I85PREP
⌘ K
NICA CCCA study materials
NICA CCCA study resources

NICA CCCA practice questions

One question at a time. Build your NICA CCCA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Fundamentals and Risk Management

In the NICA CCCA body of knowledge, which statement best defines risk as it applies to a commercial cannabis operation?

  1. The schedule of inspections published by the regulator each quarter
  2. The total dollar value of all inventory held in a licensed vault
  3. The list of employees who hold a state-issued agent badge
  4. The probability and impact of an adverse event affecting assets, people, or compliance standing Correct answer.

Explanation

Risk combines the likelihood that a threat event occurs with the severity of the resulting impact on the organization. Valuations, badge rosters, and inspection schedules are data inputs or controls, not the definition of risk itself.

Question 2Security Fundamentals and Risk Management

A cultivator identifies that a former employee still knows the door codes to the drying room. Which risk response is being applied when the facility immediately changes all codes and reissues badges?

  1. Risk mitigation Correct answer.
  2. Risk acceptance
  3. Risk avoidance
  4. Risk transference

Explanation

Mitigation reduces likelihood or impact by applying a control, here removing unauthorized access. Acceptance retains the exposure, transference shifts financial consequences to another party, and avoidance eliminates the activity entirely.

Question 3Security Fundamentals and Risk Management

Which element is the most appropriate first step of a formal risk assessment for a licensed dispensary?

  1. Drafting the annual security training calendar
  2. Inventorying assets and identifying threats and vulnerabilities Correct answer.
  3. Purchasing a cyber liability policy
  4. Selecting a video management system vendor

Explanation

A risk assessment begins by establishing context: what assets exist, what threats act on them, and where vulnerabilities exist. Purchasing insurance, scheduling training, and choosing vendors are responses that should follow the assessment.

Question 4Security Fundamentals and Risk Management

Under the principle of least privilege, how should access to a seed-to-sale inventory system be granted to a budtender?

  1. Temporary rights that expire only at the annual performance review
  2. Rights limited to the functions the budtender's role actually requires Correct answer.
  3. Full administrative rights so any transaction can be corrected
  4. The same rights as the store manager for scheduling flexibility

Explanation

Least privilege grants only the minimum access needed to perform assigned duties, which limits the damage from error or misuse. Administrative rights, manager parity, and long-lived temporary access all exceed what the role requires.

Question 5Security Fundamentals and Risk Management

Which of the following best describes the purpose of separation of duties in a cannabis cash-handling process?

  1. Allowing a single manager to approve and reconcile all daily deposits
  2. Reducing the number of employees who need security awareness training
  3. Ensuring one person cannot both record and conceal a fraudulent transaction Correct answer.
  4. Shortening the time needed to complete the daily close-out

Explanation

Separation of duties splits sensitive tasks among different people so that no single individual can perpetrate and hide an error or fraud. It is a fraud-prevention control, not a training, efficiency, or single-approver arrangement.

Question 6Security Fundamentals and Risk Management

Which term describes a weakness in a system or process that a threat could exploit?

  1. Vulnerability Correct answer.
  2. Impact
  3. Threat
  4. Likelihood

Explanation

A vulnerability is the weakness itself, while a threat is the actor or event that could exploit it. Impact and likelihood are the two dimensions used to score the resulting risk.

Question 7Security Fundamentals and Risk Management

What is the primary security purpose of a visitor log at a licensed production facility?

  1. Replacing the need for badge-based access control
  2. Satisfying the marketing team's tour scheduling needs
  3. Recording employee payroll hours for the pay period
  4. Documenting who entered restricted areas and when for accountability Correct answer.

Explanation

Visitor logs create an accountability record of entry into controlled areas, supporting investigations and audits. They complement rather than replace electronic access control and are not payroll or marketing tools.

Question 8Security Fundamentals and Risk Management

Which practice most directly protects the confidentiality of patient records in a medical cannabis dispensary?

  1. Encrypting records at rest and restricting access by role Correct answer.
  2. Posting purchase histories on a shared staff bulletin board
  3. Storing printed records in an unlocked reception drawer
  4. Emailing full records to personal accounts for backup

Explanation

Confidentiality is protected by technical controls such as encryption and by limiting access to those with a need to know. Public posting, unlocked storage, and personal-account backups all expose records to unauthorized disclosure.

Question 9Security Fundamentals and Risk Management

A security team rates a threat as high likelihood and low impact, while a second threat is low likelihood and severe impact. Which statement about comparing these two risks is most accurate?

  1. Only threats with high likelihood require documentation
  2. The low-likelihood threat can be ignored regardless of impact
  3. The two risks are identical because risk depends only on impact
  4. The risks must be compared using a consistent scoring method that combines likelihood and impact Correct answer.

Explanation

Risk scoring requires a defined method that consistently combines likelihood and impact so results are comparable and defensible. Ignoring a low-likelihood event with severe consequences, or reducing risk to impact alone, distorts prioritization.

Question 10Security Fundamentals and Risk Management

A dispensary purchases a policy that covers losses from employee theft of cash. Which risk treatment strategy does this represent?

  1. Transference Correct answer.
  2. Avoidance
  3. Acceptance
  4. Mitigation

Explanation

Insurance transfers the financial consequence of a risk to a third party, although the underlying exposure and reputational harm remain. Avoidance would end the cash-handling activity, mitigation would add controls, and acceptance would retain the loss.

Question 11Security Fundamentals and Risk Management

Which control is the clearest example of a detective control in a cannabis retail environment?

  1. A firewall rule blocking unauthorized network traffic
  2. A pre-employment background screening policy
  3. A locked vault requiring two-person access
  4. Daily reconciliation of point-of-sale totals against cash deposits Correct answer.

Explanation

Detective controls identify problems after or while they occur, and reconciliation reveals discrepancies. Vault access rules and firewalls are preventive, while background screening is a preventive personnel control.

Question 12Security Fundamentals and Risk Management

During an audit, a licensee finds that terminated employees retained active system accounts for weeks. Which corrective action best addresses the root cause?

  1. Integrating human resources termination events with an automated account deprovisioning workflow Correct answer.
  2. Reviewing account activity once per year
  3. Adding a second password to each terminated account
  4. Increasing the password length requirement for all users

Explanation

The root cause is a missing or delayed deprovisioning process, so automating the link between termination and account removal closes the gap. Password changes, added credentials, and annual reviews do not ensure timely removal.

Question 13Security Fundamentals and Risk Management

Which statement correctly distinguishes a security policy from a security procedure?

  1. A policy states management intent and requirements, while a procedure gives step-by-step instructions Correct answer.
  2. A policy is written only by IT staff, while a procedure is approved by the board
  3. A policy describes technical settings, while a procedure describes legal obligations
  4. A policy changes daily, while a procedure is permanent

Explanation

Policies express management's intent and mandatory requirements at a high level, while procedures document the specific steps used to carry them out. Authorship, change frequency, and technical detail do not define the distinction.

Question 14Security Fundamentals and Risk Management

An attacker calls a budtender claiming to be from the state regulator and asks for the manager's login credentials to 'complete an inspection.' Which threat is being used?

  1. Tailgating
  2. Denial of service
  3. Social engineering Correct answer.
  4. Shoulder surfing

Explanation

Social engineering manipulates people into divulging information or taking unsafe actions through impersonation and pressure. Shoulder surfing is visual observation, tailgating is unauthorized physical following, and denial of service degrades availability.

Question 15Security Fundamentals and Risk Management

Which factor should most influence whether a residual risk is formally accepted by senior management?

  1. The number of pages in the security policy manual
  2. The seniority of the analyst who performed the assessment
  3. The color scheme used in the risk register dashboard
  4. Whether the remaining risk falls within the organization's defined risk tolerance Correct answer.

Explanation

Residual risk is accepted when it is documented and falls within the tolerance the organization has defined. Presentation details, document length, and analyst rank do not determine whether acceptance is appropriate.

Question 16Security Fundamentals and Risk Management

A cultivation site wants to reduce the chance that a single stolen badge grants entry to every restricted area. Which design choice best accomplishes this?

  1. Removing badge readers from interior doors
  2. Configuring zone-based access so badges open only assigned areas Correct answer.
  3. Extending badge validity to five years without review
  4. Issuing one master badge to each shift supervisor

Explanation

Zone-based access enforces least privilege physically, so a single badge cannot unlock the entire facility. Master badges, removal of readers, and long unreviewed validity all increase the blast radius of a lost credential.

Question 17Security Fundamentals and Risk Management

Which of the following is the best example of multi-factor authentication for remote access to a seed-to-sale platform?

  1. Two different passwords entered in sequence
  2. A username plus a password
  3. A password plus a hardware token code Correct answer.
  4. A username plus a security question

Explanation

Multi-factor authentication combines factors from different categories, such as something you know (password) and something you have (hardware token). Two passwords or a password and a knowledge question both rely on the memory factor.

Question 18Security Fundamentals and Risk Management

A security manager must prioritize two remediation projects with equal cost. Project A reduces a frequently exploited vulnerability; Project B addresses a rarely exploited vulnerability that could halt all sales. Which reasoning is most sound?

  1. Always choose Project B because rare events are unpredictable
  2. Defer both projects until the next fiscal year
  3. Always choose Project A because frequency alone determines priority
  4. Weigh both likelihood and business impact, since a sales-halting event may justify higher priority Correct answer.

Explanation

Prioritization should reflect both likelihood and impact, including business consequence, rather than frequency alone. A low-frequency event that halts sales can outrank a common but minor issue when impact is weighed.

Question 19Security Fundamentals and Risk Management

Which practice best supports the integrity of audit logs in a regulated cannabis system?

  1. Storing logs on write-once media or forwarding them to a separate log server Correct answer.
  2. Keeping logs only on the workstation where events occurred
  3. Disabling time synchronization across servers
  4. Allowing administrators to edit or delete log entries at will

Explanation

Log integrity depends on preventing alteration, which write-once storage or centralized forwarding to a protected server provides. Editable local logs, single-workstation retention, and unsynchronized clocks undermine reliability and evidentiary value.

Question 20Security Fundamentals and Risk Management

A vendor hosts the dispensary's loyalty program and will process customer data. Which document provision most directly addresses the dispensary's third-party risk?

  1. An informal email confirming the vendor's office location
  2. A verbal assurance from the vendor's sales representative
  3. A contract clause requiring the vendor to maintain specified security controls and notify of breaches Correct answer.
  4. A marketing brochure describing the vendor's uptime

Explanation

Third-party risk is managed through enforceable contract terms that specify security obligations and breach notification duties. Verbal assurances, brochures, and informal emails are not enforceable commitments and cannot be audited.

Question 21Security Fundamentals and Risk Management

Which scenario best illustrates the concept of defense in depth at a cannabis retail store?

  1. Using one strong password for every system
  2. Removing alarms because cameras are installed
  3. Relying solely on a single guard at the front door
  4. Layering perimeter fencing, access control, cameras, alarms, and trained staff Correct answer.

Explanation

Defense in depth layers independent controls so that failure of one does not eliminate protection. Single guards, removed alarms, and shared passwords all reduce to a single point of failure.

Question 22Security Fundamentals and Risk Management

An analyst calculates that a threat occurs about twice per year with an average loss of $10,000 per event. What is the annualized loss expectancy?

  1. $20,000 Correct answer.
  2. $2,000
  3. $10,000
  4. $5,000

Explanation

Annualized loss expectancy equals the single loss expectancy multiplied by the annualized rate of occurrence, so $10,000 times two equals $20,000. The other values misapply the formula by dividing, ignoring frequency, or misplacing a decimal.

Question 23Security Fundamentals and Risk Management

A licensee discovers that a cloud backup of customer data is stored in a region not permitted by its data handling obligations. Which characterization of this finding is most accurate?

  1. A compliance gap that also creates legal and reputational risk requiring treatment Correct answer.
  2. A physical security failure unrelated to data handling
  3. A purely cosmetic configuration issue with no risk consequence
  4. An accepted risk because backups are encrypted

Explanation

Storing data outside permitted locations breaches obligations and creates legal, regulatory, and reputational exposure that must be treated. Encryption does not cure a location restriction, and the issue is a data-handling control failure rather than a cosmetic or purely physical one.

Question 24Security Fundamentals and Risk Management

A security team wants to verify that a new access control process actually works before relying on it. Which activity provides the strongest evidence?

  1. Reviewing the written procedure with the author
  2. Asking employees whether they believe the process is effective
  3. Testing the control by attempting unauthorized access under controlled conditions Correct answer.
  4. Filing the procedure in the policy repository

Explanation

Control effectiveness is demonstrated through testing that exercises the control and observes results, such as controlled attempts at unauthorized access. Document review, opinion surveys, and filing show existence, not operational effectiveness.

Question 25Security Fundamentals and Risk Management

A risk register shows a high-severity finding with no assigned owner and no target date. Which governance weakness does this most directly indicate?

  1. Overreliance on quantitative risk analysis
  2. Excessive risk appetite defined by the board
  3. Absence of accountability and remediation tracking for identified risk Correct answer.
  4. Insufficient physical perimeter fencing

Explanation

Findings without an owner or due date cannot be tracked to closure, which signals a breakdown in accountability and remediation governance. The gap is not about appetite definition, analytic method, or a specific physical control.

Question 26Security Fundamentals and Risk Management

Under a standard risk assessment model, which pair of factors is multiplied together to produce a risk score for a specific threat event?

  1. Likelihood of occurrence and magnitude of impact Correct answer.
  2. Threat actor count and audit frequency
  3. Control cost and control maturity
  4. Asset value and number of employees

Explanation

Risk is conventionally expressed as the product of how probable an event is and how severe its consequences would be, so likelihood times impact yields the score used to rank findings. Asset value, control cost, and staffing figures inform the analysis but do not by themselves define the event's risk level.

Question 27Security Fundamentals and Risk Management

A licensee classifies its data so that seed-to-sale records, customer identifiers, and security camera footage are handled differently from public marketing material. Which security objective is this classification scheme primarily designed to support?

  1. Availability of the point-of-sale system during peak hours
  2. Confidentiality by limiting access according to sensitivity Correct answer.
  3. Physical safety of cultivation personnel
  4. Non-repudiation of budtender transactions

Explanation

Data classification assigns sensitivity labels so that handling and access rules can be matched to the value of each data set, which is a confidentiality-driven control. Availability, non-repudiation, and physical safety are separate objectives addressed by other controls such as redundancy, logging, and facility safeguards.

Question 28Security Fundamentals and Risk Management

A compliance analyst is building a risk register and needs to record the level of risk that remains after existing controls have been applied. Which entry should the analyst document?

  1. Residual risk Correct answer.
  2. Inherent risk
  3. Risk transfer
  4. Risk appetite

Explanation

Residual risk is the exposure that persists once current safeguards are accounted for, and it is the figure management formally accepts or remediates. Inherent risk is the exposure before controls, while appetite and transfer describe tolerance and treatment rather than a measured leftover level.

Question 29Security Fundamentals and Risk Management

A cultivation facility's badge system allows any employee with a valid credential to open the vault where harvested product is weighed. A reviewer recommends splitting the vault into two separately controlled compartments so no single credential opens both. Which security principle does this recommendation most directly apply?

  1. Mandatory vacation
  2. Least privilege Correct answer.
  3. Separation of duties
  4. Job rotation

Explanation

Least privilege means each identity receives only the access needed for its role, so restricting a single badge from reaching every compartment limits unnecessary exposure. Separation of duties concerns dividing a transaction among different people, while mandatory vacation and job rotation are fraud-detection practices for staff behavior.

Question 30Security Fundamentals and Risk Management

A licensee's security program relies on a single network firewall between the internet and the seed-to-sale environment, with no segmentation, endpoint monitoring, or independent logging. A consultant argues this design concentrates catastrophic failure in one place. Which concept best describes the weakness the consultant is identifying?

  1. An overinvestment in layered detective controls
  2. A single point of failure that undermines defense in depth Correct answer.
  3. A failure of the principle of least astonishment
  4. An excessive reliance on least privilege enforcement

Explanation

Defense in depth assumes that if one safeguard fails, independent layers still protect the asset, so a lone perimeter firewall creates a single point of failure. The scenario shows too few controls rather than too many, and least privilege concerns access scope, not the absence of redundant layers.

Question 31Network Security and Architecture

In a NICA-defined network architecture, which device is primarily responsible for enforcing security policy between network segments by inspecting traffic flows?

  1. A media converter
  2. A patch panel
  3. A firewall Correct answer.
  4. A Layer 2 access switch

Explanation

A firewall sits at the boundary between segments and enforces policy by inspecting traffic and permitting or denying flows according to rules. Layer 2 switches forward frames within a broadcast domain but do not normally apply security policy between segments.

Question 32Network Security and Architecture

A network engineer needs to place a device that provides deep packet inspection, intrusion prevention, and application awareness inline at the data center edge. Which device class best fits this requirement?

  1. A next-generation firewall Correct answer.
  2. A KVM switch
  3. A DNS forwarder
  4. A load balancer

Explanation

A next-generation firewall combines stateful inspection with intrusion prevention and application-level awareness, which matches the inline inspection requirement. The other devices listed provide traffic distribution, name resolution, or console access rather than security inspection.

Question 33Network Security and Architecture

Which statement correctly describes the security purpose of network segmentation in a data center design?

  1. It guarantees that encrypted traffic cannot be decrypted by an attacker.
  2. It reduces the scope of a compromise by limiting lateral movement between zones. Correct answer.
  3. It removes the need for authentication inside each segment.
  4. It increases the size of broadcast domains to simplify routing tables.

Explanation

Segmentation divides the network into zones with controlled paths between them, so a compromised host cannot freely reach unrelated systems. This containment of lateral movement is the core security benefit, and it must be paired with policy enforcement at zone boundaries.

Question 34Network Security and Architecture

Which protocol provides cryptographic protection for HTTP sessions by encrypting application data in transit?

  1. NTP
  2. DHCP
  3. SNMPv3
  4. TLS Correct answer.

Explanation

TLS establishes an encrypted channel and authenticates the server, protecting application data such as HTTP in transit. The other protocols provide management, time synchronization, or address assignment and do not encrypt arbitrary application sessions.

Question 35Network Security and Architecture

An administrator wants to prevent unauthorized devices from connecting to switch access ports in a data center. Which control directly addresses this requirement?

  1. Jumbo frame support
  2. Link aggregation
  3. Port security with MAC address limits Correct answer.
  4. Spanning Tree Protocol root guard

Explanation

Port security restricts which MAC addresses may appear on an access port and can limit the number of learned addresses, blocking rogue devices. Root guard and link aggregation address topology and bandwidth concerns rather than endpoint admission.

Question 36Network Security and Architecture

What is the primary security function of a demilitarized zone (DMZ) in a network architecture?

  1. To host internal domain controllers with direct internet exposure
  2. To terminate all internal user sessions
  3. To isolate externally reachable services from the internal network Correct answer.
  4. To store offline backups in a physically separate facility

Explanation

A DMZ places internet-facing services on a segment that is separated from internal systems by filtering devices, so a compromise of those services does not grant direct internal access. Internal assets remain behind an additional policy boundary.

Question 37Network Security and Architecture

Which practice most directly reduces the risk of a compromised server being used to attack other internal hosts?

  1. Assigning the server a static IP address
  2. Applying egress filtering at the server's network boundary Correct answer.
  3. Increasing the server's CPU allocation
  4. Enabling jumbo frames on the server's NIC

Explanation

Egress filtering restricts outbound traffic from a host to only the destinations and ports it legitimately needs, which limits its usefulness as an attack launch point. The other options affect performance or addressing and do not constrain malicious outbound traffic.

Question 38Network Security and Architecture

Which element of a zero trust architecture replaces the assumption that a host is trusted because of its network location?

  1. Permanent VPN access for all internal users
  2. Continuous verification of identity and device posture Correct answer.
  3. Implicit trust based on VLAN membership
  4. A flat network with no internal filtering

Explanation

Zero trust removes location-based implicit trust and instead evaluates identity, device health, and context for each request. Access decisions are made per session rather than once per network attachment.

Question 39Network Security and Architecture

A company must allow remote administrators to reach management interfaces without exposing those interfaces to the internet. Which design best satisfies this requirement?

  1. Place management interfaces on the same VLAN as user workstations
  2. Disable logging on management interfaces to reduce noise
  3. Publish the management interfaces on public IP addresses with strong passwords
  4. Require administrators to connect through a hardened jump host inside a protected management zone Correct answer.

Explanation

A hardened jump host in a restricted management zone provides a controlled entry point that can enforce authentication and logging while keeping interfaces off the public internet. Direct public exposure and shared VLANs with users both broaden the attack surface.

Question 40Network Security and Architecture

In a network security architecture, what is the purpose of separating the management plane from the data plane?

  1. To ensure administrative access is not reachable through the same paths as user data Correct answer.
  2. To eliminate the need for out-of-band console access
  3. To allow management traffic to bypass all authentication
  4. To increase throughput by disabling encryption

Explanation

Separating management from data traffic means administrative protocols are carried on dedicated paths and are not exposed to the same exposure as user-facing data flows. This limits the chance that a data-plane compromise yields control of infrastructure devices.

Question 41Network Security and Architecture

An architect is designing east-west controls inside a data center. Which approach best limits lateral movement between application tiers?

  1. Relying only on perimeter firewalls at the internet edge
  2. Connecting all tiers to a single large VLAN for simplicity
  3. Applying host-based and network policy between tiers so only required flows are permitted Correct answer.
  4. Allowing all internal traffic and monitoring it after the fact

Explanation

East-west controls require policy enforcement between internal tiers, using host-based firewalls or microsegmentation so only required application flows pass. Perimeter-only defenses leave internal traffic unrestricted once an attacker is inside.

Question 42Network Security and Architecture

A web application must be published to the internet while its backend database remains unreachable from outside. Which architecture achieves this?

  1. Direct database exposure with IP allowlisting
  2. A reverse proxy in a DMZ that forwards requests to the database directly
  3. A flat network where all servers share one public subnet
  4. A reverse proxy in a DMZ that forwards requests to an application server, which alone can reach the database Correct answer.

Explanation

Placing a reverse proxy in the DMZ and allowing only the application tier to reach the database keeps the data tier off the public path. The proxy terminates external requests while backend policy blocks direct access to the database.

Question 43Network Security and Architecture

Which control best mitigates ARP spoofing on a campus access switch?

  1. Quality of Service marking
  2. Dynamic ARP Inspection with DHCP snooping Correct answer.
  3. Port mirroring to an IDS
  4. Storm control on uplinks

Explanation

Dynamic ARP Inspection validates ARP packets against a trusted binding table built by DHCP snooping, dropping spoofed replies. Port mirroring only observes traffic, and storm control or QoS do not validate ARP bindings.

Question 44Network Security and Architecture

An organization wants to detect malicious traffic without risking disruption to production flows. How should a network intrusion detection sensor be deployed?

  1. Inline in the production path with blocking enabled
  2. Directly on each production server as the default gateway
  3. On a SPAN or TAP port that receives a copy of traffic Correct answer.
  4. Between the core switch and the internet edge as the only router

Explanation

A passive sensor fed by a SPAN or TAP receives copies of traffic and can alert without affecting forwarding. Inline placement with blocking introduces availability risk, which conflicts with the stated requirement to avoid disruption.

Question 45Network Security and Architecture

Which design element provides the strongest protection against a single compromised credential granting broad access to the entire network?

  1. Shared administrator accounts across all devices
  2. Privileged access management with per-user accounts and just-in-time elevation Correct answer.
  3. Network access that trusts any host on the corporate VLAN
  4. A single static password rotated annually

Explanation

Per-user privileged accounts with just-in-time elevation limit standing privileges and create accountability, so one stolen credential does not grant broad persistent access. Shared accounts and annual rotation increase exposure and reduce attribution.

Question 46Network Security and Architecture

A network team observes that a compromised workstation can reach database servers on port 3306 across the data center. Which change most directly addresses this finding?

  1. Increase the database server's memory
  2. Move the workstation to a faster uplink
  3. Add a firewall policy permitting only application servers to reach the database on port 3306 Correct answer.
  4. Enable jumbo frames on the database servers

Explanation

The finding is excessive reachability, so the fix is a policy that permits only the application tier to reach the database on the required port. Performance and capacity changes do not reduce the exposed attack path.

Question 47Network Security and Architecture

What is the security benefit of terminating TLS at a reverse proxy that then re-encrypts traffic to backend servers?

  1. It removes the need for certificates on backend servers entirely
  2. It allows inspection and policy enforcement at the proxy while keeping backend traffic encrypted Correct answer.
  3. It eliminates the need for authentication at the proxy
  4. It guarantees that backend servers cannot be reached from the proxy

Explanation

Terminating and re-encrypting lets the proxy inspect requests, apply policy, and authenticate clients while backend hops remain encrypted. It does not remove backend certificates or proxy authentication requirements.

Question 48Network Security and Architecture

Which statement best explains why defense in depth remains relevant when a strong perimeter firewall is deployed?

  1. A single control may fail or be bypassed, so layered controls provide continued protection Correct answer.
  2. Layered controls eliminate the need for monitoring
  3. Defense in depth removes the need for patching
  4. Perimeter firewalls are always misconfigured by default

Explanation

Defense in depth assumes any single control can fail or be circumvented, so independent layers continue to protect assets. It complements monitoring and patching rather than replacing them.

Question 49Network Security and Architecture

A remote site connects to headquarters over the internet and requires encrypted transport with mutual authentication of both endpoints. Which technology best meets this requirement?

  1. An IPsec VPN with certificate-based authentication on both peers Correct answer.
  2. An unencrypted SNMP management link
  3. A GRE tunnel without encryption
  4. A public DNS zone transfer

Explanation

IPsec provides encrypted transport, and certificate-based authentication on both peers supplies mutual authentication of the endpoints. GRE alone carries traffic without encryption or strong peer authentication.

Question 50Network Security and Architecture

Which monitoring approach best supports detecting unauthorized configuration changes on network devices?

  1. Comparing running configurations against a known baseline on a schedule Correct answer.
  2. Disabling syslog to reduce storage costs
  3. Using only ping checks for availability
  4. Increasing interface bandwidth

Explanation

Baselining configurations and comparing against them reveals unauthorized or accidental changes that could weaken security posture. Availability checks and bandwidth changes do not detect configuration drift.