CCNA Cybersecurity Fundamentals Questions

Disabling unnecessary services and closing unused ports reduces the attack surface by eliminating potential entry points for attackers. This aligns with least privilege by ensuring only required services are running, minimizing the exposure of the system. It is a fundamental hardening practice that complements other access controls, making it harder for an attacker to find and exploit vulnerabilities.

Least privilege means granting the minimum access necessary for a user's role. Role-based access control maps permissions to job functions, so an auditor gets read-only access while a preparer gets edit rights only for assigned clients. This directly limits unnecessary access to tax returns and is the most targeted enforcement of the principle in this scenario.

Credential Theft Prevention within a URL Filtering profile inspects submitted form data against corporate credential patterns, blocking submission to known phishing sites in real time. This directly satisfies the stem's requirement to stop users typing corporate credentials into phishing websites.

This is the definition of least privilege: users should have only the permissions required to complete their tasks, nothing more. In this scenario, developers should be given deployment-specific permissions rather than full administrative rights. This reduces the attack surface and limits the potential damage from accidental or malicious actions. Implementing least privilege often involves role-based access control and regular reviews of permissions.

WildFire submits the unknown sample to cloud sandbox analysis, derives a signature from the observed malicious behaviour, and pushes it to all subscribed Next-Generation Firewalls automatically, satisfying the minutes-scale global blocking requirement without manual signature updates.

A Vulnerability Protection Exception for that specific threat ID disables the signature's action for the matching traffic, clearing the false positive without weakening the broader security policy. Restricting it to the source or destination IP narrows scope, avoiding blanket exposure.

Application-level encryption with organization-managed keys ensures ePHI remains unreadable even if the device is lost, because the ciphertext cannot be decrypted without the organization's keys. This satisfies the requirement to avoid reliance on native device encryption and provides a consistent control across managed desktops and personal mobile devices.

Permitting 'any' in the application field decouples port from protocol, so traffic on 80 and 443 is no longer restricted to sanctioned apps. Attackers can tunnel command-and-control or exfiltration over those permitted ports, directly widening the attack surface the policy was meant to constrain.

For SSL decryption without warnings, the firewall uses a forward trust certificate to generate certificates for decrypted sites. User devices must trust the CA that signed the forward trust certificate. Therefore, the forward trust certificate (with private key) is installed on the firewall, and its CA certificate is installed in the trusted root store on user devices. This ensures seamless decryption.

This rule explicitly permits only HTTP and HTTPS traffic to the web server while denying all other traffic, which meets the requirement. It is a best practice to define a default-deny stance for all other traffic to minimize the attack surface. This approach ensures that only the necessary services are exposed to the internet, reducing the risk of exploitation.

Searching the WildFire Portal or firewall submission logs by SHA-256 hash queries historical verdicts and analysis reports already stored for the enterprise, returning results immediately without resubmitting the file. This satisfies the stem's requirement for the fastest way to check whether the hash was previously analysed.

Parameterized queries separate SQL code from user-supplied data, so special characters in parameters are treated as data rather than executable syntax. Strict input validation further rejects unexpected content before it reaches the database layer. Together they eliminate the structural weakness that allows injection, directly addressing the root cause rather than merely hiding symptoms observed in the logs.

App-ID classifies traffic by application regardless of port or protocol, letting internal segmentation firewalls enforce granular allow/deny rules between tiers sharing a zone. This satisfies the requirement for precise intra-zone access control that port-based policies cannot achieve.

Once stolen credentials are captured, the attacker redeems them by authenticating as the legitimate user, which is the use-of-valid-accounts phase. This grants initial access or enables lateral movement, immediately following the credential capture described in the exercise.

Actions on Objectives is the kill chain's final phase, covering the attacker's actual goal after establishing persistence — here, encrypting files for ransom on the internal file server. It sits after Command and Control in the Lockheed Martin sequence.

Prolonged, stealthy presence directly satisfies the APT defining constraint: adversaries maintain persistence over months or years, evading detection through low-and-slow techniques rather than rapid exploitation. This extended dwell time enables continuous intelligence gathering and lateral movement, distinguishing APTs from opportunistic attacks that complete quickly.

Isolation limits the spread of an incident and is a classic containment action. Disabling the switch port severs network communication while preserving the host for forensic analysis. This activity occurs after detection and analysis, during containment, so it is correctly placed in the requested phases.

Administrator activity and authentication logs capture login timestamps and source IPs, providing the audit trail that demonstrates administrative accountability and change control. Auditors can attribute configuration changes to named administrators, satisfying the framework's accountability requirement.

Dynamic application security testing exercises a running application, sending crafted inputs and observing responses, which matches reviewing compiled behavior without source. It can reveal runtime issues such as injection flaws and authentication bypasses in the deployed module. This aligns precisely with the stated constraint of no source access and live execution.

The risk is a lingering active account after termination. Automating deprovisioning ties account state to the authoritative HR event, so disabling occurs within minutes rather than waiting for a manual ticket. This directly closes the window an ex-employee could exploit and is the most effective control for the stated risk.

Clientless VPN acts as a reverse proxy in front of legacy applications, terminating SAML authentication at the firewall and brokering access, so the legacy apps need no federation support. This satisfies the constraint of enforcing authentication without modifying the legacy applications.

NIST SP 800-30 defines risk as a function of the likelihood that a threat exploits a vulnerability and the adverse impact of that event. Evaluating threat likelihood alongside impact magnitude lets the team rank the database vulnerability and prioritise mitigation accordingly.

The attacker is using encrypted HTTPS traffic to a suspicious IP with no reverse DNS, which is a classic sign of a covert C2 channel. The low, steady traffic mimics normal browsing to evade detection, and the lack of association with business services indicates malicious intent. This technique allows attackers to maintain persistent access and exfiltrate data while blending in with legitimate traffic.

WildFire only receives files when SSL decryption exposes the HTTPS payload and the security rule attaches a WildFire Analysis profile forwarding that file type. Both conditions satisfy the stem's requirement for cloud analysis of the malware binary.

Patient treatment records contain protected health information and heart-rate telemetry is live clinical data; both demand the highest handling controls, so Restricted is appropriate. Visitor parking maps are intentionally published for public consumption, so Public is correct. This risk-based split matches the sensitivity and regulatory obligations of each asset, making this the accurate classification.

Captive Portal intercepts unmapped source IPs and presents a web login, then relays credentials to Microsoft Entra ID via LDAP or SAML for validation. On success, the firewall writes the IP-to-username mapping into its User-ID table, satisfying the requirement to map addresses for identity-based policy enforcement.

Zone Protection profiles with SYN Flood protection activate SYN cookies or random-drop once configured thresholds are exceeded, absorbing spoofed half-open connections without exhausting the firewall's session table. Applied at the ingress zone, this directly counters the randomised-source SYN scan by validating handshakes before allocating state, satisfying the volumetric reconnaissance constraint in the stem.

Panorama's Log Viewer consolidates firewall Traffic and Threat logs, letting the analyst filter by source IP to trace every session from the compromised host across 30 days, with applications, bytes transferred and correlated threat entries in one explorer view. This satisfies the forensic requirement for a single consolidated session view.

Encrypted HTTPS payloads remain opaque to Data Filtering profiles, so sensitive source code or cardholder data can leave the network without inspection. This directly satisfies the stem's constraint: no decryption policy on the firewall means content-based controls cannot identify or block exfiltration over TLS.

Security Profiles are the grouped inspection modules attached to a policy rule, covering antivirus, anti-spyware, vulnerability protection, URL filtering, file blocking, data filtering and WildFire analysis. They define what content inspection applies once the rule matches traffic.

AutoFocus aggregates threat intelligence and correlates indicators with actor TTPs, letting the analyst research threats targeting their sector. It provides the contextual hunting data required, unlike raw firewall logs or vulnerability scans, satisfying the exposure-assessment and TTP-research constraint.

HIP profiles collect endpoint posture data such as patch level, disk encryption and management status, which Security policy then matches against zone and posture criteria. This blocks authenticated BYOD devices lacking compliant posture from reaching the sensitive database zone, enforcing Zero Trust.

Client-side encryption with customer-managed keys stored outside the provider's infrastructure ensures the cloud provider only handles ciphertext and cannot decrypt data. This directly satisfies the requirement that the provider cannot access plaintext, while still allowing the company to store data in the cloud.

Enabling both Log at Session Start and Log at Session End ensures that a log entry is generated when the session begins and when it ends. This provides a complete audit trail for the session, capturing the start time and the end time along with other details. This is the correct configuration for full auditing.

User-ID maps IP addresses to authenticated user identities, letting policy match on user rather than IP alone. Integrating the User-ID agent or Panorama mapping with the firewall supplies that identity data, which is precisely what Least Privilege Access under Zero Trust demands.

App-ID classifies each recognised session to a specific application and attaches its risk rating on a 1–5 scale, letting analysts prioritise threats. This risk level is one of the two data points the engine returns per session.

Verifying explicitly means every access request is authenticated and authorised using all available signals — identity, device health, location and behaviour — before granting resource access, satisfying the Zero Trust requirement that no actor is trusted by default based on network location alone.

Active/Active distributes traffic across both firewalls simultaneously while session synchronisation replicates session tables, so either device can process existing flows after a failure. This satisfies the stem's requirement that both firewalls actively process traffic with real-time session state sharing.

Defence in depth layers independent controls across the attack surface; combining perimeter threat prevention, internal segmentation, Cortex XDR endpoint protection and MFA covers network, host and identity planes. A single firewall tier alone would not satisfy the principle's requirement for multiple overlapping layers.

Continue is a configurable URL Filtering action that displays a warning page requiring the user to acknowledge before proceeding, letting organisations permit access to a category while enforcing awareness. It sits alongside block, alert and override actions assignable per URL category.

This is correct because the traffic is allowed due to lack of blocklist, but threat intelligence can reveal if the IP/domain is associated with malicious activity. By correlating with external threat feeds, the analyst can quickly assess whether the communication is likely malicious or benign, which is a standard validation step in incident response.

SQL injection inserts malicious SQL statements through unsanitised input fields, exploiting the application layer rather than the network layer. Next-generation firewall security profiles inspect HTTP payloads and match injection signatures, satisfying the stem's requirement for an application-layer attack mitigated by such profiles.

GlobalProtect authentication is enforced through Authentication Profiles bound to the portal and gateway, so referencing a profile linked to an MFA provider triggers the second factor during the connection phase. This satisfies the framework's requirement that MFA apply to all remote access connections.

Forwarding unknown files to the WildFire cloud satisfies the zero-day constraint: signatures cannot detect never-before-seen malware, so the file must be executed in a sandbox to observe malicious behaviour. WildFire returns a verdict, enabling enforcement against threats with no existing signature.

Immutable storage with retention locks prevents modification or deletion for a defined period, and separating credentials removes the backup from the compromised domain's control. An offline or air-gapped copy is unreachable by an attacker operating within production. This combination directly satisfies the requirement for a guaranteed, isolated, unalterable copy that survives a ransomware event affecting production servers.

Application whitelisting allows only approved applications to execute, blocking all others by default. This directly prevents unauthorized code from running, even if malware bypasses antivirus. It enforces a strict execution policy, making it a robust defense-in-depth control. It is particularly effective against zero-day exploits and advanced malware.

For SSL decryption, the firewall acts as a man-in-the-middle, presenting its own certificate to clients. To avoid errors, clients must trust the firewall's CA. Using the internal CA to issue the firewall's decryption certificate and distributing that CA to clients ensures trust. This allows the firewall to decrypt and re-encrypt traffic transparently, and clients will not see certificate warnings.

EDR with behavioral analytics and process lineage tracking detects malicious activity by observing anomalous process behavior, such as a productivity application spawning PowerShell or WMI. This approach is effective against LOLBins and fileless attacks because it focuses on actions rather than static file signatures, providing the visibility the SOC needs.

Assuming breach drives microsegmentation and least-privilege inspection of all traffic, shrinking the blast radius of any compromised asset. This satisfies the Zero Trust requirement that no implicit trust be granted based on network location alone.

App-ID permits only explicitly required business applications, directly enforcing least privilege for outbound traffic, while WildFire and Anti-Spyware profiles inspect those permitted flows to detect exfiltration payloads. This satisfies the stem's constraint by combining granular allow-listing with content inspection rather than blanket port-based rules.

Vishing is voice-based phishing, where an attacker uses a phone call to manipulate a victim into disclosing sensitive information or performing an action. The caller impersonating IT support and requesting a one-time passcode fits this definition precisely, because the deception is delivered verbally over the telephone rather than through email or a website.

The Anti-Spyware profile with DNS signature enforcement inspects DNS queries against known malicious domain signatures, blocking resolution of malware-delivery domains. Attached to the security rule, it satisfies the requirement that internal hosts cannot resolve those domains.

The Data Filtering profile inspects outbound traffic for patterns such as credit card and social security numbers, then alerts or blocks matching flows. This satisfies the requirement to detect and prevent sensitive information from leaving the network during the suspected exfiltration.

DGA is a technique used by malware to generate a large number of domain names to avoid static blocklists. The infected host queries these domains until it finds one that is registered by the attacker and responds, establishing C2 communication. The random-looking subdomains and regular intervals are characteristic of DGA-based malware. This behavior indicates the host is attempting to locate its C2 server.

Outbound connections to a known command and control IP indicate the endpoint is beaconing to attacker infrastructure, which is the Command and Control phase. The adversary has already established a channel to direct the compromised host.

DGAs are used by malware to generate many pseudo-random domain names and attempt to resolve them to find a command-and-control (C2) server. The high volume of queries with few successful resolutions is a classic indicator. The infected host tries numerous domains until one resolves, indicating DGA-based C2 communication. This matches the observed pattern.

Actions on Objectives occurs after the adversary has established internal presence, so the attacker's infrastructure actively interacts with the target enterprise network during lateral movement and exfiltration. A Palo Alto Networks firewall inspecting internal east-west traffic can detect or disrupt this phase.

An inline firewall's DoS Protection profile inspects HTTP requests and applies classified and aggregate rate limiting, throttling GET floods per source and in total. This targets the application-layer flood while permitting legitimate traffic, satisfying the requirement to mitigate without blocking genuine users.

Application-based security policies on Palo Alto Networks firewalls allow administrators to define rules that permit or deny traffic based on the identified application, irrespective of port or protocol. This is a core feature of the next-generation firewall, providing granular control and reducing attack surface by not relying on traditional port-based rules.

The antivirus profile scans traffic streams for known malware signatures, viruses, spyware and command-and-control patterns. It satisfies the stem's requirement to inspect content payloads for known malware, complementing the anti-spyware profile that targets software exploit attempts.

Panorama administrative roles map individual administrators to granular, role-scoped permissions, while external authentication profiles (RADIUS, TACACS+, or SAML) integrate authentication with the enterprise directory. Together they replace the shared generic firewall login, satisfying the auditor's RBAC and individual-account requirement.

WildFire executes the submitted sample inside an instrumented sandbox, observing runtime actions such as registry modification and process injection. That observation of behaviour during execution, rather than static inspection of file structure or signatures, is what defines dynamic behavioural analysis.

A file blocking profile with the action set to block for WildFire verdicts ensures that files identified as malicious are blocked. This profile must be attached to the security policy. It works in conjunction with the WildFire analysis profile to enforce blocking based on the analysis results.

Permitted IP address lists restrict management-plane access to known secure jump hosts, so connections from any other source are dropped before authentication. This directly satisfies the stem's constraint of protecting the management interface from unauthorised access by enforcing network-layer source filtering.

Comparing hashes is the standard method for verifying file integrity. A cryptographic hash function like SHA-256 produces a unique fixed-size string for the file's contents. If the current hash matches the known-good hash, the file is likely unaltered. Any change to the file, even a single bit, will result in a completely different hash. This method is reliable and widely used in digital forensics and security operations.

ABAC evaluates multiple attributes (user, resource, environment) to make access decisions dynamically. This aligns with zero trust's 'never trust, always verify' by considering context like device health, location, and time. ABAC enables fine-grained, adaptive policies that continuously assess risk, which is essential for a zero trust architecture.

Command and Control is the correct phase because the endpoint is communicating with an external server controlled by the attacker. This phase occurs after exploitation and installation, where the adversary establishes a channel to remotely control the compromised system. The repeated contacts to the C2 server are a hallmark of this stage, allowing the attacker to issue commands, exfiltrate data, or download additional payloads.

Firewall session and network flow records show the five-tuple of actual connections, including source, destination, port, and bytes transferred. Correlating these with the DNS alert reveals whether the workstation truly opened a session to the resolved C2 address or merely queried the name. This directly answers the analyst's question about an established connection rather than a lookup.

Application whitelisting allows only approved applications to run, preventing unauthorized malware from executing. It is a direct control against malware execution because it blocks unknown or malicious binaries. This is a core endpoint security measure recommended in defense-in-depth.

Network segmentation with strict east-west controls prevents a compromised host from freely reaching other systems even if valid credentials are available. It enforces boundaries that must be crossed, creating opportunities for detection and containment. Combined with least privilege, segmentation directly limits how far an attacker can pivot after stealing an account, which is the goal described in the scenario.