I85PREP
⌘ K
ECF Cybersecurity (Core) study materials
ECF Cybersecurity (Core) study resources

ECF Cybersecurity (Core) practice questions

One question at a time. Build your ECF Cybersecurity (Core) understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Fundamentals and Risk Management

In risk management, what does the term 'asset' refer to within an organization's information security scope?

  1. The likelihood that a control will fail during an audit
  2. A threat actor with the capability and intent to cause harm
  3. Any software vulnerability that has been publicly disclosed
  4. Anything of value to the organization that supports its objectives and requires protection Correct answer.

Explanation

An asset is any item of value to the organization, including data, systems, people, facilities, and reputation, that must be protected. Risk analysis pairs each asset with the threats that could affect it and the impact of loss. Vulnerabilities, threat actors, and control failures are separate concepts used alongside assets in risk assessment.

Question 2Security Fundamentals and Risk Management

Which statement correctly distinguishes a vulnerability from a threat?

  1. A threat exists only after exploitation, while a vulnerability exists only before exploitation
  2. A threat is a weakness in a system, while a vulnerability is an external attacker
  3. A vulnerability and a threat are interchangeable terms in risk assessment
  4. A vulnerability is a weakness that can be exploited, while a threat is a potential cause of harm Correct answer.

Explanation

A vulnerability is an internal weakness or flaw, such as an unpatched service or weak configuration, while a threat is any potential source of harm that could exploit that weakness. Risk arises when a threat can act on a vulnerability and produce impact. Keeping the two terms distinct is essential for accurate risk analysis.

Question 3Security Fundamentals and Risk Management

An analyst calculates risk as likelihood multiplied by impact. Which scenario yields the highest relative risk score?

  1. Low likelihood with high impact
  2. High likelihood with low impact
  3. Low likelihood with low impact
  4. High likelihood with high impact Correct answer.

Explanation

When risk is modeled as likelihood times impact, the maximum product comes from combining a high likelihood of occurrence with a high impact if it occurs. This combination warrants prioritized treatment. The other combinations produce lower products and therefore lower relative risk.

Question 4Security Fundamentals and Risk Management

What is the primary purpose of the principle of least privilege?

  1. To guarantee availability through redundant infrastructure
  2. To limit user and process permissions to only what is required to perform their tasks Correct answer.
  3. To encrypt all data at rest using strong algorithms
  4. To ensure every action is recorded in an immutable audit log

Explanation

Least privilege restricts access rights to the minimum necessary for a user or process to complete its function, reducing the attack surface and limiting damage from compromise. It is an access-control principle rather than an encryption, logging, or availability control. Applying it requires periodic review of entitlements.

Question 5Security Fundamentals and Risk Management

Which security objective is most directly concerned with ensuring that data has not been altered by unauthorized parties?

  1. Confidentiality
  2. Non-repudiation
  3. Integrity Correct answer.
  4. Availability

Explanation

Integrity ensures that information and systems remain accurate and complete and have not been modified without authorization. Confidentiality concerns unauthorized disclosure, and availability concerns timely access to resources. Non-repudiation is a related assurance that a party cannot deny an action, but it is not the primary label for preventing unauthorized alteration.

Question 6Security Fundamentals and Risk Management

A company stores customer records and must ensure only authorized staff can read them. Which element of the CIA triad is being addressed?

  1. Accountability
  2. Integrity
  3. Availability
  4. Confidentiality Correct answer.

Explanation

Confidentiality ensures that information is accessible only to those authorized to view it, which matches restricting record access to approved staff. Integrity concerns unauthorized changes, and availability concerns reliable access. Accountability is a supporting property, not one of the three CIA elements.

Question 7Security Fundamentals and Risk Management

What is the main difference between a qualitative and a quantitative risk assessment?

  1. Qualitative assessment applies only to physical security, while quantitative assessment applies only to cyber systems
  2. Qualitative assessment ignores threats, while quantitative assessment ignores vulnerabilities
  3. Qualitative assessment requires automated tools, while quantitative assessment is manual
  4. Qualitative assessment uses descriptive ratings, while quantitative assessment uses numeric values Correct answer.

Explanation

Qualitative risk assessment expresses risk using descriptive scales such as high, medium, or low, while quantitative assessment assigns numeric values such as monetary loss or annualized loss expectancy. Both approaches consider threats, vulnerabilities, and impact; they differ in how results are expressed. The choice depends on available data and decision needs.

Question 8Security Fundamentals and Risk Management

Which activity is performed during the risk treatment step of the risk management process?

  1. Selecting controls to mitigate, transfer, avoid, or accept identified risk Correct answer.
  2. Cataloging hardware assets and their owners
  3. Estimating the annualized loss expectancy of each threat
  4. Defining the organization's risk appetite statement

Explanation

Risk treatment involves choosing how to respond to assessed risk, typically through mitigation, transfer, avoidance, or acceptance. Asset inventory, loss estimation, and risk appetite definition occur in earlier or governing phases. Treatment decisions follow the assessment and are documented for tracking.

Question 9Security Fundamentals and Risk Management

An organization purchases a cyber insurance policy to cover potential breach costs. Which risk treatment strategy does this represent?

  1. Risk acceptance
  2. Risk mitigation
  3. Risk transfer Correct answer.
  4. Risk avoidance

Explanation

Risk transfer shifts the financial consequences of a risk to a third party, and insurance is the classic example. Avoidance eliminates the activity causing the risk, mitigation reduces likelihood or impact, and acceptance retains the risk. Insurance does not reduce the likelihood of a breach, only the financial impact borne by the organization.

Question 10Security Fundamentals and Risk Management

A team decides to discontinue an outdated public-facing service rather than patch it. Which risk response have they chosen?

  1. Risk transfer
  2. Risk avoidance Correct answer.
  3. Risk acceptance
  4. Risk mitigation

Explanation

Risk avoidance eliminates the risk by removing the activity or asset that creates exposure, which is what decommissioning the service accomplishes. Mitigation would reduce risk while keeping the service, transfer would shift consequences to a third party, and acceptance would retain the risk. Removing the exposure entirely is the defining feature of avoidance.

Question 11Security Fundamentals and Risk Management

Which formula correctly expresses single loss expectancy (SLE) in quantitative risk analysis?

  1. SLE = annualized rate of occurrence x asset value
  2. SLE = exposure factor / annualized rate of occurrence
  3. SLE = asset value x exposure factor Correct answer.
  4. SLE = asset value / annualized rate of occurrence

Explanation

Single loss expectancy estimates the loss from one incident and equals asset value multiplied by the exposure factor, the percentage of the asset affected. Annualized loss expectancy then equals SLE multiplied by the annualized rate of occurrence. Dividing or combining values differently produces meaningless figures.

Question 12Security Fundamentals and Risk Management

An asset is valued at $200,000, the exposure factor for a given threat is 25 percent, and the annualized rate of occurrence is 2. What is the annualized loss expectancy?

  1. $50,000
  2. $200,000
  3. $400,000
  4. $100,000 Correct answer.

Explanation

Single loss expectancy equals asset value times exposure factor, so $200,000 x 0.25 = $50,000. Annualized loss expectancy equals SLE times the annualized rate of occurrence, so $50,000 x 2 = $100,000. This figure is compared with control costs to justify treatment decisions.

Question 13Security Fundamentals and Risk Management

Which document records management's decision to tolerate a specific identified risk along with the rationale and any conditions?

  1. A business continuity plan
  2. An incident response playbook
  3. A vulnerability disclosure policy
  4. A risk register entry documenting formal risk acceptance Correct answer.

Explanation

A risk register records identified risks, their assessment, treatment decisions, owners, and status, including formal acceptance with rationale and conditions. Playbooks, continuity plans, and disclosure policies address response, resilience, and reporting rather than documenting acceptance of a specific risk. Formal acceptance should be time-bound and reviewed.

Question 14Security Fundamentals and Risk Management

What is the relationship between a policy, a standard, and a procedure in a security program?

  1. A procedure sets high-level intent, a policy defines mandatory requirements, and a standard lists step-by-step actions
  2. A policy, a standard, and a procedure are synonyms and can be used interchangeably
  3. A standard states high-level intent, a procedure defines mandatory requirements, and a policy gives step-by-step instructions
  4. A policy states high-level intent, a standard defines mandatory specific requirements, and a procedure gives step-by-step instructions Correct answer.

Explanation

Policies express management intent and mandatory direction at a high level, standards specify concrete mandatory requirements that support the policy, and procedures describe the step-by-step actions to implement them. This hierarchy moves from intent to specific requirement to operational instruction. Confusing the levels weakens governance and auditability.

Question 15Security Fundamentals and Risk Management

A security team wants to reduce the likelihood of a successful phishing attack against employees. Which control type most directly addresses this goal?

  1. Network segmentation between server tiers
  2. Full-disk encryption on employee laptops
  3. Awareness training that teaches employees to recognize and report suspicious messages Correct answer.
  4. Data backup replication to an offsite facility

Explanation

Awareness training reduces the likelihood that employees will fall for phishing by improving recognition and reporting behavior. Encryption protects data at rest, backups support recovery, and segmentation limits lateral movement, but none directly reduces how often users are deceived. Likelihood-reducing controls target the human and process factors behind the threat.

Question 16Security Fundamentals and Risk Management

Which pairing correctly classifies a control by its function?

  1. A firewall is a compensating control, while an intrusion detection system is a corrective control
  2. A firewall is a preventive control, while an intrusion detection system is a detective control Correct answer.
  3. A firewall is a detective control, while an intrusion detection system is a preventive control
  4. A firewall is a corrective control, while an intrusion detection system is a preventive control

Explanation

A firewall blocks or allows traffic based on rules, which prevents unwanted access, making it preventive. An intrusion detection system monitors and alerts on suspicious activity, making it detective. Corrective controls act after an event to restore state, and compensating controls substitute for a primary control.

Question 17Security Fundamentals and Risk Management

What distinguishes a defense-in-depth strategy from relying on a single strong control?

  1. It uses multiple layered controls so that failure of one does not eliminate all protection Correct answer.
  2. It requires that every control be identical across all layers
  3. It removes the need for monitoring because each layer is independently sufficient
  4. It applies only to physical security perimeters

Explanation

Defense in depth layers independent controls across people, process, and technology so that a single failure or bypass does not remove all protection. The layers are complementary rather than identical, and monitoring remains necessary because no layer is assumed sufficient. The approach applies broadly, not only to physical perimeters.

Question 18Security Fundamentals and Risk Management

Which statement best describes the purpose of a business impact analysis (BIA)?

  1. It identifies critical business functions and the impact of their disruption to set recovery priorities Correct answer.
  2. It enumerates technical vulnerabilities and assigns CVSS scores
  3. It defines the firewall rule set for the data center
  4. It records employee security awareness completion rates

Explanation

A BIA identifies critical business processes and quantifies the operational and financial impact of their disruption, which drives recovery time and recovery point objectives. Vulnerability scoring, firewall rules, and training records serve different purposes. BIA output feeds business continuity and disaster recovery planning.

Question 19Security Fundamentals and Risk Management

A system has a recovery time objective of four hours and a recovery point objective of one hour. What does the recovery point objective specify?

  1. The maximum acceptable amount of data loss measured in time before the incident Correct answer.
  2. The maximum acceptable time to restore service after an outage
  3. The time required to notify regulators after a breach
  4. The interval between scheduled vulnerability scans

Explanation

The recovery point objective defines how much data loss, expressed as time, the business can tolerate, which determines backup frequency. The recovery time objective defines how quickly service must be restored. Regulatory notification and scan intervals are separate requirements not governed by RPO.

Question 20Security Fundamentals and Risk Management

Which statement accurately reflects a risk matrix approach to prioritizing risks?

  1. It guarantees that all residual risk is eliminated
  2. It replaces the need for asset identification
  3. It plots likelihood against impact to rank risks for treatment Correct answer.
  4. It calculates exact monetary loss for each threat event

Explanation

A risk matrix plots likelihood against impact, often on a grid, to assign relative priority to identified risks. It is a qualitative or semi-quantitative tool and does not compute exact monetary loss, which requires quantitative analysis. It still depends on asset identification and does not eliminate residual risk.

Question 21Security Fundamentals and Risk Management

An organization defines a risk appetite that is lower than the residual risk of a legacy system it must keep operating. What is the most appropriate governance response?

  1. Ignore the gap because the system is legacy and cannot be changed
  2. Immediately shut down the system without any continuity planning
  3. Reclassify the residual risk as zero to close the finding
  4. Document the exception, assign an owner, and define a time-bound remediation plan with compensating controls Correct answer.

Explanation

When residual risk exceeds the stated appetite, governance requires a documented exception with an accountable owner, compensating controls, and a time-bound plan to reduce or formally accept the risk. Ignoring the gap or misrepresenting the risk violates governance, and abrupt shutdown without continuity planning can cause greater harm. Exceptions should be reviewed periodically.

Question 22Security Fundamentals and Risk Management

Which scenario best illustrates residual risk?

  1. The risk that exists before any controls are applied
  2. The risk that is transferred entirely to an insurer
  3. The risk introduced solely by a new threat actor
  4. The risk that remains after controls have been implemented and assessed Correct answer.

Explanation

Residual risk is what remains after controls are applied and their effectiveness is evaluated. Inherent risk is the risk before controls, so that describes a different concept. Residual risk is rarely zero, even when controls are well designed, and it must be compared with the organization's risk appetite.

Question 23Security Fundamentals and Risk Management

An organization wants to justify a proposed security control costing $40,000 per year. The control would reduce annualized loss expectancy from $150,000 to $30,000. How should this be evaluated?

  1. The control should be rejected because ALE figures are always unreliable
  2. The control is justified because the $120,000 ALE reduction exceeds the $40,000 annual cost Correct answer.
  3. The control is not justified because the cost exceeds the remaining ALE
  4. The control should be adopted only if it eliminates all risk

Explanation

The control reduces ALE by $120,000, which exceeds its $40,000 annual cost, producing a positive return and supporting adoption. Comparing cost against the remaining ALE instead of the reduction is a common error. No control eliminates all risk, and ALE estimates are approximations rather than grounds for automatic rejection.

Question 24Security Fundamentals and Risk Management

Which statement best describes how threat modeling adds value early in the system development life cycle?

  1. It replaces the need for security testing once the system is deployed
  2. It documents only threats that have already caused production incidents
  3. It identifies likely threats and attack paths before code is written, when design changes are cheapest Correct answer.
  4. It guarantees that no vulnerabilities will exist in the final product

Explanation

Threat modeling examines architecture and data flows early to identify plausible threats and attack paths, allowing design changes while they are inexpensive. It complements rather than replaces testing, and it cannot guarantee a vulnerability-free product. It is forward-looking and does not merely record past incidents.

Question 25Security Fundamentals and Risk Management

A company must comply with a regulation requiring encryption of specific data categories. Which statement correctly describes how compliance relates to security?

  1. Compliance guarantees that the organization is secure against all threats
  2. Compliance satisfies defined requirements but does not by itself ensure comprehensive security Correct answer.
  3. Compliance is only relevant to physical security controls
  4. Security and compliance are identical and cannot be pursued separately

Explanation

Compliance demonstrates that specified requirements are met, but requirements are a baseline and may not cover every threat an organization faces. Security is broader and requires ongoing risk assessment beyond the checklist. Treating compliance as equivalent to security can leave significant gaps unaddressed.

Question 26Security Fundamentals and Risk Management

Which statement best describes the role of a risk register within a security risk management program?

  1. It is the approved budget that funds security controls across the fiscal year
  2. It is the catalog of technical vulnerabilities produced by an authenticated scan
  3. It is the signed attestation that confirms regulatory compliance each quarter
  4. It is a living record of identified risks with owners, ratings, and treatment status Correct answer.

Explanation

A risk register is the central tracking document for identified risks, capturing details such as the risk description, likelihood and impact ratings, assigned risk owner, chosen treatment, and current status. It stays current as risks are reassessed, closed, or escalated, and it supports reporting to management. It is not a budget, a scanner output, or a compliance attestation, though those artifacts may feed into it.

Question 27Security Fundamentals and Risk Management

An employee receives an email that appears to come from the finance director and requests an urgent wire transfer. The employee verifies the request through a separate phone call before acting. Which term describes the attack and the employee's response?

  1. The attack is credential stuffing and the response is multi-factor authentication
  2. The attack is business email compromise and the response is a verification control Correct answer.
  3. The attack is a supply chain compromise and the response is vendor due diligence
  4. The attack is a denial-of-service attempt and the response is load balancing

Explanation

Business email compromise uses impersonation, often of an executive or trusted partner, to trick staff into transferring funds or data. Out-of-band verification by a known phone number is a recognized control against this social engineering tactic because it validates the request through a channel the attacker does not control. The other options describe unrelated attack classes and defenses.

Question 28Security Fundamentals and Risk Management

A security manager must choose between two controls addressing the same risk. Control X is a preventive control that blocks the attack path entirely but costs significantly more. Control Y is a detective control that alerts quickly after the event but does not stop it. Which reasoning best supports the decision?

  1. Defer the decision until the next audit cycle to confirm the risk is still relevant
  2. Choose the detective control because alerts always cost less to operate than prevention
  3. Compare the annualized loss each control avoids against its total cost of ownership Correct answer.
  4. Choose the preventive control because prevention is universally preferred over detection

Explanation

Control selection should be an economic and risk-based comparison: estimate how much each option reduces annualized loss expectancy and weigh that against the full cost of acquisition and operation. A preventive control may justify a higher price if it removes a large loss, while a cheaper detective control may suffice for lower-impact risks. Blanket preferences or delaying the decision are not defensible justifications.

Question 29Security Fundamentals and Risk Management

A vendor contract requires the vendor to notify the organization within 24 hours of any confirmed data breach affecting shared data. Which category of control does this contractual requirement represent?

  1. A corrective control that restores data after an incident occurs
  2. A directive control that mandates how the vendor must behave Correct answer.
  3. A compensating control that substitutes for missing technical safeguards
  4. A deterrent control that discourages attackers through the threat of penalties

Explanation

Directive controls establish required behavior, rules, or obligations that steer how people and organizations act, and contractual notification clauses are a classic example. They do not themselves prevent, detect, or repair an incident; they obligate a specific response and timeline. Deterrent, compensating, and corrective controls each describe a different function.

Question 30Security Fundamentals and Risk Management

A risk assessment team rates a threat as high likelihood and high impact, but the asset owner argues the estimate is inflated because the underlying data is sparse and several assumptions were unstated. Which action best strengthens the assessment before a treatment decision is made?

  1. Raise the rating further to be conservative until better data becomes available
  2. Proceed with treatment immediately so the uncertainty no longer matters
  3. Average the disputed rating with a lower rating to reach a compromise score
  4. Document the assumptions and data sources, then test the estimate with a sensitivity analysis Correct answer.

Explanation

When estimates rest on sparse data, the assessment should make its assumptions and sources explicit and then test how sensitive the result is to changes in those inputs. Sensitivity analysis shows whether the decision would change under plausible alternative values, which tells management how much confidence the rating deserves. Inflating scores, splitting differences, or skipping analysis hides uncertainty rather than managing it.

Question 31Network Security

A workstation sends a frame to a host on a different subnet. Which destination MAC address does the frame carry when it leaves the workstation?

  1. The MAC address of the remote host
  2. The MAC address of the local DNS server
  3. The broadcast address FF:FF:FF:FF:FF:FF
  4. The MAC address of the default gateway interface Correct answer.

Explanation

When the destination IP is off-subnet, the host resolves the gateway's IP to a MAC with ARP and frames the packet to that gateway MAC while keeping the remote IP as the destination. The gateway then routes and re-frames the packet for the next hop. The remote host's MAC is never used on the local segment.

Question 32Network Security

Which statement describes the function of a VLAN in a switched network?

  1. It converts Layer 2 frames into routable Layer 3 packets
  2. It assigns IP addresses to endpoints automatically
  3. It encrypts frames between access switches
  4. It logically segments broadcast domains on shared physical switches Correct answer.

Explanation

A VLAN creates separate Layer 2 broadcast domains on the same physical switching infrastructure, so broadcasts and unknown unicast stay within the VLAN. Traffic between VLANs requires a Layer 3 device. VLANs do not encrypt, address, or route traffic by themselves.

Question 33Network Security

A user reports that a web application is unreachable, but pinging the server's IP succeeds. Which troubleshooting step best isolates the problem?

  1. Verify the server's default gateway configuration
  2. Test name resolution for the application's hostname Correct answer.
  3. Check the switch MAC address table for the server
  4. Capture traffic on the user's default gateway

Explanation

Successful IP reachability with failed application access points to name resolution or application-layer issues. Testing resolution of the hostname distinguishes a DNS failure from a service or port problem. Gateway, MAC table, and server gateway checks would not explain why the IP works but the name does not.

Question 34Network Security

Which protocol provides confidentiality for the payload of IP packets at Layer 3 without requiring changes to applications?

  1. SSH port forwarding
  2. SNMPv3 with authPriv
  3. IPsec in tunnel or transport mode Correct answer.
  4. TLS on port 443

Explanation

IPsec operates at Layer 3 and can encrypt IP payloads transparently to applications, in either transport or tunnel mode. TLS and SSH are application or session layer protections that require the application to use them. SNMPv3 authPriv protects only SNMP messages.

Question 35Network Security

An administrator wants to allow only established inbound sessions to a web server while blocking new unsolicited connections. Which control accomplishes this?

  1. A NAT overload rule on the border router
  2. A stateful firewall rule permitting return traffic for tracked sessions Correct answer.
  3. A port security rule limiting MAC addresses on the switch port
  4. A stateless ACL permitting all inbound TCP from any source

Explanation

A stateful firewall tracks session state and permits return traffic for sessions initiated from inside while denying unsolicited inbound connections. Stateless ACLs cannot track state and would need explicit rules for both directions. NAT and port security address different problems.

Question 36Network Security

Which characteristic distinguishes a screened subnet (DMZ) from an internal network segment?

  1. It uses only static routing to reach the internet
  2. It must contain no servers that store credentials
  3. It is always implemented as a separate physical switch fabric
  4. It hosts services reachable from untrusted networks under tighter filtering Correct answer.

Explanation

A screened subnet is a buffer zone that exposes public-facing services while restricting traffic between the internet and the internal network. It is defined by its filtering posture, not by physical implementation or routing method. It may still contain systems with credentials, which should be hardened.

Question 37Network Security

A SIEM alert shows repeated failed logins to a jump host followed by one success from the same external address. Which conclusion is most defensible?

  1. The external address is a trusted partner because it authenticated
  2. The host may be compromised and should be isolated and investigated Correct answer.
  3. The failures indicate a misconfigured password policy only
  4. The alert is a false positive because logins eventually succeeded

Explanation

A burst of failures followed by success is consistent with password guessing that succeeded, so containment and investigation take priority. A successful login does not make the pattern benign. Password policy may be relevant but does not explain the successful external authentication.

Question 38Network Security

Which mechanism allows a host to learn a peer's Layer 2 address for a known IPv4 address on the local link?

  1. ARP request broadcast with a unicast reply Correct answer.
  2. ICMP echo request and reply
  3. DHCP discover and offer exchange
  4. Router advertisement and solicitation

Explanation

ARP broadcasts a request asking who owns a given IPv4 address, and the owner replies with its MAC address. DHCP assigns addresses, ICMP tests reachability, and router advertisements support IPv6 configuration and discovery, not IPv4-to-MAC resolution.

Question 39Network Security

Which wireless security configuration provides per-client encryption keys derived during a distinct authentication exchange?

  1. WPA3-Enterprise with 802.1X and EAP Correct answer.
  2. Open network with captive portal
  3. WPA2-Personal with a shared passphrase
  4. WEP with a 128-bit shared key

Explanation

WPA3-Enterprise uses 802.1X/EAP so each client authenticates and derives unique session keys. Personal mode uses a shared passphrase from which all clients derive keys. Open networks provide no link encryption, and WEP is cryptographically broken.

Question 40Network Security

A company wants to detect unauthorized devices plugged into access switch ports. Which control is most directly suited?

  1. Dynamic ARP inspection on the uplink
  2. DHCP snooping with option 82 insertion
  3. 802.1X port-based authentication with MAC or certificate credentials Correct answer.
  4. Spanning Tree Protocol root guard

Explanation

802.1X requires a device to authenticate before the port passes traffic, which directly limits unauthorized endpoints. Root guard and DHCP snooping address topology and rogue-server threats, and DAI protects against ARP spoofing rather than device admission.

Question 41Network Security

Which statement best explains why an any-any permit rule at the top of an ACL is a security weakness?

  1. It disables logging for all subsequent rules
  2. It forces all traffic through the management VLAN
  3. It allows traffic before later deny rules can be evaluated Correct answer.
  4. It consumes excessive switch CAM table entries

Explanation

ACLs are evaluated in order, so a broad permit placed first matches all traffic and makes subsequent restrictive rules unreachable. The weakness is policy ordering, not resource consumption or logging behavior. Management VLAN placement is a separate design concern.

Question 42Network Security

Which DNS control reduces the risk of clients contacting malicious domains by checking reputation before resolution completes?

  1. Round-robin load balancing across resolvers
  2. A protective DNS resolver that filters based on threat intelligence Correct answer.
  3. A secondary zone hosted on an internal server
  4. DNSSEC validation on the recursive resolver

Explanation

Protective DNS resolvers block or sinkhole queries to domains flagged by threat intelligence, adding a preventive layer. DNSSEC validates authenticity and integrity of answers but does not judge reputation. Secondary zones and load balancing affect availability, not malicious-domain filtering.

Question 43Network Security

A network engineer needs to protect management traffic to routers so credentials and configuration commands are encrypted and integrity-protected. Which approach satisfies this?

  1. SSHv2 with a management ACL restricting source addresses Correct answer.
  2. Telnet with a strong enable secret
  3. SNMPv2c with a complex community string
  4. TFTP with file permissions on the server

Explanation

SSHv2 encrypts and integrity-protects management sessions, and a management ACL limits who may connect. Telnet, SNMPv2c, and TFTP all send data in cleartext and lack strong integrity protection.

Question 44Network Security

Which technique best mitigates ARP spoofing on a switched LAN?

  1. Dynamic ARP inspection with trusted DHCP snooping bindings Correct answer.
  2. Disabling STP on all access ports
  3. Enabling proxy ARP on the router
  4. Using static ARP entries only on servers

Explanation

Dynamic ARP inspection validates ARP packets against a trusted binding table built from DHCP snooping, dropping spoofed replies. Proxy ARP and static entries on servers do not protect the broader segment, and disabling STP creates loops.

Question 45Network Security

Which protocol and port pair should be permitted on a firewall to allow secure web browsing to an internal application server?

  1. TCP 443 Correct answer.
  2. UDP 53
  3. TCP 25
  4. UDP 123

Explanation

HTTPS uses TCP 443, so permitting it enables encrypted web access to the server. UDP 53 is DNS, TCP 25 is SMTP, and UDP 123 is NTP; none of these carry HTTPS traffic.

Question 46Network Security

A remote worker needs access to internal applications without exposing those applications directly to the internet. Which design best meets this requirement?

  1. A VPN concentrator that authenticates users and routes them into the internal network Correct answer.
  2. A public reverse proxy with no authentication
  3. An internet-facing jump host with a shared local account
  4. A port-forward on the border router to each application server

Explanation

A VPN concentrator authenticates remote users and provides an encrypted tunnel into the internal network so applications remain unexposed. Port forwarding and unauthenticated proxies publish services directly. A shared-account jump host weakens accountability.

Question 47Network Security

Which statement about NAT and security is accurate?

  1. NAT hides internal addressing but is not a substitute for a firewall Correct answer.
  2. NAT encrypts translated packets for confidentiality
  3. NAT authenticates inbound connections before translation
  4. NAT inspects application payloads for malware

Explanation

NAT obscures internal addresses and can incidentally limit unsolicited inbound reachability, but it provides no policy enforcement, encryption, authentication, or content inspection. Those functions belong to firewalls and other security tools.

Question 48Network Security

An analyst sees a large outbound transfer to an unfamiliar external IP at 02:00 from a database server that normally only receives inbound connections. Which action should come first?

  1. Restart the database service to clear the connection
  2. Contain the host and preserve evidence before scoping the incident Correct answer.
  3. Add the destination to the allow list for monitoring
  4. Block the destination IP permanently on all firewalls

Explanation

Unusual outbound traffic from a server that should not initiate connections suggests compromise or data exfiltration; containment plus evidence preservation protects both the environment and the investigation. Premature global blocks, restarts, or allow-listing can destroy evidence or mask scope.

Question 49Network Security

Which protocol provides cryptographic authentication of routing updates between routers?

  1. OSPFv3 with IPsec authentication Correct answer.
  2. ICMP redirects
  3. CDP neighbor advertisements
  4. RIPv2 with plaintext authentication

Explanation

OSPFv3 relies on IPsec AH or ESP to authenticate and optionally encrypt routing protocol traffic. RIPv2 plaintext authentication can be replayed or spoofed easily, and ICMP redirects and CDP are not routing authentication mechanisms.

Question 50Network Security

Which control limits the impact of a compromised server by restricting which internal hosts it can reach?

  1. Disabling host-based firewalls to simplify management
  2. Microsegmentation with least-privilege east-west firewall rules Correct answer.
  3. A larger DMZ subnet with more public IP addresses
  4. A single flat VLAN for all servers

Explanation

Microsegmentation applies least-privilege rules between workloads, so a compromised server cannot freely reach other internal systems. Flat networks and disabled host firewalls increase lateral movement, and expanding public addresses increases exposure.