I85PREP
⌘ K
ECF-GSF Core study materials
ECF-GSF Core study resources

ECF-GSF Core practice questions

One question at a time. Build your ECF-GSF Core understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Fundamentals and Risk Management

In an information security programme, which statement best distinguishes an asset from a threat?

  1. An asset is anything of value to the organisation, while a threat is a potential cause of harm to that asset. Correct answer.
  2. An asset is a realised security incident, while a threat is the record of that incident.
  3. An asset is a countermeasure deployed to reduce risk, while a threat is the residual risk remaining.
  4. An asset is a weakness in a control, while a threat is the likelihood that the weakness is exploited.

Explanation

An asset is any item, data, service or capability that has value to the organisation and therefore requires protection. A threat is a potential cause of an unwanted incident that could damage or compromise an asset. Weaknesses are vulnerabilities, and realised harm is an incident, so asset and threat are distinct concepts.

Question 2Security Fundamentals and Risk Management

A risk assessment records that a vulnerability has a high likelihood of exploitation but the affected system holds only publicly available marketing material. How should the risk most appropriately be rated?

  1. Low impact, because the affected asset has low value and exposure of public data causes little harm Correct answer.
  2. Zero, because public information is never an asset
  3. High impact, because likelihood of exploitation is high
  4. Critical, because any exploitable vulnerability is automatically critical

Explanation

Risk combines the likelihood of an event with its impact, and impact depends on the value and sensitivity of the affected asset. Publicly available marketing content has low confidentiality value, so even a readily exploitable flaw yields limited impact. Rating the risk high or critical ignores the impact dimension of risk.

Question 3Security Fundamentals and Risk Management

Which activity is a preventive control rather than a detective or corrective control?

  1. Restoring a database from backup after corruption
  2. Reviewing audit logs each morning for failed login attempts
  3. Enforcing role-based access restrictions on the payroll system Correct answer.
  4. Investigating an alert raised by an intrusion detection system

Explanation

Preventive controls stop an event from occurring, and restricting access by role keeps unauthorised users out of the payroll system before any harm occurs. Log review and intrusion alerts detect events after they happen, while restoration is a corrective action taken after damage.

Question 4Security Fundamentals and Risk Management

An organisation's risk appetite statement says it will accept only low residual risk for customer payment data. Which action best reflects this appetite when a new payment service is designed?

  1. Transfer all responsibility to the cloud provider and close the risk register entry
  2. Accept the default vendor configuration to shorten delivery time
  3. Defer risk assessment until after the first production incident
  4. Apply layered controls and require risk sign-off before go-live Correct answer.

Explanation

Risk appetite defines how much risk the organisation is willing to accept, and a low appetite for payment data demands strong, layered controls plus formal acceptance before exposure. Deferring assessment or accepting defaults would place payment data at risk above the stated tolerance.

Question 5Security Fundamentals and Risk Management

What is the primary purpose of a business impact analysis within business continuity management?

  1. To list every asset in the configuration management database
  2. To identify the threats most likely to cause an outage
  3. To test whether backups can be restored successfully
  4. To determine which activities are time-critical and the consequences of their disruption Correct answer.

Explanation

A business impact analysis identifies time-critical business activities and quantifies the operational and financial consequences of disrupting them over time. Its outputs, such as recovery time objectives, drive continuity strategy. Threat identification, restore testing and asset inventory are separate activities that support but do not define the BIA.

Question 6Security Fundamentals and Risk Management

A team classifies a dataset as confidential. Which handling requirement follows most directly from that classification?

  1. The data may be posted to any internal collaboration site for convenience
  2. The data must be encrypted in transit and stored only in approved repositories Correct answer.
  3. The data must be deleted within 24 hours of creation
  4. The data may be shared externally without any approval

Explanation

Information classification drives handling rules, and confidential data typically requires encryption in transit and storage only in approved, access-controlled repositories. Classification exists precisely to constrain how data is stored, shared and transmitted.

Question 7Security Fundamentals and Risk Management

Which principle states that a user should be granted only the access necessary to perform their assigned job duties?

  1. Mandatory access control
  2. Defence in depth
  3. Separation of duties
  4. Least privilege Correct answer.

Explanation

Least privilege limits each user's access rights to the minimum required for their assigned tasks, reducing the blast radius of misuse or compromise. Separation of duties divides critical tasks among people, and defence in depth layers controls; neither defines minimum necessary access.

Question 8Security Fundamentals and Risk Management

During risk treatment, an organisation purchases cyber insurance to cover losses from ransomware. Which treatment option does this represent?

  1. Risk mitigation
  2. Risk avoidance
  3. Risk transfer Correct answer.
  4. Risk acceptance

Explanation

Risk transfer shifts the financial consequence of a risk to another party, and insurance is the classic example because the insurer absorbs covered losses. The underlying risk of an attack remains with the organisation, so it is not avoidance or mitigation.

Question 9Security Fundamentals and Risk Management

A security team wants to know how quickly systems must be restored after an outage. Which metric should they define?

  1. Recovery time objective Correct answer.
  2. Mean time between failures
  3. Maximum tolerable period of disruption
  4. Recovery point objective

Explanation

The recovery time objective specifies the target duration within which a service must be restored after disruption. The recovery point objective instead defines how much data loss is tolerable, measured backwards from the failure.

Question 10Security Fundamentals and Risk Management

An employee receives an email urging immediate payment to a new supplier bank account, with a spoofed executive signature. Which control is most directly designed to prevent loss from this attack?

  1. A documented change-of-bank-details verification process using a known phone number Correct answer.
  2. An antivirus signature update schedule
  3. Weekly full backups of the finance file server
  4. A firewall rule blocking outbound traffic on unusual ports

Explanation

This is business email compromise, and an out-of-band verification step for bank detail changes directly interrupts the fraud before payment is made. Technical network and endpoint controls do not address the social engineering and process gap that enables the loss.

Question 11Security Fundamentals and Risk Management

Which statement correctly describes the relationship between vulnerability, threat and risk?

  1. Risk is eliminated once all vulnerabilities are documented in a register
  2. A threat is the measure of harm caused by an exploited vulnerability
  3. A vulnerability always produces risk regardless of threats or asset value
  4. Risk exists only when a threat can exploit a vulnerability and cause impact Correct answer.

Explanation

Risk arises from the combination of a threat, a vulnerability that the threat can exploit, and the resulting impact on an asset. Documenting a vulnerability does not by itself create or remove risk, and a threat without a matching weakness or valuable target may pose little risk.

Question 12Security Fundamentals and Risk Management

Under a mandatory access control model, how are access decisions primarily made?

  1. Access is granted to anyone who knows the file path
  2. Users decide which files to share with colleagues
  3. Access is granted by the resource owner's discretion
  4. Access is based on system-assigned labels compared against the subject's clearance Correct answer.

Explanation

Mandatory access control compares security labels on objects with the clearance level of the subject, and the system enforces the result. Users cannot override the policy, which distinguishes it from discretionary models where owners set permissions.

Question 13Security Fundamentals and Risk Management

A penetration test finds that a legacy server runs an unsupported operating system. Which risk response is most appropriate if the server supports a critical business process that cannot yet be migrated?

  1. Ignore the finding because the server is internal only
  2. Isolate the server with network segmentation, add compensating monitoring, and plan migration Correct answer.
  3. Disable all logging on the server to reduce noise
  4. Remove the server from the asset inventory to close the finding

Explanation

When a risk cannot be immediately eliminated, compensating controls such as segmentation and enhanced monitoring reduce likelihood and impact while a remediation plan proceeds. Internal placement alone is not a control, and hiding the asset or its logs increases exposure.

Question 14Security Fundamentals and Risk Management

Which of the following best describes the role of a risk owner?

  1. The vendor who supplies the affected product
  2. The person who performs technical remediation of vulnerabilities
  3. The person accountable for ensuring a specific risk is managed within tolerance Correct answer.
  4. The auditor who independently verifies control effectiveness

Explanation

A risk owner is accountable for the management of a defined risk, including approving treatment and monitoring that residual risk stays within tolerance. Remediation may be performed by others, and auditors provide independent assurance rather than ownership.

Question 15Security Fundamentals and Risk Management

An organisation applies encryption at rest, network segmentation, endpoint detection and regular phishing training. Which security principle does this collection of measures illustrate?

  1. Least common mechanism
  2. Single point of failure
  3. Open design
  4. Defence in depth Correct answer.

Explanation

Defence in depth layers independent controls so that failure of one does not expose the asset entirely. Encryption, segmentation, endpoint detection and user training each address different attack paths and reinforce one another.

Question 16Security Fundamentals and Risk Management

A risk register entry shows likelihood 4 of 5 and impact 5 of 5, with no existing controls. After treatment, likelihood falls to 2 and impact stays at 5. What does the remaining value represent?

  1. Risk appetite
  2. Risk transfer
  3. Residual risk Correct answer.
  4. Inherent risk

Explanation

Residual risk is the risk remaining after controls or treatment have been applied. The original pre-treatment score is the inherent risk, so the reduced post-treatment score is residual risk.

Question 17Security Fundamentals and Risk Management

Why is separation of duties an effective fraud control in a payment approval process?

  1. It removes the need for audit logging of approvals
  2. It guarantees that all payments are correct
  3. It encrypts payment instructions in transit
  4. It ensures that one person cannot both initiate and approve a payment Correct answer.

Explanation

Separation of duties splits a sensitive transaction so that no single individual controls all stages, making concealment of fraud harder. It does not provide cryptographic protection or guarantee correctness, and logging remains essential for accountability.

Question 18Security Fundamentals and Risk Management

Which activity is characteristic of a quantitative rather than a qualitative risk assessment?

  1. Listing threats in a brainstorming session
  2. Categorising risks by colour on a heat map
  3. Estimating annualised loss expectancy from asset value and exposure factor Correct answer.
  4. Assigning ratings of high, medium and low in a workshop

Explanation

Quantitative assessment expresses risk in monetary or numerical terms, such as annualised loss expectancy derived from asset value, exposure factor and annualised rate of occurrence. Qualitative methods use descriptive scales, workshops and heat maps.

Question 19Security Fundamentals and Risk Management

A company discovers that a former contractor's account remains active three months after the contract ended. Which control failure does this most directly indicate?

  1. Failure of the joiner-mover-leaver access lifecycle process Correct answer.
  2. Weak cryptographic key length
  3. Insufficient backup retention
  4. Inadequate capacity planning

Explanation

Timely revocation of access on termination is a core element of the joiner-mover-leaver lifecycle. A lingering contractor account shows the leaver step failed, leaving standing access that violates least privilege.

Question 20Security Fundamentals and Risk Management

Which statement about the CIA triad is accurate?

  1. Confidentiality guarantees that data cannot be deleted
  2. Availability ensures data is accurate and unaltered
  3. Integrity ensures data is accessible whenever needed
  4. Confidentiality ensures data is disclosed only to authorised parties Correct answer.

Explanation

Confidentiality restricts information disclosure to authorised parties. Integrity concerns accuracy and completeness, and availability concerns timely access, so the options that swap these meanings are incorrect.

Question 21Security Fundamentals and Risk Management

A cloud customer stores regulated data with a provider. Which statement best reflects the shared responsibility model?

  1. The provider assumes all security responsibility once data is migrated
  2. The customer is responsible only for physical data centre security
  3. The customer retains responsibility for data classification, access management and configuration of their own workloads Correct answer.
  4. Responsibility is shared equally and identically for every service model

Explanation

In the shared responsibility model the provider secures the underlying infrastructure while the customer remains accountable for their data, identities, access and workload configuration. The split varies by service model, so responsibility is neither wholly transferred nor identical across models.

Question 22Security Fundamentals and Risk Management

What is the main purpose of maintaining a risk register?

  1. To store employee passwords securely
  2. To list approved software vendors only
  3. To document the network topology in detail
  4. To record and track identified risks, their owners, ratings and treatment status Correct answer.

Explanation

A risk register is the record of identified risks together with ownership, assessment results, treatment decisions and status, supporting ongoing monitoring. It is a governance tool, not a credential store, network diagram or vendor list.

Question 23Security Fundamentals and Risk Management

An organisation decides to stop offering a legacy file-sharing service entirely because its risks cannot be cost-effectively controlled. Which risk treatment has been applied?

  1. Risk avoidance Correct answer.
  2. Risk deferral
  3. Risk transfer
  4. Risk acceptance

Explanation

Risk avoidance eliminates the risk by discontinuing the activity that creates it. Here the service is retired, so the associated exposure no longer exists rather than being accepted, insured or postponed.

Question 24Security Fundamentals and Risk Management

A security manager must prioritise remediation across many findings with limited resources. Which approach best aligns with risk-based decision making?

  1. Remediate the findings with the highest combined likelihood and business impact first Correct answer.
  2. Remediate only the findings reported by external auditors
  3. Remediate the oldest findings regardless of severity
  4. Remediate findings alphabetically by system name

Explanation

Risk-based prioritisation ranks findings by the likelihood of exploitation and the business impact if exploited, directing limited resources to the greatest exposure. Alphabetical, age-based or purely audit-driven ordering ignores actual risk.

Question 25Security Fundamentals and Risk Management

Which of the following is an example of a detective control for physical security?

  1. A locked door requiring badge access
  2. CCTV recording with motion-triggered alerts Correct answer.
  3. A fire suppression system
  4. A visitor sign-in policy

Explanation

Detective controls identify and record events as or after they occur, and CCTV with alerts provides that visibility. Badge-locked doors and visitor policies prevent unauthorised entry, while fire suppression limits damage.

Question 26Security Fundamentals and Risk Management

An organisation defines risk appetite as the amount and type of risk it is willing to accept before action is required. Which statement best describes how risk appetite differs from risk tolerance?

  1. Risk appetite applies only to financial risk, while risk tolerance applies only to operational and technical risk.
  2. Risk appetite is set by external regulators, while risk tolerance is negotiated with customers and suppliers.
  3. Risk appetite is the broad level of risk the organisation seeks to pursue, while risk tolerance sets the acceptable variation around specific objectives or metrics. Correct answer.
  4. Risk appetite is recalculated after every incident, while risk tolerance is a permanent figure that never changes.

Explanation

Risk appetite expresses the overall amount and type of risk an organisation is willing to pursue to meet its objectives, and it is usually stated at a strategic level. Risk tolerance translates that appetite into concrete acceptable thresholds or variation for particular objectives, systems or metrics. The two are related but operate at different levels of granularity.

Question 27Security Fundamentals and Risk Management

A security analyst is told that a specific threat actor has both the capability and intent to target the organisation's payment systems. Which term best describes this combination of capability and intent directed at a specific asset?

  1. Exposure factor
  2. Vulnerability
  3. Threat Correct answer.
  4. Control gap

Explanation

A threat is a potential cause of an unwanted incident, and it is commonly characterised by an actor's intent and capability to exploit a weakness. Vulnerability refers to the weakness itself, not the actor. Exposure factor is a quantitative estimate of how much of an asset is lost in an incident.

Question 28Security Fundamentals and Risk Management

Which statement best describes the purpose of a business impact analysis within a business continuity programme?

  1. It determines the criticality of business functions and the consequences of their disruption over time. Correct answer.
  2. It identifies the likelihood that each identified threat will exploit a control weakness.
  3. It lists the technical vulnerabilities present on production servers and their patch status.
  4. It records the disciplinary actions taken when staff fail to follow security policy.

Explanation

A business impact analysis identifies critical business functions and quantifies the operational and financial consequences of disrupting them over time. Its outputs, such as recovery time objectives and recovery point objectives, drive continuity and recovery planning. It is not a threat-likelihood exercise or a technical vulnerability inventory.

Question 29Security Fundamentals and Risk Management

An organisation's risk register shows a risk with an inherent score of 20. After implementing a new data loss prevention tool, the residual score is 12. Which statement best explains what these two figures represent?

  1. The inherent score measures likelihood only, while the residual score measures impact only.
  2. The inherent score reflects risk with no controls considered, while the residual score reflects risk remaining after the DLP control is applied. Correct answer.
  3. The inherent score reflects risk after controls are applied, while the residual score reflects risk before any controls exist.
  4. Both scores measure the same thing, and the difference simply reflects a scoring error that should be corrected.

Explanation

Inherent risk is assessed without considering existing controls, whereas residual risk is what remains after controls are applied and evaluated for effectiveness. The drop from 20 to 12 reflects the estimated risk reduction attributable to the DLP tool. Both scores combine likelihood and impact, not one each.

Question 30Security Fundamentals and Risk Management

A security architect needs to select a control that will stop unauthorised users from reaching a sensitive database segment even if they obtain valid credentials. Which control type and function best fits this requirement?

  1. A detective control that logs failed login attempts for later review
  2. A corrective control that restores the database from backup after an intrusion
  3. A preventive control that enforces network segmentation and least-privilege access to the segment Correct answer.
  4. A compensating control that documents the risk in the risk register

Explanation

Preventive controls are designed to stop an event before it occurs, and network segmentation with least-privilege access restricts reachability even when credentials are valid. Detective controls only identify events after the fact. Corrective controls act after an incident to restore normal operations.

Question 31Security Fundamentals and Risk Management

An organisation's risk assessment team wants to express risk in monetary terms so that treatment options can be compared against a budget. Which approach should they use?

  1. A quantitative assessment using annualised loss expectancy derived from asset value, exposure factor and annualised rate of occurrence Correct answer.
  2. A qualitative assessment using high, medium and low ratings agreed by workshop consensus
  3. A maturity model score benchmarked against industry peers
  4. A control self-assessment questionnaire completed by business unit managers

Explanation

Quantitative assessment assigns numeric, often monetary, values to risk, and annualised loss expectancy is computed as single loss expectancy multiplied by annualised rate of occurrence. This allows direct comparison of treatment cost against expected loss. Qualitative ratings and maturity scores support prioritisation but do not express risk in currency.

Question 32Security Fundamentals and Risk Management

A risk owner is asked to decide how to treat a risk involving an outdated internal application. Which of the following best illustrates risk acceptance as a treatment decision?

  1. Formally documenting that the risk will be retained because the cost of treatment exceeds the expected loss Correct answer.
  2. Migrating the application to a supported platform before the next audit cycle
  3. Removing the application from service so the associated risk no longer exists
  4. Transferring the financial consequences to an insurer through a cyber liability policy

Explanation

Risk acceptance means the organisation consciously decides to retain a risk, and this decision should be documented and approved by an accountable owner. It is appropriate when treatment cost outweighs expected loss or when the risk falls within appetite. Migration is mitigation, insurance is transfer, and decommissioning is avoidance.

Question 33Security Fundamentals and Risk Management

An organisation wants to measure how long a critical service can be unavailable before the impact becomes unacceptable. Which metric should be defined and agreed with the business?

  1. Exposure factor
  2. Annualised rate of occurrence
  3. Recovery time objective Correct answer.
  4. Mean time between failures

Explanation

The recovery time objective defines the maximum acceptable time to restore a service after disruption, and it is agreed with business owners based on impact. It directly answers how long unavailability can be tolerated. Mean time between failures describes reliability, while the other two are risk quantification inputs.

Question 34Security Fundamentals and Risk Management

A risk assessment identifies that a supplier holds regulated data but has no contractual security obligations. Which control category most directly addresses this gap?

  1. Deploying an intrusion detection system at the network perimeter
  2. Implementing file integrity monitoring on internal servers
  3. Establishing a third-party risk management process with contractual security requirements and periodic assurance reviews Correct answer.
  4. Increasing the frequency of internal vulnerability scans

Explanation

Third-party risk management addresses risks arising from suppliers through due diligence, contractual security clauses, and ongoing assurance such as audits or certifications. The gap described is an absent supplier obligation, so a contractual and assurance process is the direct control. The other options are internal technical controls that do not govern the supplier relationship.

Question 35Security Fundamentals and Risk Management

An organisation classifies information into public, internal, confidential and restricted tiers. Which statement best describes the primary purpose of such a classification scheme?

  1. It guarantees that all data is encrypted at rest and in transit across every system.
  2. It ensures that protective handling requirements are proportionate to the value and sensitivity of the information. Correct answer.
  3. It replaces the need for access control by making data self-protecting.
  4. It transfers legal liability for data breaches to the employees who handle the data.

Explanation

Classification assigns sensitivity labels so that handling, storage, transmission and access requirements can be matched to the value of the information. It is a governance mechanism that drives proportionate controls. It does not by itself guarantee encryption, replace access control, or shift legal liability to individuals.

Question 36Security Fundamentals and Risk Management

A security manager is comparing two safeguards. Safeguard A costs 40,000 per year and is expected to reduce annualised loss expectancy from 150,000 to 60,000. Safeguard B costs 25,000 per year and is expected to reduce annualised loss expectancy from 150,000 to 100,000. Which conclusion is best supported by a cost-benefit comparison?

  1. Safeguard B is preferable because it has the lower absolute cost regardless of risk reduction.
  2. Neither safeguard should be adopted because residual risk remains above zero.
  3. Safeguard A delivers a net benefit of 50,000 per year, which is greater than the 25,000 net benefit of Safeguard B. Correct answer.
  4. Both safeguards deliver identical net benefit because both address the same risk.

Explanation

Safeguard A reduces annualised loss expectancy by 90,000 at a cost of 40,000, giving a net benefit of 50,000. Safeguard B reduces loss by 50,000 at a cost of 25,000, giving a net benefit of 25,000. Comparing net benefit rather than absolute cost shows Safeguard A delivers greater value.

Question 37Network Security and Architecture

Which security control is designed to enforce separation between network segments by permitting or denying traffic based on stateful inspection of sessions?

  1. A hub that repeats frames to every connected port
  2. A load balancer that distributes requests across web servers
  3. A stateful firewall placed at the segment boundary Correct answer.
  4. A DNS forwarder that resolves internal names

Explanation

A stateful firewall tracks connection state and applies policy at segment boundaries, which is the definition of enforced segmentation. Devices that merely forward or distribute traffic do not apply security policy between zones.

Question 38Network Security and Architecture

An organization wants to ensure that traffic between two internal VLANs is inspected by a security appliance without changing host default gateways. Which design accomplishes this?

  1. Enable proxy ARP on the core switch so hosts resolve each other directly
  2. Route the inter-VLAN traffic through a firewall using a transit link and set the appliance as the gateway for those VLANs Correct answer.
  3. Place both VLANs on the same Layer 2 broadcast domain and rely on switch ACLs
  4. Attach the appliance as a passive SPAN destination port

Explanation

Making the firewall the Layer 3 gateway for the VLANs forces inter-VLAN flows through it for inspection. Passive monitoring copies traffic but cannot block, and merging broadcast domains removes the boundary entirely.

Question 39Network Security and Architecture

Which statement best describes the security purpose of a demilitarized zone (DMZ) in a network architecture?

  1. It provides a second broadcast domain for voice over IP handsets
  2. It stores backups of internal databases for disaster recovery
  3. It hosts externally reachable services so that a compromise does not grant direct access to the internal network Correct answer.
  4. It terminates remote access VPN tunnels for employees

Explanation

A DMZ isolates internet-facing systems behind an additional policy boundary, so an exploited public service sits in a lower-trust segment. Internal data stores, voice segments, and VPN termination are separate design concerns.

Question 40Network Security and Architecture

A web tier in a three-tier architecture must reach a database tier. Which control most directly limits lateral movement if the web tier is compromised?

  1. Permit all traffic between internal tiers and rely on host antivirus
  2. Allow only the specific database port from web tier addresses to the database tier and deny all other inter-tier traffic Correct answer.
  3. Place the database tier and web tier in the same VLAN
  4. Permit the web tier to reach the database tier on any port to simplify troubleshooting

Explanation

Least-privilege inter-tier rules restrict a compromised host to the minimum flows it legitimately needs, which limits lateral movement. Broad permits and shared VLANs give an attacker far more reachable surface.

Question 41Network Security and Architecture

Which characteristic distinguishes an inline intrusion prevention system from a passive intrusion detection system?

  1. The prevention system only stores packet captures for later review
  2. The prevention system can drop malicious packets in the traffic path Correct answer.
  3. The prevention system relies solely on signature updates from the vendor
  4. The prevention system is always deployed on a SPAN port

Explanation

An inline IPS sits in the forwarding path and can block traffic that matches a policy, whereas a passive IDS only observes and alerts. Signature reliance is common to both and does not distinguish them.

Question 42Network Security and Architecture

Encrypted traffic traverses a network sensor that cannot decrypt it. Which approach lets the sensor inspect application-layer content while preserving privacy for excluded categories?

  1. Mirror traffic to the sensor and enable promiscuous mode
  2. Deploy a TLS break-and-inspect capability with policy-based bypass for sensitive categories such as health and finance Correct answer.
  3. Disable TLS on all internal servers so traffic is readable
  4. Rely on IP header inspection alone and ignore encrypted payloads

Explanation

TLS inspection decrypts, inspects, and re-encrypts sessions, and policy bypass preserves privacy and compliance for sensitive categories. Removing TLS or relying on headers alone sacrifices either confidentiality or visibility.

Question 43Network Security and Architecture

Which DNS control most directly reduces the risk of users reaching malicious domains resolved through an external resolver?

  1. Force clients to use an internal resolver that applies reputation filtering and logs queries Correct answer.
  2. Enable NetBIOS name resolution as a fallback
  3. Allow clients to query any external resolver directly over UDP port 53
  4. Increase the DNS cache time-to-live on client workstations

Explanation

Concentrating resolution on a controlled resolver enables reputation filtering, logging, and policy enforcement. Direct external queries bypass those controls, and longer caching or legacy name resolution does not add protection.

Question 44Network Security and Architecture

Which practice best mitigates DNS cache poisoning against a recursive resolver?

  1. Disable DNSSEC validation to reduce resolver load
  2. Allow recursion from any internet source
  3. Use a single static source port for all outbound queries
  4. Randomize source ports and query IDs and validate DNSSEC signatures Correct answer.

Explanation

Source port and transaction ID randomization makes off-path spoofing harder, and DNSSEC validation cryptographically confirms answers. Disabling validation or using a fixed port weakens exactly these defenses.

Question 45Network Security and Architecture

A remote employee connects to the corporate network. Which design provides least-privilege access while reducing exposure of internal applications?

  1. A site-to-site IPsec tunnel from the employee's home router
  2. A zero-trust access broker that grants per-application access after device and user posture checks Correct answer.
  3. A full-tunnel VPN that places the device on the flat internal network
  4. An RDP gateway exposed directly to the internet with password authentication

Explanation

Per-application brokering with posture checks grants only the access needed and keeps applications off the public internet. Flat full-tunnel access and internet-exposed RDP both expand exposure.

Question 46Network Security and Architecture

Which statement correctly describes microsegmentation in a data center?

  1. Policies are applied to individual workloads or groups rather than only at the perimeter Correct answer.
  2. Traffic between workloads is left uninspected to maximize throughput
  3. Segmentation is achieved solely by physical cabling changes
  4. All workloads share one subnet protected by a single perimeter firewall

Explanation

Microsegmentation applies granular policy close to workloads, often in software, so east-west traffic is controlled. Perimeter-only, physical-only, or uninspected designs do not achieve workload-level control.

Question 47Network Security and Architecture

An architect must place a WAF for a public web application. Where does it provide the most value?

  1. Inline in front of the web servers, inspecting HTTP requests and responses Correct answer.
  2. On the backup network, inspecting replication traffic
  3. On the internal user VLAN, filtering workstation browsing
  4. Behind the database tier, filtering SQL responses

Explanation

A web application firewall analyzes HTTP traffic, so it must sit in the request path in front of the web tier. Other placements see traffic unrelated to the web application's request flow.

Question 48Network Security and Architecture

Which control most effectively reduces the blast radius of a compromised server in a flat legacy subnet while a full redesign is pending?

  1. Extending the DHCP lease duration
  2. Increasing the subnet size to reduce broadcast traffic
  3. Host-based firewalls with deny-by-default rules between servers Correct answer.
  4. Adding more bandwidth to the core switch

Explanation

Host-based firewalls can enforce deny-by-default between servers even when the network is flat, limiting what a compromised host can reach. The other options address performance or addressing, not containment.

Question 49Network Security and Architecture

What is the primary security benefit of terminating outbound web traffic at an authenticated forward proxy?

  1. It eliminates the need for endpoint protection software
  2. It enforces acceptable-use policy and logs user-attributed outbound requests Correct answer.
  3. It guarantees that no malware can leave the network
  4. It encrypts traffic between the proxy and the destination server

Explanation

A forward proxy centralizes policy enforcement and attributes outbound requests to authenticated users for logging and control. It does not provide end-to-end encryption guarantees or replace endpoint defenses.

Question 50Network Security and Architecture

Which network architecture principle best supports defense in depth for a payment processing environment?

  1. A single strong perimeter firewall protecting a flat internal network
  2. Layered controls across network, host, application, and data tiers so no single failure grants full access Correct answer.
  3. Relying exclusively on encryption at rest for all protection
  4. Consolidating all services on one host to simplify monitoring

Explanation

Defense in depth assumes controls can fail, so independent layers must each resist compromise. Single-perimeter, single-control, or consolidated-host designs create single points of failure.