100-160 Practice Questions

Maintaining a hardware inventory is a fundamental practice in IT asset management. Its benefits include providing a clear record of all physical assets for procurement and lifecycle planning (A), offering the necessary context for effective software license management and compatibility checks (B), and giving technical support teams quick access to device specifications to expedite troubleshooting (C). A hardware inventory is a passive documentation and tracking tool; it does not perform active security functions and cannot, by itself, eliminate the critical and ongoing need for software updates and security patching to protect against vulnerabilities.

A. A hardware inventory is the cornerstone of asset management, providing essential data for planning purchases, tracking depreciation, and managing the asset lifecycle.

B. Effective software inventory and license compliance are impossible without knowing the hardware on which the software is installed, making this a key benefit.

C. An accurate inventory allows support staff to instantly know a device's configuration (model, RAM, OS), which significantly simplifies and accelerates the troubleshooting process.

1. Official Vendor Documentation: Cisco Press, IT Essentials Companion Guide v7, Chapter 13, "The IT Professional." Section 13.2.1, "Troubleshooting Theory," emphasizes that proper documentation, which includes hardware inventories, is a critical part of the troubleshooting process, directly supporting the benefit described in option C.

2. Peer-reviewed Academic Publications (Government Standards): National Institute of Standards and Technology (NIST), Special Publication 800-53 Revision 5, "Security and Privacy Controls for Information Systems and Organizations," December 2020.

Control AM-2 (Asset Inventory) and CM-8 (System Component Inventory) describe the purpose of inventory as a tool for tracking, managing, and securing assets. This directly supports the benefits listed in options A, B, and C.

The existence of a separate control, SI-2 (Flaw Remediation), which mandates the timely installation of security patches, confirms that inventory management (AM/CM controls) does not replace or eliminate the need for patching.

3. University Courseware: Principles of IT Asset Management (ITAM) are foundational in information systems curricula. Course materials on the IT Infrastructure Library (ITIL) framework, commonly taught in university IT management programs, place hardware inventory within the "Service Asset and Configuration Management" (SACM) process. This process is shown to be essential for supporting financial management (procurement), incident management (troubleshooting), and change management, validating options A and C as core benefits.

The Family Educational Rights and Privacy Act (FERPA) is a United States federal law specifically designed to protect the privacy of student education records. This law applies to all schools that receive funds under an applicable program of the U.S. Department of Education. FERPA gives parents certain rights with respect to their children's education records, which transfer to the student when they reach the age of 18 or attend a school beyond the high school level. It governs the access to and release of these records, ensuring they are not disclosed without written consent, with some specific exceptions.

A. HIPAA: The Health Insurance Portability and Accountability Act (HIPAA) protects sensitive patient health information (PHI), not student education records.

B. PCI-DSS: The Payment Card Industry Data Security Standard (PCI-DSS) applies to organizations that handle branded credit cards, securing cardholder data, not academic information.

D. GDPR: The General Data Protection Regulation (GDPR) is a broad EU law protecting the personal data of EU citizens, not a framework specifically for US student records.

1. U.S. Department of Education. (n.d.). Family Educational Rights and Privacy Act (FERPA). Retrieved from https://www2.ed.gov/policy/gen/guid/fpco/ferpa/index.html. (See the "About FERPA" section, which states, "The Family Educational Rights and Privacy Act (FERPA) ... is a Federal law that protects the privacy of student education records.")

2. Cornell Law School, Legal Information Institute. (n.d.). 20 U.S. Code § 1232g - Family educational rights and privacy. Retrieved from https://www.law.cornell.edu/uscode/text/20/1232g. (This document provides the full legal text of the statute, defining its scope and purpose in section (b) "Release of education records.")

3. University of California, Berkeley, Office of the CIO. (n.d.). Major Laws and Policies Related to Information Security and Privacy. Retrieved from https://security.berkeley.edu/resources/major-laws-and-policies-related-information-security-and-privacy. (This university resource explicitly lists and describes FERPA as the law governing "the privacy of student records.")

Assessments of IT systems are a comprehensive and fundamental practice within information security and change management. Their purpose is multifaceted. From a security perspective, assessments are crucial for proactively identifying vulnerabilities and weaknesses that could be exploited (C). From a governance and compliance standpoint, they are used to verify that systems adhere to legal, regulatory, and policy requirements (D). In the context of change management, assessments are essential for evaluating the potential impact of proposed changes on system performance, stability, and availability, thereby mitigating risks associated with modifications (B). Since all these objectives are valid and integral to the assessment process, "All of the above" is the correct answer.

B. To assess the potential impact of changes on overall system performance: This is an incomplete answer, as it only addresses the change management aspect and omits the critical security and compliance functions of an assessment.

C. To identify any vulnerabilities or weaknesses in the system: This is an incomplete answer because it focuses solely on the security vulnerability aspect, ignoring the equally important goals of compliance and change impact analysis.

D. To determine the level of compliance with regulatory requirements: This is an incomplete answer, as it limits the purpose of assessments to compliance verification, excluding the crucial tasks of vulnerability discovery and performance impact analysis.

1. National Institute of Standards and Technology (NIST) Special Publication 800-53A, Rev. 4, Assessing Security and Privacy Controls in Information Systems and Organizations. Section 1.1, "Purpose and Applicability," states that the purpose of assessments is to determine if controls are implemented correctly and meet security/privacy requirements, which directly supports options C and D.

2. National Institute of Standards and Technology (NIST) Special Publication 800-115, Technical Guide to Information Security Testing and Assessment. The Executive Summary (Page vii) states that security testing and assessment techniques are used to "identify vulnerabilities" and "quantify risk," which supports option C.

3. The University of Washington, UW-IT Service Management, ITIL Change Management Process Guide. Section 4.2, "Assess and Evaluate," details the process of assessing a change request, which includes evaluating its "impact on services, infrastructure, and customers," directly supporting the performance impact analysis mentioned in option B.

4. Carnegie Mellon University, Information Security Guideline (GDL-001). Section 3.0, "Risk Assessment," specifies that assessments are conducted to "identify threats and vulnerabilities to information assets" and "determine compliance with University policies and legal/regulatory requirements," supporting options C and D.

A preventive control is a security measure designed to proactively stop an undesirable event or security incident from occurring. A firewall is a prime example of this, as its core function is to inspect and filter network traffic based on a set of security rules. By blocking unauthorized or malicious traffic before it can reach internal systems, the firewall actively prevents potential intrusions, malware infections, and other network-based attacks, thus fulfilling the definition of a preventive control.

A. Backup and recovery procedures: These are corrective controls, as they are used to restore systems and data to a normal state after a failure or data loss incident has already happened.

C. Incident response planning: This is a corrective and responsive control framework that guides actions during and after a security incident to manage and mitigate its impact.

D. Penetration testing: This is a detective control. Its purpose is to actively search for and identify existing vulnerabilities, not to prevent an initial incident from occurring.

1. National Institute of Standards and Technology (NIST). (2020). Security and Privacy Controls for Information Systems and Organizations (Special Publication 800-53, Revision 5).

Reference: Section 2.2, "Control and Control Enhancements," discusses the nature of controls. Controls within families like Access Control (AC) and System and Communications Protection (SC), where firewalls are implemented (e.g., SC-7), are fundamentally preventive as they are "intended to avoid an event from occurring."

2. Santos, O., & Stuppi, J. (2020). CCNA CyberOps Associate CBROPS 200-201 Official Cert Guide. Cisco Press.

Reference: Chapter 1, "The Danger," in the section "Security Controls," explicitly categorizes firewalls and access control lists (ACLs) as technical, preventive controls. The text contrasts this with detective controls (like IDS) and corrective controls (like backups).

3. Saltzer, J. H., & Schroeder, M. D. (1975). The Protection of Information in Computer Systems. Communications of the ACM, 18(7), 38-42.

Reference: This foundational academic paper on computer security outlines design principles. Principle of Least Privilege (Section I.A.3), which is enforced by mechanisms like firewalls, is described as a preventive measure to limit the "potential for harm" before it happens. (DOI: https://doi.org/10.1145/361011.361062)

Data integrity is a fundamental component of the information security model known as the CIA triad (Confidentiality, Integrity, Availability). It refers to the assurance that data is accurate, complete, and has not been altered or corrupted in an unauthorized manner. This principle ensures the trustworthiness and reliability of data throughout its entire lifecycle, protecting it from intentional or accidental modification. Mechanisms like hashing algorithms (e.g., SHA-256) and digital signatures are commonly used to verify data integrity.

A. Preventing data loss during power outages relates to availability, which ensures that systems and data are accessible when needed.

B. Encrypting data during transmission is a primary mechanism for ensuring confidentiality, although it can also contribute to integrity.

C. Protecting data from unauthorized disclosure is the definition of confidentiality, another distinct pillar of the CIA triad.

1. Cisco Press. (2015). CCNA Security 210-260 Official Cert Guide. In Chapter 1, "Modern Network Security Threats," under the section "The CIA Triad," integrity is defined as "the assurance that information has not been modified by unauthorized people or processes." This directly supports the concept of data being accurate and reliable. (Cisco Press, ISBN: 978-1587205668, Chapter 1, p. 8).

2. National Institute of Standards and Technology (NIST). (2017). NIST Special Publication 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations. In Appendix F, "Security Control and Enhancement Index," Integrity is defined as "The property whereby information is not altered or destroyed in an unauthorized manner." This aligns with ensuring data accuracy. (NIST SP 800-53 Rev. 5, Appendix F, p. F-17).

3. Purdue University. Courseware for CS 42600: Computer Security. In the lecture notes on "Introduction to Security," the CIA triad is explained. Data Integrity is described as "prevention of unauthorized modification of data," which ensures the data remains accurate and trustworthy. (Available via Purdue University's Computer Science department course materials).

A denial-of-service (DoS) attack is a cyber-attack in which the perpetrator seeks to make a machine or network resource unavailable to its intended users. The defining characteristic of a DoS attack is the disruption of services. This is most commonly accomplished by flooding the targeted host or network with superfluous requests in an attempt to overload the system's resources, such as CPU, memory, or network bandwidth. When the system is overwhelmed, it cannot process legitimate requests, effectively denying service to legitimate users.

A. This describes an unauthorized access attack, where the goal is to compromise a system's confidentiality, not its availability.

B. This describes a data breach or data integrity attack, which focuses on stealing or modifying information, not disrupting service access.

D. This describes a man-in-the-middle (MitM) attack, where an attacker secretly relays and possibly alters the communications between two parties.

1. Cisco. (n.d.). What Is a Denial-of-Service (DoS) Attack? Cisco.com. Retrieved from https://www.cisco.com/c/en/us/products/security/what-is-a-denial-of-service-attack-dos.html.

Reference Specifics: In the "How a DoS attack works" section, paragraph 1 states, "DoS attacks accomplish this by flooding the target with traffic, or sending it information that triggers a crash."

2. Cisco Networking Academy. (2020). CCNAv7: Enterprise Networking, Security, and Automation (ENSA) Curriculum.

Reference Specifics: Module 10, Section 10.1.2, "Threat Actors," describes DoS attacks as a common threat that results in an "interruption of network services to users, devices, or applications" by "overwhelming the target with a large amount of traffic."

3. Rivest, R. L. (2017). 6.857 Computer and Network Security, Lecture 15: Network Security II. MIT OpenCourseWare.

Reference Specifics: The lecture notes define Denial of Service (DoS) as an attack that "prevents legitimate users from using a service" and lists "flooding the server with requests" as a primary method.

An artifact, in the context of a cybersecurity investigation, is a piece of data that provides evidence of an activity. Firewall logs are a primary example of such an artifact. They contain time-stamped records of network connections that have been permitted or denied, including source/destination IP addresses, ports, and protocols. This information is fundamental for digital forensic investigators to reconstruct the timeline of an incident, trace the path of an attacker, and identify compromised systems. These logs are a direct record of network events, making them a critical source of evidence.

B. Configuration files describe the intended state of a device; they are not a direct record of a security event, although an unauthorized change to them could be an artifact.

C. Security policy documents are administrative controls that define rules and procedures. They are used for compliance and to define a violation, not as evidence of the event itself.

D. Training materials are preventative and educational tools. They do not contain any data related to the occurrence of a specific security incident.

1. National Institute of Standards and Technology (NIST). (2012). Computer Security Incident Handling Guide (Special Publication 800-61 Rev. 2).

Section 3.2.3, "Sources of Precursors and Indicators," lists firewall logs as a common source for detecting and analyzing security incidents. It states, "Logs from firewalls... are also valuable sources of precursors and indicators."

2. National Institute of Standards and Technology (NIST). (2006). Guide to Integrating Forensic Techniques into Incident Response (Special Publication 800-86).

Section 3.2.2, "Network-Based Evidence," explicitly identifies firewall logs as a key source of forensic data. It notes that "Firewall, network-based IDS, and router logs can show the network communications that have occurred."

3. Kent, K., & Souppaya, M. (2006). Guide to Computer Security Log Management (NIST Special Publication 800-92).

Section 2.2, "How Log Management Supports Security," explains that logs, including those from firewalls, are used for "establishing baselines, and identifying security incidents... Log data is also often of great value for forensic analysis, after an incident has been identified."

Proactive communication management after a security event requires accurate, timely, and credible information. Conducting a forensic analysis is the systematic process of investigating the incident to determine its scope, impact, and root cause. The factual findings from this analysis are the essential foundation for all subsequent communications. This data allows an organization to inform affected parties, regulators, and law enforcement with precision, thereby controlling the narrative, managing liability, and maintaining trust, rather than reacting to speculation.

A. Regularly backing up data: This is a data recovery and business continuity measure implemented before an incident, not a post-event communication strategy.

C. Implementing multi-factor authentication: This is a preventative access control measure designed to stop an incident from occurring, not a method for managing communication afterward.

D. Keeping antivirus software up to date: This is a preventative security control to protect endpoints; it is not a strategy for managing communication after an incident has already happened.

1. National Institute of Standards and Technology (NIST). (2012). Computer Security Incident Handling Guide (Special Publication 800-61 Rev. 2).

Section 3.2.4, "Containment, Eradication, & Recovery," and Section 3.2.5, "Post-Incident Activity," detail the incident response lifecycle. Forensic analysis is a core component of the analysis and eradication phases. The output of this analysis directly informs the "lessons learned" and reporting activities in the post-incident phase, which are critical for external and internal communication.

2. Cisco. (n.d.). Cisco Product Security Incident Response Team (PSIRT). Cisco Trust Center.

In the "Vulnerability Disclosure" section, Cisco PSIRT's policy states that it discloses details about vulnerabilities, including impact and affected products. This public communication is only possible after a thorough internal investigation and analysis (a form of forensics) to gather the necessary facts. This demonstrates the direct link between technical analysis and post-event communication strategy.

3. Carnegie Mellon University Software Engineering Institute. (1998). An Overview of the Computer Security Incident Response Team (CSIRT) (CMU/SEI-98-TR-001).

Section 3.2, "Reactive Services," lists "Artifact Analysis" as a key service. The report states that the results of such analysis are used to "understand the artifacts and to provide information that can be used to detect and eradicate the problem." This information is then used for announcements and reporting to the organization's constituency.

Corrective controls are implemented to remediate issues after a vulnerability or incident has been identified. Their primary focus is on "addressing" the weakness to restore the system to a secure state. This includes actions such as applying software patches, reconfiguring security settings, or restoring data from backups. While detective controls are responsible for the "identifying" phase, corrective controls are specifically designed for the subsequent action of fixing the identified problem.

A. Preventive controls are proactive measures, like firewalls or access policies, designed to stop security incidents before they happen, not to fix existing flaws.

B. Compensating controls are alternative safeguards used only when a primary control is not feasible; they do not focus on identifying and fixing vulnerabilities directly.

C. Detective controls, such as intrusion detection systems or log monitoring, are used only to identify and alert on vulnerabilities or incidents, not to remediate them.

1. National Institute of Standards and Technology (NIST). (2020). Special Publication (SP) 800-53, Revision 5: Security and Privacy Controls for Information Systems and Organizations. Page 13. The document defines corrective controls as actions taken to "correct and reduce the impact of an incident." The control family SI-2 FLAW REMEDIATION further details the process of identifying and correcting system flaws.

2. Santos, O., Stuppi, J., & Pirc, J. (2017). CCNA Cyber Ops SECFND 210-250 Official Cert Guide. Cisco Press. Chapter 1, "Cybersecurity and the Security Operations Center," Section: "Security Controls." This official Cisco publication defines corrective controls as those that "reduce the effect of an attack," which includes patching vulnerabilities that have been discovered.

3. Wilson, M., & Hash, J. (2003). NIST Special Publication (SP) 800-61: Computer Security Incident Handling Guide. Section 2.3.3, "Post-Incident Activity." This guide discusses corrective actions as a critical part of the incident response lifecycle, which involves "addressing the cause of the incident" (e.g., patching a vulnerability).

An incident response policy is a high-level document that establishes the organization's framework, authority, and intent for managing security incidents. It typically includes the mission, scope, roles and responsibilities (C), communication plans, and escalation procedures (A). It also mandates the creation and maintenance of detailed incident handling procedures (B).

However, detailed backup and recovery processes (D), while essential for the recovery phase of incident handling, are not a direct component of the incident response policy itself. These technical procedures are typically documented in a separate, more detailed Disaster Recovery Plan (DRP) or Business Continuity Plan (BCP), which the incident response plan may reference and activate.

A. Escalation procedures: This is a critical component, defining the pathway for reporting and elevating an incident based on its severity to ensure appropriate levels of management and technical staff are involved.

B. Incident handling procedures: The policy provides the authority and framework for creating and implementing the specific, step-by-step procedures for handling incidents (e.g., identification, containment, eradication, recovery).

C. Roles and responsibilities: This is a fundamental element of the policy, clearly defining who is responsible for specific actions during an incident to ensure a coordinated and efficient response.

1. NIST Special Publication 800-61 Rev. 2, Computer Security Incident Handling Guide. Section 2.3.1, "Incident Response Policy," lists the typical elements of an IR policy. These include a statement of management commitment, scope, definition of incidents, organizational structure, roles, responsibilities, and prioritization. It does not include detailed technical processes like backup and recovery, which are part of the operational recovery phase that uses separate plans.

2. Carnegie Mellon University, Software Engineering Institute, Defining Incident Management Processes, CMU/SEI-2004-TN-028. This technical note outlines the necessary processes for incident management. It discusses the need for a policy to establish authority and define roles (p. 11, Section 3.1.1), and it separates the incident handling lifecycle from the detailed technical implementation of recovery, which would rely on pre-existing disaster recovery or continuity plans.

3. Cisco, Security Policy: A Best Practices White Paper. This document describes the hierarchy of security documentation. A policy is a high-level statement of intent. The detailed "how-to" steps, such as backup and recovery processes, would be documented in lower-level procedural documents, not in the overarching policy itself (See section "Security Policy Hierarchy").