now limiting its impact, which aligns with containment. This step precedes eradication and recovery, and is critical to prevent lateral movement or data exfiltration.

This is correct because tokenization replaces sensitive data with non-sensitive surrogate values, and the mapping to the original value is held in a separate, hardened token vault. If the database is breached, the tokens are useless without the vault. This directly reduces impact, which is what the auditor requested, and it is the standard approach for protecting stored payment card data.

NAT rewrites source addresses as traffic leaves the internal network, so external observers see only the translating device's address rather than internal hosts. This conceals internal IP addressing and topology, satisfying the requirement to hide network structure from external entities.

Least privilege limits each account to the minimum rights needed for its current responsibilities and pairs with periodic access reviews to catch drift. It directly resolves the finding that employees retained access to systems they no longer use. Together with lifecycle management, it closes the gap between what people should have and what they actually have.

Integrity means data is accurate, complete, and protected from unauthorized modification both at rest and in transit. Hashing, digital signatures, and checksums are common integrity controls. Because the officer wants assurance that patient records remain unaltered and trustworthy, integrity is the precise security objective being requested, and it maps directly to the controls the team should propose.

Phishing is a social engineering attack where attackers impersonate a trusted entity to trick victims into revealing sensitive information or clicking malicious links. The email pretending to be from IT and directing to a fake login page is a classic phishing attempt. It aims to steal credentials.

Ransomware encrypts a victim's files and typically appends a new extension or drops a ransom note demanding payment for the decryption key. The console report of files being encrypted and renamed with a new extension matches that behavior exactly, so ransomware is the most likely classification and the incident should be escalated immediately.

This is correct because the request matches a classic vishing pattern: urgency, authority impersonation, and a demand for a one-time passcode. A one-time passcode is an authentication secret, and no legitimate help desk needs it for certificate renewal. Independently verifying the caller through a trusted directory breaks the attacker's control of the communication channel before any credential is disclosed.

A DoS Protection profile with SYN flood thresholds rate-limits half-open connections per source, absorbing the flood before sessions exhaust the firewall's table. This directly addresses the stem's resource exhaustion constraint on the targeted public web server.

Responders need a pre-agreed, out-of-band channel and a clear escalation path so that a compromised corporate email or chat system does not cripple coordination. Standing up and testing that channel before an incident is preparation work. If the channel is improvised during an active ransomware event, confusion and delay are likely, so provisioning it in advance is a defining preparation-phase task.

A DoS Protection Profile with random early drop or classified rate limiting absorbs and throttles volumetric floods from thousands of distributed source IP addresses, which per-IP blocking cannot handle. Attaching it to the security rule mitigates the brute-force traffic before it reaches the administrative portal.

Data Filtering profiles inspect traffic content for patterns such as credit card or social security numbers, matching the stem's data protection goal. When matched, the firewall can block or alert, preventing unauthorised exfiltration of sensitive regulated data.

Custom Admin Roles are defined under Device > Admin Roles in the Palo Alto Networks web interface, where role-based access scopes each administrator to specific configuration and operational tasks. This satisfies least privilege by granting only the permissions each admin needs.

App-ID performs Layer 7 classification by identifying the application regardless of port or protocol, then the Security policy rule enforces threat prevention profiles on that identified traffic. This delivers the required application-layer inspection and control over internal traffic to the sensitive database servers.

Input validation ensures that user-supplied data conforms to expected formats, while output encoding ensures that any data rendered in the browser is treated as text, not executable code. Together, they prevent cross-site scripting (XSS) by stopping malicious scripts from being injected and executed. This is the primary defense against XSS.

Records linking names, birth dates, insurance identifiers, and treatment notes to identifiable people are regulated personally identifiable and protected health information. Such data must be restricted to authorized clinical and billing staff under least privilege. Confidential is the correct label because unauthorized disclosure would cause significant harm to individuals and legal liability for the hospital, requiring encryption, access controls, and audit logging.

Parameterized queries separate the SQL statement structure from the data values, so user input is always treated as a literal value and never as executable syntax. This removes the root cause of SQL injection regardless of how the payload is encoded. Binding parameters also prevents the crafted input from altering query logic or returning schema-revealing errors, making it the correct structural fix for this scenario.

WPA3 is the latest wireless security protocol that provides strong encryption and protection against unauthorized access. Enabling WPA3 on the wireless access point ensures that only authorized users with the correct password can connect, and it protects data in transit. Without encryption, wireless traffic can be intercepted or accessed by outsiders. This is a fundamental step to secure a wireless network from external threats.

Anti-Spyware is an out-of-the-box Palo Alto Networks Security Profile type that inspects data plane traffic for spyware, command-and-control callbacks and known malicious patterns. It satisfies the stem's requirement by covering a specific threat vector within the Security Profiles framework.

Regular vulnerability assessments and penetration testing actively uncover exploitable weaknesses before attackers do, directly satisfying the proactive identification requirement. Unlike reactive monitoring, this scheduled testing exposes misconfigurations and unpatched flaws, feeding findings into risk assessment so remediation prioritises genuine exposure rather than theoretical threats.

Full-disk encryption (FDE) encrypts the entire storage drive, making data unreadable without the decryption key. If a laptop is lost or stolen, the data remains protected because the attacker cannot access it without the correct credentials or recovery key. This directly addresses the requirement to keep sensitive data confidential in the event of physical loss.

App-ID classifies traffic by application regardless of port, and Threat Prevention inspects all allowed sessions. Logging every port and protocol enforces the Zero Trust requirement to verify and inspect all traffic rather than trusting implicit port-based permissions.

The Incidents tab aggregates correlated alerts into cases, each mapped to MITRE ATT&CK techniques, letting the analyst see active threats and C2 communications. It provides the categorised, framework-mapped view the stem requires, unlike raw endpoint or log views.

Phishing is a social engineering attack that uses fraudulent emails or messages to trick recipients into revealing sensitive information such as credentials. In this scenario, the attacker impersonates the IT department and creates urgency to pressure the employee into clicking a malicious link and entering credentials on a fake login page, which is the classic pattern of a phishing attack.

Phishing is a social-engineering attack that uses a fraudulent message, such as email, to trick a user into revealing credentials or clicking a malicious link. The misspelled URL impersonating the company's single sign-on portal is the classic credential-harvesting pattern, so classifying the event as phishing is correct and directs the analyst to the right response playbook.

A structured risk assessment paired with control review and management sign-off creates the auditable record auditors seek. It identifies threats and vulnerabilities, maps them to implemented controls, records residual risk decisions, and captures dated approvals from accountable managers. That combination demonstrates the controls were evaluated and formally accepted, which is exactly the evidence of ongoing governance and effectiveness the compliance manager must present.

The payload `' OR '1'='1` is a classic SQL injection attempt. It tries to manipulate the SQL query by breaking out of the id parameter and adding a condition that is always true, potentially bypassing authentication or returning all records. This matches the pattern of SQL injection, where malicious SQL statements are inserted into input fields.

Phishing is a social-engineering attack that uses a fraudulent message, often mimicking a trusted entity such as a bank, to trick the recipient into revealing credentials or clicking a malicious link. Here the email impersonates the firm's bank and pressures the employee to re-enter banking credentials, which matches the defining characteristics of phishing.

GlobalProtect is Palo Alto Networks' client VPN, tunnelling remote users' traffic to the next-generation firewall for inspection and policy enforcement. It secures public Wi-Fi connections by encrypting both internet-bound and corporate traffic back to the firewall.

This is correct because the finding about former employees retaining active accounts is a lifecycle management failure. A formal deprovisioning process with defined triggers and timelines ensures accounts are disabled or removed as soon as employment ends, closing the window an attacker could use a stale credential. This directly remediates the specific gap the auditors identified.

Full-disk encryption encodes all data on the drive so it cannot be read without the decryption key. If the disk is physically removed from the server, the stored card data remains unreadable to anyone without the key, directly mitigating the confidentiality risk described in the scenario.

URL filtering profiles inspect outbound HTTP/HTTPS requests against category and reputation lists, blocking known phishing and malicious domains at the rule level. This directly satisfies the requirement to prevent employees reaching those destinations, unlike TLS inspection or threat-intelligence feeds alone.

A Vulnerability Protection Profile inspects traffic against signatures for known scanning and exploit activity, and drop or reset-both actions terminate the session. Applied to the security rule, it detects and blocks the reconnaissance scans targeting the internal database server from external IPs.

A WAF inspects HTTP traffic and blocks or alerts on malicious requests such as SQL injection or cross-site scripting attempts. It is a technical control because it is implemented in software or hardware and automatically enforces security policy on traffic, directly reducing the likelihood that common web attacks succeed.

Least privilege grants users and applications only the minimum access rights needed for their authorised tasks, reducing the attack surface exposed by excessive permissions. It directly matches the requirement that privileges be restricted to what each identity genuinely requires, limiting damage from compromised accounts or over-privileged processes.

Aggregating and correlating feeds from multiple sources lets the TIP normalise indicators and operationalise them into existing controls, satisfying the stem's requirement to complement traditional defences. Rather than merely collecting data, it enriches detection and response with actionable, prioritised intelligence drawn from both external and internal telemetry.

This sequence matches the widely used incident response lifecycle: preparation before incidents, detection and analysis to confirm and scope, containment, eradication, and recovery to remove the threat and restore service, and post-incident activity to capture lessons learned. It reflects the logical order in which responders move from readiness through investigation to cleanup and improvement.

The Cortex XDR endpoint agent hooks OS kernel-level events, capturing process creation, parent-child relationships and full command-line arguments. This kernel telemetry is what reconstructs the exact execution tree and PowerShell parameters, satisfying the need to identify the precise script invocation.