I85PREP
⌘ K
CCIS study materials
CCIS study resources

CCIS practice questions

One question at a time. Build your CCIS understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Fundamentals and Governance

In an information security governance program, what is the primary purpose of a formal risk appetite statement approved by executive leadership?

  1. To document the step-by-step procedures used during incident response
  2. To define the amount and type of risk the organization is willing to accept in pursuit of its objectives Correct answer.
  3. To record which employees have completed annual security awareness training
  4. To list the technical controls required for each system baseline

Explanation

A risk appetite statement expresses, at the leadership level, how much and what kinds of risk the organization will tolerate while pursuing its goals. It guides decision-making, prioritization, and the thresholds used in risk treatment, rather than specifying controls or procedures. Technical baselines and incident runbooks are downstream artifacts that should align with the stated appetite.

Question 2Security Fundamentals and Governance

Which principle from a widely used security control framework states that an individual should not be able to both initiate and approve a sensitive transaction?

  1. Least privilege
  2. Defense in depth
  3. Separation of duties Correct answer.
  4. Need to know

Explanation

Separation of duties splits critical tasks among different people so that no single individual controls an entire process end to end. Requiring one person to initiate and another to approve a transaction is the classic example. Least privilege and need to know limit access scope, while defense in depth layers controls, but none of these specifically prevents one person from completing a whole transaction alone.

Question 3Security Fundamentals and Governance

A security team classifies data so that the label determines handling rules such as encryption and retention. Which governance artifact most directly establishes those labels and their required handling?

  1. A vulnerability management standard
  2. A change management procedure
  3. A data classification policy Correct answer.
  4. A business continuity plan

Explanation

A data classification policy defines the categories of information (for example public, internal, confidential) and the handling requirements attached to each. It is the governance document that ties labels to controls such as encryption, sharing, and retention. Continuity plans, vulnerability standards, and change procedures address different concerns and do not define classification labels.

Question 4Security Fundamentals and Governance

Which type of control is an automated alert that fires when a user downloads an unusually large volume of records from a database?

  1. Corrective
  2. Detective Correct answer.
  3. Directive
  4. Preventive

Explanation

Detective controls identify and report events after or while they occur, enabling a response. An alert on anomalous download volume detects possible data exfiltration rather than blocking it. Preventive controls stop actions, corrective controls restore state after an incident, and directive controls steer behavior through policy or instruction.

Question 5Security Fundamentals and Governance

Under the principle of least privilege, how should access rights for a help desk analyst be assigned?

  1. Grant only the permissions needed to perform the assigned job tasks, reviewed periodically Correct answer.
  2. Grant administrator rights broadly so the analyst can resolve any ticket without escalation
  3. Grant the same rights as peers to ensure consistent service delivery
  4. Grant rights based on the analyst's seniority within the team

Explanation

Least privilege means granting the minimum access necessary to complete assigned work, with periodic review to remove what is no longer needed. This limits the blast radius of misuse or compromise. Broad administrator rights, seniority-based grants, and copying peer access all violate the principle by over-provisioning.

Question 6Security Fundamentals and Governance

What distinguishes a policy from a standard within a security governance hierarchy?

  1. A policy describes step-by-step tasks, while a standard describes roles
  2. A policy states management intent and mandatory requirements, while a standard specifies the mandatory details for meeting them Correct answer.
  3. A policy is written by technical staff, while a standard is approved by the board
  4. A policy is optional guidance, while a standard is mandatory

Explanation

In a typical hierarchy, policies are high-level management statements of intent and mandatory requirements, standards define specific mandatory requirements or configurations, and procedures describe step-by-step execution. Policies are not optional, and authorship does not define the distinction. This ordering keeps governance coherent and auditable.

Question 7Security Fundamentals and Governance

Which element is essential to a defensible security awareness program for a regulated organization?

  1. Tracking completion and measuring behavior change over time Correct answer.
  2. Distributing a single email reminder once per year
  3. Limiting training to the IT department only
  4. Requiring employees to sign an acknowledgment and nothing further

Explanation

An effective awareness program tracks participation and measures whether behavior actually improves, such as reduced phishing click rates. Completion tracking supports audit evidence, while behavior metrics show the program is working. One-off emails, bare acknowledgments, and restricting training to IT leave most of the workforce untested.

Question 8Security Fundamentals and Governance

Which statement best describes the role of the 'three lines model' in security governance?

  1. It requires three separate security operations centers for redundancy
  2. It separates management ownership, independent risk oversight, and independent assurance across functions Correct answer.
  3. It assigns all security responsibilities to the internal audit function
  4. It mandates three rounds of penetration testing each year

Explanation

The three lines model distributes responsibilities so that operational management owns and manages risk, a risk and compliance function provides independent oversight, and internal audit provides independent assurance. This separation reduces conflicts of interest and strengthens governance. It does not prescribe the number of SOCs or penetration tests.

Question 9Security Fundamentals and Governance

A vendor will process customer records on the organization's behalf. Which contract element most directly establishes the vendor's obligation to protect that data?

  1. A data processing agreement with defined security and breach notification obligations Correct answer.
  2. A statement of work describing project milestones
  3. A purchase order listing the license quantity
  4. A service level agreement specifying uptime percentages

Explanation

A data processing agreement defines how a processor may handle personal or confidential data and imposes security, confidentiality, and breach notification obligations. Uptime commitments, license quantities, and milestone descriptions do not establish data protection duties. This makes the processing agreement the controlling artifact for third-party data risk.

Question 10Security Fundamentals and Governance

When performing a qualitative risk assessment, which combination is typically used to prioritize identified risks?

  1. Likelihood and impact expressed on a defined scale Correct answer.
  2. Annualized loss expectancy and single loss expectancy
  3. Asset value and depreciation schedule
  4. Control cost and vendor licensing fees

Explanation

Qualitative assessments rate risks using descriptive scales for likelihood and impact, often combined in a matrix to produce a relative priority. Quantitative approaches use monetary measures such as single and annualized loss expectancy. Asset depreciation and vendor fees are not risk-rating dimensions in this context.

Question 11Security Fundamentals and Governance

A control is rated as having high inherent risk but low residual risk. What does this most likely indicate?

  1. The asset has no value to the organization
  2. Effective mitigating controls reduce the risk to an acceptable level Correct answer.
  3. The control has not been implemented at all
  4. The risk assessment was performed incorrectly

Explanation

Inherent risk is the exposure before controls, and residual risk is what remains after controls are applied. A large gap between high inherent and low residual risk indicates that mitigating controls are working effectively. It does not imply missing controls or assessment error, and valuable assets can still carry low residual risk.

Question 12Security Fundamentals and Governance

Which activity best demonstrates due care in security governance when a high-severity vulnerability is identified on an internet-facing server?

  1. Removing the server from the asset inventory to close the finding
  2. Applying a documented risk-based remediation timeline with interim compensating controls Correct answer.
  3. Waiting for the vendor to release a patch without any interim mitigation
  4. Documenting the vulnerability and deferring action until the next annual review

Explanation

Due care means acting reasonably and promptly in proportion to risk, which includes a defined remediation timeline and compensating controls while a permanent fix is pending. Deferring to an annual cycle ignores urgency, removing the asset from inventory conceals rather than manages the risk, and waiting passively leaves exposure unaddressed.

Question 13Security Fundamentals and Governance

What is the primary purpose of performing an access recertification campaign?

  1. To verify that existing access remains justified and to remove excessive or stale entitlements Correct answer.
  2. To measure the performance of the identity management system
  3. To confirm that users can still log in to their accounts
  4. To reset all user passwords on a quarterly basis

Explanation

Access recertification requires managers or resource owners to review entitlements and confirm or revoke them, which counters access creep and supports least privilege. Login testing, password resetting, and system performance measurement are separate operational activities. Recertification produces audit evidence that access is periodically validated.

Question 14Security Fundamentals and Governance

An organization adopts a framework that maps its controls to multiple regulatory requirements. What is the main governance benefit of this mapping?

  1. It reduces duplicate control testing and provides a unified view of compliance obligations Correct answer.
  2. It replaces the need for a risk assessment process
  3. It eliminates the need for any internal audit activity
  4. It guarantees that no regulatory finding will ever occur

Explanation

Control mapping lets one set of controls satisfy multiple frameworks, reducing redundant testing and giving leadership a consolidated view of obligations. It does not remove the need for independent audit, guarantee zero findings, or substitute for risk assessment. Mapping improves efficiency and traceability of compliance evidence.

Question 15Security Fundamentals and Governance

During a security audit, an auditor requests evidence that firewall rule changes were approved before implementation. Which artifact best satisfies this request?

  1. The current firewall configuration export
  2. The firewall vendor's product documentation
  3. A change ticket showing approval and the associated rule change record Correct answer.
  4. The network team's organizational chart

Explanation

Audit evidence must demonstrate that the approval happened before implementation, so a change ticket linking approval to the specific rule change is the appropriate artifact. A configuration export shows the current state but not the approval, and vendor documentation or an org chart does not evidence the control. Traceability between approval and change is the key attribute.

Question 16Security Fundamentals and Governance

A risk treatment option is selected in which the organization purchases cyber insurance to transfer part of the financial consequence of an incident. Which risk treatment strategy does this represent?

  1. Risk mitigation
  2. Risk transfer Correct answer.
  3. Risk acceptance
  4. Risk avoidance

Explanation

Risk transfer shifts some financial consequence to a third party, and insurance is the standard example. Avoidance eliminates the activity, mitigation reduces likelihood or impact through controls, and acceptance retains the risk knowingly. Insurance does not reduce the likelihood of the incident, only the financial exposure.

Question 17Security Fundamentals and Governance

Why should security metrics reported to executive leadership be tied to business objectives rather than only technical counts?

  1. Technical counts are always inaccurate and should never be collected
  2. Business-aligned metrics help leadership make informed risk decisions and allocate resources Correct answer.
  3. Executives are legally prohibited from reviewing technical data
  4. Technical metrics cannot be automated and require manual effort

Explanation

Governance reporting is most useful when metrics connect security posture to business outcomes, enabling informed decisions and resource allocation. Technical counts still matter operationally but are less meaningful to executives without business context. There is no prohibition on executives reviewing technical data, and many technical metrics are automated.

Question 18Security Fundamentals and Governance

Which practice best supports accountability for security responsibilities across an organization?

  1. Relying on employees to self-identify security tasks they will perform
  2. Assigning all security duties informally to the most experienced engineer
  3. Documenting security roles and responsibilities in formal charters and job descriptions Correct answer.
  4. Centralizing every security decision in the legal department

Explanation

Clear accountability requires documented roles, responsibilities, and decision rights so that ownership is explicit and auditable. Informal assignment, voluntary self-selection, and misplacing security decisions in legal leave gaps and ambiguity. Formal charters and job descriptions make responsibility enforceable and reviewable.

Question 19Security Fundamentals and Governance

A company must retain financial records for seven years under regulation. Which governance decision does this requirement most directly drive?

  1. The frequency of vulnerability scanning on web servers
  2. The data retention and disposal schedule for those records Correct answer.
  3. The password complexity requirement for administrators
  4. The choice of encryption algorithm for data at rest

Explanation

A regulatory retention period directly determines how long records must be kept and when they may be disposed of, which is captured in a retention schedule. Encryption algorithm selection, scanning frequency, and password complexity address different control objectives. Retention requirements also inform legal hold and disposal procedures.

Question 20Security Fundamentals and Governance

In a risk register, what does the 'risk owner' role entail?

  1. The individual accountable for managing the risk and ensuring treatment is carried out Correct answer.
  2. The person who performs the technical remediation work on the affected system
  3. The auditor who independently verifies control effectiveness
  4. The vendor who supplied the affected product

Explanation

The risk owner is accountable for the risk itself, including selecting and overseeing treatment and monitoring changes to exposure. Remediation may be delegated to technical staff, and auditors provide independent assurance rather than ownership. Vendors may contribute to treatment but do not own the organization's risk.

Question 21Security Fundamentals and Governance

An organization wants to reduce the likelihood that a departing employee retains access to cloud applications. Which governance control is most directly relevant?

  1. A quarterly review of firewall rule sets
  2. A joiner-mover-leaver process that triggers access revocation upon termination Correct answer.
  3. A monthly patch cycle for endpoint operating systems
  4. An annual phishing simulation for all staff

Explanation

A joiner-mover-leaver process ensures access is provisioned, adjusted, and revoked in step with employment changes, directly addressing orphaned accounts. Phishing simulations, firewall reviews, and endpoint patching address different threats and do not ensure timely revocation. Timely deprovisioning is a core identity governance control.

Question 22Security Fundamentals and Governance

Which statement best captures the relationship between compliance and security?

  1. Compliance demonstrates adherence to requirements, while security requires managing risk beyond those requirements Correct answer.
  2. Achieving compliance guarantees that an organization is secure against all threats
  3. Security and compliance are identical concepts with no meaningful distinction
  4. An organization can be secure without ever assessing its compliance obligations

Explanation

Compliance is evidence of meeting defined requirements, whereas security is the ongoing management of risk, including threats not covered by any framework. An organization can be compliant yet exposed to unaddressed risks, or secure in areas outside regulatory scope. Treating the two as identical leads to checkbox programs that miss emerging threats.

Question 23Security Fundamentals and Governance

A business unit requests an exception to a mandatory security standard to meet a product launch date. What is the most defensible governance response?

  1. Require a documented exception with risk assessment, compensating controls, approval authority, and an expiration date Correct answer.
  2. Approve the exception verbally to avoid delaying the launch
  3. Deny all exceptions because standards are absolute
  4. Allow the business unit to self-approve the exception and notify security afterward

Explanation

Policy exceptions should be formally documented, risk-assessed, supported by compensating controls, approved by the appropriate authority, and time-bound so they do not become permanent. Verbal approval and self-approval remove accountability, while blanket denial ignores legitimate business needs and pushes risk underground. A controlled exception process balances agility with governance.

Question 24Security Fundamentals and Governance

An organization discovers that a critical third-party provider has suffered a breach affecting shared data. Which governance action best reflects sound oversight?

  1. Remove the provider from the vendor inventory to limit liability
  2. Wait for the provider to publish a public statement before taking any internal action
  3. Terminate the contract immediately without assessing operational impact
  4. Activate the incident response and vendor management processes to assess impact, coordinate with the provider, and notify affected parties as required Correct answer.

Explanation

Sound oversight means invoking established incident response and third-party management processes to determine impact, coordinate with the provider, and meet notification obligations. Immediate termination without impact analysis can disrupt critical operations, passive waiting delays required notifications, and removing the vendor from inventory conceals the relationship. Governance requires documented, timely, and coordinated action.

Question 25Security Fundamentals and Governance

A risk assessment identifies a high-impact risk that leadership decides to accept rather than treat. What governance evidence makes this decision defensible?

  1. A copy of the vendor's security certification
  2. A formal acceptance record signed by an authorized owner acknowledging the risk and its rationale Correct answer.
  3. An entry in the asset inventory showing the affected system
  4. A note that the risk was discussed informally in a team meeting

Explanation

Risk acceptance should be explicit, documented, and approved at the appropriate authority level, with the rationale and any monitoring conditions recorded. Informal discussion, asset inventory entries, and vendor certifications do not demonstrate that a decision-maker knowingly accepted the risk. Formal records support accountability and auditability.

Question 26Security Fundamentals and Governance

In a security governance structure, what is the primary distinction between a policy and a procedure?

  1. A policy describes technical configuration settings, while a procedure assigns ownership of business risks
  2. A policy is advisory and optional, while a procedure is legally binding on all staff
  3. A policy states management intent and mandatory requirements, while a procedure gives the step-by-step instructions for meeting them Correct answer.
  4. A policy is written by auditors, while a procedure is written by system administrators

Explanation

A policy is a high-level statement of management intent that mandates what must be done and why, and it is approved at a senior level. A procedure is a lower-level document that specifies the ordered steps, roles, and tools used to carry out the policy in practice. This hierarchy lets governance set direction while operational teams implement it consistently.

Question 27Security Fundamentals and Governance

Which classification approach best reflects a data governance scheme where handling requirements are driven by the sensitivity of the information rather than by the system that stores it?

  1. Classify data by the department that created it and apply that department's existing controls
  2. Classify data by storage location so that each server has its own handling rules
  3. Classify data only at the point of disposal so that retention rules can be applied
  4. Classify data by sensitivity level and define handling rules per level that apply wherever the data resides Correct answer.

Explanation

Sensitivity-based classification assigns each data set a level such as public, internal, confidential, or restricted, and attaches handling requirements to the level. Because the rules follow the data rather than the system, they remain valid when data is copied to a new platform, shared with a partner, or moved to the cloud. This is what makes classification a durable governance control.

Question 28Security Fundamentals and Governance

An organization defines a recovery time objective of four hours for its order-processing system. Which governance action most directly makes that objective enforceable?

  1. Documenting the objective in the business continuity plan and testing restoration against it on a scheduled basis Correct answer.
  2. Adding the objective to the security awareness training curriculum for all staff
  3. Listing the objective in the risk register as an accepted risk
  4. Publishing the objective in the annual report to shareholders

Explanation

A recovery time objective becomes meaningful only when it is written into continuity and disaster recovery plans and then validated through scheduled tests that measure actual restoration time. Testing exposes gaps between the stated objective and real capability, which drives corrective action and resource decisions. Without testing, the objective is an aspiration rather than a control.

Question 29Security Fundamentals and Governance

A security team wants to demonstrate that its controls are operating effectively over time rather than merely existing on paper. Which evidence set best supports that claim?

  1. A list of the security tools deployed and their vendor support status
  2. Sample records showing controls executed during the period, such as reviewed access logs, completed change tickets, and closed remediation items Correct answer.
  3. The approved policy document and the organizational chart of the security function
  4. A signed statement from the chief information security officer affirming control effectiveness

Explanation

Operating effectiveness is evidenced by records produced while controls actually ran during the review period, such as reviewed logs, approved changes, and closed findings. These artifacts show the control was performed, by whom, and when, which is what an assessor tests. Design documents alone only prove intent, not execution.

Question 30Security Fundamentals and Governance

A regulator requires that only authorized personnel can approve changes to payment card systems, and the organization delegates this authority to two named roles. Which governance mechanism most effectively preserves accountability when those individuals are unavailable?

  1. Suspend all changes to payment card systems whenever either named role is absent
  2. Define documented delegation of authority with named alternates, time limits, and logging of each approval Correct answer.
  3. Require the two named roles to approve all changes retroactively once they return
  4. Allow any member of the IT operations team to approve changes during absences to avoid delays

Explanation

Accountability survives absence only when delegation is explicit: the authority, the alternates, the scope, and the duration are documented, and each approval is attributable in a log. This keeps every change tied to a responsible, authorized individual while avoiding operational paralysis. Undocumented or retroactive approval breaks the audit trail the regulator requires.

Question 31Network Security

In a network security context, which statement best defines the CIA triad principle of integrity?

  1. Data is disclosed only to users who hold a signed confidentiality agreement.
  2. Data is protected from unauthorized modification or deletion, whether in transit or at rest. Correct answer.
  3. Data is encrypted with a key that only the security team can recover.
  4. Data is available to authorized users whenever they legitimately need it.

Explanation

Integrity means that data and systems remain accurate and unaltered except through authorized, accountable changes. Encryption and access agreements are mechanisms that may support confidentiality, not the definition of integrity itself.

Question 32Network Security

A firewall rule set processes packets in order and stops at the first match. A packet from 10.1.5.20 to a web server matches rule 3 (deny) before rule 7 (permit). What is the outcome?

  1. The packet is permitted only if the session is already established.
  2. The packet is denied because first-match semantics apply. Correct answer.
  3. The packet is permitted because a later permit rule also matches.
  4. The packet is logged and forwarded for administrator review.

Explanation

In first-match firewall evaluation the first rule that matches determines the action and later rules are never consulted. A later permit rule therefore cannot override an earlier deny for the same traffic.

Question 33Network Security

Which protocol and port combination is used by a stateful packet filter to recognize an established outbound HTTPS session?

  1. UDP port 53
  2. TCP port 25
  3. UDP port 123
  4. TCP port 443 Correct answer.

Explanation

HTTPS runs over TCP port 443, and a stateful firewall tracks the connection tuple so return traffic is allowed without an inbound rule. The other ports correspond to unrelated services.

Question 34Network Security

An organization wants to separate the guest wireless network from the corporate wired network while allowing both to reach the internet. Which control most directly achieves this segmentation?

  1. Enabling port security with sticky MAC addresses on access ports.
  2. Applying a longer WPA2 passphrase to the guest SSID.
  3. Configuring DHCP snooping on all access switches.
  4. Deploying a VLAN with inter-VLAN routing restricted by an access control list. Correct answer.

Explanation

VLANs create separate broadcast domains, and an ACL on the routing path controls which traffic may cross between them. This provides the isolation while still permitting shared internet egress.

Question 35Network Security

Which description correctly characterizes a DMZ in a typical enterprise architecture?

  1. A backup network used only during disaster recovery failover.
  2. A management VLAN reserved for out-of-band switch administration.
  3. An encrypted tunnel between two branch offices over the internet.
  4. A subnet that holds internet-facing services and is reachable from both untrusted and internal networks under policy control. Correct answer.

Explanation

A DMZ is a screened subnet that hosts externally accessible services while limiting direct exposure of the internal network. Traffic between the DMZ, the internet, and internal hosts is controlled by firewall policy.

Question 36Network Security

What is the primary purpose of NAT in a perimeter design from a security standpoint?

  1. It hides internal addressing from direct external reachability and reduces address exposure. Correct answer.
  2. It guarantees integrity of packets in transit.
  3. It encrypts all traffic leaving the internal network.
  4. It authenticates users before they can reach the internet.

Explanation

NAT translates internal addresses so external parties cannot directly address internal hosts, which reduces exposure. It is not an authentication, encryption, or integrity mechanism.

Question 37Network Security

Which technology allows a remote employee's traffic to be encrypted to the corporate gateway while the device itself is checked for compliance before access is granted?

  1. A site-to-site IPsec tunnel between two data centers
  2. A TACACS+ server for device administration
  3. A remote-access VPN combined with endpoint posture assessment Correct answer.
  4. A transparent web proxy using explicit authentication

Explanation

Remote-access VPNs encrypt the client-to-gateway path, and posture assessment verifies device health before granting access. The combination addresses both transport protection and endpoint trust.

Question 38Network Security

A security team wants to detect a port scan that touches many ports on one host in a short window. Which detection approach fits this goal?

  1. Threshold-based alerting on distinct destination ports per source Correct answer.
  2. Signature matching on known malware file hashes
  3. Auditing password complexity policy compliance
  4. Reviewing DHCP lease duration anomalies

Explanation

Port scanning produces a distinctive pattern of many distinct destination ports contacted by one source in a short period. Threshold or frequency-based detection captures this behavior directly.

Question 39Network Security

An IDS is deployed on a switch span port and generates an alert for traffic it observed. What is the security consequence of this deployment mode?

  1. It terminates the attacker's TCP session automatically.
  2. It blocks the traffic inline before it reaches the server.
  3. It rewrites the malicious packets to neutralize them.
  4. It can detect but not block the malicious traffic it observes. Correct answer.

Explanation

A passive IDS receives a copy of traffic and therefore can only alert, not act on the original flow. Blocking requires an inline prevention mode such as IPS.

Question 40Network Security

A signature detects the byte sequence 'GET /admin' in HTTP requests. Which evasion is most likely to defeat this signature while still reaching the same resource?

  1. Sending the request over TCP instead of UDP.
  2. Using a different source port for the connection.
  3. Encoding the path as 'GET /%61dmin' so the server decodes it after inspection. Correct answer.
  4. Increasing the TCP window size during the session.

Explanation

If the sensor matches literal bytes but the server normalizes percent-encoding, an encoded path can bypass the signature yet resolve to the same resource. This is a classic normalization mismatch evasion.

Question 41Network Security

Which IPsec component provides data origin authentication and integrity for the entire IP packet, including the outer IP header?

  1. AH in transport mode Correct answer.
  2. IKE phase 1
  3. GRE encapsulation
  4. ESP in tunnel mode

Explanation

Authentication Header protects the packet with an integrity check that covers the IP header fields plus payload, providing origin authentication and integrity. ESP provides confidentiality and does not authenticate the outer header in the same way.

Question 42Network Security

A site-to-site IPsec tunnel is failing phase 2 negotiation while phase 1 succeeds. Which mismatch is the most likely cause?

  1. Different proposed encryption and hash algorithms for the IPsec security association Correct answer.
  2. Blocked UDP port 500 between the peers
  3. Mismatched IKE identity types during main mode
  4. Incorrect pre-shared key on the two peers

Explanation

Phase 2 establishes the IPsec SA and requires agreement on ESP proposals such as encryption and hash algorithms. A mismatch there fails phase 2 even when phase 1 has completed.

Question 43Network Security

A web application behind a reverse proxy must preserve the client's original IP for logging and access control. Which approach is appropriate?

  1. Configure the proxy to insert a forwarded-for header and have the application trust it only from the proxy. Correct answer.
  2. Enable source NAT so all clients appear as the proxy address.
  3. Terminate TLS at the client and pass plaintext to the backend.
  4. Disable logging on the proxy to avoid duplicate entries.

Explanation

A reverse proxy can convey the original client address in a standardized forwarding header. The application must trust that header only from the proxy, otherwise clients could spoof their address.

Question 44Network Security

Which control best mitigates ARP spoofing on a switched local network?

  1. Dynamic ARP inspection tied to the DHCP snooping binding table Correct answer.
  2. Applying storm control for broadcast traffic
  3. Enabling BPDU guard on all access ports
  4. Configuring root guard on distribution uplinks

Explanation

Dynamic ARP inspection validates ARP packets against a trusted binding of IP-to-MAC learned through DHCP snooping. Gratuitous or forged ARP replies from an attacker are then dropped.

Question 45Network Security

An attacker on the same wireless network impersonates the legitimate access point to capture credentials. Which term describes this attack?

  1. DNS cache poisoning
  2. Bluejacking
  3. Evil twin access point Correct answer.
  4. VLAN hopping

Explanation

An evil twin is a rogue access point broadcasting the same SSID as a legitimate network to lure clients and intercept their traffic. Clients associate to it believing it is the real AP.

Question 46Network Security

Which authentication framework forwards user credentials from a network access device to a central server and supports per-command authorization for administrative sessions?

  1. Kerberos
  2. TACACS+ Correct answer.
  3. LDAP
  4. RADIUS

Explanation

TACACS+ separates authentication, authorization, and accounting and supports granular per-command authorization for device administration. RADIUS combines authentication and authorization and is more common for network access.

Question 47Network Security

A company requires that all DNS responses be validated cryptographically to prevent forged answers. Which deployment meets this requirement?

  1. Split-horizon DNS with separate internal and external zones
  2. A DNS sinkhole that blocks known malicious domains
  3. A validating DNS resolver that performs DNSSEC signature checks Correct answer.
  4. DNS over TLS between the client and the resolver

Explanation

DNSSEC provides cryptographic signatures over DNS records, and a validating resolver checks them to reject forged data. Encryption of the transport alone does not prove record authenticity.

Question 48Network Security

Which statement accurately distinguishes a network-based IPS from a host-based IPS?

  1. A network IPS runs as an agent on servers, while a host IPS sits inline at the perimeter.
  2. A network IPS only logs events, while a host IPS only blocks them.
  3. A network IPS inspects traffic at a chokepoint for many hosts, while a host IPS inspects activity on a single endpoint. Correct answer.
  4. A network IPS requires no signature updates, while a host IPS requires daily updates.

Explanation

The key distinction is placement and scope: a network IPS monitors traffic traversing a segment, and a host IPS runs on the endpoint to watch local processes and file activity. Both can detect and prevent.

Question 49Network Security

A SOC wants to correlate firewall denies, IDS alerts, and authentication failures across devices. Which capability is most important for this goal?

  1. Centralized log collection with normalized timestamps and fields Correct answer.
  2. Shortening the DHCP lease time
  3. Increasing the firewall session table size
  4. Deploying additional signature sensors

Explanation

Correlation requires that events from different sources share a common time base and normalized schema. Centralized collection with consistent timestamps and fields enables meaningful correlation.

Question 50Network Security

An organization segments its data center so that the web tier may reach the application tier on port 8443 and nothing else. Which enforcement point best implements this in a virtualized environment?

  1. A perimeter firewall at the internet edge
  2. Microsegmentation policy applied at the hypervisor level Correct answer.
  3. Spanning-tree portfast on access ports
  4. A wireless controller ACL on the guest SSID

Explanation

Microsegmentation enforces east-west policy close to the workloads, such as at the hypervisor, so only the permitted application flow is allowed. A perimeter firewall does not see internal tier-to-tier traffic.