I85PREP
⌘ K
CPDN study materials
CPDN study resources

CPDN practice questions

One question at a time. Build your CPDN understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Foundational Concepts and Terminology

Which security principle is violated when an unauthorized user alters a financial record?

  1. Integrity Correct answer.
  2. Confidentiality
  3. Non-repudiation
  4. Availability

Explanation

Integrity guarantees that data remains accurate, complete, and unmodified except through authorized processes. Unauthorized modification therefore breaks integrity, while confidentiality concerns disclosure and availability concerns timely access.

Question 2Foundational Concepts and Terminology

Which term describes the potential for loss or damage when a threat exploits a weakness?

  1. Risk Correct answer.
  2. Threat
  3. Vulnerability
  4. Exploit

Explanation

Risk combines the likelihood of a threat acting on a weakness with the resulting impact, so it expresses potential for loss. A threat is the actor or event, a vulnerability is the weakness itself, and an exploit is the technique or code used.

Question 3Foundational Concepts and Terminology

Which of the following is an example of a "something you know" authentication factor?

  1. A password Correct answer.
  2. A fingerprint
  3. A hardware token
  4. A smart card

Explanation

Authentication factors are grouped into something you know, something you have, and something you are. A password is memorized information, so it belongs to the knowledge category.

Question 4Foundational Concepts and Terminology

At which OSI model layer does a router primarily operate?

  1. Transport layer
  2. Network layer Correct answer.
  3. Session layer
  4. Data link layer

Explanation

Routers make forwarding decisions based on logical addresses such as IP addresses, which are defined at the network layer (layer 3). Data link layer devices such as switches forward on MAC addresses.

Question 5Foundational Concepts and Terminology

A self-replicating program that spreads across networks without user interaction and does not need to attach itself to a host file is called a:

  1. Virus
  2. Worm Correct answer.
  3. Trojan
  4. Rootkit

Explanation

Worms are standalone malware that replicate and propagate over networks by exploiting services or weak credentials, requiring no user action. Viruses need a host file and usually a user to execute them.

Question 6Foundational Concepts and Terminology

Which statement is true of symmetric encryption?

  1. The sender uses the receiver's public key
  2. A different key is used for encryption and decryption
  3. Both parties share the same secret key Correct answer.
  4. Keys are distributed through digital certificates

Explanation

Symmetric algorithms use one shared secret key for both encryption and decryption, which makes them fast but creates a key distribution challenge. Public and private key pairs belong to asymmetric cryptography.

Question 7Foundational Concepts and Terminology

Which property best distinguishes a cryptographic hash function from encryption?

  1. It hides the length of the original input
  2. It is a one-way, irreversible transformation Correct answer.
  3. It can be reversed with the correct key
  4. It uses a shared secret key held by both parties

Explanation

A hash function maps input of any length to a fixed-length digest and is designed so the original input cannot be recovered from the digest. Encryption, by contrast, is reversible by design for anyone holding the correct key.

Question 8Foundational Concepts and Terminology

Which firewall keeps a state table of active connections so that return traffic is permitted automatically?

  1. A packet filter
  2. An application gateway
  3. A proxy server
  4. A stateful firewall Correct answer.

Explanation

Stateful inspection firewalls record connection state and use it to decide whether a packet belongs to an established, permitted session. Stateless packet filters evaluate each packet in isolation with no memory of prior traffic.

Question 9Foundational Concepts and Terminology

How does an intrusion prevention system differ from an intrusion detection system?

  1. An IPS scans hosts, an IDS scans clouds
  2. An IPS blocks traffic, an IDS only alerts Correct answer.
  3. An IPS only raises alerts, an IDS blocks traffic
  4. An IPS is passive, an IDS is inline

Explanation

An IPS is deployed inline and can drop or reset malicious traffic, whereas an IDS is typically passive and only generates alerts for analysts. Both may use signature or anomaly detection, so the difference lies in the response capability.

Question 10Foundational Concepts and Terminology

What is the primary purpose of a DMZ in a network architecture?

  1. To isolate public services from internal hosts Correct answer.
  2. To encrypt traffic between remote branch sites
  3. To keep backups of critical servers offline
  4. To authenticate wireless clients before access

Explanation

A DMZ is a segmented zone that hosts internet-facing services, so a compromise there does not give direct access to the internal network. Traffic between the DMZ and the internal network is restricted by firewall rules.

Question 11Foundational Concepts and Terminology

Which problem does network address translation primarily solve?

  1. It encrypts traffic between two sites
  2. It load-balances traffic across servers
  3. It conserves public IPv4 addresses Correct answer.
  4. It prevents ARP spoofing on a LAN

Explanation

NAT allows many internal hosts to share one or a few public IPv4 addresses, slowing address exhaustion. It rewrites address fields and provides no cryptographic protection.

Question 12Foundational Concepts and Terminology

In the AAA framework, which function determines what an authenticated user is permitted to do?

  1. Accounting
  2. Auditing
  3. Authorization Correct answer.
  4. Authentication

Explanation

Authorization applies policy to decide which resources and actions an authenticated identity may use. Authentication verifies identity, and accounting records what the user did.

Question 13Foundational Concepts and Terminology

The principle of least privilege requires that:

  1. Users get only the access needed to do their job Correct answer.
  2. Access is granted by default and removed later
  3. All administrators share one root account
  4. Users rotate passwords every 30 days

Explanation

Least privilege limits rights to the minimum necessary for a role, which reduces the damage possible if an account is compromised or misused. Password rotation and shared administrative accounts are separate controls that do not implement least privilege.

Question 14Foundational Concepts and Terminology

Defense in depth is best described as:

  1. Outsourcing security to a cloud provider
  2. Layering multiple independent controls Correct answer.
  3. Encrypting all data at rest only
  4. Relying on a single strong perimeter firewall

Explanation

Defense in depth assumes any single control can fail, so it stacks complementary controls across people, process, and technology. A breach of one layer should still be blocked or detected by another.

Question 15Foundational Concepts and Terminology

An attacker calls an employee, claims to be an IT technician, and asks for a password reset. Which technique is being used?

  1. Shoulder surfing
  2. Tailgating
  3. Phishing
  4. Pretexting Correct answer.

Explanation

Pretexting is the creation of a fabricated scenario or identity to manipulate a target into revealing information. The invented IT technician role is the pretext that makes the request appear legitimate.

Question 16Foundational Concepts and Terminology

Which incident response phase immediately follows the detection and analysis of a confirmed incident?

  1. Eradication
  2. Recovery
  3. Containment Correct answer.
  4. Lessons learned

Explanation

The standard sequence is preparation, detection and analysis, containment, eradication, recovery, and post-incident activity. Containment comes first because the incident must be stopped from spreading before it can be removed.

Question 17Foundational Concepts and Terminology

In a public key infrastructure, what is the role of a certificate authority?

  1. It encrypts all internal network traffic flows
  2. It stores the private keys of all users
  3. It signs and issues digital certificates Correct answer.
  4. It audits firewall rule changes

Explanation

The certificate authority verifies identity and signs certificates that bind a subject to a public key, allowing relying parties to trust that binding. Private keys must remain under the subject's control and are never held centrally by the CA.

Question 18Foundational Concepts and Terminology

A digital signature primarily provides which two security services?

  1. Confidentiality and availability
  2. Anonymity and confidentiality
  3. Authentication and non-repudiation Correct answer.
  4. Availability and integrity

Explanation

A signature is produced with the sender's private key and verified with the corresponding public key, proving origin and preventing later denial. It also protects integrity, but confidentiality requires separate encryption.

Question 19Foundational Concepts and Terminology

Which IPsec protocol encrypts the payload to provide confidentiality?

  1. GRE
  2. ESP Correct answer.
  3. AH
  4. IKE

Explanation

Encapsulating Security Payload encrypts the data and optionally authenticates it, so it delivers confidentiality. Authentication Header provides integrity and origin authentication but no encryption.

Question 20Foundational Concepts and Terminology

Which TCP port is used by HTTPS by default?

  1. 443 Correct answer.
  2. 23
  3. 25
  4. 21

Explanation

HTTPS runs HTTP over TLS and is assigned TCP port 443 by convention and IANA registration. The other well-known ports listed serve different protocols.

Question 21Foundational Concepts and Terminology

A zero-day vulnerability is one that:

  1. Requires physical access to exploit
  2. Only affects mobile devices
  3. Was patched more than a year ago
  4. Is exploited before a patch is available Correct answer.

Explanation

The term zero-day refers to the absence of a vendor fix at the time of exploitation, giving defenders no patch to apply. Aging vulnerabilities or device-specific flaws are not what defines the term.

Question 22Foundational Concepts and Terminology

Which threat actor is characterized by long-term, stealthy campaigns against specific high-value targets with substantial funding?

  1. A hacktivist collective
  2. A malicious insider
  3. An APT group Correct answer.
  4. An organized crime group

Explanation

Advanced persistent threat groups pursue prolonged, targeted intrusion with strong resources to maintain access and exfiltrate data. Unlike opportunistic criminals or protesters, their campaigns emphasize patience and concealment.

Question 23Foundational Concepts and Terminology

On a router, an access control list is typically evaluated:

  1. In random order
  2. Top-down until a match is found Correct answer.
  3. By matching the last rule first
  4. Only when the interface is idle

Explanation

ACLs are processed sequentially from the first entry, and the first rule that matches the packet determines the action. There is an implicit deny at the end if no entry matches.

Question 24Foundational Concepts and Terminology

In asymmetric cryptography, which key is used to encrypt a message intended to be read only by a specific recipient?

  1. The sender's private key
  2. The sender's public key
  3. The recipient's public key Correct answer.
  4. The recipient's private key

Explanation

Anyone may use the recipient's public key to encrypt, but only the matching private key can decrypt it. This is what makes public key distribution practical for confidentiality.

Question 25Foundational Concepts and Terminology

Under the shared responsibility model for infrastructure as a service, which element is the customer's responsibility?

  1. Patching the guest operating system Correct answer.
  2. Securing the physical data center
  3. Managing the storage hardware
  4. Maintaining the hypervisor

Explanation

In IaaS the provider secures the facilities and virtualization layer, while the customer manages everything from the guest operating system upward, including patching and application security. This division is what distinguishes IaaS from platform and software service models.

Question 26Foundational Concepts and Terminology

Which element of the CIA triad ensures that data has not been altered or destroyed in an unauthorized manner?

  1. Integrity Correct answer.
  2. Confidentiality
  3. Availability
  4. Non-repudiation

Explanation

Integrity is the property that data remains accurate, complete, and unmodified except through authorized actions. Controls such as hashing and file permissions help detect or prevent unauthorized changes.

Question 27Foundational Concepts and Terminology

In risk terminology, which phrase best defines a vulnerability?

  1. A technique used to take advantage of a flaw
  2. A potential source of harm such as an attacker
  3. A weakness that can be exploited Correct answer.
  4. The combined likelihood and impact of loss

Explanation

A vulnerability is a weakness in a system, process, or control that a threat could exploit. It is distinct from the threat itself and from the risk that results when threats and vulnerabilities intersect.

Question 28Foundational Concepts and Terminology

Which type of malware self-replicates across networks without requiring a user to open a file or click a link?

  1. Logic bomb
  2. Worm Correct answer.
  3. Virus
  4. Trojan

Explanation

A worm is stand-alone malware that propagates by exploiting network services and does not need a user to execute an infected file. Viruses generally require a host file and user action, while trojans rely on disguise.

Question 29Foundational Concepts and Terminology

A security camera that records activity in a data center is best classified as which type of control?

  1. Corrective
  2. Preventive
  3. Compensating
  4. Detective Correct answer.

Explanation

Detective controls identify and record that an event has occurred, allowing investigation after the fact. A camera does not physically stop an intruder; it provides evidence and awareness.

Question 30Foundational Concepts and Terminology

Which expression best represents risk as used in security management?

  1. Impact minus the cost of controls
  2. Threat plus vulnerability plus control cost
  3. Likelihood multiplied by impact Correct answer.
  4. Asset value divided by exposure factor

Explanation

Risk is commonly expressed as the probability that a threat exploits a vulnerability multiplied by the resulting impact. Controls are chosen to reduce that combined likelihood or impact to an acceptable level.

Question 31Foundational Concepts and Terminology

How does a penetration test differ from a vulnerability assessment?

  1. It only inventories assets and reports missing patches.
  2. It relies solely on automated scanners without human review.
  3. It exploits weaknesses to prove real impact. Correct answer.
  4. It focuses only on physical access controls and guards.

Explanation

A penetration test goes beyond identifying weaknesses by attempting controlled exploitation to demonstrate business impact. A vulnerability assessment primarily discovers and lists weaknesses without necessarily exploiting them.

Question 32Foundational Concepts and Terminology

An attacker sends a researched email to a specific accounts payable employee that references a real invoice and asks for payment to a new bank account. Which term best describes this attack?

  1. Spear phishing Correct answer.
  2. Tailgating
  3. Phishing
  4. Vishing

Explanation

Spear phishing is a targeted email attack crafted using details specific to the recipient or organization. Generic phishing is sent indiscriminately, while vishing uses voice calls and tailgating uses physical entry.

Question 33Foundational Concepts and Terminology

Which malware type presents itself as legitimate software to persuade a user to install it?

  1. Worm
  2. Rootkit
  3. Trojan Correct answer.
  4. Virus

Explanation

A trojan disguises itself as desirable or legitimate software so the user voluntarily runs it. Once executed, it can perform hidden malicious actions, but it does not self-replicate like a worm.

Question 34Foundational Concepts and Terminology

What is the primary purpose of a honeypot?

  1. To provide encrypted remote access for employees working outside the office.
  2. To back up critical data continuously so it can be restored after an incident.
  3. To filter malicious traffic at the network perimeter before it reaches servers.
  4. To lure attackers away from production systems and observe them. Correct answer.

Explanation

A honeypot is a decoy system or service intended to attract attackers so their methods can be studied and production assets protected. It is not a primary filtering, remote-access, or backup control.

Question 35Foundational Concepts and Terminology

A company wants to separate guest wireless traffic from internal server traffic at Layer 2 without purchasing additional switches. Which technology is most appropriate?

  1. DMZ
  2. NAT
  3. VPN
  4. VLAN Correct answer.

Explanation

A VLAN logically segments a switched network so that ports can be placed in separate broadcast domains. This isolates traffic between groups without requiring separate physical switches.

Question 36Foundational Concepts and Terminology

A remote worker uses a VPN to connect to the corporate network over the Internet. What security property does the VPN primarily add?

  1. It blocks the client from visiting malicious websites using a URL filter.
  2. It encrypts traffic between the client and the corporate gateway. Correct answer.
  3. It assigns a public IP address to the client for direct Internet access.
  4. It scans the client device for malware before allowing access to applications.

Explanation

A VPN creates an encrypted tunnel between the remote client and the corporate gateway, protecting data in transit over untrusted networks. It does not inherently scan endpoints, filter web content, or assign public addresses.

Question 37Foundational Concepts and Terminology

A login requires a password and a fingerprint. Which combination of authentication factors does this represent?

  1. Something you have and something you know
  2. Something you are and something you have
  3. Somewhere you are and something you know
  4. Something you know and something you are Correct answer.

Explanation

A password is knowledge (something you know), and a fingerprint is a biometric trait (something you are). Combining factors from different categories provides multifactor authentication.

Question 38Foundational Concepts and Terminology

A company purchases cyber insurance to cover losses from a data breach. Which risk treatment strategy is this?

  1. Risk avoidance
  2. Risk transfer Correct answer.
  3. Risk acceptance
  4. Risk mitigation

Explanation

Risk transfer shifts the financial consequences of a risk to another party, such as an insurer. The organization still faces the event, but the loss is compensated under the policy.

Question 39Foundational Concepts and Terminology

An attacker on the same LAN sends forged ARP replies so that traffic intended for the default gateway is sent to the attacker's MAC address. What is the primary security impact?

  1. The attacker can crash the router by exhausting its translation table.
  2. The attacker can decrypt TLS sessions without obtaining any keys.
  3. The attacker can intercept and alter traffic between hosts. Correct answer.
  4. The attacker can poison DNS records at the authoritative server.

Explanation

ARP spoofing lets an attacker position itself between hosts on a local network, enabling man-in-the-middle interception and modification. It does not by itself break TLS or affect authoritative DNS servers.

Question 40Foundational Concepts and Terminology

An attacker injects false records into a recursive DNS resolver's cache. Which effect is most directly achieved?

  1. Network packets are encrypted with a weak cipher by the resolver.
  2. The resolver's hardware is physically damaged by the injected records.
  3. Users are sent to attacker-chosen addresses for legitimate domains. Correct answer.
  4. The attacker gains a copy of the resolver's private TLS key.

Explanation

DNS cache poisoning corrupts the resolver's stored mappings so that queries for legitimate names return attacker-chosen IP addresses. This can redirect users to malicious sites without altering the domain itself.

Question 41Design and Planning

Which of the following is a functional requirement for a new remote-access solution?

  1. The solution must authenticate users against the existing directory service. Correct answer.
  2. The solution must sustain 5 Gbps of aggregate throughput.
  3. The solution must recover from an outage within four hours.
  4. The solution must achieve 99.99 percent availability.

Explanation

Functional requirements describe what the system must do - the behaviours, services, and capabilities it delivers. Throughput, availability, and recovery time are quality attributes, which fall under non-functional requirements. Separating the two categories during planning keeps design decisions traceable to the right type of requirement.

Question 42Design and Planning

A design specifies perimeter firewalls, host-based firewalls on every server, and per-application authentication. Which design principle does this primarily illustrate?

  1. Fail-safe defaults
  2. Separation of duties
  3. Defense in depth Correct answer.
  4. Least privilege

Explanation

Defense in depth places multiple independent controls along the attack path so that defeating one control does not defeat the whole system. Perimeter, host, and application controls each operate at a different layer and do not depend on one another. Least privilege and separation of duties concern authorisation scope and role assignment, not layering of controls.

Question 43Design and Planning

A new floor requires 500 host addresses in a single subnet. Which prefix length is the most efficient choice that satisfies the requirement?

  1. /22
  2. /24
  3. /25
  4. /23 Correct answer.

Explanation

A /23 contains 512 addresses, of which 510 are usable after the network and broadcast addresses are reserved, which just covers the 500 hosts. A /22 would also work but wastes more than 500 addresses, so it is not the most efficient fit. Efficiency means choosing the smallest block that still meets the requirement with a reasonable growth margin.

Question 44Design and Planning

An address plan allocates 10.20.0.0/24 through 10.20.3.0/24 to one region. Which single summary route covers exactly those four subnets and nothing else?

  1. 10.20.0.0/22 Correct answer.
  2. 10.20.0.0/21
  3. 10.20.0.0/24
  4. 10.20.0.0/23

Explanation

Four contiguous /24 blocks equal one /22, because 4 = 2^2 and the prefix shortens by two bits. The third octet values 0 through 3 all share the same first six bits, so 10.20.0.0/22 spans exactly 10.20.0.0 to 10.20.3.255. Shorter prefixes would pull in unrelated address space and longer prefixes would not cover all four subnets.

Question 45Design and Planning

Business owners state that in a disaster the organization can afford to lose no more than 15 minutes of transaction data. Which planning metric does this define?

  1. Mean time to repair (MTTR)
  2. Mean time between failures (MTBF)
  3. Recovery time objective (RTO)
  4. Recovery point objective (RPO) Correct answer.

Explanation

The recovery point objective defines the maximum acceptable amount of data loss, expressed as a period of time before the failure. It drives replication frequency and backup intervals. The recovery time objective, by contrast, defines how quickly service must be restored, not how much data may be lost.

Question 46Design and Planning

Two core switches are configured so that either can carry the full production load if the other fails. Which design concern has been addressed?

  1. It eliminates a single point of failure. Correct answer.
  2. It prevents data remanence.
  3. It reduces scope creep.
  4. It enforces least privilege.

Explanation

A single point of failure is any component whose loss interrupts service. Providing a redundant path in which each device can carry the full load removes that dependency. Scope creep, data remanence, and least privilege are unrelated to component redundancy.

Question 47Design and Planning

What is the primary purpose of classifying data during the planning phase?

  1. To reduce the number of network devices required
  2. To determine the protection and handling controls each data set requires Correct answer.
  3. To set the physical dimensions of the data center
  4. To select the storage hardware vendor

Explanation

Classification assigns a sensitivity level to each data set so that proportionate controls - encryption, access restrictions, retention, and monitoring - can be selected. Without classification, controls tend to be applied uniformly, which either over-protects low-value data or under-protects sensitive data. Facility sizing and vendor selection follow from capacity and procurement planning, not from classification.

Question 48Design and Planning

A design team must apply an urgent patch to a production firewall outside the approved maintenance window. Which action best follows change management practice?

  1. Apply the patch only after the vendor publishes a subsequent release.
  2. Submit an emergency change request and obtain approval from the designated authority before applying the patch. Correct answer.
  3. Apply the patch immediately and document it at the next scheduled review.
  4. Defer the patch until the next monthly change advisory board meeting.

Explanation

Change management provides an emergency path precisely so that urgent work does not bypass oversight. The request is raised, assessed, and approved by a designated authority, then applied and recorded. Retrospective documentation or indefinite delay both defeat the purpose of the process.

Question 49Design and Planning

Which document records the configuration of a device as it actually runs in production?

  1. Risk register
  2. Design blueprint
  3. Baseline configuration Correct answer.
  4. Statement of work

Explanation

A baseline configuration captures the approved, hardened state of a device as deployed, and it is used to detect drift and to restore known-good settings. The design blueprint describes intended architecture rather than a device's live settings. A statement of work defines contractual deliverables, and a risk register tracks identified risks.

Question 50Design and Planning

A web server must be reachable from the internet but must not initiate connections to internal database servers. Which placement and control set best meets this requirement?

  1. In the management VLAN alongside network devices
  2. Directly on the perimeter router with an ACL that permits all traffic
  3. On the internal server VLAN, relying on host-based firewalls
  4. In a screened subnet that allows inbound access from the internet and blocks outbound access to internal networks Correct answer.

Explanation

A screened subnet, or DMZ, is a buffer zone between the internet and the internal network, allowing inbound service access while denying the server a path inward. This limits the damage an attacker can do if the web server is compromised. Placing the server inside the trusted network or on a management segment directly contradicts the requirement.