D329 Networks and Security Applications - Set 3 - Part 2

Correct Answer: A document defining permitted use of organizational IT resources

An acceptable use policy specifies how employees may use organizational systems and data, establishing clear expectations and grounds for enforcement.

Correct Answer: Categorizing data by sensitivity to determine required protection

Data classification assigns sensitivity levels such as public, internal, or confidential, driving proportionate handling, access, and protection requirements.

Correct Answer: Technology detecting and blocking unauthorized transfer of sensitive data

DLP inspects data in motion, at rest, and in use, blocking or alerting when sensitive information moves in violation of policy.

Correct Answer: Data exposure if a device is lost or stolen

Full disk encryption renders stored data unreadable without the key, protecting information on lost or stolen devices. It does not protect data in transit.

Correct Answer: Three copies on two media types with one copy offsite

The 3-2-1 rule keeps three copies of data on two different media types with at least one stored offsite, protecting against hardware failure, corruption, and site disaster.

Correct Answer: Ransomware commonly encrypts reachable backups along with production data

Modern ransomware seeks and encrypts accessible backups. Offline, air-gapped, or immutable copies survive such attacks and enable recovery without paying.

Correct Answer: Maintaining essential operations during and after a disruption

Business continuity planning identifies critical functions and establishes how they will continue during disruption, encompassing but extending beyond IT recovery.

Correct Answer: Threats, vulnerabilities, and their potential impact on assets

A risk assessment identifies assets, the threats and vulnerabilities affecting them, and the likelihood and impact of compromise, guiding control priorities.

Correct Answer: As a function of likelihood and impact

Risk combines the probability that a threat exploits a vulnerability with the magnitude of resulting harm, allowing risks to be compared and prioritized.

Correct Answer: Accept, avoid, mitigate, and transfer

Organizations may accept a risk, avoid the activity causing it, mitigate it with controls, or transfer it through mechanisms such as insurance or contracts.

Correct Answer: Insurance or contractual allocation to a third party

Transference shifts financial consequence to another party, commonly through cyber insurance or contract terms, though accountability often cannot be fully transferred.

Correct Answer: The risk remaining after controls have been applied

No control set reduces risk to zero. Residual risk is what remains after mitigation and must be formally accepted by management.

Correct Answer: Independently verifying that controls exist and operate effectively

An audit independently examines whether controls are implemented as documented and functioning effectively, providing assurance to management and regulators.

Correct Answer: Never trust implicitly; verify every request regardless of network location

Zero trust abandons implicit trust based on network position, requiring continuous verification of identity, device posture, and authorization for every access request.

Correct Answer: Cloud services and remote work place resources and users outside the perimeter

With applications in the cloud and users working remotely, there is no longer a single boundary containing all resources, undermining perimeter-centric defense.

Correct Answer: Applying fine-grained security policy between individual workloads

Microsegmentation enforces policy between individual workloads rather than only at network boundaries, tightly constraining lateral movement after a compromise.

Correct Answer: A system physically isolated from unsecured networks

An air-gapped system has no network connection to untrusted networks, used for highly sensitive environments where remote compromise must be prevented.

Correct Answer: They can introduce malware and exfiltrate data bypassing network controls

Removable media crosses network boundaries physically, potentially carrying malware inward or sensitive data outward without traversing monitored network controls.

Correct Answer: Gaining higher access rights than originally authorized

Privilege escalation exploits a flaw or misconfiguration to obtain elevated rights, converting limited access into administrative control over a system.

Correct Answer: Moving from one compromised system to others within the network

After gaining an initial foothold, attackers move laterally to reach higher-value systems. Segmentation and least privilege are the primary defenses.