Pass the IIBA Cybersecurity Analysis IIBA-CCA Questions and answers with ExamsMirror

Multiple sources that can harm an organization’s systems are classified as threats. In cybersecurity risk terminology, a threat is any circumstance, event, actor, or condition with the potential to adversely impact confidentiality, integrity, or availability. Threats can be human (external attackers, insiders, third-party compromises), technical (malware, ransomware campaigns, exploit kits), operational (misconfigurations, weak processes, inadequate monitoring), or environmental (power disruption, natural disasters). This differs from a breach, which is the realized outcome where unauthorized access or disclosure has already occurred. It also differs from hacker, which refers to one type of threat actor rather than the broader category of potential harm. Ransomware is a specific threat type (malware that encrypts data and demands payment), not a general term for multiple sources of harm. Cybersecurity documents commonly pair “threats” with “vulnerabilities” and “controls”: threats exploit vulnerabilities to create risk; controls reduce either the likelihood of exploitation or the impact if exploitation occurs. Identifying “multiple sources which can harm systems” is essentially threat identification—an early and ongoing step in risk management used to inform security architecture, monitoring, and incident preparedness. Therefore, the correct concept is threat.

A cryptographic hash function supports data in transit primarily by providingintegrity assurance. When a sender computes a hash (digest) of a message and the receiver recomputes the hash after receipt, the two digests should match if the message arrived unchanged. If the message is altered in any way while traveling across the network—whether by an attacker, a faulty intermediary device, or transmission errors—the recomputed digest will differ from the original. This difference is the key signal that the messagewas modified in transit, which is what option B expresses. In practical secure-transport designs, hashes are typically combined with a secret key or digital signature so an attacker cannot simply modify the message and generate a new valid digest. Examples include HMAC for message authentication and digital signatures that hash the content and then sign the hash with a private key. These mechanisms provide integrity and, when keyed or signed, also provide authentication and non-repudiation properties.

Option A is more specifically about authentication of origin, which requires a keyed construction such as HMAC or a signature scheme; a plain hash alone cannot prove who sent the message. Option C is incorrect because keys are not “converted” from public to private. Option D relates to confidentiality, which is provided by encryption, not hashing. Therefore, the best answer is B because hashing enables detection of message modification during transit.

An embedded system is a specialized computing system designed to perform a dedicated function as part of a larger device or physical system. Unlike general-purpose computers, embedded systems are built to support a specific mission such as controlling sensors, actuators, communications, or device logic in products like routers, printers, medical devices, vehicles, industrial controllers, and smart appliances. Cybersecurity documentation commonly highlights that embedded systems tend to operate with constrained resources, which may include limited CPU power, memory, storage, and user interface capabilities. These constraints affect both design and security: patching may be harder, logging may be minimal, and security features must be carefully engineered to fit the platform’s limitations.

Option C best matches this characterization by describing a small form factor and limited processing power, which are typical attributes of many embedded devices. While not every embedded system is “small,” the key idea is that it is purpose-built, resource-constrained, and tightly integrated into a larger product.

The other options describe different concepts. A secure underground facility relates to physical site security, not embedded computing. Being hard to remove is about physical installation or tamper resistance, which can apply to many systems but is not what defines “embedded.” Storing cryptographic keys in a tamper-resistant external device describes a hardware security module or secure element use case, not the general definition of an embedded system.

KRIs and KPIs are only useful when they are handled as part of a disciplined measurement lifecycle. Cybersecurity governance guidance emphasizes three essential activities:collect,analyze, andreport. Organizations must firstcollectKRI and KPI data consistently from reliable sources such as vulnerability scanners, SIEM logs, IAM systems, ticketing platforms, and asset inventories. Collection requires defined metric owners, clear definitions, standardized time windows, and data quality checks so results are comparable across periods and business units.

Next, organizationsanalyzethe data to understand what it means for risk and performance. Analysis includes trending over time, comparing results to targets and thresholds, correlating indicators to business outcomes, identifying outliers, and determining root causes. For KRIs, analysis highlights rising exposure or control breakdowns such as increasing critical vulnerabilities beyond SLA. For KPIs, analysis evaluates operational effectiveness such as mean time to detect and mean time to remediate.

Finally, organizationsreportresults to the right audiences with the right level of detail. Reporting supports accountability by assigning actions, tracking remediation progress, and escalating when thresholds are exceeded. It also supports decision making by showing where investment, staffing, or control changes will have the greatest risk-reduction and performance impact. The other options are not standard, auditable metric management activities and do not reflect the established lifecycle used in cybersecurity measurement programs.

Personal information is classified primarily based on the harm that could result fromunauthorized disclosure, which maps directly to theconfidentialityobjective. Cybersecurity and privacy governance frameworks treat personal data as sensitive because exposure can lead to identity theft, fraud, discrimination, personal safety risks, and loss of privacy. Organizations also face regulatory penalties, contractual consequences, and reputational damage when personal data is disclosed without authorization. For this reason, when determining classification, the first and most influential question is typically: “What is the impact if this data becomes known to someone who should not have it?” That impact assessment drives the required protection level and handling rules.

Confidentiality-focused controls then follow from the classification decision, including least privilege and role-based access, strong authentication, encryption at rest and in transit, secure key management, data loss prevention where appropriate, logging and monitoring of access to sensitive records, and strict sharing/transfer procedures.

Integrity and availability matter for personal information, but they are usually secondary in classification decisions. Integrity affects trustworthiness and correctness (for example, incorrect medical or payroll data), and availability affects the ability to access records when needed. However, the defining sensitivity of personal information is that it must not be disclosed improperly. “Accessibility” is not a core security objective used in standard classification models; it is an operational usability concept that is managed through access design after sensitivity is established.

Logging requirements in cybersecurity focus on ensuring the system can produce reliable, actionable records that support detection, investigation, compliance, and accountability. The most fundamental capability is the ability torecord information about user access and actionswithin the system. This includes authentication events such as logon success or failure, logoff, session creation, and privilege elevation; authorization decisions such as access granted or denied; and security-relevant actions such as viewing, creating, modifying, deleting, exporting, or transmitting sensitive data. Good security logging also captures context like timestamp synchronization, user or service identity, source device or IP, target resource, action performed, and outcome.

This capability supports multiple operational needs. Security monitoring teams rely on logs to identify anomalies like repeated failed logins, unusual access times, access from unexpected locations, or high-risk administrative changes. Incident responders need logs to reconstruct timelines, confirm scope, and preserve evidence. Auditors and compliance teams require logs to demonstrate control effectiveness, segregation of duties, and traceability of changes.

The other options are not sufficient to satisfy logging requirements. Single sign-on can simplify authentication but does not guarantee application-level activity logging. Integration with specialized tools may be useful, but the solution must first generate the required events. Deployment model options do not address whether the system can create detailed audit trails. Therefore, the required capability is recording user access and actions in the system.

Multi-factor authentication requires a user to prove identity usingtwo or more different factor types. Cybersecurity standards describe the main factor categories assomething you know(for example, a password or PIN),something you have(for example, a hardware token, smart card, or authenticator app producing a one-time code), andsomething you are(biometrics such as fingerprint, face, or iris). A valid MFA pair must come fromdifferent categories, not just two items from the same category or a mix of authentication with non-authentication concepts.

OptionBis correct because it explicitly combines two distinct factor types: a knowledge factor and an inherence factor. This pairing is widely recognized as MFA because compromising one factor does not automatically compromise the other: an attacker who steals a password still needs the biometric, and spoofing a biometric does not provide the secret knowledge factor.

OptionAis incorrect because “encryption” is not an authentication factor; it is a protection mechanism for confidentiality and integrity of data. OptionDhas the same problem: encryption is not a user factor. OptionCcan represent MFA in many real implementations if “token” is truly a possession factor; however, training materials and exam items often prefer the clearest, unambiguous factor-language pairing, which is why “Something You Know and Something You Are” is the best single answer here.

ARecovery Point Objectivedefines the acceptable amount of data loss measured in time. It answers the question: “After an outage or disruptive event,how far back in time can we restore data and still meet business needs?” If the RPO is 4 hours, the organization is stating it can tolerate losing up to 4 hours of data changes, meaning backups, replication, journaling, or snapshots must be frequent enough to restore to a point no older than 4 hours before the incident. That is exactly what option A describes: the specific point in time prior to the outage to which data must be recovered.

RPO is often paired withRecovery Time Objectivebut they are not the same. RTO focuses onhow quicklyservice must be restored, while RPO focuses onhow much datathe organization can afford to lose. Options B, C, and D all describe time-to-restore concepts, which align with RTO or related recovery targets rather than RPO.

In operational resilience and disaster recovery planning, RPO drives technical design choices: backup frequency, replication methods, storage and retention strategies, and validation testing. Lower RPO values generally require more robust and often more expensive solutions, such as near-real-time replication and strong change capture controls. RPO also influences incident response and recovery procedures to ensure restoration steps reliably meet the agreed data-loss tolerance.

Top of Form

Social engineeringis the broad technique attackers use when they manipulate human psychology—such as trust, fear, urgency, curiosity, sympathy, authority, or the desire to be helpful—to persuade someone to take an action that benefits the attacker. The key idea in the question is “exploit human emotions and connection,” which is the defining characteristic of social engineering. Rather than breaking a system through purely technical means, the attacker targets the person as the easiest path to access, credentials, sensitive information, or physical entry.

Phishing is aspecific subtypeof social engineering that typically uses email, text messages, or fake websites to trick users into clicking links, opening attachments, or entering credentials. Tailgating is another subtype focused onphysical access, where an attacker follows an authorized person into a restricted area by leveraging politeness or social pressure. Malware is malicious software used to compromise systems; it can be delivered through social engineering, but malware itself is not the human-manipulation technique.

Cybersecurity control guidance treats social engineering as a major risk because it can bypass technical protections by causing legitimate users to unintentionally grant access. Common defenses include awareness training, verification procedures (call-back and out-of-band confirmation), least privilege, multi-factor authentication, strong email and web filtering, and clear reporting channels so suspicious requests can be escalated quickly.

Risk mitigation is the risk treatment approach focused onreducing risk to an acceptable levelby lowering either the likelihood of a risk event, the impact of that event, or both. In cybersecurity risk management, mitigation is accomplished by implementingcontrols and countermeasuressuch as technical safeguards, process changes, and administrative measures. Examples include patching vulnerable systems, hardening configurations, enabling multi-factor authentication, applying least privilege, network segmentation, encryption, improved logging and monitoring, secure development practices, and user awareness training. Each of these actions reduces exposure or limits damage if an incident occurs.

The other options describe different risk treatment strategies, not mitigation. Purchasing insurance is generally consideredrisk transfer, where financial impact is shifted to a third party, but the underlying threat and vulnerability may still exist. Eliminating risk by stopping the risky activity isrisk avoidance; it removes the exposure by discontinuing the process, system, or behavior causing the risk. Documenting the risk and preparing a recovery plan aligns more closely withrisk acceptancecombined withcontingency planningor resilience planning; it acknowledges the risk and focuses on recovery rather than reducing the probability of occurrence.

Therefore, the correct definition of risk mitigation is reducing the risk through implementing one or more countermeasures.