Free CC Practice Test Questions and Answers (2026)

Ransomware is a specific category of malicious software designed to block access to a computer system or data, typically by encrypting files, until a sum of money (a ransom) is paid. The malware's primary function is to hold the victim's data hostage, demanding payment for the decryption key to restore access. This directly matches the scenario described in the question, where data is held hostage in exchange for a ransom payment.

A. Trojan: A Trojan is a delivery mechanism that disguises malware as legitimate software; it does not inherently hold data for ransom.

B. Virus: A virus is self-replicating code that attaches to other programs to spread. Its primary purpose is propagation, not extortion.

D. DoS: A Denial-of-Service (DoS) is an attack type, not malware, that makes a service unavailable. It does not involve encrypting data for a ransom.

1. National Institute of Standards and Technology (NIST). (n.d.). Glossary: Ransomware. Computer Security Resource Center. Retrieved from https://csrc.nist.gov/glossary/term/ransomware.

Reference Point: The glossary defines ransomware as "A type of malicious software that infects a computer and restricts users’ access to it until a ransom is paid to unlock it."

2. University of California

Berkeley. (n.d.). What is Ransomware? Information Security Office. Retrieved from https://security.berkeley.edu/education-awareness/what-ransomware.

Reference Point: The "What is Ransomware?" section states

"Ransomware is a type of malware that encrypts your files

holding them hostage until you pay a ransom to the attacker."

3. Kharraz

A.

Robertson

W.

Balzarotti

D.

Bilge

L.

& Kirda

E. (2015). Cutting the Gordian Knot: A Look at Ransomware Attacks. In Proceedings of the 12th International Conference on Detection of Intrusions and Malware

and Vulnerability Assessment (DIMVA) (pp. 3-22). Springer. https://doi.org/10.1007/978-3-319-20550-21

Reference Point: Page 3

Section 1 (Introduction)

Paragraph 1: "Ransomware is a particularly nasty type of malware that prevents victims from using their computer or accessing their personal files until a ransom is paid."

Due care is the legal and ethical principle that describes the standard of conduct expected of a reasonable person under specific circumstances. In information security, it means taking the necessary, ongoing actions to protect assets and mitigate risks. This standard requires individuals and organizations to act prudently and responsibly to avoid causing harm or loss, which directly aligns with the "reasonable person" test mentioned in the question.

A. Separation of duties is a security control that divides a critical task among multiple individuals to prevent fraud or error, not a standard of conduct.

B. Due diligence refers to the preparatory investigation and research conducted before taking an action to identify potential risks and liabilities.

D. Least privilege is an access control principle that ensures users are only granted the minimum level of access necessary to perform their job functions.

1. Cornell Law School

Legal Information Institute (LII). "Due Care." The LII

a reputable academic source

defines due care as: "The degree of care that a reasonable person would exercise under the same or similar circumstances." This provides the foundational legal definition.

Source: https://www.law.cornell.edu/wex/duecare

2. NIST Special Publication 800-161 Revision 1

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations. This official publication distinguishes between the two key concepts.

Section 2.3.2

"Due Diligence and Due Care

" states: "Due care is the prudent and responsible execution of the duties and responsibilities associated with a given role or position." This directly supports the concept of ongoing

reasonable action.

3. (ISC)². Official (ISC)² Guide to the CISSP CBK. 6th Edition. CRC Press

2022. This is an official vendor document for a foundational cybersecurity certification whose concepts are shared with the CC.

Chapter 3

"Security Governance Principles

" defines due care as "the standard of care that a reasonable person is expected to exercise in all activities that could potentially harm others." It explicitly contrasts this with due diligence

which is defined as the "process of investigation."

Political affiliation is a protected characteristic under various state and local laws, and for federal employees, it is explicitly prohibited as a basis for personnel actions. Using it as a factor in hiring decisions constitutes illegal discrimination as it is not considered a Bona Fide Occupational Qualification (BFOQ) for the vast majority of roles. While the other attributes listed—such as criminal records, credit history, references, education, and employment history—can be legitimate components of a background check, their use is heavily regulated to ensure they are job-related and applied non-discriminatorily. Political affiliation, however, is fundamentally a non-job-related attribute that should never be a basis for an employment decision.

A. Criminal Records, credit history, references: Criminal and credit histories can be legally used in hiring decisions when relevant to the job, as guided by the EEOC and the Fair Credit Reporting Act (FCRA).

B. Credit history, employment history, references: These are all standard, permissible components of a background check used to verify a candidate's qualifications and reliability, provided they are applied consistently and are job-related.

D. Employment history, references, criminal records: Verifying employment history and references are standard practices. Criminal records can be a valid consideration for roles requiring a high degree of trust or security, subject to legal constraints.

1. U.S. Equal Employment Opportunity Commission (EEOC). "Prohibited Employment Policies/Practices." The EEOC outlines federally protected classes. While Title VII does not explicitly list political affiliation for private employers

the EEOC's principles focus on job-relatedness. Furthermore

the Civil Service Reform Act of 1978 explicitly prohibits discrimination based on political affiliation in federal employment

establishing the legal principle. Many state and local laws extend this protection to the private sector. (See Prohibited Personnel Practices

5 U.S.C. § 2302(b)(1)(E)).

2. U.S. Equal Employment Opportunity Commission (EEOC). "Background Checks: What Employers Need to Know." This guidance document clarifies the legal parameters for using criminal records and credit history in employment decisions. It confirms that such information can be used if employers "comply with the federal nondiscrimination laws" and consider the nature of the job

the nature of the offense

and the time that has passed. This confirms these are not attributes that can never be used.

3. Cornell Law School Legal Information Institute (LII). "Bona Fide Occupational Qualification (BFOQ)." University-supported legal resources define BFOQ

explaining that characteristics like race or color can never be BFOQs. Similarly

political affiliation is not considered a legitimate BFOQ for non-political positions

making discrimination on this basis impermissible.

The question asks for the components of an incident response plan, which are best represented by the phases of the incident response lifecycle. The correct sequence is established by the National Institute of Standards and Technology (NIST). The lifecycle begins with Preparation, where the organization establishes its incident response capabilities. This is followed by Detection and Analysis to identify and validate an incident. The next phase, Containment, Eradication, and Recovery, focuses on limiting the incident's impact, removing the threat, and restoring systems to normal operation. The final phase is Post-Incident Activity, which involves analyzing the incident and the response to improve future security and incident handling efforts. Option A accurately reflects this established four-phase model.

B. This option incorrectly places Recovery before Containment and Eradication. An incident must be contained and the threat eradicated before systems can be safely recovered.

C. This option incorrectly places Recovery after Post-Incident Activity. System recovery is a critical step to restore business operations and must occur before the final lessons-learned phase.

D. This option incorrectly places Containment last among the active response phases. Containment is the immediate priority after detection to prevent further damage.

1. National Institute of Standards and Technology (NIST). (2012). Computer Security Incident Handling Guide. Special Publication (SP) 800-61 Rev. 2. Section 2.3

"Incident Response Life Cycle

" page 7. The document states

"The life cycle has four phases: 1. Preparation; 2. Detection and Analysis; 3. Containment

Eradication

and Recovery; 4. Post-Incident Activity." Figure 2-1 visually depicts this exact flow.

2. Tøndel

I. A.

Line

M. B.

& Gjøsæter

T. (2008). A Comparative Study of Incident Response Methodologies. In Proceedings of the 4th International Conference on Information-Warfare and Information-Security (ICIW 2008). Section 3.1

"The NIST Methodology

" page 370. This paper reviews various methodologies and describes the NIST model with the phases: Preparation

Detection & Analysis

Containment

Eradication & Recovery

and Post-Incident Activity.

3. Carnegie Mellon University

Software Engineering Institute. (2016). Defining the Process for Incident Response. CERT Division. Retrieved from course materials related to incident management. The CERT model

which heavily influenced the NIST framework

outlines a similar process: Prepare -> Protect -> Detect -> Triage -> Respond. The "Respond" phase encompasses containment

eradication

and recovery

aligning with the NIST structure.

Procedures are formal documents that provide detailed, step-by-step instructions on how to perform a specific task or process. They are designed to ensure that actions are carried out consistently and correctly, in alignment with established policies and standards. For example, a procedure would outline the exact sequence of actions a system administrator must take to create a new user account, ensuring compliance with the organization's access control policy.

A. Policies are high-level documents that state management's intent and objectives; they define what is required, not the specific steps on how to do it.

B. Regulations are mandatory rules or laws imposed by an external governing body, which an organization must follow, but they are not internal step-by-step guides.

C. Standards establish mandatory, specific requirements for technologies, configurations, or methods to ensure consistency, but they are not detailed procedural instructions.

1. National Institute of Standards and Technology (NIST). (2017). An Introduction to Information Security (NIST Special Publication 800-12 Rev. 1). U.S. Department of Commerce. In Section 2.3.1

"Policy

Standards

and Practices

" it states

"Procedures are detailed

step-by-step instructions that are created to ensure that personnel can perform a given action." (p. 10).

2. National Institute of Standards and Technology (NIST). (n.d.). Glossary. Computer Security Resource Center. Retrieved from https://csrc.nist.gov/glossary. The glossary defines a procedure as: "A set of steps that can be followed to accomplish a task."

3. University of California

Berkeley. (n.d.). Information Security Policy Program. Information Security Office. The document outlines the policy framework

defining Procedures as: "Step-by-step instructions to assist staff in implementing the various policies

standards

and guidelines."

An on-path attack, also known as a man-in-the-middle (MITM) attack, is a form of active eavesdropping where an attacker positions themselves in the communication path between two parties. By spoofing the IP address of a legitimate server, the attacker can intercept traffic intended for that server, and then inspect, modify, or redirect it without the knowledge of the communicating parties. The scenario described—intercepting and redirecting traffic via IP spoofing—is a textbook example of an on-path attack methodology.

B. Advanced persistent threat (APT): An APT refers to a prolonged and targeted cyberattack campaign, not the specific network interception technique described.

C. Trojan: A Trojan is a type of malware that misleads users of its true intent by disguising itself as legitimate software; it does not describe a network traffic interception method.

D. Spyware: Spyware is a category of malware designed to secretly gather information from a user's device, which is different from actively intercepting and redirecting network traffic.

---

1. National Institute of Standards and Technology (NIST) Computer Security Resource Center (CSRC) Glossary.

On-Path Attacker: "An adversary that can read

write

and delete messages between two parties without either party knowing that the adversary is on the path."

IP Address Spoofing: "Faking the sending IP address in a packet to fool the recipient into accepting it as coming from a trusted source."

Source: NIST CSRC Glossary

s.v. "on-path attacker

" "IP address spoofing." Retrieved from https://csrc.nist.gov/glossary

2. Internet Engineering Task Force (IETF) RFC 4949.

Man-in-the-middle attack: "A form of active wiretapping attack in which the attacker intercepts and selectively modifies communicated data to masquerade as one or both of the entities involved in a communication association." (Note: On-path attack is the modern term for MITM).

Source: Shirey

R. (2007). Internet Security Glossary

Version 2. IETF. RFC 4949

Section 2

Page 189. https://doi.org/10.17487/RFC4949

3. MIT OpenCourseWare

6.858 Computer Systems Security.

Lecture notes describe Man-in-the-Middle (MITM) attacks where an adversary can "impersonate server to client (and client to server)" and "intercept and modify traffic." Techniques like ARP spoofing and DNS spoofing are cited as methods to achieve this position.

Source: Kaashoek

M. F.

& Zeldovich

N. (2014). 6.858 Computer Systems Security

Lecture 11: Network Security. MIT OpenCourseWare. Retrieved from https://ocw.mit.edu/courses/6-858-computer-systems-security-fall-2014/resources/mit6858f14lec11/

The primary objective of physical access controls is to enforce the principle of least privilege in the physical domain. These controls are designed to manage and restrict entry to facilities, rooms, and specific areas to safeguard an organization's most critical assets. This includes protecting personnel, preventing unauthorized access to sensitive information stored on servers or in documents, and securing physical resources like equipment and infrastructure from theft, damage, or tampering. By limiting access to only authorized individuals, these controls form a foundational layer of a defense-in-depth security strategy, directly supporting the confidentiality, integrity, and availability of organizational assets.

A. Physical controls are meant to complement, not replace, technical security controls as part of a layered, defense-in-depth security posture.

B. This contradicts the security principle of least privilege, which dictates that access should be restricted based on job requirements, not granted universally.

D. Allowing public access to sensitive areas would introduce unacceptable risks, directly undermining the fundamental purpose of security controls.

1. National Institute of Standards and Technology (NIST). (2020). Security and Privacy Controls for Information Systems and Organizations (NIST Special Publication 800-53

Revision 5). U.S. Department of Commerce. The purpose of the Physical and Environmental Protection (PE) control family is to "limit physical access to systems

equipment

and the respective operating environments to authorized individuals." (p. 199

PE Family Introduction).

2. International Organization for Standardization. (2022). Information security

cybersecurity and privacy protection — Information security controls (ISO/IEC 27002:2022). The objective for control 7.2 "Physical entry" is to "ensure that only authorized personnel are allowed to enter secured areas." (Annex A

Control 7.2).

3. Saltzer

J. H.

& Schroeder

M. D. (1975). The Protection of Information in Computer Systems. Communications of the ACM

18(7)

387–408. This foundational paper on computer security design principles implicitly supports physical controls through the principle of "Complete Mediation

" where every access must be checked. Physical controls are the first layer of mediation for physical assets. (Section A.3

p. 5). https://doi.org/10.1145/361011.361062

Infrastructure-as-a-Service (IaaS) provides the highest level of flexibility and customization among cloud service models. In an IaaS model, the cloud provider manages the core physical infrastructure (servers, networking, storage), but the customer retains control over the operating systems, middleware, runtime, data, and applications. This extensive control allows organizations to build and configure their environments precisely to their specifications, similar to on-premises infrastructure but without the capital expenditure and physical maintenance overhead. This model is ideal for organizations with complex or unique IT requirements that cannot be met by the more abstracted PaaS or SaaS models.

B. Platform-as-a-Service (PaaS): PaaS abstracts the underlying infrastructure, including the operating system and middleware, offering less control and customization than IaaS.

C. On-premises: While offering complete control, on-premises is a traditional deployment model, not a cloud service, and thus does not answer the question as posed.

D. Software-as-a-Service (SaaS): SaaS provides the least flexibility, as the vendor manages the entire stack, including the application. Customization is typically limited to user-level configurations.

---

1. Mell

P.

& Grance

T. (2011). The NIST Definition of Cloud Computing (NIST Special Publication 800-145). National Institute of Standards and Technology. Page 2

Section "Service Models". The document specifies that with IaaS

the consumer "has control over operating systems

storage

and deployed applications

" which is the broadest scope of control among the three service models.

2. Amazon Web Services. (n.d.). What is IaaS? AWS Documentation. Retrieved from https://aws.amazon.com/what-is/iaas/. The documentation states

"IaaS provides you with the highest level of flexibility and management control over your IT resources."

3. Microsoft Azure. (n.d.). What is infrastructure as a service (IaaS)? Azure Documentation. Retrieved from https://azure.microsoft.com/en-us/resources/cloud-computing-dictionary/what-is-iaas/. The documentation notes

"Of the three cloud service models

IaaS offers the most control for the business over its hardware."

4. Armbrust

M.

Fox

A.

Griffith

R.

Joseph

A. D.

Katz

R.

Konwinski

A.

... & Zaharia

M. (2009). A view of cloud computing. Communications of the ACM

53(4)

50-58. (Also available as Technical Report No. UCB/EECS-2009-28). Section 3.1 discusses how IaaS providers like Amazon EC2 offer low-level virtualized resources

which inherently provides more flexibility for users to build their own systems compared to higher-level PaaS offerings. DOI: https://doi.org/10.1145/1721654.1721672

The primary purpose of encryption is to provide confidentiality. It is the process of converting readable data (plaintext) into an unreadable format (ciphertext) using an algorithm and a key. This transformation ensures that only authorized parties, who possess the correct decryption key, can access and understand the original information. Therefore, its fundamental goal is to protect data from being read or accessed by unauthorized individuals or systems.

B. Encryption makes data unreadable and thus inherently difficult to analyze without prior decryption.

C. While encryption is a critical component of secure data storage, "secure storage" is a broader concept that also includes physical security and access controls. Encryption's specific role is confidentiality.

D. Encryption adds computational overhead to data operations, which generally decreases, rather than increases, processing efficiency.

1. National Institute of Standards and Technology (NIST). (2020). Recommendation for Key Management

Part 1: General (NIST SP 800-57 Part 1 Rev. 5). Section 2.1.1

"Cryptographic Mechanisms

" states

"Encryption provides the service of confidentiality by transforming data into an unreadable form." (Page 7).

2. Rivest

R. L. (2006). Lecture 1: Introduction; security mindset; threats

attacks

and assets; policies and mechanisms. MIT OpenCourseWare

6.857 Computer and Network Security. The lecture notes introduce cryptography as a primary mechanism for achieving confidentiality

defined as preventing the unauthorized release of information.

3. Pfleeger

C. P.

Pfleeger

S. L.

& Margulies

J. (2015). Security in Computing (5th ed.). Pearson Education. Chapter 2

"Toolbox: Authentication

Access Control

and Cryptography

" explains that cryptography "transforms a message so that it is unintelligible... The goal is that an outsider

seeing the encrypted data

cannot determine the original data." (Page 49).

An Advanced Persistent Threat (APT) is a sophisticated, long-term cyberattack in which an intruder establishes an undetected presence on a network to steal sensitive data over a prolonged period. The "Advanced" aspect refers to the use of highly sophisticated techniques and tools to breach defenses. The "Persistent" aspect signifies that the external command and control system is continuously monitoring and extracting data from a specific target. These campaigns are characterized by their stealth, long duration (months or years), and clear objectives, matching the description in the question precisely.

B. Ping of death: This is a specific type of denial-of-service (DoS) attack, not a long-term, sophisticated campaign. It is a singular event designed to crash a system.

C. Rootkit: A rootkit is a type of malicious software used to gain and maintain privileged access while hiding its presence. It is a tool an APT might use, not the threat campaign itself.

D. Side-channel: This refers to a type of attack that exploits information from the physical implementation of a system (e.g., power consumption), not the overall long-term threat actor or campaign.

1. National Institute of Standards and Technology (NIST). (2011). Special Publication 800-39

Managing Information Security Risk: Organization

Mission

and Information System View. Page C-1

Appendix C. "An adversary that possesses sophisticated levels of expertise and significant resources... pursues its objectives repeatedly over an extended period of time."

2. Chen

P.

Desmet

L.

& Huygens

C. (2014). A Study on Advanced Persistent Threats. In IFIP International Conference on Communications and Multimedia Security (pp. 63-72). Springer

Berlin

Heidelberg. DOI: https://doi.org/10.1007/978-3-662-44885-45. (Abstract and Section 2 define APTs by their advanced

persistent

and targeted nature over long periods).

3. Carnegie Mellon University Software Engineering Institute (SEI). (2017). Common Sense Guide to Mitigating Insider Threats

5th Edition. Page 10. "Advanced Persistent Threat (APT): A targeted

persistent

and skilled adversary who seeks to compromise a specific organization."

The (ISC)² Code of Ethics is structured around four mandatory canons that all members must adhere to. The official canons are:

1. Protect society, the common good, necessary public trust and confidence, and the infrastructure.

2. Act honorably, honestly, justly, responsibly, and legally.

3. Provide diligent and competent service to principals.

4. Advance and protect the profession.

Option B states, "Provide active and qualified service to principal." While similar in intent to the third canon, the official wording is "diligent and competent," not "active and qualified." This distinction makes option B not an official canon of the (ISC)² Code of Ethics.

A. This is a direct statement of the first canon of the (ISC)² Code of Ethics.

C. This is a direct statement of the fourth canon of the (ISC)² Code of Ethics.

D. This is a direct statement of the second canon of the (ISC)² Code of Ethics.

1. (ISC)². (2024). Code of Ethics. (ISC)² Official Documentation. Retrieved from https://www.isc2.org/Ethics. The four canons are listed in the "Preamble" and "Canons" sections.

2. University of Washington. (n.d.). Professional Codes of Ethics. UW Information Technology. Retrieved from https://itconnect.uw.edu/work/professional-development/professional-codes-of-ethics/. This page explicitly lists the four (ISC)² Code of Ethics canons under the "(ISC)²" section.

The main purpose of an Acceptable Use Policy (AUP) is to serve as a foundational administrative control that clearly communicates an organization's expectations to users. It defines the rules, responsibilities, and acceptable behaviors for individuals accessing and using corporate information technology (IT) resources, such as networks, computers, and data. The AUP explicitly outlines what activities are permitted and prohibited, thereby establishing a clear standard of conduct. This policy is crucial for managing risk, protecting organizational assets, and providing a formal basis for enforcing security rules and taking disciplinary action in case of violations.

B. Monitoring is a technical or procedural control used to enforce policies like the AUP, not the primary purpose of the policy document itself.

C. This describes a Password Policy, a specific document that sets standards for password creation and management, which is often referenced within a broader AUP.

D. While an AUP is a critical component that contributes to security, its specific purpose is to govern user behavior, not to be the sole mechanism that "ensures" security.

1. National Institute of Standards and Technology (NIST) Special Publication 800-53

Revision 5

Security and Privacy Controls for Information Systems and Organizations. Control PL-4

"Rules of Behavior

" directly corresponds to the function of an AUP. The control states that an organization must "establish and make readily available to individuals requiring access to the system the rules that describe their responsibilities and expected behavior with regard to information and system usage." This directly supports that the purpose is to inform users of expectations.

2. National Institute of Standards and Technology (NIST) Special Publication 800-12

Revision 1

An Introduction to Information Security. In Section 4.2.1

"Policies

" it is stated that "Policies are the documents that codify an organization’s security requirements

responsibilities

and expectations." This aligns with the AUP's role in communicating expectations for system use.

3. Stanford University

Administrative Guide Memo 6.2.1

Computer and Network Usage Policy. The "Purpose" section of this policy states its goal is to "ensure that use of these resources is consistent with the university's educational goals and legal obligations." This exemplifies how an AUP's primary function is to define the expected and appropriate use of systems.

Detective access controls are implemented to identify and alert on security incidents or policy violations after they have occurred or as they are occurring. An Intrusion Detection System (IDS) is a quintessential detective tool. Its primary function is to monitor network traffic or system activities for suspicious patterns, known attack signatures, or anomalies. When a potential threat is identified, the IDS generates an alert, enabling security personnel to investigate and respond. This directly strengthens an organization's ability to detect unauthorized access and other security events.

A. Patches: This is a preventive and corrective control. It fixes known vulnerabilities to prevent them from being exploited in the first place.

B. Backups: This is a corrective and recovery control. It is used to restore data and systems to a known-good state after a security incident has caused damage or loss.

D. Encryption: This is a preventive control. It renders data unreadable to unauthorized parties, thereby preventing a breach of confidentiality, but it does not detect access attempts.

1. National Institute of Standards and Technology (NIST). (2020). Security and Privacy Controls for Information Systems and Organizations (NIST Special Publication 800-53

Revision 5). Section 3.3

Control SI-4

"System Monitoring

" describes the function of monitoring systems to "detect attacks and indicators of potential attacks" and "unauthorized local

network

and remote connections

" which is the core purpose of an IDS as a detective control. (p. 299).

2. Bauer

L. (2019). 18-730: Introduction to Computer Security

Lecture 2: Security Policies & Controls. Carnegie Mellon University. Slide 19

"Types of Controls

" explicitly categorizes "Intrusion detection systems" under the "Detective" control type.

3. Saltzer

J. H.

& Schroeder

M. D. (1975). The Protection of Information in Computer Systems. Communications of the ACM

18(7)

387–408. This foundational paper discusses security principles. While it doesn't use the modern "detective" term

it describes the principle of "audit trail" (Section I.A.5)

which is the basis for detective controls like IDS that analyze activity logs to detect intrusions. DOI: https://doi.org/10.1145/361011.361062

The Payment Card Industry Data Security Standard (PCI-DSS) is a global information security standard created by the major payment card brands (Visa, MasterCard, American Express, Discover, and JCB). Its primary and explicit objective is to enhance the security of cardholder data and promote a secure environment for accepting, processing, storing, or transmitting credit card information. The standard provides a baseline of technical and operational requirements designed to protect account data and prevent credit card fraud.

A. Change Management is a specific procedural requirement within the PCI-DSS framework (e.g., Requirement 6), not the overall objective of the standard itself.

B. While cardholder data is a type of Personally Identifiable Information (PII), the scope of PCI-DSS is narrowly focused on payment card data, not all forms of PII.

C. Protected Health Information (PHI) is the specific focus of healthcare regulations such as the Health Insurance Portability and Accountability Act (HIPAA), not PCI-DSS.

1. PCI Security Standards Council. Payment Card Industry (PCI) Data Security Standard

Requirements and Testing Procedures

Version 4.0. (March 2022). Page 8

Section "Introduction." The document states

"The Payment Card Industry Data Security Standard (PCI DSS) was developed to encourage and enhance cardholder data security and facilitate the broad adoption of consistent data security measures globally."

2. Carnegie Mellon University

Information Security Office. PCI DSS Compliance. The university's official documentation states

"The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards designed to ensure that ALL companies that accept

process

store or transmit credit card information maintain a secure environment."

3. Cornell University

IT Security & Policy. Regulated Data Chart. The chart explicitly defines PCI as applying to "Credit/debit card numbers..." and distinguishes it from PII and PHI

which are governed by different regulations. This clarifies the distinct and primary focus of the standard.

Software as a Service (SaaS) is a cloud computing model that delivers complete, ready-to-use software applications to end-users over the internet. In this model, the cloud provider hosts and manages the entire technology stack, including the application, underlying servers, storage, and networking. A ready-to-use email service, such as Gmail or Microsoft 365, is a quintessential example of SaaS. The user simply accesses the service through a web browser or client application without any responsibility for maintaining or managing the infrastructure or the email platform itself.

A. CaaS: Communications as a Service (CaaS) is a specialized subset of SaaS. While email is a communication tool, SaaS is the broader, fundamental service category for a complete software application.

B. PaaS: Platform as a Service (PaaS) provides a platform and environment for developers to build, deploy, and manage applications, not a finished, ready-to-use application like an email service.

D. IaaS: Infrastructure as a Service (IaaS) provides fundamental computing resources like virtual servers and storage. The user would be responsible for installing and managing the operating system and the email server software.

1. Mell

P.

& Grance

T. (2011). The NIST Definition of Cloud Computing (NIST Special Publication 800-145). National Institute of Standards and Technology. In Section 2

"Service Models

" SaaS is defined as the capability for a consumer "to use the provider’s applications running on a cloud infrastructure." The document notes that this model means the consumer does not manage the underlying infrastructure. Web-based email is a commonly cited example of this model.

2. Buyya

R.

Vecchiola

C.

& Thamarai Selvi

S. (2013). Mastering Cloud Computing: Foundations and Applications Programming. Morgan Kaufmann. In Chapter 3

"Cloud Computing Architecture

" Section 3.3.3

"Software as a Service (SaaS)

" the authors explicitly list "web-based e-mail" as a characteristic example of a SaaS application.

3. Armbrust

M.

Fox

A.

et al. (2009). Above the Clouds: A Berkeley View of Cloud Computing (Technical Report No. UCB/EECS-2009-28). EECS Department

University of California

Berkeley. On page 2

the report defines SaaS and lists Google Apps (which includes Gmail) as a prime example of an application delivered as a service.

VLAN (Virtual Local Area Network) segmentation is a technology used to logically partition a single physical network into multiple, distinct broadcast domains. In a unified cloud storage environment, this allows administrators to group servers and storage resources into separate virtual networks. For instance, servers handling sensitive patient records can be placed in one VLAN, while those with administrative data are in another. Access Control Lists (ACLs) and routing policies can then be applied to strictly control or prevent traffic between these VLANs, effectively separating access to the different data types without requiring separate physical network infrastructure.

A. Screened subnet: This is a perimeter network (DMZ) designed to separate an internal network from an untrusted, external network, not for segmenting data types internally.

C. Zero trust zone: This is a strategic security model or architecture, not a specific technology for network segmentation. VLANs can be a tool used to implement a zero-trust model.

D. An intranet: This refers to the entire private, internal network of an organization, not the method used to create logical separations within it.

1. Cisco Systems

Inc.

"Virtual LANs (VLANs)

" Internetworking Technology Handbook. In Chapter 50

the document states

"VLANs logically segment a LAN into different broadcast domains... VLANs provide a mechanism to partition a single switched network so that traffic is contained within that partition." This directly supports the use of VLANs for logical separation.

2. Stallings

W. (2016). Foundations of Modern Networking: SDN

NFV

and Cloud Computing. Pearson Education

Inc. In Chapter 6.3

"Virtual LANs (VLANs)

" it is explained that "The logical separation of devices provides a degree of security. Departments can be separated into their own VLANs so that they cannot directly communicate with each other." This aligns with separating patient and administrative data access.

3. Stanford University

CS144: Introduction to Computer Networking

Fall 2013

Lecture 10 - "Switching." The lecture notes describe VLANs as a mechanism where "a single physical switch can be partitioned into multiple 'virtual' switches

" which is the core concept required to solve the problem in the question.

Data Loss Prevention (DLP) is a security technology designed to discover, monitor, and protect sensitive data wherever it resides. A key function of endpoint DLP solutions is to scan data at rest, such as files stored on hard drives, to identify content that violates organizational policies. By using content-aware detection methods like regular expressions or data fingerprinting, DLP can effectively detect the unauthorized storage of sensitive information (e.g., personally identifiable information, intellectual property) on user workstations and servers. This capability directly addresses the requirement of the question.

B. IDS: An Intrusion Detection System (IDS) monitors network or system activity for malicious patterns or policy violations but is not designed to scan the contents of files on a hard drive.

C. TLS: Transport Layer Security (TLS) is a cryptographic protocol that provides security for data in transit over a network; it does not address the detection of data stored at rest.

D. IPS: An Intrusion Prevention System (IPS) is an active security device that detects and blocks network-based attacks; its function is not to discover sensitive data stored on local drives.

---

1. National Institute of Standards and Technology (NIST). (2018). NIST Internal Report 8202: Data Loss Prevention Practices. Section 2.1

"DLP systems are tools that can be configured to detect and prevent the unauthorized use and transmission of sensitive information... DLP systems can be used to protect data in any of its three states: data in use

data in motion

and data at rest."

2. Carnegie Mellon University

Software Engineering Institute. (2017). A Look at Data Loss Prevention. CERT/CC. Page 2

"For data at rest

DLP solutions can scan file systems

databases

and other data repositories for sensitive data. This capability is useful for discovering where sensitive data resides within the organization..."

3. Vaidya

T.

& Soni

D. (2013). Data Leakage Prevention System. International Journal of Engineering Research & Technology (IJERT)

2(12)

2990-2994. Section III.A

"Data-at-rest DLP typically involves a client-based agent that runs on end-user workstations or servers. The agent can be configured to scan the local hard drive to discover sensitive information and report back to a central management server."

Discretionary Access Control (DAC) is the model where control over an object is at the discretion of its owner. The creator of an object is typically its initial owner and has the authority to define access permissions for other subjects (users or groups). This includes the ability to grant, revoke, and delegate permissions, such as read, write, or execute rights. This model is identity-based, where access control lists (ACLs) specify which users are allowed to access the object. The owner's ability to delegate permissions is a fundamental characteristic of DAC.

A. RBAC: Access is determined by a user's assigned role(s), which are centrally managed by an administrator, not by the object's creator.

B. MAC: A central authority enforces access based on system-wide security labels and clearances; individual creators cannot alter these mandatory rules.

D. ABAC: Access is granted based on policies combining subject, object, and environmental attributes, which are typically defined by an administrator, not the object's owner.

1. National Institute of Standards and Technology (NIST). (2017). Special Publication 800-192: Verification and Test Methods for Access Control Policies/Models. Section 2.2

"Discretionary Access Control (DAC)

" Page 4. "In a system with DAC

the owner of an object can decide which other subjects are allowed to access the object and what operations they are allowed to perform."

2. Hu

V. C.

Ferraiolo

D.

Kuhn

R.

Schnitzer

A.

Sandlin

K.

Miller

R.

& Scarfone

K. (2013). NIST Special Publication 800-162: Guide to Attribute Based Access Control (ABAC) Definition and Considerations. Section 2.3.1

"Discretionary Access Control

" Page 6. "DAC is a means of restricting access to objects based on the identity of subjects and/or groups to which they belong. The controls are discretionary in the sense that a subject with a certain access permission is capable of passing that permission (perhaps indirectly) on to any other subject."

3. Myers

A. C.

& Schneider

F. B. (2014). CS 5430: System Security

Lecture 5: Access Control. Cornell University. Page 4. "Discretionary Access Control (DAC): Owner of an object specifies which subjects can access the object."

A fundamental security property of a cryptographic hash function is that it must be a one-way function, meaning it is computationally infeasible to reverse. This property, formally known as pre-image resistance, ensures that an original input (e.g., a password) cannot be derived from its resulting hash value. Therefore, being "reversible" is explicitly NOT a feature of a cryptographic hash function. The other options are essential features: they must be deterministic (same input always produces the same output), unique in practice (collision-resistant), and useful for applications like data integrity verification and digital signatures.

A. Useful: Cryptographic hash functions are highly useful for verifying data integrity, storing passwords securely, and creating digital signatures.

B. Deterministic: A hash function must be deterministic, meaning a specific input will always generate the exact same hash output.

D. Unique: This refers to collision resistance, a critical property where it is computationally infeasible to find two different inputs that produce the same hash.

1. National Institute of Standards and Technology (NIST) Special Publication 800-107 Revision 1

Recommendation for Applications Using Approved Hash Algorithms

August 2012.

Section 4

"Properties of Hash Functions

" page 4: "Three properties are of particular importance...: pre-image resistance

second pre-image resistance

and collision resistance." Pre-image resistance is the formal term for the one-way (non-reversible) property.

2. Katz

J.

& Lindell

Y. (2014). Introduction to Modern Cryptography (2nd ed.). Chapman and Hall/CRC.

Chapter 5

Section 5.2.1

"Preimage Resistance

" page 158: Defines pre-image resistance (one-wayness) as a core security property

stating that for a given hash output y

it is infeasible to find any input x such that H(x) = y. This directly contradicts the concept of reversibility.

3. Massachusetts Institute of Technology (MIT) OpenCourseWare

6.857 Computer and Network Security

Fall 2017.

Lecture 5 Notes: Hashing

page 1: Lists the desired properties of a cryptographic hash function H as: "1. H is deterministic... 3. H is one-way (preimage resistant)... 4. H is collision-resistant." This explicitly states that being one-way (non-reversible) and deterministic are required features.

Security controls are categorized into three main types: administrative, technical, and physical. Technical controls are safeguards implemented and executed by a computer system through hardware, software, or firmware. A Closed-Circuit Television (CCTV) system is a technological system composed of hardware (cameras, recorders) and software used to monitor and record activity, thereby functioning as a technical control. In contrast, administrative controls are based on policies, procedures, and training, which manage human behavior. Options A, B, and D all represent administrative controls, as they are policies or training programs, not technological systems.

A. Establishing an acceptable usage policy is an administrative control that defines rules for users; it is a document, not a technology.

B. Conducting user security awareness training is an administrative control focused on educating personnel and influencing behavior.

D. Establishing a BYOD policy is an administrative control that sets guidelines and procedures for using personal devices.

1. National Institute of Standards and Technology (NIST). (2017). Special Publication 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations. Section 2.2

"Control Structure

" categorizes controls into Management

Operational

and Technical classes. The Physical and Environmental Protection (PE) family

which includes video surveillance (PE-6)

contains numerous technical implementations.

2. National Institute of Standards and Technology (NIST). (2017). Special Publication 800-12 Revision 1: An Introduction to Information Security. Section 4.2

"Security Controls

" defines technical controls as those "primarily implemented and executed by the information system through mechanisms contained in the hardware

software

or firmware components of the system." This definition encompasses a CCTV system.

3. (ISC)². (2022). CC Certified in Cybersecurity Official Study Guide. Chapter 2

"Incident Response

Business Continuity and Disaster Recovery

" p. 45. This source defines administrative controls as including "policies

procedures

standards

and guidelines" and "awareness and training

" which directly corresponds to options A

B

and D.