I85PREP
⌘ K
ATSA study materials
ATSA study resources

ATSA practice questions

One question at a time. Build your ATSA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1General Security Concepts

In the standard AAA framework used to control access to network devices and systems, which function determines what an authenticated identity is permitted to do?

  1. Auditing
  2. Authorization Correct answer.
  3. Authentication
  4. Accounting

Explanation

AAA separates three functions: authentication verifies identity, authorization decides which resources and actions that identity may use, and accounting records activity for later review. Authorization is the step that maps a verified identity to permissions such as command levels or resource scopes.

Question 2General Security Concepts

A security team wants a control that enforces least privilege by granting elevated rights only for a limited time and only after approval. Which concept does this describe?

  1. Role explosion
  2. Implicit deny
  3. Just-in-time access Correct answer.
  4. Privilege auditing

Explanation

Just-in-time access grants privileged rights temporarily and only when a justified need exists, then revokes them automatically. This limits standing privilege and reduces the window an attacker could exploit a compromised account.

Question 3General Security Concepts

Which statement correctly distinguishes a vulnerability from a threat?

  1. A vulnerability is an attacker, while a threat is a missing patch on a server.
  2. A vulnerability is a weakness that can be exploited, while a threat is a potential actor or event that could cause harm. Correct answer.
  3. A vulnerability is a confirmed breach, while a threat is an attempted breach.
  4. A vulnerability is a control that prevents attacks, while a threat is a policy violation.

Explanation

A vulnerability is an internal weakness such as a flaw or misconfiguration, whereas a threat is an external or potential source of harm such as an attacker or natural event. Risk arises when a threat can act on a vulnerability and cause impact.

Question 4General Security Concepts

A company installs a second independent approval step so that a single compromised administrator account cannot approve and execute a large funds transfer. Which principle is being applied?

  1. Zero trust
  2. Least privilege
  3. Separation of duties Correct answer.
  4. Defense in depth

Explanation

Separation of duties splits a sensitive task so that no single person or account can complete every step alone. Requiring an independent second approver prevents one compromised account from both initiating and authorizing the transfer.

Question 5General Security Concepts

Which cryptographic property ensures that a party cannot later deny having signed a message?

  1. Key escrow
  2. Confidentiality
  3. Non-repudiation Correct answer.
  4. Availability

Explanation

Non-repudiation provides evidence that a specific party performed an action, typically through a digital signature tied to a key only that party controls. It prevents the signer from credibly denying the action later.

Question 6General Security Concepts

A user receives a text message claiming to be from a bank and is directed to a lookalike website to enter credentials. Which attack best describes this?

  1. Tailgating
  2. Vishing
  3. Smishing Correct answer.
  4. Shoulder surfing

Explanation

Smishing is phishing delivered over SMS or text messaging, often using a link to a fraudulent site to harvest credentials. It relies on social engineering rather than technical exploitation of the device.

Question 7General Security Concepts

Which control type is a security awareness training program for employees?

  1. Compensating control
  2. Physical control
  3. Technical control
  4. Administrative control Correct answer.

Explanation

Administrative controls are policies, procedures, and training that shape human behavior rather than enforcing restrictions through technology or physical barriers. Awareness training is a classic administrative control.

Question 8General Security Concepts

An organization wants to verify that a downloaded software package has not been altered since the vendor built it. Which mechanism is most appropriate?

  1. Renaming the file to match the expected filename
  2. Scanning the package with antivirus software
  3. Encrypting the package with the organization's own key
  4. Comparing a cryptographic hash against the vendor-published value Correct answer.

Explanation

A cryptographic hash acts as a fixed fingerprint, so recomputing it and matching the vendor's published value detects any modification to the package. Integrity verification depends on comparing hashes rather than on encryption or naming.

Question 9General Security Concepts

Which statement accurately describes symmetric encryption compared with asymmetric encryption?

  1. Symmetric encryption uses one shared key for both encryption and decryption and is generally faster. Correct answer.
  2. Symmetric encryption uses a public key to encrypt and a private key to decrypt.
  3. Symmetric encryption provides non-repudiation by design.
  4. Symmetric encryption eliminates the need for key distribution.

Explanation

Symmetric algorithms use the same secret key for encryption and decryption and are computationally efficient for bulk data. Their main challenge is distributing and protecting the shared key among parties.

Question 10General Security Concepts

A security analyst wants to prove that a specific user's private key, and not someone else's, created a digital signature. Which key is used to verify the signature?

  1. The recipient's private key
  2. A shared symmetric session key
  3. The signer's public key Correct answer.
  4. The signer's private key

Explanation

A digital signature is created with the signer's private key and verified with the corresponding public key. Because only the signer should hold the private key, successful verification links the signature to that signer.

Question 11General Security Concepts

Which characteristic of a certificate authority primarily allows clients to trust certificates it issues without contacting it each time?

  1. It assigns IP addresses to servers.
  2. It stores every user's private key.
  3. It encrypts all traffic between clients and servers.
  4. Its root certificate is distributed in trusted certificate stores. Correct answer.

Explanation

Clients trust a CA because its root certificate is preinstalled in operating system and browser trust stores. The client can then validate a certificate chain locally without a real-time lookup to the CA.

Question 12General Security Concepts

Which practice best protects data at rest on a stolen laptop?

  1. A screen lock timeout
  2. Full-disk encryption tied to authentication Correct answer.
  3. Network segmentation
  4. A host-based firewall

Explanation

Full-disk encryption renders stored data unreadable without the correct authentication or key, which directly protects data at rest if the device is physically stolen. The other options address session or network exposure rather than stored data.

Question 13General Security Concepts

An attacker intercepts traffic between two parties and relays it while appearing to be each endpoint. Which attack is this?

  1. SQL injection
  2. On-path attack Correct answer.
  3. Denial-of-service attack
  4. Brute-force attack

Explanation

An on-path attack places the attacker between two communicating parties so traffic can be observed or altered while each side believes it talks directly to the other. Strong mutual authentication and encryption mitigate it.

Question 14General Security Concepts

Which security model enforces access decisions by comparing the classification of a resource with the clearance of the subject and the current context?

  1. Rule-based access control
  2. Role-based access control
  3. Mandatory access control Correct answer.
  4. Discretionary access control

Explanation

Mandatory access control uses labels on objects and clearances on subjects, and the system enforces the comparison rather than the data owner. Context such as compartment membership can further restrict access.

Question 15General Security Concepts

Which factor makes multi-factor authentication stronger than a single password?

  1. It requires two passwords of different lengths.
  2. It relies on a single long passphrase.
  3. It combines factors from different categories such as knowledge and possession. Correct answer.
  4. It stores passwords in a shared spreadsheet.

Explanation

True multi-factor authentication combines factors from separate categories, such as something you know and something you have, so compromising one factor is insufficient. Using two passwords remains a single knowledge category.

Question 16General Security Concepts

A security architect wants to reduce the impact of a compromised credential by requiring continuous verification of device health and user context for every request. Which approach matches this goal?

  1. Zero trust architecture Correct answer.
  2. Perimeter-based security
  3. Implicit trust on the internal network
  4. Single sign-on without context checks

Explanation

Zero trust removes implicit trust based on network location and evaluates each request using identity, device health, and context. This limits the damage a stolen credential can cause because access is continuously re-evaluated.

Question 17General Security Concepts

Which term describes the maximum period a system can be unavailable before the organization suffers unacceptable harm?

  1. Mean time between failures
  2. Recovery time objective Correct answer.
  3. Recovery point objective
  4. Service level agreement

Explanation

The recovery time objective defines the target time to restore a service after disruption, reflecting how long downtime can be tolerated. It differs from the recovery point objective, which concerns acceptable data loss measured in time.

Question 18General Security Concepts

A team classifies a risk as high because both likelihood and impact are high, then chooses to purchase cyber insurance. Which risk response is this?

  1. Risk acceptance
  2. Risk mitigation
  3. Risk transfer Correct answer.
  4. Risk avoidance

Explanation

Risk transfer shifts the financial consequences of a risk to another party, commonly through insurance or contractual arrangements. The risk itself remains, but the organization is compensated for losses.

Question 19General Security Concepts

Which practice most directly protects against credential stuffing attacks that replay leaked username and password pairs?

  1. Disabling account lockouts to prevent denial of service
  2. Requiring users to change passwords every 30 days
  3. Blocking authentication attempts that fail repeatedly across many accounts Correct answer.
  4. Publishing password complexity rules to users

Explanation

Credential stuffing succeeds by trying known leaked pairs against many accounts, so detecting and blocking distributed failed attempts across accounts is the most direct defense. Rate limiting and anomaly detection also reduce its effectiveness.

Question 20General Security Concepts

An organization adopts a policy that only approved, signed applications may run on endpoints. Which control is this?

  1. Application denylisting
  2. Application allowlisting Correct answer.
  3. Vulnerability scanning
  4. Patch management

Explanation

Application allowlisting permits only explicitly approved software to execute, blocking everything else by default. This prevents unapproved or malicious binaries from running even if downloaded.

Question 21General Security Concepts

Which property of a hashing algorithm is most important when choosing it for storing passwords?

  1. It uses the same output for all inputs.
  2. It produces the shortest possible digest.
  3. It is deliberately slow and supports salting to resist brute force. Correct answer.
  4. It produces output that can be reversed to the original password.

Explanation

Password hashing should use algorithms intentionally designed to be slow and memory-hard, combined with a unique salt per password, to make offline guessing expensive. Reversibility or fixed short output would undermine security.

Question 22General Security Concepts

A visitor badge grants access only to the lobby and expires at the end of the day. Which access control concept does the expiration represent?

  1. Mandatory clearance
  2. Discretionary ownership
  3. Role-based permission
  4. Time-of-day restriction Correct answer.

Explanation

A time-based restriction limits access to specific periods, and here the badge stops working after the day ends. This is a rule-based condition independent of the visitor's role or classification.

Question 23General Security Concepts

Which statement about the CIA triad is accurate?

  1. Availability ensures data is encrypted at rest.
  2. Confidentiality ensures data is always accessible to authorized users.
  3. Integrity ensures that data is hidden from unauthorized parties.
  4. Integrity ensures data is accurate and unaltered, while availability ensures timely access to it. Correct answer.

Explanation

The CIA triad separates confidentiality, integrity, and availability, where integrity concerns accuracy and freedom from unauthorized modification and availability concerns reliable access. Confidentiality is the property that addresses secrecy.

Question 24General Security Concepts

During an incident, an analyst needs to determine the sequence of events across several systems. Which practice supports this most directly?

  1. Storing logs only on the affected host
  2. Relying on user recollection of events
  3. Disabling logging on high-traffic servers
  4. Synchronizing system clocks to a common time source and centralizing logs Correct answer.

Explanation

Accurate timelines require consistent timestamps, which clock synchronization provides, and centralized collection so logs survive and can be correlated. Without these, event ordering across systems becomes unreliable.

Question 25Network Security

A network engineer is configuring a firewall rule to permit only web traffic to an internal server. Which port and protocol combination should be allowed for HTTPS?

  1. UDP port 53
  2. UDP port 443
  3. TCP port 443 Correct answer.
  4. TCP port 80

Explanation

HTTPS uses TCP as its transport protocol and by default listens on port 443. Allowing TCP 443 permits encrypted web traffic, while port 80 is plain HTTP and port 53 is DNS.

Question 26Network Security

During a security audit, an analyst observes that a workstation is sending repeated ARP requests for the default gateway's IP address, and the gateway's MAC address in replies changes frequently. Which attack is most likely occurring?

  1. VLAN hopping
  2. SYN flood
  3. DNS tunneling
  4. ARP spoofing Correct answer.

Explanation

ARP spoofing involves sending forged ARP replies to associate an attacker's MAC address with a legitimate IP, causing traffic to be redirected. Frequent changes in the gateway's MAC mapping on a workstation are a classic symptom.

Question 27Network Security

Which security control is designed to detect and block malicious traffic by comparing network packets against known attack signatures?

  1. Security information and event management (SIEM)
  2. Virtual private network (VPN) concentrator
  3. Load balancer
  4. Intrusion prevention system (IPS) Correct answer.

Explanation

An IPS inspects traffic in line and can drop packets that match attack signatures, unlike a SIEM which only aggregates logs. A VPN concentrator and load balancer provide connectivity and distribution, not signature-based blocking.

Question 28Network Security

A company wants to allow remote employees to access internal applications securely over the internet without exposing those applications directly. Which solution best meets this requirement?

  1. A public-facing jump host with password-only SSH
  2. Site-to-site IPsec tunnel between the employee's home router and the office
  3. Port forwarding on the perimeter firewall to each application server
  4. Remote-access VPN with multi-factor authentication Correct answer.

Explanation

A remote-access VPN encrypts traffic from the employee device to the corporate network and, combined with MFA, provides strong authentication. It avoids exposing application servers directly to the internet.

Question 29Network Security

An administrator needs to segment a network so that guests can reach the internet but cannot reach internal servers. Which technology is most appropriate?

  1. A single flat subnet with host-based firewalls
  2. VLANs with inter-VLAN access control lists Correct answer.
  3. NAT overload on the border router
  4. A hub in place of a switch

Explanation

VLANs logically separate traffic, and ACLs on the router or Layer 3 switch enforce which VLANs may communicate. This isolates guest traffic from internal server subnets while permitting internet access.

Question 30Network Security

Which protocol encrypts the entire IP packet, including the original IP header, to provide confidentiality in a site-to-site VPN?

  1. ESP in tunnel mode Correct answer.
  2. AH in transport mode
  3. GRE without IPsec
  4. L2TP without IPsec

Explanation

IPsec ESP in tunnel mode encrypts the payload and encapsulates the original IP packet inside a new IP header, hiding internal addresses. AH provides integrity but not confidentiality, and GRE or L2TP alone do not encrypt.

Question 31Network Security

A security team notices a large volume of DNS queries to a single external domain, each query containing long random-looking subdomains. What is the most likely explanation?

  1. A zone transfer misconfiguration
  2. DNS cache poisoning
  3. A legitimate content delivery network
  4. DNS tunneling for data exfiltration Correct answer.

Explanation

DNS tunneling encodes data in the subdomain labels of queries to an attacker-controlled authoritative server, producing long random-looking names and high query volume. This is a common exfiltration technique.

Question 32Network Security

Which network device primarily forwards frames based on MAC addresses and maintains a MAC address table?

  1. Load balancer
  2. Firewall
  3. Layer 2 switch Correct answer.
  4. Router

Explanation

A Layer 2 switch learns source MAC addresses and forwards frames only to the port associated with the destination MAC. Routers forward based on IP addresses, not MAC addresses.

Question 33Network Security

An attacker on the same VLAN sends frames with a source MAC address of the default gateway to intercept traffic. Which mitigation is most effective?

  1. Enabling DHCP snooping and dynamic ARP inspection Correct answer.
  2. Increasing the CAM table aging time
  3. Using static ARP entries on all hosts
  4. Disabling Spanning Tree Protocol

Explanation

Dynamic ARP inspection validates ARP packets against the DHCP snooping binding table, blocking forged ARP replies. DHCP snooping is a prerequisite because it builds the trusted binding database.

Question 34Network Security

Which characteristic distinguishes a stateful firewall from a stateless packet filter?

  1. It maintains a connection table to track the state of TCP sessions Correct answer.
  2. It inspects only the Ethernet header
  3. It requires a proxy for every application protocol
  4. It encrypts all traffic between networks

Explanation

A stateful firewall records active connections and permits return traffic that belongs to an established session, whereas a stateless filter evaluates each packet independently. This reduces the need for broad inbound rules.

Question 35Network Security

A network uses 802.1X for port-based access control. Which component acts as the intermediary between the supplicant and the authentication server?

  1. Supplicant
  2. RADIUS server
  3. Certificate authority
  4. Authenticator Correct answer.

Explanation

In 802.1X, the authenticator is the switch or wireless access point that relays authentication messages between the supplicant and the RADIUS server. It also enforces the resulting authorization state on the port.

Question 36Network Security

Which wireless security protocol uses SAE (Simultaneous Authentication of Equals) to provide forward secrecy and resistance to offline dictionary attacks?

  1. WPA3-Personal Correct answer.
  2. WEP
  3. WPA2-Personal
  4. WPA2-Enterprise

Explanation

WPA3-Personal replaces the WPA2-Personal pre-shared key handshake with SAE, which provides forward secrecy and thwarts offline guessing of captured handshakes. WPA2-Personal uses the four-way handshake vulnerable to offline dictionary attacks.

Question 37Network Security

A company deploys a web application firewall (WAF) in front of an HTTP server. Which threat does the WAF primarily mitigate?

  1. ARP cache poisoning
  2. BGP route hijacking
  3. SQL injection and cross-site scripting Correct answer.
  4. Rogue DHCP servers

Explanation

A WAF inspects HTTP requests and responses to detect and block application-layer attacks such as SQL injection and XSS. It does not operate at Layer 2 or on routing protocols.

Question 38Network Security

An administrator configures a firewall rule that permits inbound TCP 3389 from any source to a server. Which risk does this rule introduce?

  1. Exposure of SMTP relay to spam
  2. Exposure of DNS zone transfers to the internet
  3. Exposure of SNMP community strings
  4. Exposure of Remote Desktop Protocol to brute-force and exploitation attempts Correct answer.

Explanation

TCP 3389 is used by Microsoft Remote Desktop Protocol, and allowing it from any source exposes the service to credential brute force and RDP vulnerabilities. Access should be restricted to trusted sources or mediated through a VPN.

Question 39Network Security

Which mitigation reduces the impact of a MAC flooding attack against a switch?

  1. Enabling proxy ARP on the router
  2. Using unmanaged switches at the access layer
  3. Disabling DHCP snooping
  4. Configuring port security with a maximum number of MAC addresses per port Correct answer.

Explanation

MAC flooding exhausts the switch CAM table so that unknown unicast frames are flooded to all ports. Port security limits the number of learned MAC addresses per port and can shut down a violating port.

Question 40Network Security

Which protocol is used to securely transfer files over an encrypted channel and typically listens on TCP port 22?

  1. FTP
  2. SFTP Correct answer.
  3. HTTP
  4. TFTP

Explanation

SFTP runs over SSH, which listens on TCP 22, and encrypts both authentication and file transfer. FTP and TFTP send data in cleartext, and HTTP is not a file transfer protocol.

Question 41Network Security

A network architect is designing a DMZ for public web servers. Which design principle best limits the impact of a compromised web server?

  1. Allow all outbound traffic from the DMZ to the internal network
  2. Use a single firewall interface for both the DMZ and the internal network
  3. Place the web servers in a separate subnet with strict firewall rules between the DMZ and the internal network Correct answer.
  4. Place the web servers on the same VLAN as internal database servers

Explanation

A DMZ segments internet-facing systems from internal assets, and firewall rules should permit only necessary traffic from the DMZ to the internal network. This containment limits lateral movement if a web server is compromised.

Question 42Network Security

Which statement accurately describes the role of DNSSEC?

  1. It provides cryptographic integrity and authenticity of DNS responses Correct answer.
  2. It replaces DNS with a directory service
  3. It blocks all DNS tunneling attempts
  4. It encrypts DNS queries to prevent eavesdropping

Explanation

DNSSEC signs DNS records so that resolvers can verify the origin and integrity of responses, preventing cache poisoning and spoofing. It does not encrypt queries; that is the role of DNS over HTTPS or TLS.

Question 43Network Security

An IDS sensor reports a high volume of alerts for the same signature, but investigation shows the traffic is benign. Which tuning action is most appropriate?

  1. Block all traffic from the source subnet
  2. Create an exception or threshold for the known benign traffic Correct answer.
  3. Increase the sensor's capture buffer size
  4. Disable the signature entirely on all sensors

Explanation

False positives should be tuned with exceptions or thresholds so that legitimate traffic no longer triggers the signature while the signature remains active for malicious traffic. Disabling the signature entirely would blind the IDS to real attacks.

Question 44Network Security

Which attack involves sending a large number of TCP SYN packets with spoofed source addresses to exhaust a server's connection table?

  1. SYN flood Correct answer.
  2. Smurf attack
  3. Teardrop attack
  4. Ping flood

Explanation

A SYN flood exploits the TCP three-way handshake by leaving many half-open connections, exhausting server resources. Spoofed source addresses prevent completion of the handshake and complicate filtering.

Question 45Network Security

A company wants to protect against BGP route hijacking by validating that an autonomous system is authorized to originate a prefix. Which mechanism should be used?

  1. BGP route reflection
  2. BGP MD5 authentication
  3. RPKI with route origin validation Correct answer.
  4. BGP graceful restart

Explanation

RPKI publishes signed route origin authorizations, and routers performing route origin validation can reject prefixes announced by unauthorized autonomous systems. MD5 authentication only secures the peering session, not the legitimacy of the prefix.

Question 46Network Security

Which term describes a network device that enforces security policy between network zones while maintaining awareness of the application-layer protocol?

  1. Passive hub
  2. Patch panel
  3. Media converter
  4. Next-generation firewall Correct answer.

Explanation

A next-generation firewall combines stateful inspection with application awareness, user identity, and threat prevention. Hubs, media converters, and patch panels are passive or Layer 1 components without security policy enforcement.

Question 47Network Security

A security analyst observes that an internal host is communicating with an external IP address on TCP port 4444 at regular intervals, and the traffic payload is encrypted. Which hypothesis is most consistent with these findings?

  1. The host is performing a DNS zone transfer
  2. The host is participating in a legitimate NTP sync
  3. The host may be beaconing to a command-and-control server Correct answer.
  4. The host is acting as a DHCP relay

Explanation

Periodic encrypted connections to an external IP on an uncommon port are characteristic of malware beaconing to command-and-control infrastructure. The regularity and encryption suggest automated check-in rather than normal user traffic.

Question 48Network Security

Which protocol provides centralized authentication, authorization, and accounting for network access and commonly uses UDP ports 1812 and 1813?

  1. LDAP
  2. TACACS+
  3. Kerberos
  4. RADIUS Correct answer.

Explanation

RADIUS is widely used for AAA in network access and by default uses UDP ports 1812 for authentication and 1813 for accounting. TACACS+ uses TCP port 49, Kerberos uses TCP/UDP 88, and LDAP uses TCP 389.

Question 49Network Security

A network engineer is hardening a switch against VLAN hopping. Which configuration change is most effective?

  1. Place all ports in the native VLAN
  2. Use the default VLAN 1 for all access ports
  3. Disable automatic trunk negotiation and explicitly configure access ports as access mode Correct answer.
  4. Enable DTP on all access ports

Explanation

VLAN hopping often relies on DTP negotiation to form an unauthorized trunk or on double tagging through the native VLAN. Disabling DTP and hard-coding access ports prevents an attacker from negotiating a trunk.

Question 50Network Security

A network security analyst is reviewing a packet capture from a host that opens a connection to a remote server. The analyst notes that the TCP three-way handshake completes, but the initial data segments show the TCP sequence numbers were negotiated using a predictable, low-entropy initial sequence number (ISN) generation scheme. Which weakness does this condition most directly expose the connection to?

  1. The handshake can be completed without the server ever allocating state for the connection.
  2. The client and server will fall back to an unencrypted protocol because the ISN is too short.
  3. An off-path attacker can inject forged segments into the established session by guessing valid sequence numbers. Correct answer.
  4. An on-path attacker can decrypt the payload because the ISN doubles as a session key.

Explanation

TCP relies on unpredictable initial sequence numbers to make off-path injection impractical; if an attacker can predict the ISN, they can guess the sequence and acknowledgment numbers needed to insert forged segments into an established session without seeing the traffic. The ISN is a synchronization value, not a cryptographic key, and it does not govern whether the server allocates connection state or whether encryption is applied.