I85PREP
⌘ K
DSTC study materials
DSTC study resources

DSTC practice questions

One question at a time. Build your DSTC understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Fundamentals and Threat Landscape

Which security principle states that a user should be granted only the minimum access necessary to perform their job?

  1. Zero trust
  2. Defense in depth
  3. Least privilege Correct answer.
  4. Separation of duties

Explanation

Least privilege limits each account to only the permissions required for its function, reducing the blast radius of misuse or compromise. Separation of duties divides tasks among people, defense in depth layers controls, and zero trust is an architectural stance about verifying every request.

Question 2Security Fundamentals and Threat Landscape

What is the primary purpose of hashing a password before storing it?

  1. To encrypt it with a shared key
  2. To allow the password to be recovered later
  3. To compress the password to a fixed length
  4. To make the stored value irreversible Correct answer.

Explanation

A cryptographic hash is a one-way function, so storing only the digest means an attacker who reads the database cannot directly read the password. Salting and slow hashing further resist guessing and precomputation.

Question 3Security Fundamentals and Threat Landscape

Which type of malware self-replicates across networks without requiring a user to open a file?

  1. Adware
  2. Trojan
  3. Rootkit
  4. Worm Correct answer.

Explanation

A worm spreads autonomously by exploiting reachable services or vulnerabilities, so it does not depend on user interaction. Trojans rely on disguise and user execution, rootkits hide presence, and adware displays advertising.

Question 4Security Fundamentals and Threat Landscape

A user receives an email that appears to come from the IT department asking them to confirm their password via a linked page. Which attack does this illustrate?

  1. Smishing
  2. Tailgating
  3. Phishing Correct answer.
  4. Vishing

Explanation

Phishing is a social-engineering attack delivered by email that impersonates a trusted party to harvest credentials or deliver malware. Smishing uses SMS, vishing uses voice calls, and tailgating is physical entry following an authorized person.

Question 5Security Fundamentals and Threat Landscape

Which control type is a locked door badge reader?

  1. Preventive Correct answer.
  2. Corrective
  3. Compensating
  4. Detective

Explanation

A badge reader stops unauthorized entry before it happens, which makes it preventive. Detective controls identify events after the fact, corrective controls restore state, and compensating controls substitute for a primary control.

Question 6Security Fundamentals and Threat Landscape

What distinguishes a vulnerability from a risk?

  1. A vulnerability is a threat actor, while risk is a control gap
  2. A vulnerability is always exploitable, while risk is only theoretical
  3. A vulnerability is a control, while risk is a policy exception
  4. A vulnerability is a weakness, while risk is the likelihood and impact of that weakness being exploited Correct answer.

Explanation

A vulnerability is a weakness in an asset or control, whereas risk combines the likelihood of a threat exploiting that weakness with the resulting impact. Treating the two as synonyms leads to misprioritized remediation.

Question 7Security Fundamentals and Threat Landscape

Which of the following best describes symmetric encryption?

  1. Keys are exchanged in plaintext by design
  2. A hash is used instead of a key
  3. The same key is used to encrypt and decrypt Correct answer.
  4. A public key encrypts and a private key decrypts

Explanation

Symmetric algorithms use one shared secret key for both encryption and decryption, which makes them fast but requires secure key distribution. Asymmetric cryptography instead uses a key pair.

Question 8Security Fundamentals and Threat Landscape

What is the main security benefit of network segmentation?

  1. It removes the need for authentication
  2. It limits lateral movement between zones Correct answer.
  3. It encrypts all traffic on the network
  4. It guarantees availability of services

Explanation

Segmentation divides a network into zones with controlled paths between them, so a compromise in one zone cannot freely reach others. It complements, rather than replaces, encryption, authentication, and availability controls.

Question 9Security Fundamentals and Threat Landscape

An attacker floods a web server with SYN packets from many spoofed source addresses. Which attack is this?

  1. Distributed denial of service Correct answer.
  2. Cross-site scripting
  3. SQL injection
  4. Privilege escalation

Explanation

A SYN flood from many spoofed sources is a distributed denial-of-service attack that exhausts connection state and bandwidth. Injection and scripting attacks target application input handling, and privilege escalation targets permission boundaries.

Question 10Security Fundamentals and Threat Landscape

A security team wants to detect unauthorized changes to critical system files. Which control best fits?

  1. Password complexity policy
  2. Full-disk encryption
  3. Network access control
  4. File integrity monitoring Correct answer.

Explanation

File integrity monitoring records baseline hashes and alerts when they change, which directly detects tampering. Encryption protects confidentiality, password policy governs credentials, and network access control governs admission to the network.

Question 11Security Fundamentals and Threat Landscape

During an incident, which action should come first for a running server suspected of active compromise, given evidence must be preserved?

  1. Delete suspicious files and continue monitoring
  2. Reimage the server immediately
  3. Reboot the server to clear malicious processes
  4. Isolate the host from the network while capturing volatile data Correct answer.

Explanation

Containment limits further damage, and volatile data such as memory and connections must be captured before power state changes. Reboots, reimaging, and deletion destroy evidence and may not stop the intrusion.

Question 12Security Fundamentals and Threat Landscape

Which authentication factor category does a hardware token generating a time-based code belong to?

  1. Something you have Correct answer.
  2. Something you are
  3. Somewhere you are
  4. Something you know

Explanation

A time-based code generator is a physical possession factor, so it falls under something you have. Knowledge factors are memorized secrets, inherence factors are biometrics, and location is a contextual signal.

Question 13Security Fundamentals and Threat Landscape

A developer hard-codes database credentials in application source code. Which risk is most directly introduced?

  1. Backups will fail
  2. The database will run faster
  3. The application cannot use TLS
  4. Credentials may be exposed to anyone with repository access Correct answer.

Explanation

Secrets in source code are copied into version history and readable by anyone with repository access, so exposure is broad and revocation is difficult. Secrets should be stored in a managed vault and injected at runtime.

Question 14Security Fundamentals and Threat Landscape

Which practice best mitigates credential stuffing against a login service?

  1. Rate limiting and breached-password checks Correct answer.
  2. Requiring password rotation every 30 days
  3. Disabling account lockouts
  4. Increasing password maximum length

Explanation

Credential stuffing replays leaked username and password pairs at scale, so rate limiting and blocking known-breached passwords reduce successful logins. Forced frequent rotation pushes users toward weaker, predictable passwords.

Question 15Security Fundamentals and Threat Landscape

What does a digital signature primarily provide?

  1. Availability of the signing service
  2. Authenticity and integrity of the message Correct answer.
  3. Confidentiality of the message body
  4. Compression of the message

Explanation

A signature over a message digest, verified with the signer's public key, proves who signed and that the content was not altered. Confidentiality requires encryption, and availability or compression are unrelated properties.

Question 16Security Fundamentals and Threat Landscape

An employee plugs an unknown USB drive found in a parking lot into a workstation. Which threat is most directly enabled?

  1. DNS cache poisoning
  2. Removable-media malware introduction Correct answer.
  3. Watering-hole attack
  4. Session fixation

Explanation

Unknown removable media can carry autorun payloads or malicious documents that execute on insertion or opening, introducing malware directly to the host. The other options are network or web-session attacks.

Question 17Security Fundamentals and Threat Landscape

Which of the following is an example of a technical detective control?

  1. A backup restoration procedure
  2. A signed acceptable-use policy
  3. Security awareness training
  4. Intrusion detection system alerts Correct answer.

Explanation

An intrusion detection system observes activity and raises alerts about suspicious events, which makes it a technical detective control. Training and policy are administrative, and restoration is corrective.

Question 18Security Fundamentals and Threat Landscape

What is the main purpose of a DMZ in a network architecture?

  1. To host internet-facing services while shielding the internal network Correct answer.
  2. To provide physical security for the data center
  3. To replace firewalls with routing rules
  4. To store backups offline

Explanation

A DMZ is a buffer zone for externally reachable services, so a compromise there does not grant direct access to internal systems. It supplements firewalls and does not address physical security or backup storage.

Question 19Security Fundamentals and Threat Landscape

An attacker manipulates a hidden form field to change the price of an item at checkout. Which weakness is being exploited?

  1. Insufficient logging
  2. Missing input validation and trust in client-side data Correct answer.
  3. Improper error handling
  4. Weak TLS cipher suites

Explanation

Prices and other security-relevant values must be validated and determined server-side, because clients can alter any data they submit. Trusting client-supplied fields lets users change values that should be authoritative.

Question 20Security Fundamentals and Threat Landscape

Which activity is characteristic of an advanced persistent threat rather than opportunistic crimeware?

  1. Immediate ransomware extortion of many victims
  2. Defacement of public websites for notoriety
  3. Long-term stealthy access with specific objectives Correct answer.
  4. Broad untargeted spam campaigns

Explanation

An APT is a well-resourced actor that maintains stealthy, long-duration access to pursue specific intelligence or disruption goals. Opportunistic crimeware favors broad, fast monetization or visible vandalism.

Question 21Security Fundamentals and Threat Landscape

Which vulnerability is most likely present when an application builds a database query by concatenating user input?

  1. Insecure deserialization
  2. Open redirect
  3. SQL injection Correct answer.
  4. Cross-site request forgery

Explanation

Concatenating input into a query lets the input change the query's structure, which is SQL injection. Parameterized queries keep data separate from code and prevent it.

Question 22Security Fundamentals and Threat Landscape

A user's session cookie is sent over plain HTTP and is captured on a shared network. Which control most directly prevents this exposure?

  1. Setting the Secure attribute and enforcing HTTPS Correct answer.
  2. Adding a CAPTCHA to login
  3. Rotating the cookie name periodically
  4. Shortening the session timeout

Explanation

The Secure attribute keeps cookies off unencrypted channels, and enforcing HTTPS encrypts the traffic so a passive eavesdropper cannot read the cookie. Timeouts and CAPTCHAs do not stop interception in transit.

Question 23Security Fundamentals and Threat Landscape

An organization must choose between accepting, transferring, mitigating, or avoiding a risk. Which response is chosen when a low-impact risk is documented and monitored because treatment cost exceeds the loss?

  1. Risk mitigation
  2. Risk avoidance
  3. Risk transfer
  4. Risk acceptance Correct answer.

Explanation

Acceptance is a deliberate decision to retain a risk, typically when treatment cost outweighs the potential loss, with documentation and monitoring. Avoidance eliminates the activity, transfer shifts the financial impact, and mitigation reduces likelihood or impact.

Question 24Security Fundamentals and Threat Landscape

An attacker with limited access on a host uses a kernel flaw to obtain administrative rights. This best illustrates which stage of an attack?

  1. Reconnaissance
  2. Privilege escalation Correct answer.
  3. Exfiltration
  4. Command and control

Explanation

Privilege escalation moves an attacker from lower to higher permissions on a system. Reconnaissance gathers information, exfiltration removes data, and command and control maintains remote communication.

Question 25Security Fundamentals and Threat Landscape

A web application reflects unescaped user input into the HTML response. Which consequence is most direct?

  1. Server-side request forgery to internal hosts
  2. Directory traversal of the file system
  3. Deserialization of untrusted objects
  4. Reflected cross-site scripting in the victim's browser Correct answer.

Explanation

Unescaped reflected input is interpreted as markup or script in the victim's browser, enabling reflected XSS to run in that user's context. SSRF, traversal, and deserialization involve different mechanisms and inputs.

Question 26Security Fundamentals and Threat Landscape

Which concept describes the principle that a user should be granted only the permissions necessary to perform their job and no more?

  1. Defense in depth
  2. Separation of duties
  3. Zero trust
  4. Least privilege Correct answer.

Explanation

Least privilege limits access rights to the minimum required for a task, reducing the potential damage from accidents or malicious actions. Separation of duties divides critical tasks among multiple people, defense in depth layers controls, and zero trust assumes no implicit trust based on network location.

Question 27Security Fundamentals and Threat Landscape

Which security control is designed to prevent an attacker from reading data by observing the electromagnetic emissions of a monitor?

  1. Faraday cage for network cables
  2. TEMPEST shielding Correct answer.
  3. Screen privacy filter
  4. EMI filtering on power lines

Explanation

TEMPEST refers to standards and techniques for preventing electromagnetic eavesdropping on devices such as monitors. A Faraday cage for cables, EMI filtering, and privacy filters address different concerns and do not specifically prevent emission-based data theft.

Question 28Security Fundamentals and Threat Landscape

An attacker sends an email that appears to come from the CEO to the finance department, requesting an urgent wire transfer. Which type of attack is this?

  1. Whaling
  2. Phishing
  3. Business email compromise Correct answer.
  4. Spear phishing

Explanation

Business email compromise (BEC) specifically involves impersonating an executive or trusted partner to trick employees into transferring funds or data. Phishing is a broader term, spear phishing targets specific individuals, and whaling targets high-level executives as victims.

Question 29Security Fundamentals and Threat Landscape

Which type of malware is designed to encrypt files and demand payment for the decryption key?

  1. Trojan
  2. Worm
  3. Rootkit
  4. Ransomware Correct answer.

Explanation

Ransomware encrypts data and holds it hostage until a ransom is paid. Trojans disguise themselves as legitimate software, worms self-propagate across networks, and rootkits hide malicious activity.

Question 30Security Fundamentals and Threat Landscape

In a public key infrastructure, which entity is responsible for issuing and revoking digital certificates?

  1. Relying party
  2. Certificate authority Correct answer.
  3. Registration authority
  4. Validation authority

Explanation

The certificate authority (CA) signs and issues certificates and manages revocation. A registration authority verifies identity before issuance, a relying party trusts the certificate, and a validation authority checks revocation status.

Question 31Security Fundamentals and Threat Landscape

Which protocol is used to securely transfer files over an encrypted channel and is often preferred over FTP for sensitive data?

  1. FTP
  2. SCP
  3. SFTP Correct answer.
  4. TFTP

Explanation

SFTP (SSH File Transfer Protocol) provides secure file transfer over an encrypted SSH session. TFTP and FTP are unencrypted, and SCP is also secure but is a simpler file copy protocol; SFTP is the standard secure file transfer protocol.

Question 32Security Fundamentals and Threat Landscape

An attacker uses a tool to systematically try common passwords against many user accounts on a website. Which attack is this?

  1. Credential stuffing
  2. Dictionary attack
  3. Brute force
  4. Password spraying Correct answer.

Explanation

Password spraying tries a few common passwords across many accounts to avoid lockouts. Brute force tries many passwords per account, credential stuffing uses leaked credentials, and a dictionary attack uses a list of words against one account.

Question 33Security Fundamentals and Threat Landscape

Which type of access control model uses labels such as 'Secret' and 'Top Secret' and prohibits users from accessing data unless they have the appropriate clearance?

  1. Discretionary access control
  2. Role-based access control
  3. Mandatory access control Correct answer.
  4. Attribute-based access control

Explanation

Mandatory access control (MAC) enforces access based on security labels and clearances. Discretionary access control lets owners set permissions, role-based access control uses roles, and attribute-based access control uses attributes.

Question 34Security Fundamentals and Threat Landscape

A security analyst observes repeated failed logins from a single IP address followed by a successful login. Which type of attack is most likely indicated?

  1. Brute force Correct answer.
  2. Phishing
  3. Cross-site scripting
  4. SQL injection

Explanation

Repeated failed logins from one source suggest a brute-force password guessing attack. Phishing is a social engineering attack, SQL injection targets databases, and cross-site scripting targets web applications.

Question 35Security Fundamentals and Threat Landscape

Which security principle states that a system should fail securely, denying access by default when an error occurs?

  1. Fail-safe defaults Correct answer.
  2. Least common mechanism
  3. Psychological acceptability
  4. Open design

Explanation

Fail-safe defaults dictate that access should be denied unless explicitly allowed, and systems should fail closed. Least common mechanism minimizes shared resources, open design means security does not depend on secrecy of design, and psychological acceptability concerns usability.

Question 36Security Fundamentals and Threat Landscape

Which type of firewall tracks the state of active connections and allows return traffic automatically?

  1. Proxy firewall
  2. Packet-filtering firewall
  3. Next-generation firewall
  4. Stateful firewall Correct answer.

Explanation

A stateful firewall maintains a state table for connections and permits return traffic for established sessions. Packet-filtering firewalls examine each packet in isolation, proxy firewalls mediate connections at the application layer, and next-generation firewalls add features like intrusion prevention but are not defined by state tracking alone.

Question 37Security Fundamentals and Threat Landscape

An attacker intercepts communication between two parties and relays messages without their knowledge. Which type of attack is this?

  1. Replay
  2. Denial-of-service
  3. Man-in-the-middle Correct answer.
  4. Session hijacking

Explanation

A man-in-the-middle attack involves an attacker secretly relaying and possibly altering communications between two parties. Denial-of-service disrupts availability, replay reuses captured data, and session hijacking takes over an existing session.

Question 38Security Fundamentals and Threat Landscape

Which security control is best suited to detect an intrusion attempt by monitoring network traffic for known attack patterns?

  1. Antivirus software
  2. Host-based firewall
  3. Security information and event management
  4. Network-based intrusion detection system Correct answer.

Explanation

A network-based intrusion detection system (NIDS) inspects network traffic for signatures of known attacks. Host-based firewalls filter traffic on a single host, antivirus scans files, and SIEM aggregates logs but does not directly monitor traffic patterns.

Question 39Security Fundamentals and Threat Landscape

Which type of cryptographic attack exploits the mathematical structure of the algorithm to find weaknesses?

  1. Brute force
  2. Rainbow table
  3. Cryptanalysis Correct answer.
  4. Side-channel

Explanation

Cryptanalysis involves analyzing the algorithm to find weaknesses. Brute force tries all keys, rainbow tables precompute hashes, and side-channel attacks exploit physical implementation leaks.

Question 40Security Fundamentals and Threat Landscape

An organization wants to ensure that a former employee cannot access the building after termination. Which control is most directly appropriate?

  1. Implementing full-disk encryption
  2. Enforcing password complexity
  3. Revoking physical access credentials Correct answer.
  4. Changing network firewall rules

Explanation

Revoking physical access credentials such as badges or keys directly prevents the former employee from entering the building. Firewall rules, encryption, and password policies address logical access, not physical entry.

Question 41Network Security and Architecture

Which OSI layer is responsible for logical addressing and path selection between networks?

  1. Network layer Correct answer.
  2. Session layer
  3. Data link layer
  4. Transport layer

Explanation

The network layer handles logical addressing (such as IP addresses) and routing decisions that move packets between different networks. The data link layer deals with physical addressing on a local segment, while the transport layer manages end-to-end delivery.

Question 42Network Security and Architecture

What is the primary function of a DMZ in a network architecture?

  1. To aggregate VLAN traffic from access switches
  2. To encrypt all internal traffic between servers
  3. To provide backup routing for the core network
  4. To isolate publicly accessible services from the internal network Correct answer.

Explanation

A DMZ is a segmented zone that hosts internet-facing services while limiting direct access to the internal network if those services are compromised. It reduces the blast radius of an attack by placing a controlled boundary between external and internal systems.

Question 43Network Security and Architecture

Which protocol translates domain names into IP addresses?

  1. DHCP
  2. DNS Correct answer.
  3. NTP
  4. ARP

Explanation

DNS resolves human-readable hostnames to IP addresses. DHCP assigns addresses, ARP maps IP addresses to MAC addresses on a local segment, and NTP synchronizes time.

Question 44Network Security and Architecture

A security engineer wants to prevent users on the guest wireless network from reaching internal file servers while still allowing internet access. Which control best achieves this?

  1. Deploy WPA3 encryption on the guest SSID
  2. Place guest traffic in a separate VLAN with ACLs to internal subnets Correct answer.
  3. Enable port security on access ports
  4. Enable DHCP snooping on the guest VLAN

Explanation

Segmenting guest traffic into its own VLAN and applying ACLs that block internal subnets enforces the intended isolation while permitting internet-bound traffic. Encryption and port security address different threats and do not by themselves prevent reachability to internal hosts.

Question 45Network Security and Architecture

Which characteristic distinguishes a stateful firewall from a stateless packet filter?

  1. It operates only at the application layer
  2. It inspects the payload of every packet for malware
  3. It requires encryption of all traffic
  4. It tracks active connections to evaluate return traffic Correct answer.

Explanation

A stateful firewall maintains a connection table so return traffic for an established session is permitted without broad inbound rules. A stateless filter evaluates each packet independently against static rules.

Question 46Network Security and Architecture

Which address range is reserved for private use under RFC 1918?

  1. 192.0.2.0/24
  2. 169.254.0.0/16
  3. 172.16.0.0/12 Correct answer.
  4. 198.51.100.0/24

Explanation

RFC 1918 defines 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 as private address space. The other ranges shown serve documentation and link-local purposes.

Question 47Network Security and Architecture

What is the purpose of Network Address Translation (NAT) at an internet edge?

  1. To provide redundant default gateways
  2. To map private addresses to a public address for outbound connectivity Correct answer.
  3. To authenticate users before granting internet access
  4. To encrypt traffic between remote sites

Explanation

NAT rewrites private source addresses to a routable public address, allowing many internal hosts to share limited public IPs. It is not an encryption, authentication, or redundancy mechanism.

Question 48Network Security and Architecture

An organization wants to detect and block known malicious traffic patterns at the network perimeter without decrypting TLS. Which technology is most appropriate?

  1. Security information and event management
  2. Host-based antivirus
  3. Network intrusion prevention system with signature matching Correct answer.
  4. Full-disk encryption

Explanation

A network IPS with signature matching inspects traffic flows and can drop sessions that match known-bad patterns. It can do this for unencrypted traffic and for metadata of encrypted flows without terminating TLS.

Question 49Network Security and Architecture

Which protocol provides confidentiality and integrity for IP traffic in a site-to-site VPN?

  1. IPsec Correct answer.
  2. LLDP
  3. SNMPv3
  4. RADIUS

Explanation

IPsec uses ESP and related mechanisms to provide confidentiality, integrity, and authentication for IP packets, making it the standard for site-to-site VPNs. The other protocols serve management, authentication, or discovery functions.

Question 50Network Security and Architecture

A company needs to give remote employees access to internal applications without exposing those applications directly to the internet. Which architecture best fits?

  1. Move applications to the DMZ with no authentication
  2. Publish each application server with a public IP
  3. Open the firewall to all inbound traffic from the internet
  4. Deploy a remote-access VPN terminating in the internal network Correct answer.

Explanation

A remote-access VPN creates an authenticated encrypted tunnel so users reach internal applications without public exposure. Publishing servers directly or broadly opening the firewall increases attack surface.