I85PREP
⌘ K
CCNA Cybersecurity (200-201 CCNACBR) study materials
CCNA Cybersecurity (200-201 CCNACBR) study resources

CCNA Cybersecurity (200-201 CCNACBR) practice questions

One question at a time. Build your CCNA Cybersecurity (200-201 CCNACBR) understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Concepts

A security team wants to reduce the attack surface on a public-facing web server by removing unnecessary services. Which concept best describes this practice?

  1. System hardening Correct answer.
  2. Patch regression testing
  3. Incident response
  4. Threat hunting

Explanation

System hardening reduces the exposed attack surface by disabling unused services, closing unused ports, and applying secure configuration baselines. Incident response and threat hunting are detection and reaction activities, not preventive configuration reduction.

Question 2Security Concepts

Which security principle states that a user should be granted only the access required to perform their job and nothing more?

  1. Least privilege Correct answer.
  2. Separation of duties
  3. Defense in depth
  4. Zero trust

Explanation

Least privilege limits rights to the minimum necessary for the assigned tasks, reducing the impact of a compromised account. Separation of duties instead splits critical tasks among multiple people, while defense in depth layers controls.

Question 3Security Concepts

An organization classifies data so that only employees in the finance department can view payroll records. Which data protection goal is being enforced?

  1. Confidentiality Correct answer.
  2. Non-repudiation
  3. Integrity
  4. Availability

Explanation

Confidentiality ensures data is disclosed only to authorized parties, which is exactly what restricting payroll records to finance staff accomplishes. Integrity concerns unauthorized modification, and availability concerns timely access.

Question 4Security Concepts

Which term describes a weakness in software, configuration, or process that could be exploited by a threat actor?

  1. Vulnerability Correct answer.
  2. Exploit
  3. Risk
  4. Threat

Explanation

A vulnerability is the weakness itself, while a threat is a potential actor or event that could exploit it. Risk combines the likelihood and impact of a threat exploiting a vulnerability.

Question 5Security Concepts

Which control type is a badge reader that restricts entry to a data center?

  1. Compensating logical control
  2. Preventive physical control Correct answer.
  3. Detective technical control
  4. Corrective administrative control

Explanation

A badge reader stops unauthorized people from entering, so it is preventive, and it acts on physical access. Detective controls only record or reveal events after they occur.

Question 6Security Concepts

Which term describes a piece of malicious software that self-replicates across networks without requiring a host file or user action?

  1. Worm Correct answer.
  2. Rootkit
  3. Trojan
  4. Adware

Explanation

A worm propagates automatically across networks by exploiting reachable services, without needing a host program or user interaction. A Trojan instead relies on disguise and user execution.

Question 7Security Concepts

Which document defines the acceptable use of company assets, email, and internet access for employees?

  1. Acceptable use policy Correct answer.
  2. Disaster recovery plan
  3. Business impact analysis
  4. Service level agreement

Explanation

An acceptable use policy states what employees may and may not do with organizational systems and data. A business impact analysis and disaster recovery plan instead address continuity and recovery.

Question 8Security Concepts

Which authentication factor category is represented by a fingerprint scan?

  1. Something you have
  2. Somewhere you are
  3. Something you are Correct answer.
  4. Something you know

Explanation

Biometric traits such as fingerprints, iris patterns, and voiceprints are inherent to the person, so they fall under something you are. A token or smart card would be something you have.

Question 9Security Concepts

An attacker sends emails that appear to come from the CEO and ask the finance team to wire funds urgently. Which attack is this?

  1. SQL injection
  2. Business email compromise Correct answer.
  3. On-path attack
  4. Cross-site scripting

Explanation

Business email compromise uses spoofed or compromised executive accounts to trick staff into transferring money or data. It relies on social engineering rather than code injection flaws.

Question 10Security Concepts

A user reports that their browser shows a certificate warning for the corporate intranet site, and the certificate issuer is not the internal certificate authority. What is the most appropriate first interpretation?

  1. The server has been decommissioned
  2. The site is simply using HTTP instead of HTTPS
  3. The browser version is too old to display certificates
  4. The certificate may be untrusted or replaced, indicating possible interception Correct answer.

Explanation

A certificate issued by an unexpected authority is a classic sign of interception or misconfiguration, so the warning should be treated as a possible man-in-the-middle condition until verified. Decommissioning or browser age would not produce an unexpected issuer.

Question 11Security Concepts

Which exploit technique relies on tricking a user into clicking a link that contains a crafted script payload reflected by the web application?

  1. Command injection
  2. Directory traversal
  3. Reflected cross-site scripting Correct answer.
  4. Session fixation

Explanation

Reflected cross-site scripting returns attacker-supplied script through the application response so it executes in the victim's browser. The payload is delivered to the victim via a crafted link rather than stored on the server.

Question 12Security Concepts

Which measure most directly mitigates the impact of a stolen password by requiring a second, independent factor at login?

  1. Account lockout threshold
  2. Password history enforcement
  3. Password complexity policy
  4. Multifactor authentication Correct answer.

Explanation

Multifactor authentication requires an additional independent factor, so a stolen password alone is insufficient to authenticate. Complexity and history policies only make the password harder to guess or reuse.

Question 13Security Concepts

A company wants to verify that a downloaded firmware image came from the vendor and was not altered in transit. Which combination of mechanisms provides this assurance?

  1. Encryption only
  2. Hashing only
  3. Digital signature with hash verification Correct answer.
  4. Compression with checksum

Explanation

A digital signature verifies the signer's identity and, combined with a hash of the image, detects any modification. A hash alone proves integrity only if the reference hash is trusted and authentic.

Question 14Security Concepts

An analyst observes a host resolving many algorithmically generated domain names in rapid succession. Which malware behavior does this most likely indicate?

  1. Domain generation algorithm beaconing Correct answer.
  2. Privilege escalation
  3. Credential dumping
  4. Ransomware encryption

Explanation

Domain generation algorithms produce large numbers of pseudo-random domains so malware can locate its command-and-control server despite takedowns. Ransomware encryption and credential dumping do not require mass domain resolution.

Question 15Security Concepts

Which attack involves an adversary inserting themselves between a client and a server to read or modify traffic?

  1. Smurf attack
  2. VLAN hopping
  3. On-path attack Correct answer.
  4. Ping flood

Explanation

An on-path attack places the adversary in the communication path so traffic can be captured or altered. Smurf and ping floods are volumetric denial-of-service techniques.

Question 16Security Concepts

Which security model enforces access decisions based on the sensitivity labels of objects and the clearance of subjects?

  1. Mandatory access control Correct answer.
  2. Discretionary access control
  3. Role-based access control
  4. Attribute-based access control

Explanation

Mandatory access control compares classification labels on objects with clearances held by subjects, and the owner cannot override the policy. Discretionary access control instead lets owners set permissions.

Question 17Security Concepts

A phishing simulation shows that several employees entered credentials on a fake login page. Which control best limits the damage if those credentials were real?

  1. Blocking all external email attachments
  2. Increasing password length requirements
  3. Deploying multifactor authentication Correct answer.
  4. Disabling browser autofill

Explanation

Multifactor authentication prevents an attacker who captured only the password from completing a login. Longer passwords and attachment blocking do not neutralize credentials already disclosed to a phishing site.

Question 18Security Concepts

Which statement best distinguishes a vulnerability from a risk?

  1. A vulnerability is a control, while risk is the policy that governs it
  2. A vulnerability and a risk are the same thing measured in different units
  3. A vulnerability is a weakness, while risk is the potential for loss when a threat exploits it Correct answer.
  4. A vulnerability is an attacker, while risk is the weakness being targeted

Explanation

A vulnerability is an identifiable weakness, whereas risk expresses the likelihood and impact of that weakness being exploited. The two are related but not interchangeable, and risk assessment weighs both.

Question 19Security Concepts

A hospital must ensure patient records remain readable during a ransomware outbreak on other systems. Which property is the primary concern?

  1. Confidentiality
  2. Availability Correct answer.
  3. Non-repudiation
  4. Integrity

Explanation

Availability ensures authorized users can access data when needed, which is the immediate concern when ransomware threatens access to records. Integrity and confidentiality matter too, but the scenario describes continued access.

Question 20Security Concepts

An organization segments its network so that a compromised workstation cannot reach the database subnet directly. Which security principle does this best illustrate?

  1. Separation of duties
  2. Defense in depth Correct answer.
  3. Implicit deny
  4. Least functionality

Explanation

Defense in depth layers controls so that a failure or compromise at one layer does not expose critical assets. Segmentation adds an internal boundary beyond the perimeter, limiting lateral movement.

Question 21Security Concepts

An analyst reviews logs and finds repeated failed logins from a single external IP against many usernames, followed by one success. Which activity is most consistent with this pattern?

  1. Spear phishing
  2. Shoulder surfing
  3. Password spraying Correct answer.
  4. Watering hole attack

Explanation

Password spraying tries a small set of common passwords across many accounts to avoid lockout thresholds, which matches many usernames failing from one source. Spear phishing targets specific individuals with tailored messages.

Question 22Security Concepts

Which sequence correctly reflects the phases of the NIST incident response lifecycle?

  1. Detection, preparation, recovery, eradication, analysis
  2. Preparation, detection and analysis, containment eradication and recovery, post-incident activity Correct answer.
  3. Containment, preparation, detection, eradication, recovery
  4. Preparation, containment, detection, recovery, eradication

Explanation

The NIST lifecycle begins with preparation, moves to detection and analysis, then containment, eradication, and recovery, and ends with post-incident activity. Lessons learned from the final phase feed back into preparation.

Question 23Security Concepts

A security engineer must choose between two controls: one costs 50,000 and reduces expected annual loss from 400,000 to 250,000, the other costs 20,000 and reduces expected annual loss from 400,000 to 330,000. Which statement is most accurate?

  1. The second control has the better return because it saves more per unit of cost Correct answer.
  2. Neither control is justified because residual risk remains
  3. The first control has the better return because it reduces loss the most
  4. Both controls have identical return on investment

Explanation

The first control reduces expected loss by 150,000 at a cost of 50,000, a three-to-one return. The second reduces loss by 70,000 at a cost of 20,000, a 3.5-to-one return, so it delivers more benefit per unit of cost.

Question 24Security Concepts

A web application reflects user input into an HTML page without encoding, and an attacker crafts a URL that executes script in a victim's browser session. Which mitigation most directly addresses the root cause?

  1. Rate limiting login attempts
  2. Rotating TLS certificates
  3. Output encoding of untrusted data Correct answer.
  4. Enabling HSTS

Explanation

Output encoding neutralizes script by converting special characters into inert entities before the response is rendered. Rate limiting and HSTS address different threats and do not stop reflected script execution.

Question 25Security Concepts

An attacker with local administrator rights on one host uses stolen domain credentials to move laterally to a domain controller. Which control most directly limits this escalation path?

  1. Password complexity on local accounts
  2. Antivirus signature updates
  3. Disabling USB ports
  4. Tiered administrative accounts with separate credentials per tier Correct answer.

Explanation

Tiered administration prevents high-privilege domain credentials from being used on or exposed to lower-trust systems, breaking the path from workstation admin to domain control. Complexity rules and endpoint antivirus do not segregate credential tiers.

Question 26Security Concepts

Which concept describes the assurance that data has not been changed, whether in transit or at rest?

  1. Confidentiality
  2. Availability
  3. Integrity Correct answer.
  4. Non-repudiation

Explanation

Integrity guarantees that data remains accurate and complete and has not been altered by unauthorized parties. Hashing and digital signatures are common mechanisms used to detect modification. The other options describe different pillars of the CIA triad or a related property.

Question 27Security Concepts

Which type of threat actor is typically characterized by high resources, long-term persistence, and motivation tied to a nation-state agenda?

  1. Hacktivist
  2. Script kiddie
  3. Insider
  4. Advanced persistent threat Correct answer.

Explanation

An advanced persistent threat (APT) is a well-resourced actor, often state-sponsored, that maintains stealthy long-term access to a target. Its goals are usually strategic rather than opportunistic. Other actor types lack the combination of funding, patience, and sophistication.

Question 28Security Concepts

Which term describes the practice of collecting and correlating threat data from multiple sources to inform defensive decisions?

  1. Threat intelligence Correct answer.
  2. Vulnerability scanning
  3. Penetration testing
  4. Configuration management

Explanation

Threat intelligence is evidence-based knowledge about existing or emerging threats, gathered from internal and external sources and used to guide security decisions. It differs from scanning or testing, which actively probe systems. Its value comes from correlation and context, not raw data alone.

Question 29Security Concepts

Which control type is a security awareness training program that teaches employees to recognize phishing emails?

  1. Detective
  2. Preventive Correct answer.
  3. Compensating
  4. Corrective

Explanation

Awareness training is preventive because it reduces the likelihood that users will fall for an attack before it occurs. Detective controls identify events after they happen, and corrective controls restore systems afterward. Training aims to stop the incident from occurring at all.

Question 30Security Concepts

An organization wants to protect data at rest on a stolen laptop so that the disk cannot be read without the proper key. Which control best meets this requirement?

  1. Data loss prevention
  2. Host-based firewall
  3. Full-disk encryption Correct answer.
  4. File integrity monitoring

Explanation

Full-disk encryption renders stored data unreadable without the decryption key, protecting against physical theft of the device. Integrity monitoring and firewalls do not protect data on a device that is out of the organization's control. DLP focuses on preventing data exfiltration, not on encrypting the disk.

Question 31Security Concepts

Which identity concept grants users only the permissions required to perform their job duties and nothing more?

  1. Mandatory vacation
  2. Least privilege Correct answer.
  3. Separation of duties
  4. Job rotation

Explanation

Least privilege limits each account to the minimum access needed to complete assigned tasks, reducing the blast radius of a compromised account. Separation of duties splits critical tasks among multiple people. Job rotation and mandatory vacation are fraud-detection practices, not access-limiting principles.

Question 32Security Concepts

A user receives a text message claiming to be from a bank and asking them to confirm account details via a link. Which attack does this describe?

  1. Pharming
  2. Vishing
  3. Smishing Correct answer.
  4. Tailgating

Explanation

Smishing is phishing conducted through SMS or text messaging, often using a link to a fraudulent site. Vishing uses voice calls, and pharming redirects users through DNS manipulation. Tailgating is a physical intrusion technique.

Question 33Security Concepts

An analyst needs a control that detects unauthorized changes to critical operating system files on a server. Which control best fits?

  1. Security awareness training
  2. File integrity monitoring Correct answer.
  3. Antivirus signature updates
  4. Network access control

Explanation

File integrity monitoring baselines critical files and alerts when their hashes or contents change, which is exactly the detection of unauthorized modification. Antivirus updates improve malware detection but do not verify system file integrity. NAC and training address different risks.

Question 34Security Concepts

Which element of risk analysis represents the likelihood that a threat will exploit a vulnerability?

  1. Exposure factor
  2. Probability Correct answer.
  3. Impact
  4. Asset value

Explanation

Risk is commonly expressed as the combination of the probability that a threat event occurs and the impact if it does. Probability captures the likelihood of exploitation. Impact describes the magnitude of loss, exposure factor is the percentage of an asset lost, and asset value is the worth of the asset.

Question 35Security Concepts

A security team must prove that a specific user performed a transaction and cannot later deny it. Which mechanism provides this assurance?

  1. Symmetric encryption
  2. Access control list
  3. Digital signature Correct answer.
  4. Hashing alone

Explanation

A digital signature binds the signer's private key to the message, so the signer cannot credibly deny having signed it. This provides non-repudiation plus integrity and authenticity. Symmetric encryption and hashing alone do not establish who performed an action.

Question 36Security Concepts

An organization classifies data as public, internal, confidential, and restricted. Which action best reflects proper handling of restricted data?

  1. Storing it only in approved encrypted repositories with logged access Correct answer.
  2. Backing it up to a personal cloud account for convenience
  3. Posting it to the internal collaboration site for transparency
  4. Emailing it to any employee who requests it

Explanation

Restricted data requires the strictest handling, including encryption, limited access, and auditing. Approved repositories with access logging support both confidentiality and accountability. Broad distribution or personal storage would violate the classification's handling requirements.

Question 37Security Concepts

Which security principle states that a subject should not be granted access based on possession of information alone but must prove identity through multiple independent means?

  1. Defense in depth
  2. Multifactor authentication Correct answer.
  3. Single sign-on
  4. Implicit deny

Explanation

Multifactor authentication requires two or more independent factor categories, such as something you know plus something you have. Possession of a password alone is a single factor and can be stolen. Defense in depth and implicit deny are broader architectural principles.

Question 38Security Concepts

A SOC analyst receives an alert showing a workstation contacting a known command-and-control IP address. Which action should the analyst take first according to typical incident response practice?

  1. Notify the media about the breach
  2. Immediately reimage the workstation without further review
  3. Validate and scope the alert by reviewing related logs and endpoint data Correct answer.
  4. Disable logging to reduce noise

Explanation

Before acting, the analyst should validate the alert and determine scope so that containment decisions are based on evidence. Reimaging destroys forensic data, and public disclosure or disabling logging would harm the investigation. Confirmation precedes containment and eradication.

Question 39Security Concepts

An attacker exploits a vulnerability that has been publicly disclosed but for which no vendor patch exists. Which mitigation strategy best reduces exposure?

  1. Waiting for the next scheduled patch cycle
  2. Removing antivirus to improve performance
  3. Applying a virtual patch at the network or host layer Correct answer.
  4. Increasing password length for all users

Explanation

When no vendor fix exists, a virtual patch such as a WAF rule, IPS signature, or configuration change can block the exploit path. Waiting leaves the system exposed indefinitely. Unrelated controls such as password length do not address the code flaw.

Question 40Security Concepts

A company must choose between accepting a residual risk and purchasing cyber insurance. Which statement best describes the role of risk transference?

  1. It shifts the financial consequence of a risk to a third party while the risk event can still occur Correct answer.
  2. It avoids the risk by ceasing the activity that creates it
  3. It reduces the likelihood of the threat by adding preventive controls
  4. It eliminates the risk entirely by removing the vulnerable asset

Explanation

Risk transference moves the financial impact to another party, typically through insurance or contracts, but the underlying event can still happen. Elimination, avoidance, and mitigation are distinct strategies. Transfer does not remove the vulnerability or the threat.

Question 41Security Monitoring

An analyst is reviewing a packet capture and needs to identify the protocol used to centrally export flow records from a router to a collector. Which technology matches this requirement?

  1. SNMP trap
  2. NetFlow Correct answer.
  3. Syslog
  4. SPAN session

Explanation

NetFlow is a Cisco flow-export technology in which a router or switch summarizes traffic into flow records and sends them to a collector for analysis. It captures metadata such as source and destination addresses, ports, and byte counts rather than full packet payloads.

Question 42Security Monitoring

Which security monitoring data source provides the most direct evidence of the actual content of an application-layer conversation between two hosts?

  1. Interface counters
  2. Authentication logs
  3. Full packet capture Correct answer.
  4. NetFlow records

Explanation

Full packet capture stores complete packet payloads, so an analyst can reconstruct and read the application-layer exchange itself. Flow records and counters only describe volume and endpoints, and authentication logs record identity events rather than payload content.

Question 43Security Monitoring

A SIEM correlates events from many sources. Which characteristic most distinguishes a SIEM from a standalone syslog server?

  1. It replaces the need for endpoint antivirus software
  2. It normalizes and correlates events from multiple sources to generate alerts Correct answer.
  3. It forwards messages using UDP port 514 by default
  4. It stores log messages in flat text files on disk

Explanation

A SIEM ingests, normalizes, and correlates events across disparate sources and applies rules to raise prioritized alerts. A plain syslog server primarily receives and stores messages without cross-source correlation logic.

Question 44Security Monitoring

Which intrusion detection deployment monitors traffic on a single host and can inspect system calls and file integrity?

  1. Flow collector
  2. Network-based IDS
  3. Host-based IDS Correct answer.
  4. Passive network tap

Explanation

A host-based IDS runs an agent on the endpoint and can monitor file integrity, logs, and system activity in addition to network connections. Network-based sensors see only traffic traversing a monitored link.

Question 45Security Monitoring

What is the primary purpose of network telemetry baselining in a security monitoring program?

  1. To shorten the DHCP lease duration
  2. To establish normal behavior so deviations can be detected Correct answer.
  3. To encrypt all monitored traffic
  4. To replace firewall rule sets

Explanation

Baselining documents expected traffic volumes, protocols, and host behaviors so that anomalies stand out against a reference. Detection rules and thresholds are tuned against that normal profile.

Question 46Security Monitoring

Which log source would an analyst query first to determine which user account authenticated to a server at a specific time?

  1. DNS query logs
  2. Authentication and account logon events Correct answer.
  3. NetFlow records
  4. Firewall deny logs

Explanation

Authentication logs record account logon events with the identity, timestamp, and result, which directly answers who logged in. Flow, firewall, and DNS logs describe network activity without tying it to an authenticated account.

Question 47Security Monitoring

An analyst wants to confirm that a suspicious file executed on an endpoint and what child processes it spawned. Which endpoint data source is most appropriate?

  1. Endpoint detection and response process telemetry Correct answer.
  2. SNMP interface statistics
  3. NetFlow records from the gateway
  4. Syslog from the core switch

Explanation

EDR agents record process creation, parent-child relationships, and command lines on the endpoint, which reveals execution chains. Network and device telemetry cannot show local process ancestry.

Question 48Security Monitoring

Which element of a monitoring architecture is responsible for capturing copies of traffic from a switch port for analysis by an IDS?

  1. SPAN port Correct answer.
  2. NTP server
  3. Default gateway
  4. RADIUS server

Explanation

A SPAN port mirrors traffic from selected source ports or VLANs to a destination port where a sensor can analyze it. The other devices provide routing, authentication, or time services rather than traffic mirroring.

Question 49Security Monitoring

An IDS sensor is deployed on a SPAN port and generates an alert for a signature match. Which statement best describes the sensor's capability in this deployment?

  1. It can drop offending packets before they reach the target
  2. It can detect and alert on the traffic but cannot block it inline Correct answer.
  3. It can terminate the attacker's TCP session on the firewall
  4. It can rewrite packet headers to neutralize the attack

Explanation

A sensor fed by a SPAN port receives mirrored copies, so it can detect and alert but has no path to block the original traffic. Blocking requires inline placement such as an IPS.

Question 50Security Monitoring

A signature alerts on outbound traffic to a known command-and-control IP address. The analyst observes many hosts contacting that address on port 443 at regular 60-second intervals. Which conclusion is best supported?

  1. The firewall is misconfigured to allow inbound 443
  2. Multiple hosts are beaconing to command-and-control infrastructure Correct answer.
  3. The DNS server is failing to resolve the domain
  4. The hosts are receiving legitimate software updates from a vendor

Explanation

Periodic, evenly spaced connections from many hosts to a known malicious address are characteristic of beaconing used by malware for command and control. Legitimate updates rarely match a known C2 indicator or such rigid timing.