I85PREP
⌘ K
CSAT (USAF Cyber Test) study materials
CSAT (USAF Cyber Test) study resources

CSAT (USAF Cyber Test) practice questions

One question at a time. Build your CSAT (USAF Cyber Test) understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Networking Fundamentals and Protocols

Which OSI model layer is responsible for logical addressing and choosing a path between networks?

  1. Transport layer
  2. Session layer
  3. Network layer Correct answer.
  4. Data Link layer

Explanation

Layer 3, the network layer, handles logical (IP) addressing and best-path forwarding between different networks. The data link layer deals with framing and hardware addresses on a single link, while the transport layer provides end-to-end delivery between processes.

Question 2Networking Fundamentals and Protocols

By default, which TCP port does HTTPS use?

  1. 22
  2. 80
  3. 443 Correct answer.
  4. 53

Explanation

HTTPS is HTTP carried over TLS and is assigned TCP port 443 by IANA. Port 80 is plain HTTP, port 22 is SSH, and port 53 is used for DNS queries.

Question 3Networking Fundamentals and Protocols

Which protocol is used to map a known IPv4 address to a MAC address on the local link?

  1. ARP Correct answer.
  2. DHCP
  3. ICMP
  4. DNS

Explanation

ARP broadcasts a request asking which station owns a given IPv4 address, and the owner replies with its MAC address so frames can be encapsulated. DNS maps names to addresses, DHCP leases addresses, and ICMP carries error and diagnostic messages.

Question 4Networking Fundamentals and Protocols

What is the default subnet mask for a classful Class C IPv4 network?

  1. 255.255.255.0 Correct answer.
  2. 255.0.0.0
  3. 255.255.0.0
  4. 255.255.255.128

Explanation

A Class C network uses the first three octets for the network portion, which corresponds to a /24 prefix and the mask 255.255.255.0. 255.0.0.0 is the Class A default and 255.255.0.0 is the Class B default.

Question 5Networking Fundamentals and Protocols

Which of these is the standard IPv4 loopback address?

  1. 169.254.0.1
  2. 0.0.0.0
  3. 192.168.0.1
  4. 127.0.0.1 Correct answer.

Explanation

The entire 127.0.0.0/8 range is reserved for loopback, and 127.0.0.1 is the conventional address a host uses to reach its own IP stack. 169.254.0.0/16 is link-local self-assignment, and 192.168.0.0/16 is private space.

Question 6Networking Fundamentals and Protocols

Which device forwards frames based on destination MAC addresses?

  1. A hub
  2. A switch Correct answer.
  3. A repeater
  4. A router

Explanation

A Layer 2 switch learns MAC addresses per port and forwards each frame only out the port where the destination MAC was learned. Routers forward on IP addresses, while hubs and repeaters simply regenerate signals without any addressing logic.

Question 7Networking Fundamentals and Protocols

What is the primary function of the Domain Name System?

  1. It assigns IP addresses to hosts automatically
  2. It resolves host names to IP addresses Correct answer.
  3. It encrypts traffic between web servers
  4. It forwards packets between subnets

Explanation

DNS is a distributed hierarchical database that translates human-readable names such as www.example.com into the IP addresses clients need to connect. Address assignment is DHCP's job, encryption is TLS's job, and packet forwarding is routing.

Question 8Networking Fundamentals and Protocols

Which transport-layer protocol is connectionless and provides no delivery guarantee?

  1. SCTP
  2. TCP
  3. UDP Correct answer.
  4. FTP

Explanation

UDP sends datagrams without a handshake, acknowledgments, or retransmission, leaving reliability to the application. TCP and SCTP both provide connection-oriented, acknowledged delivery, and FTP is an application-layer protocol that runs over TCP.

Question 9Networking Fundamentals and Protocols

How many usable host addresses are available in a /27 IPv4 subnet?

  1. 14
  2. 32
  3. 62
  4. 30 Correct answer.

Explanation

A /27 leaves 5 host bits, giving 2^5 = 32 total addresses. The all-zeros network address and all-ones broadcast address cannot be assigned to hosts, leaving 30 usable addresses.

Question 10Networking Fundamentals and Protocols

Which sequence correctly describes the TCP three-way handshake used to open a connection?

  1. SYN, SYN-ACK, ACK, FIN
  2. ACK, SYN, SYN-ACK
  3. SYN-ACK, SYN, RST
  4. SYN, SYN-ACK, ACK Correct answer.

Explanation

The client initiates with a SYN carrying its initial sequence number, the server replies with SYN-ACK acknowledging that number and advertising its own, and the client completes with an ACK. Ordering data transfer, teardown, or reset messages before the handshake completes is incorrect.

Question 11Networking Fundamentals and Protocols

Which of the following IPv4 addresses belongs to a private RFC 1918 range?

  1. 8.8.8.8
  2. 172.32.5.1
  3. 172.20.10.5 Correct answer.
  4. 192.169.1.1

Explanation

RFC 1918 reserves 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 for private use. The 172 block spans only 172.16.0.0 through 172.31.255.255, so 172.20.10.5 is private while 172.32.5.1 falls outside the reserved range.

Question 12Networking Fundamentals and Protocols

What is the function of the TTL field in an IPv4 header?

  1. It caps how many hops a packet may take Correct answer.
  2. It specifies the total length of the datagram in bytes
  3. It identifies the upper-layer protocol in the payload
  4. It holds a checksum covering the header

Explanation

Each router decrements the TTL by one and discards the packet when it reaches zero, which prevents packets from circulating forever when routing loops exist. Total length, protocol, and header checksum are all separate fields and do not limit forwarding lifetime.

Question 13Networking Fundamentals and Protocols

Which message sequence does a DHCP client follow to obtain a lease?

  1. Request, Offer, Discover, ACK
  2. Discover, Request, Offer, Acknowledge
  3. Discover, Offer, Request, ACK Correct answer.
  4. Offer, Discover, Request, ACK

Explanation

The client first broadcasts Discover, a server answers with an Offer, the client formally asks for that offer with a Request, and the server confirms with an Acknowledgment - remembered as DORA. Any sequence that has the server offering before the client discovers, or the client requesting before an offer exists, cannot complete a lease.

Question 14Networking Fundamentals and Protocols

Which port range contains the IANA well-known ports?

  1. 49152-65535
  2. 0-1023 Correct answer.
  3. 1024-49151
  4. 1-255

Explanation

IANA divides the 16-bit port space so that 0-1023 are well-known system ports such as 22, 53, and 443. The 1024-49151 range holds registered ports and 49152-65535 holds dynamic or ephemeral ports.

Question 15Networking Fundamentals and Protocols

Which tool relies on ICMP Echo Request and Echo Reply messages to test reachability?

  1. Netstat
  2. Ping Correct answer.
  3. Traceroute
  4. Nslookup

Explanation

Ping sends an ICMP Echo Request and waits for the Echo Reply, reporting round-trip time and loss. Traceroute manipulates TTL values, netstat lists local connections, and nslookup queries DNS servers.

Question 16Networking Fundamentals and Protocols

What does configuring VLANs on a switch accomplish?

  1. It splits a switch into separate broadcast domains Correct answer.
  2. It assigns IP addresses to connected hosts dynamically
  3. It converts private addresses into public addresses at the edge
  4. It encrypts frames traveling between switches

Explanation

A VLAN logically partitions one physical switch into multiple Layer 2 broadcast domains, so broadcasts and unknown unicast frames stay within their own group. Encryption, address assignment, and address translation are performed by other technologies entirely.

Question 17Networking Fundamentals and Protocols

What does Network Address Translation primarily do?

  1. It assigns IP addresses to hosts automatically
  2. It filters traffic based on TCP port numbers
  3. It converts private IPs to a public IP Correct answer.
  4. It resolves host names to IP addresses

Explanation

NAT rewrites the source or destination addresses in packet headers, letting many hosts with RFC 1918 addresses share a single public address. Name resolution, dynamic addressing, and port-based filtering are separate functions.

Question 18Networking Fundamentals and Protocols

How long is a MAC address as defined by Ethernet?

  1. 48 bits Correct answer.
  2. 64 bits
  3. 128 bits
  4. 32 bits

Explanation

Ethernet MAC addresses are 48 bits, conventionally written as twelve hexadecimal digits. The first 24 bits identify the organizationally unique identifier assigned to the vendor and the remainder is set by the vendor.

Question 19Networking Fundamentals and Protocols

Why does a host need a default gateway configured?

  1. To obtain an IP address from a server
  2. To resolve MAC addresses of local hosts
  3. To reach hosts on other networks Correct answer.
  4. To authenticate users before granting access

Explanation

When the destination IP is outside the host's own subnet, the host sends the frame to the default gateway, which routes it onward. Traffic for hosts inside the same subnet is delivered directly using ARP and never touches the gateway.

Question 20Networking Fundamentals and Protocols

Given the subnet 192.168.1.0/26, what is the broadcast address of the second subnet?

  1. 192.168.1.127 Correct answer.
  2. 192.168.1.126
  3. 192.168.1.63
  4. 192.168.1.64

Explanation

A /26 provides blocks of 64 addresses, so the subnets begin at .0, .64, .128, and .192. The second block spans 192.168.1.64 through 192.168.1.127, and the highest address in a block is its broadcast address.

Question 21Networking Fundamentals and Protocols

How many /26 subnets can be created from 10.0.0.0/24, and how many usable hosts does each contain?

  1. 2 subnets with 126 usable hosts each
  2. 8 subnets with 30 usable hosts each
  3. 4 subnets, each with 64 usable hosts
  4. 4 subnets with 62 usable hosts each Correct answer.

Explanation

Moving from /24 to /26 borrows 2 bits, which yields 2^2 = 4 subnets. Each subnet keeps 6 host bits, giving 64 total addresses minus the network and broadcast addresses for 62 usable hosts.

Question 22Networking Fundamentals and Protocols

Which protocol is an exterior gateway protocol that uses a path-vector algorithm between autonomous systems?

  1. OSPF
  2. RIP
  3. EIGRP
  4. BGP Correct answer.

Explanation

BGP is the inter-domain routing protocol of the Internet; it exchanges reachability information between autonomous systems and selects paths using attributes such as the AS path. OSPF, RIP, and EIGRP are all interior gateway protocols used within a single administrative domain.

Question 23Networking Fundamentals and Protocols

Which statement about IPv6 addressing is accurate?

  1. IPv6 uses 128-bit addresses and has no broadcast address Correct answer.
  2. IPv6 uses 128-bit addresses and sends broadcasts to all-ones
  3. IPv6 uses 32-bit addresses written in dotted-decimal notation
  4. IPv6 uses 64-bit addresses and relies on ARP for resolution

Explanation

IPv6 addresses are 128 bits and the protocol eliminates broadcast entirely; one-to-many delivery is handled by multicast groups plus Neighbor Discovery. The 32-bit dotted-decimal format belongs to IPv4, and no IPv6 broadcast address exists.

Question 24Networking Fundamentals and Protocols

A TCP receiver advertises a window size of zero. What does this signal to the sender?

  1. The connection has been reset by the receiver
  2. The sender must pause until the window reopens Correct answer.
  3. The sender must immediately retransmit the last segment
  4. The receiver has acknowledged all outstanding data

Explanation

A zero window means the receive buffer is full, so the sender stops transmitting and periodically probes until a window update greater than zero arrives. This is flow control, distinct from acknowledgments and from connection reset.

Question 25Networking Fundamentals and Protocols

An attacker on a LAN sends unsolicited ARP replies binding the default gateway's IP address to the attacker's own MAC address. What is the primary result?

  1. Hosts receive duplicate IP addresses from the DHCP server
  2. The gateway stops routing packets for the entire subnet
  3. Host traffic to the gateway is sent to the attacker Correct answer.
  4. The switch disables the port that sent the replies

Explanation

ARP has no authentication, so hosts accept the forged mapping and place the attacker's MAC in the destination field of frames bound for the gateway, creating a man-in-the-middle position. The gateway keeps routing normally and DHCP is unaffected; the deception works precisely because it is invisible to normal traffic handling.

Question 26Networking Fundamentals and Protocols

Which OSI model layer is responsible for logical addressing and for choosing a path between separate networks?

  1. Transport
  2. Physical
  3. Network Correct answer.
  4. Data link

Explanation

The network layer handles logical (IP) addressing and makes forwarding/routing decisions that move packets between different networks. Layers below it deal with the local link and the physical signaling medium, while the layer above handles end-to-end connections.

Question 27Networking Fundamentals and Protocols

In which topology is every device attached to one central device, so that a single cable failure disrupts only the device on that cable?

  1. Star Correct answer.
  2. Bus
  3. Full mesh
  4. Ring

Explanation

In a star topology each endpoint has its own dedicated link to a central hub or switch, so a break on one link isolates only that endpoint. The central device becomes the single point of failure for the whole segment.

Question 28Networking Fundamentals and Protocols

A router holds these routes: 10.0.0.0/8 via R1, 10.1.0.0/16 via R2, 10.1.2.0/24 via R3, and 0.0.0.0/0 via R4. A packet destined for 10.1.2.55 arrives. Which next hop is selected?

  1. R3, because 10.1.2.0/24 is the longest matching prefix Correct answer.
  2. R2, because 10.1.0.0/16 covers the destination
  3. R4, because the default route covers any destination
  4. R1, because 10.0.0.0/8 is the first matching entry

Explanation

When multiple routes match a destination, a router forwards using the most specific match, meaning the route with the longest prefix length. All three of the 10.x routes match 10.1.2.55, and /24 is longer than /16 and /8, so R3 is chosen.

Question 29Networking Fundamentals and Protocols

An IPv4 router receives a packet that is larger than the MTU of the outbound interface, and the packet's Don't Fragment (DF) bit is set. What does the router do?

  1. Drops the packet and returns an ICMP error to the source Correct answer.
  2. Forwards the packet unchanged toward the next hop
  3. Holds the packet in a queue until the MTU increases
  4. Fragments the packet into pieces small enough for the outbound link

Explanation

The DF bit forbids the router from fragmenting the packet, so it must discard it and report the problem. It sends an ICMP Destination Unreachable message with the fragmentation-needed code, which is how path MTU discovery works.

Question 30Networking Fundamentals and Protocols

A TCP sender transmits a segment with sequence number 4001 that carries 600 bytes of payload and has neither the SYN nor the FIN flag set. What acknowledgment number does the receiver return?

  1. 4002
  2. 600
  3. 4600
  4. 4601 Correct answer.

Explanation

The acknowledgment number is the next sequence number the receiver expects, computed as the segment's sequence number plus the count of payload bytes accepted. With no SYN or FIN present, no extra sequence numbers are consumed, so 4001 + 600 = 4601.

Question 31Operating Systems and Command-Line Concepts

Which Linux command lists the contents of the current working directory?

  1. mv
  2. ls Correct answer.
  3. cat
  4. cd

Explanation

ls reads a directory and prints its entries to standard output. cd changes the shell's working directory, mv relocates or renames files, and cat writes file contents to the terminal.

Question 32Operating Systems and Command-Line Concepts

Which Linux command prints the absolute path of the shell's current working directory?

  1. cd
  2. where
  3. dir
  4. pwd Correct answer.

Explanation

pwd stands for print working directory and outputs the full path from the root to the current directory. The other choices either change directories or belong to Windows command conventions.

Question 33Operating Systems and Command-Line Concepts

Which command creates a new directory in both the Linux and Windows command lines?

  1. newdir
  2. mkfile
  3. mkdir Correct answer.
  4. touch

Explanation

mkdir (make directory) exists in both cmd.exe and Unix shells and creates a directory at the given path. touch creates or timestamps files on Unix, and newdir and mkfile are not standard commands.

Question 34Operating Systems and Command-Line Concepts

Which Windows command-line utility displays the IP address, subnet mask, and default gateway of the local host?

  1. ipconfig Correct answer.
  2. netstat -ano
  3. ping
  4. tracert -d

Explanation

ipconfig reports the TCP/IP configuration of local interfaces, including address, mask, and gateway. ping tests reachability, tracert maps a route, and netstat lists connections.

Question 35Operating Systems and Command-Line Concepts

In an operating system, what is the main job of the kernel?

  1. Providing the graphical desktop environment and window manager for the user
  2. Translating source code into machine instructions for the processor
  3. Arbitrating hardware and isolating processes Correct answer.
  4. Storing user documents and application configuration files on the local disk

Explanation

The kernel is the privileged core that schedules CPU time, manages memory, and mediates all access to devices. User programs request those services through system calls rather than touching hardware directly.

Question 36Operating Systems and Command-Line Concepts

In a Linux permission string such as -rwxr-xr--, what does the first character represent?

  1. The file type (regular, directory, device) Correct answer.
  2. Whether the file may be executed by any user on the system
  3. The number of hard links that point to this file
  4. Whether the owner has permission to read the file

Explanation

The permission string begins with a type indicator: a hyphen for a regular file, d for a directory, and letters such as l or c for links and devices. The remaining nine characters are the read, write, and execute bits for owner, group, and others.

Question 37Operating Systems and Command-Line Concepts

Which Linux command searches for lines matching a text pattern inside files and prints the matching lines?

  1. find
  2. locate
  3. sort
  4. grep Correct answer.

Explanation

grep scans file contents line by line and outputs lines that match a supplied pattern. find and locate work on file names and paths, while sort orders lines rather than filtering them.

Question 38Operating Systems and Command-Line Concepts

A user whose working directory is /home/alice runs the command cd docs. Which directory does the shell move into?

  1. /home/docs
  2. /docs
  3. The root directory of the current file system
  4. /home/alice/docs Correct answer.

Explanation

A path that does not begin with a slash is relative and is resolved against the current working directory. Appending docs to /home/alice yields /home/alice/docs.

Question 39Operating Systems and Command-Line Concepts

What permissions does the octal mode 754 grant?

  1. rw-r--r--
  2. rwxr-xr-- Correct answer.
  3. rwxrw-r--
  4. r-xrwxr-x

Explanation

Each octal digit encodes one permission triple as the sum of read (4), write (2), and execute (1). Thus 7 is rwx for the owner, 5 is r-x for the group, and 4 is r-- for others.

Question 40Operating Systems and Command-Line Concepts

In the command ps aux | grep ssh, what does the vertical bar do?

  1. Sends the standard output of ps aux as standard input to grep Correct answer.
  2. Runs ps aux and grep concurrently and prints both outputs separately
  3. Appends the output of ps aux to a file named grep
  4. Compares the output of ps aux against the string ssh

Explanation

A pipe connects the standard output of the left command to the standard input of the right command, so grep filters the process listing as it is produced. No intermediate file is created.

Question 41Operating Systems and Command-Line Concepts

Which shell operator redirects standard output to a file and overwrites any existing contents?

  1. |
  2. >>
  3. <
  4. > Correct answer.

Explanation

A single > truncates the target file and writes standard output into it. The double >> form appends instead, and the other operators connect streams or feed input.

Question 42Operating Systems and Command-Line Concepts

What is the purpose of the sudo command?

  1. It encrypts each command before the shell executes it
  2. It permanently logs the user in as root until logout
  3. It creates a new account with administrative rights
  4. It runs one command as another user, usually root Correct answer.

Explanation

sudo consults its policy file and, if permitted, executes a single command under a different user identity, then returns the shell to the original user. It does not persist an elevated session.

Question 43Operating Systems and Command-Line Concepts

Which signal does kill -9 PID send, and how does the target process respond?

  1. SIGKILL, which the process cannot catch or ignore Correct answer.
  2. SIGTERM, which the process can handle and shut down gracefully
  3. SIGHUP, which restarts the process
  4. SIGSTOP, which pauses the process until continued

Explanation

Signal 9 is SIGKILL, which the kernel delivers directly by terminating the process; no handler is invoked. It is used when a process refuses to exit after a graceful request.

Question 44Operating Systems and Command-Line Concepts

What does the PATH environment variable control in a Unix-like shell?

  1. The list of paths the kernel uses to find device drivers
  2. The default directory where newly created files are placed
  3. Directories searched when a bare command name is typed Correct answer.
  4. The order in which the shell runs user login scripts

Explanation

When a command name contains no slash, the shell walks the colon-separated PATH entries in order and runs the first matching executable it finds. Editing PATH changes which program wins that search.

Question 45Operating Systems and Command-Line Concepts

Which command appends the contents of a file to an existing log file without destroying the log's earlier entries?

  1. cat file | tee log.txt
  2. cat file >> log.txt Correct answer.
  3. cat file > log.txt
  4. cat file < log.txt

Explanation

The >> operator opens the target in append mode, so new data is written after the existing bytes. In contrast, a single > truncates the file before writing.

Question 46Operating Systems and Command-Line Concepts

Which Linux command reports how much disk space each mounted file system is currently using?

  1. lsblk
  2. df Correct answer.
  3. free
  4. du

Explanation

df summarizes total, used, and available space per mounted file system. du aggregates usage of individual directories, lsblk lists block devices, and free reports memory.

Question 47Operating Systems and Command-Line Concepts

Which command walks a directory tree and selects files by attributes such as name, size, or modification time?

  1. which
  2. whereis
  3. find Correct answer.
  4. grep

Explanation

find descends recursively from a starting path and evaluates an expression against each entry, optionally executing a command on matches. The other tools look up commands or search file contents.

Question 48Operating Systems and Command-Line Concepts

On a Linux system, which file traditionally holds user account entries such as usernames, UIDs, and home directory paths?

  1. /etc/shadow
  2. /etc/group
  3. /etc/hosts
  4. /etc/passwd Correct answer.

Explanation

/etc/passwd contains one line per account with fields for name, UID, GID, home directory, and login shell. Password hashes were moved out of it into /etc/shadow so that the account list can remain world-readable.

Question 49Operating Systems and Command-Line Concepts

What distinguishes a thread from a process?

  1. Threads are scheduled by the application, never by the operating system
  2. Each thread is given its own private virtual address space
  3. Threads in one process cannot run at the same time as each other
  4. Threads in a process share its address space and open files Correct answer.

Explanation

Threads are execution contexts inside a process; they share that process's memory mappings and file descriptors while keeping separate stacks and register state. This sharing is why threads communicate cheaply but must synchronize carefully.

Question 50Operating Systems and Command-Line Concepts

A file report.txt is given a second name with ln report.txt report_link, and then report.txt is deleted. What happens to report_link?

  1. It becomes a dangling link pointing at a path that no longer exists
  2. It still opens the data: it is a second name for the same inode Correct answer.
  3. It keeps the name but its contents are erased at once
  4. It is removed automatically by the kernel when the target disappears

Explanation

ln without -s creates a hard link, which is an additional directory entry referencing the same inode. Deleting one name decrements the link count but the data survives until the last name is removed.