I85PREP
⌘ K
NISP L1 PT study materials
NISP L1 PT study resources

NISP L1 PT practice questions

One question at a time. Build your NISP L1 PT understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Information Security Fundamentals and Security Awareness

An employee receives an email claiming to be from the IT department that asks them to click a link and re-enter their password because the mailbox is full. Which security concept does this best illustrate?

  1. Ransomware, encryption of files until payment is made
  2. Shoulder surfing, observing a user typing a password
  3. Phishing, a form of social engineering that tricks users into revealing credentials Correct answer.
  4. Brute force, repeated automated guessing of a password

Explanation

Phishing is a social engineering attack that impersonates a trusted party to persuade a user to disclose credentials or click a malicious link. The pretext of a full mailbox and the urgent request to re-enter a password are classic lures. Brute force, ransomware, and shoulder surfing involve different mechanisms.

Question 2Information Security Fundamentals and Security Awareness

Which practice best protects a workstation when a user steps away from their desk in an open office?

  1. Locking the screen and requiring re-authentication to resume Correct answer.
  2. Closing only the email application window
  3. Turning the monitor brightness down
  4. Disconnecting the network cable but leaving the session open

Explanation

Locking the screen enforces re-authentication, so anyone who reaches the unattended machine cannot act under the user's identity. Simply closing an application or dimming the monitor leaves the active session accessible. Removing the cable protects network access only while it is unplugged and leaves the local session exposed.

Question 3Information Security Fundamentals and Security Awareness

What is the primary purpose of classifying information assets by sensitivity level?

  1. To allow all staff to access any asset once it is labelled
  2. To apply handling rules and controls proportionate to the value and risk of the asset Correct answer.
  3. To reduce the number of servers required to store the data
  4. To replace the need for user authentication

Explanation

Classification tells everyone how an asset must be stored, transmitted, shared, and destroyed based on its sensitivity and the harm from disclosure. It drives proportionate protection rather than uniform controls. It does not reduce infrastructure, grant blanket access, or remove the need to authenticate users.

Question 4Information Security Fundamentals and Security Awareness

A user chooses the password 'Summer2024!'. Which weakness does this password primarily have?

  1. It is too long for the authentication system to accept
  2. It is randomly generated and therefore hard to remember
  3. It contains a special character, which weakens it
  4. It is based on a predictable pattern and common words that dictionary and rule-based attacks target Correct answer.

Explanation

Passwords built from a season, a year, and a trailing symbol follow patterns that cracking tools model with rule-based and dictionary attacks. Length is not the problem here, and special characters generally strengthen a password. The string is clearly not random.

Question 5Information Security Fundamentals and Security Awareness

Which statement correctly describes the relationship between a threat, a vulnerability, and a risk?

  1. Risk is the absence of threats, and vulnerability is the countermeasure
  2. A threat exploits a vulnerability, and risk expresses the likelihood and impact of that happening Correct answer.
  3. A vulnerability exploits a threat, and risk is the same thing as a threat
  4. Threats, vulnerabilities, and risks are three names for the same concept

Explanation

A threat is a potential cause of harm, a vulnerability is a weakness that the threat can exploit, and risk combines the likelihood of exploitation with its impact. This causal chain is the basis of risk assessment. The other options reverse the roles or conflate distinct concepts.

Question 6Information Security Fundamentals and Security Awareness

Why is it risky to reuse the same password across multiple online services?

  1. A breach at one service lets attackers try the stolen credentials on other services Correct answer.
  2. Services automatically block any password used more than once
  3. Reuse prevents multi-factor authentication from being enabled
  4. Reused passwords are always shorter than unique ones

Explanation

Credential stuffing uses passwords leaked from one breach to attempt logins on unrelated services, so a single compromise cascades across accounts. Reuse does not inherently shorten a password, and services generally cannot detect reuse elsewhere. Multi-factor authentication can still be enabled on reused passwords, though it is not a substitute for uniqueness.

Question 7Information Security Fundamentals and Security Awareness

Which of the following is the best example of multi-factor authentication?

  1. A password combined with a one-time code from an authenticator app Correct answer.
  2. A username plus a security question
  3. A password entered twice for confirmation
  4. A long passphrase used alone

Explanation

Multi-factor authentication combines factors from different categories, such as something you know (a password) and something you have (a one-time code generator). Entering a password twice uses only one factor. A passphrase alone is also single-factor, and a username with a security question relies largely on knowledge-based answers.

Question 8Information Security Fundamentals and Security Awareness

What should a user do first when they suspect their account has been compromised?

  1. Report it to the security team and change the password from a trusted device Correct answer.
  2. Delete all their email to remove evidence of the attacker
  3. Wait a few days to see whether anything unusual happens
  4. Post the details in a public chat to warn colleagues

Explanation

Prompt reporting lets responders contain the incident, and changing the password from a trusted device cuts off the attacker's access. Waiting gives the attacker time to persist. Public disclosure can spread misinformation or tip off the attacker, and deleting data destroys evidence needed for investigation.

Question 9Information Security Fundamentals and Security Awareness

An attacker calls an employee pretending to be a helpdesk technician and asks them to read out the verification code just sent to their phone. Which attack is this?

  1. Denial of service against a phone system
  2. Watering-hole compromise of a website
  3. Tailgating at a controlled door
  4. Vishing combined with one-time-password interception Correct answer.

Explanation

Vishing is voice-based social engineering, and here it is used to capture a one-time code, defeating multi-factor authentication. The caller exploits trust in the helpdesk role rather than a physical or website vector. Tailgating, watering-hole attacks, and denial of service involve entirely different mechanisms.

Question 10Information Security Fundamentals and Security Awareness

Which control is an example of the principle of least privilege?

  1. Granting an analyst read-only access to the one database their role requires Correct answer.
  2. Sharing a single administrator account among the operations team
  3. Giving every employee administrator rights to simplify support
  4. Leaving default vendor accounts enabled for convenience

Explanation

Least privilege means each identity receives only the access needed for its tasks, for no longer than necessary. Read-only access to a single required database fits that principle. Broad administrator rights, shared accounts, and enabled defaults all exceed what the role needs and weaken accountability.

Question 11Information Security Fundamentals and Security Awareness

What distinguishes a virus from a worm?

  1. A worm only affects mobile phones, while a virus only affects servers
  2. A virus spreads without any user action, while a worm always requires a host file
  3. A virus is always harmless, while a worm always encrypts files
  4. A worm spreads across networks on its own, while a virus typically needs a host file and user action to propagate Correct answer.

Explanation

Worms are self-propagating and move between systems over networks without user interaction, whereas viruses usually attach to files and spread when those files are executed. The distinguishing factor is autonomous propagation, not the platform affected or the payload delivered.

Question 12Information Security Fundamentals and Security Awareness

A user finds a USB drive labelled 'Payroll 2024' in the office car park. What is the safest action?

  1. Copy its contents to a shared drive so colleagues can help identify the owner
  2. Hand it to the security team without plugging it into any device Correct answer.
  3. Insert it into a work computer with antivirus disabled to inspect it
  4. Plug it into a personal laptop to identify the owner

Explanation

Unknown media can carry malware or be a baiting lure, so it should be given to the security team for safe handling. Connecting it to any system risks infection, and disabling antivirus removes the protection that might detect a payload. Copying files to a shared drive would spread any malware widely.

Question 13Information Security Fundamentals and Security Awareness

Why should sensitive data be encrypted in transit as well as at rest?

  1. Both are only needed for public websites and have no role inside a corporate network
  2. In-transit encryption replaces the need for authentication, and at-rest encryption replaces backups
  3. In-transit encryption speeds up the network, and at-rest encryption reduces disk usage
  4. In-transit encryption prevents interception on networks, while at-rest encryption protects stored copies if media is lost or stolen Correct answer.

Explanation

The two controls address different exposure points: transit encryption defeats eavesdropping on the path, and at-rest encryption protects data on disks or backups that are lost or stolen. Neither is a performance feature, and neither substitutes for authentication or backups. Internal networks are not automatically trusted.

Question 14Information Security Fundamentals and Security Awareness

Which behaviour most clearly indicates a possible insider threat?

  1. An employee who does not need it repeatedly accesses sensitive files outside their role Correct answer.
  2. An employee who asks a colleague to review a report
  3. An employee who takes their full lunch break every day
  4. An employee who attends optional security awareness training

Explanation

Insider threat indicators include accessing data beyond the needs of the role, especially repeatedly and without a business reason. Ordinary routines such as lunch breaks, peer review, and voluntary training are normal and often desirable behaviours. The concern is unauthorised access to sensitive assets.

Question 15Information Security Fundamentals and Security Awareness

What is the main security benefit of applying security patches promptly?

  1. It closes known vulnerabilities that attackers routinely scan for and exploit Correct answer.
  2. It removes the need for antivirus software on the endpoint
  3. It guarantees the system can never be compromised
  4. It makes all user passwords automatically stronger

Explanation

Patches fix publicly known flaws, and attackers actively scan for unpatched systems because exploitation is cheap once a vulnerability is disclosed. Patching reduces exposure but cannot guarantee immunity, nor does it replace antivirus or password hygiene. Defence in depth remains necessary.

Question 16Information Security Fundamentals and Security Awareness

An employee wants to share a large file containing customer records with an external partner. Which approach best reflects secure data handling?

  1. Upload it to a public link with no expiry or password
  2. Attach the full file to a personal webmail account for speed
  3. Use the approved encrypted file-sharing service and share only the records the partner needs Correct answer.
  4. Print the records and post them by standard mail

Explanation

Approved encrypted channels preserve confidentiality in transit and at rest, and data minimisation limits the impact if the transfer is compromised. Personal webmail, open public links, and unsecured postal delivery all expose sensitive records to unnecessary risk. Sharing only what is needed also supports least privilege.

Question 17Information Security Fundamentals and Security Awareness

Which scenario best describes a man-in-the-middle attack?

  1. An attacker guesses a password by trying every possible combination
  2. An attacker bribes an employee to copy confidential files
  3. An attacker secretly relays and possibly alters traffic between two parties who believe they are communicating directly Correct answer.
  4. An attacker floods a server with requests until it stops responding

Explanation

In a man-in-the-middle attack the adversary positions themselves between two parties, intercepting or modifying traffic while each side believes the channel is direct. Flooding is denial of service, exhaustive guessing is brute force, and bribing an employee is an insider or social-engineering scenario.

Question 18Information Security Fundamentals and Security Awareness

A website shows a padlock and uses HTTPS. What does this actually assure a user?

  1. The site cannot contain malicious code
  2. The site has been audited and is free of fraud
  3. Traffic to the site is encrypted, but the site's trustworthiness and intent are not guaranteed Correct answer.
  4. The organisation behind the site is legally verified

Explanation

HTTPS with a valid certificate protects confidentiality and integrity of the connection, but anyone can obtain a certificate, including criminals. It does not certify good intent, audit the site, or guarantee that content is free of malware. Users must still assess whether the site is legitimate.

Question 19Information Security Fundamentals and Security Awareness

Which action best supports the principle of accountability in an information system?

  1. Permitting anonymous access to administrative functions
  2. Allowing staff to share one team login for convenience
  3. Disabling logging to improve performance
  4. Assigning unique user accounts so actions can be traced to an individual Correct answer.

Explanation

Accountability requires that every action can be attributed to a specific identity, which unique accounts and reliable logging provide. Shared logins make attribution impossible, and disabling logging erases the evidence. Anonymous administrative access removes accountability entirely.

Question 20Information Security Fundamentals and Security Awareness

What is the security purpose of a clean desk and clear screen policy?

  1. To ensure that backups run on schedule
  2. To speed up the login process for employees
  3. To reduce the amount of paper the organisation purchases
  4. To prevent sensitive information from being exposed to people who are not authorised to see it Correct answer.

Explanation

Unattended documents and unlocked screens expose information to anyone passing by, including visitors and cleaning staff. The policy limits that exposure by requiring sensitive material to be secured and screens to be locked. Cost reduction, login speed, and backup scheduling are unrelated objectives.

Question 21Information Security Fundamentals and Security Awareness

An organisation stores backup tapes in an unmarked cardboard box in a shared storage room. Which weakness does this most directly represent?

  1. Inadequate physical protection of media that may contain sensitive data Correct answer.
  2. Insufficient network bandwidth for backups
  3. Excessive encryption of backup data
  4. Overuse of multi-factor authentication

Explanation

Backup media can hold large volumes of sensitive data, so it needs controlled physical storage with access restrictions and labelling that reflects its classification. An unmarked box in a shared room allows unauthorised people to remove or inspect it. Encryption, authentication, and bandwidth are not the issue described.

Question 22Information Security Fundamentals and Security Awareness

A user receives a message from a supplier whose email account was actually compromised, asking to change bank details urgently. Which response best reflects sound verification practice?

  1. Reply to the email asking the sender to confirm the new details
  2. Forward the message to colleagues and wait for someone to respond
  3. Confirm the change through a separately known phone number before acting Correct answer.
  4. Act quickly because the request is marked urgent

Explanation

A compromised mailbox can send convincing messages, so the request must be verified out of band using contact details already on record. Replying to the same mailbox reaches the attacker, and urgency is a pressure tactic. Forwarding without verification spreads the risk rather than resolving it.

Question 23Information Security Fundamentals and Security Awareness

Which control most directly limits the damage an attacker can cause after stealing a single set of credentials?

  1. Segmentation of systems combined with least-privilege access for the compromised account Correct answer.
  2. A corporate social media policy
  3. A longer minimum password length only
  4. Regular defragmentation of hard disks

Explanation

Once credentials are stolen, the blast radius depends on what that identity can reach and do. Segmentation restricts lateral movement, and least privilege limits what the account is authorised to perform. Password length reduces the chance of theft in the first place but does nothing after a compromise, and the other options are unrelated.

Question 24Information Security Fundamentals and Security Awareness

A security awareness programme wants to reduce the chance that staff fall for phishing. Which measure is most likely to produce lasting improvement?

  1. Regular simulated phishing exercises with immediate, non-punitive coaching for those who click Correct answer.
  2. Disciplining every employee who reports a suspicious email
  3. Removing email from the organisation entirely
  4. A single mandatory briefing at induction with no follow-up

Explanation

Recognition improves through repeated practice with feedback, and non-punitive coaching encourages reporting instead of concealment. A one-off briefing decays quickly, punishing reports discourages them, and removing email is neither practical nor a targeted control. Sustainable awareness needs reinforcement.

Question 25Information Security Fundamentals and Security Awareness

An employee is asked to approve a payment to a new supplier by a message that appears to come from the chief executive and stresses confidentiality. Which combination of indicators should raise suspicion?

  1. Authority pressure, unusual urgency, secrecy, and a change in normal payment process Correct answer.
  2. A request sent during business hours
  3. A message that includes the recipient's correct job title
  4. Use of a formal greeting and a company signature

Explanation

Business email compromise relies on impersonated authority, time pressure, and requests for secrecy to bypass normal controls such as dual approval and call-back verification. Formal greetings, business-hours timing, and correct job titles are easy to obtain and are not reliable indicators. The deviation from the standard payment process is the key warning.

Question 26Information Security Fundamentals and Security Awareness

Under the CIA triad, which property is primarily concerned with ensuring that data has not been altered by an unauthorised party?

  1. Integrity Correct answer.
  2. Non-repudiation
  3. Confidentiality
  4. Availability

Explanation

Integrity means data remains accurate, complete and unmodified except by authorised processes, so unauthorised alteration breaches it. Confidentiality concerns who may read data, availability concerns timely access, and non-repudiation concerns proving an action occurred. Integrity is therefore the property directly violated by tampering.

Question 27Information Security Fundamentals and Security Awareness

A company classifies documents as Public, Internal, Confidential and Restricted. Which practice best reflects a working information classification scheme?

  1. Only the IT department decides the classification of business documents
  2. All documents are treated as Confidential so no further labelling effort is needed
  3. Every document receives a label that determines handling, storage and sharing rules Correct answer.
  4. Classification is applied once at creation and never reviewed again

Explanation

A classification scheme only adds value when each level is tied to defined handling rules for storage, transmission and sharing, so staff know what to do with a labelled item. Over-classifying everything removes the distinction between levels and encourages workarounds. Classification also needs periodic review and should be owned by the information owner, not solely by IT.

Question 28Information Security Fundamentals and Security Awareness

Which statement correctly describes the role of an Acceptable Use Policy (AUP) in an organisation?

  1. It records the cryptographic algorithms approved for protecting data at rest
  2. It lists the recovery time objectives for each critical business system
  3. It defines what users may and may not do with organisational IT resources and the consequences of misuse Correct answer.
  4. It specifies the technical configuration baseline for servers and network devices

Explanation

An AUP is a behavioural document that sets expectations for how staff use company systems, email, internet and devices, and it usually states sanctions for violations. Technical baselines, cryptography standards and recovery objectives belong to other documents such as hardening standards, a crypto policy and business continuity plans. The AUP is therefore the user-facing rule set rather than a technical specification.

Question 29Information Security Fundamentals and Security Awareness

What is the primary purpose of taking regular backups of business data?

  1. To prevent malware from infecting the production servers
  2. To replace the need for access control on file shares
  3. To speed up the encryption of data stored on disk
  4. To restore data and continue operations after loss, corruption or ransomware damage Correct answer.

Explanation

Backups provide a recoverable copy so that data lost through deletion, corruption, hardware failure or ransomware can be restored and operations resumed. They are a recovery control, not a preventive one, so they do not stop malware or remove the need for access control. Their value depends on testing restores and keeping copies isolated from the production environment.

Question 30Information Security Fundamentals and Security Awareness

An organisation wants to reduce the risk that a single stolen laptop exposes stored customer records. Which measure addresses this risk most directly?

  1. A longer password policy applied only to administrator accounts
  2. Daily incremental backups of the laptop to a network share
  3. A banner warning users that the device is monitored
  4. Full-disk encryption combined with strong authentication to the device Correct answer.

Explanation

Full-disk encryption makes the stored data unreadable without the key, and strong device authentication prevents an attacker from simply logging in to a stolen machine. Together they target the loss-of-device scenario directly. Backups help recovery but do not stop disclosure, and banners or partial password rules do not protect data at rest.

Question 31Information Security Fundamentals and Security Awareness

In an access control model, what does the principle of need-to-know require?

  1. Access is granted based on the user's seniority in the organisation
  2. Access is granted only where a specific job task genuinely requires the information Correct answer.
  3. Access is granted to everyone in the same department by default
  4. Access is granted permanently once approved by any manager

Explanation

Need-to-know limits access to those with a genuine task-related requirement, which reduces exposure of information to unnecessary readers. Department-wide or seniority-based defaults grant access for convenience rather than necessity. Permanent grants also conflict with the related idea that access should be reviewed and removed when no longer needed.

Question 32Information Security Fundamentals and Security Awareness

A staff member receives an email that appears to come from the IT department asking them to install an attached 'security update'. The sender domain is slightly misspelled and the message creates urgency. What is the most appropriate response?

  1. Do not run the attachment and report the message to the security team through the agreed channel Correct answer.
  2. Forward the attachment to colleagues so they can check whether it works
  3. Reply to the sender asking for confirmation and install it if they confirm
  4. Install the attachment because it claims to come from IT

Explanation

A misspelled sender domain plus urgency and an unsolicited attachment are classic phishing indicators, so the safe action is to avoid executing the file and report it. Replying to the sender is unreliable because the address itself may be attacker-controlled. Software updates should be obtained from official internal channels, not from email attachments.

Question 33Information Security Fundamentals and Security Awareness

Why does an organisation separate production duties from the ability to deploy changes into production?

  1. It allows developers to bypass testing when deadlines are tight
  2. It prevents one person from both writing and releasing changes without independent review Correct answer.
  3. It removes the need for logging of administrative activity
  4. It reduces the electricity cost of running the production environment

Explanation

Separating development from release creates a check so that a single individual cannot introduce unauthorised or untested code into production unnoticed. This is a form of segregation of duties that limits fraud and accidental error. It does not remove the need for logging; in fact, logging supports the review of who deployed what and when.

Question 34Information Security Fundamentals and Security Awareness

What is the main difference between pseudonymisation and anonymisation of personal data?

  1. Pseudonymisation applies only to paper records, while anonymisation applies only to databases
  2. Anonymisation requires a password, while pseudonymisation requires only a hash
  3. Pseudonymised data can be re-linked to individuals with extra information, while anonymised data cannot Correct answer.
  4. Pseudonymised data is always stored unencrypted, while anonymised data is always encrypted

Explanation

Pseudonymisation replaces identifiers with tokens but keeps a mapping or key that allows re-identification, so the data is still personal data in most regimes. Anonymisation aims to make re-identification impossible, which is a much stronger and harder-to-achieve property. The distinction matters because pseudonymised data usually remains within the scope of data protection obligations.

Question 35Information Security Fundamentals and Security Awareness

A web application shows a padlock and an HTTPS URL. Which statement best describes what this assures the user?

  1. The site cannot be impersonated by any other party
  2. The content displayed is free of malware and phishing
  3. The website owner has been audited and handles data lawfully
  4. The connection to the named site is encrypted and its certificate was issued for that name Correct answer.

Explanation

HTTPS with a valid certificate provides confidentiality for the connection and gives evidence that the site presenting the certificate controls the named domain. It does not vouch for the honesty, legality or safety of the content, since criminals can obtain certificates too. Users must still judge whether the site itself is trustworthy.

Question 36Information Security Fundamentals and Security Awareness

An organisation adopts a 'least functionality' approach when building servers. Which action implements this principle?

  1. Allowing all outbound traffic so updates never fail
  2. Installing all available tools so future needs are already covered
  3. Disabling unused services, ports and software roles on each server Correct answer.
  4. Giving every administrator a shared root account for convenience

Explanation

Least functionality means a system exposes only the services and features needed for its role, which shrinks the attack surface available to an intruder. Removing unused services and ports reduces the number of components that could contain vulnerabilities. Installing extra tools or opening broad network paths does the opposite by expanding exposure.

Question 37Information Security Fundamentals and Security Awareness

Which activity is part of an effective security awareness programme rather than a one-off event?

  1. Sending one reminder email each year during the security month campaign
  2. A single induction briefing given on the first day of employment only
  3. Scheduled refresher training with simulated phishing exercises and feedback on results Correct answer.
  4. Publishing the security policy on the intranet and assuming staff will read it

Explanation

Awareness works best as a continuous cycle of short training, realistic simulations and constructive feedback that reinforces the right behaviour over time. One-off briefings and passive publication of policy documents are easily forgotten and do not measure whether behaviour changed. Repeating exercises also produces metrics that show where further training is needed.

Question 38Information Security Fundamentals and Security Awareness

A vendor patch for a critical internet-facing service is released. Change management requires testing before deployment, but testing takes two weeks. Which approach best balances the competing requirements?

  1. Skip all testing permanently and deploy every future patch without review
  2. Wait the full two weeks regardless of exposure because the process must never be varied
  3. Apply an emergency change with documented risk acceptance, targeted testing and post-deployment monitoring Correct answer.
  4. Disable the affected service permanently instead of applying the patch

Explanation

An emergency change path lets the organisation respond quickly to a serious exposure while still recording the risk decision, doing proportionate testing and watching for problems after deployment. Rigidly waiting leaves a known critical hole open, while abandoning testing altogether creates avoidable operational risk. The decision and its rationale should be documented for later review.

Question 39Information Security Fundamentals and Security Awareness

A user reports that their laptop, which holds customer data, was left in a taxi. Which combination of actions best reflects a sound incident response sequence?

  1. Ask the user to change their email password and take no further action
  2. Wait a few days in case the laptop is returned before telling anyone
  3. Report immediately, assess remote wipe and key revocation, and follow the data breach assessment process Correct answer.
  4. Buy a replacement laptop and restore the user's files from backup

Explanation

Loss of a device holding personal data is a potential data breach, so prompt reporting starts containment through remote wipe or key revocation and allows the organisation to assess notification duties. Delaying loses the chance to act while the device is still reachable. Replacing hardware restores productivity but does not address the possible disclosure of data.

Question 40Information Security Fundamentals and Security Awareness

An organisation uses role-based access control. A user moves from finance to marketing but keeps the finance role. Which weakness does this most clearly illustrate?

  1. Role assignments are not being reviewed and revoked when a user's duties change Correct answer.
  2. The roles are defined too narrowly for the organisation's size
  3. The user's password has not been changed recently enough
  4. Role-based access control cannot express least privilege in any form

Explanation

RBAC depends on keeping role membership aligned with current job duties, so a transfer that leaves old entitlements in place produces privilege accumulation. The problem lies in the joiner-mover-leaver process, which should trigger a review and removal of the finance role. RBAC itself can express least privilege well when roles are maintained and reviewed.

Question 41Network Security Basics

A workstation is configured with IP address 192.168.10.77 and subnet mask 255.255.255.192. Which address is the directed broadcast address of this subnet?

  1. 192.168.10.127 Correct answer.
  2. 192.168.10.64
  3. 192.168.10.79
  4. 192.168.10.63

Explanation

The mask 255.255.255.192 leaves 6 host bits, so each subnet holds 64 addresses and the block boundaries fall on multiples of 64. The address 192.168.10.77 sits in the block 192.168.10.64 through 192.168.10.127, whose last address is the directed broadcast. The network address of that block is 192.168.10.64 and the usable host range ends at 192.168.10.126.

Question 42Network Security Basics

Which OSI layer is responsible for logical addressing and path selection between networks?

  1. Transport layer
  2. Data link layer
  3. Network layer Correct answer.
  4. Session layer

Explanation

The network layer (layer 3) handles logical addressing such as IP and makes routing decisions that move packets between different networks. Path selection by routers is a layer 3 function. The data link layer deals with physical addressing on a single link, and the transport layer handles end-to-end delivery between processes.

Question 43Network Security Basics

A security analyst observes a flood of TCP SYN packets to many destination ports on a single server, with source addresses that appear randomly generated and no completed handshakes. Which attack is this?

  1. DNS cache poisoning
  2. SYN flood denial of service Correct answer.
  3. ARP spoofing
  4. VLAN hopping

Explanation

A SYN flood exhausts the server's connection table by sending many half-open handshake requests, often with spoofed source addresses, so legitimate clients cannot complete connections. The absence of finished three-way handshakes is characteristic. ARP spoofing and DNS cache poisoning target name or address resolution rather than exhausting TCP state.

Question 44Network Security Basics

Which statement best describes the role of a stateful packet-filtering firewall?

  1. It assigns IP addresses to internal hosts and resolves their DNS queries.
  2. It decrypts all TLS traffic to inspect application payloads before forwarding.
  3. It tracks connection state and permits return traffic belonging to an allowed session. Correct answer.
  4. It inspects each packet in isolation using only static rules for source and destination.

Explanation

A stateful firewall maintains a connection table so that replies to an approved outbound session are automatically allowed without a separate inbound rule. This tracking distinguishes it from simple stateless filtering. It does not by itself decrypt TLS, and address assignment is a DHCP function.

Question 45Network Security Basics

An organization wants to segment its network so that a compromised guest device cannot reach internal servers, while still allowing guests to use the internet. Which control most directly achieves this?

  1. Enabling port security to limit the number of MAC addresses per switch port
  2. Using WPA2 encryption on the guest wireless network
  3. Deploying a host-based antivirus agent on every guest device
  4. Placing guest devices on a separate VLAN with filtering rules that block access to internal subnets Correct answer.

Explanation

VLAN segmentation with inter-VLAN filtering isolates guest traffic at layer 2 and layer 3 so it cannot route into internal server subnets while still permitting internet egress. This is the standard design for guest isolation. Port security and wireless encryption address different risks and do not enforce server reachability policy.

Question 46Network Security Basics

Which protocol uses a three-way handshake of SYN, SYN-ACK, and ACK to establish a connection?

  1. ARP
  2. ICMP
  3. UDP
  4. TCP Correct answer.

Explanation

TCP establishes connections with the SYN, SYN-ACK, ACK exchange, which synchronizes sequence numbers and confirms both endpoints are reachable. UDP is connectionless and sends datagrams without a handshake. ICMP and ARP are used for diagnostics and address resolution respectively.

Question 47Network Security Basics

A user reports that a web browser shows a certificate warning stating the certificate name does not match the site being visited. Which cause is most likely?

  1. The client clock is set far in the future
  2. The server's private key has been revoked by the CA
  3. The certificate was issued for a different hostname than the one requested Correct answer.
  4. The TLS session is using an outdated cipher suite

Explanation

Browsers compare the subject alternative names in a certificate against the hostname in the URL, and a mismatch triggers a name-mismatch warning. This commonly happens when a certificate is reused across services or a server is reached by an unintended name. Revocation and clock errors produce different warnings such as revoked or expired.

Question 48Network Security Basics

Which record type in DNS is used to publish the mail servers authorized to receive email for a domain?

  1. MX Correct answer.
  2. A
  3. TXT
  4. CNAME

Explanation

MX (mail exchanger) records identify the hosts that accept mail for a domain and carry a preference value for ordering them. Senders look up MX records to decide where to deliver email. A records map names to IPv4 addresses, CNAMEs alias one name to another, and TXT records hold arbitrary text such as SPF policy.

Question 49Network Security Basics

An attacker on the same local network sends forged ARP replies claiming the default gateway's IP address maps to the attacker's MAC address. What is the primary effect?

  1. The victim's DNS queries are answered by an authoritative server
  2. The switch disables the victim's port due to a MAC violation
  3. The victim's IP address is leased from a rogue DHCP server
  4. Traffic destined for the gateway is redirected through the attacker Correct answer.

Explanation

ARP has no authentication, so forged replies can poison a host's ARP cache and make the attacker's MAC the destination for gateway-bound traffic. This enables man-in-the-middle interception or modification of traffic. DHCP and DNS attacks involve different protocols, and a MAC violation is a separate port-security event.

Question 50Network Security Basics

Which security property is primarily provided by encrypting traffic with TLS between a client and a web server?

  1. Availability of the server under load
  2. Confidentiality of data in transit Correct answer.
  3. Integrity of data at rest
  4. Non-repudiation of the client's actions

Explanation

TLS encrypts the channel so eavesdroppers on the path cannot read the application data, which delivers confidentiality in transit. It also provides integrity for the session, but not for stored data. Availability and non-repudiation are not goals that transport encryption alone achieves.