I85PREP
⌘ K
HKIE Professional Assessment - Information Discipline study materials
HKIE Professional Assessment - Information Discipline study resources

HKIE Professional Assessment - Information Discipline practice questions

One question at a time. Build your HKIE Professional Assessment - Information Discipline understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Information Discipline (content domains not enumerated in source)

In a structured cabling design for a new office floor, which cabling category is specified by ISO/IEC 11801 and TIA-568 for supporting 10GBASE-T over a full 100 m channel?

  1. Category 5e
  2. Category 6A Correct answer.
  3. Category 6
  4. Category 3

Explanation

Category 6A (augmented Category 6) is the balanced twisted-pair grade specified to support 10GBASE-T over the full 100 m channel, with extended bandwidth to 500 MHz and improved alien crosstalk performance. Category 6 is limited to shorter distances for 10GBASE-T, and Category 5e and Category 3 do not support it at all.

Question 2Information Discipline (content domains not enumerated in source)

A designer needs to calculate the optical power budget for a multimode fibre link. Which combination of parameters is required to determine the budget directly?

  1. Wavelength and connector polish type
  2. Transmitter output power and receiver sensitivity Correct answer.
  3. Numerical aperture and core diameter
  4. Modal bandwidth and fibre length

Explanation

The optical power budget is the difference between the transmitter's launched output power and the receiver's minimum sensitivity, expressed in dB. Losses from connectors, splices and fibre attenuation are then subtracted to confirm adequate margin. Bandwidth and geometry parameters affect performance but not the power budget itself.

Question 3Information Discipline (content domains not enumerated in source)

Which IEEE 802.1Q mechanism prevents frames from a VLAN being carried onto a trunk port that is not configured to carry that VLAN?

  1. Dynamic ARP inspection
  2. Port security with sticky MAC addresses
  3. Spanning Tree Protocol root guard
  4. Allowed VLAN list on the trunk Correct answer.

Explanation

The allowed VLAN list on a trunk port determines which VLAN tags the port will accept and forward, so a VLAN not on the list is pruned from that trunk. Root guard and port security address topology and access-layer threats respectively, not VLAN membership on a trunk.

Question 4Information Discipline (content domains not enumerated in source)

In IPv4 subnetting, a /26 mask is applied to the network 192.168.10.0. What is the usable host address range of the second subnet?

  1. 192.168.10.65 to 192.168.10.127
  2. 192.168.10.64 to 192.168.10.127
  3. 192.168.10.64 to 192.168.10.126
  4. 192.168.10.65 to 192.168.10.126 Correct answer.

Explanation

A /26 mask leaves 6 host bits, giving 64 addresses per subnet with 62 usable hosts. The second subnet is 192.168.10.64/26, so the network address is .64 and the broadcast is .127, leaving usable hosts .65 through .126.

Question 5Information Discipline (content domains not enumerated in source)

Under Hong Kong's Personal Data (Privacy) Ordinance, which principle governs the accuracy and duration of retention of personal data?

  1. Data Protection Principle 1
  2. Data Protection Principle 2 Correct answer.
  3. Data Protection Principle 6
  4. Data Protection Principle 4

Explanation

Data Protection Principle 2 in Schedule 1 of the PDPO requires that personal data be accurate, and that it not be kept longer than is necessary for the purpose for which it is used. Principle 1 covers collection purpose and manner, Principle 4 covers security, and Principle 6 covers access and correction rights.

Question 6Information Discipline (content domains not enumerated in source)

In a project following a traditional waterfall delivery model, which document formally authorises the project and establishes the project manager's authority?

  1. Work breakdown structure
  2. Project charter Correct answer.
  3. Benefits realisation plan
  4. Business case

Explanation

The project charter is the document that formally authorises the existence of the project and gives the project manager authority to apply organisational resources to project activities. The business case justifies the investment but does not authorise the project, and the WBS is a decomposition of scope.

Question 7Information Discipline (content domains not enumerated in source)

Which type of uninterruptible power supply passes the load through a rectifier and inverter continuously, providing the highest level of protection against mains disturbances?

  1. Ferroresonant UPS
  2. Online double-conversion UPS Correct answer.
  3. Offline (standby) UPS
  4. Line-interactive UPS

Explanation

An online double-conversion UPS continuously rectifies incoming AC to DC and inverts it back to AC, so the load is isolated from sags, surges and frequency variation. Offline and line-interactive designs only switch to inverter output when mains deviates.

Question 8Information Discipline (content domains not enumerated in source)

In an IT disaster recovery plan, which metric defines the maximum acceptable time that a business process can be unavailable after a disruption?

  1. Mean time to repair
  2. Recovery time objective Correct answer.
  3. Recovery point objective
  4. Service level objective

Explanation

The recovery time objective (RTO) states the maximum tolerable duration of downtime for a process or system before the impact becomes unacceptable. The recovery point objective instead defines how much data loss, measured in time, is tolerable.

Question 9Information Discipline (content domains not enumerated in source)

A network engineer must segment a flat /22 office network into separate broadcast domains aligned to departments while keeping the existing IP addressing scheme. Which approach achieves this with the least re-addressing?

  1. Replace the /22 with a single /24 for all departments
  2. Assign each department a VLAN with a unique subnet carved from the existing /22 Correct answer.
  3. Enable private VLANs across the whole /22
  4. Convert the whole /22 to a single VLAN with larger MAC address tables

Explanation

Carving the existing /22 into smaller subnets and mapping each to a VLAN creates separate broadcast domains while preserving the address range already in use. The other options either collapse the address space or fail to create distinct broadcast domains.

Question 10Information Discipline (content domains not enumerated in source)

An engineer is asked to verify that a fibre link meets its loss budget. The measured total loss is 8.2 dB, the transmitter launches 0 dBm, the receiver sensitivity is -12 dBm, and a 3 dB margin is required. What is the conclusion?

  1. The link passes with 0.8 dB of margin
  2. The link fails because the margin is only 0.8 dB Correct answer.
  3. The link fails because measured loss exceeds the budget
  4. The link passes with 3.8 dB of margin

Explanation

The available budget is 12 dB (0 dBm launch minus -12 dBm sensitivity). Subtracting the 8.2 dB measured loss leaves 3.8 dB, and after reserving the required 3 dB margin only 0.8 dB remains, so the link does not meet the stated requirement.

Question 11Information Discipline (content domains not enumerated in source)

A campus network runs OSPF between a core layer and several distribution switches. Which design change best reduces the size of the link-state database on access-layer routers?

  1. Change the OSPF router priority on access routers
  2. Configure the distribution switches as totally stubby areas toward the access layer Correct answer.
  3. Increase the OSPF hello interval on all access links
  4. Enable equal-cost multipath on the core links

Explanation

Making the access layer a totally stubby area blocks external and inter-area type 3, 4 and 5 LSAs from entering it, leaving only a default route and intra-area topology, which substantially shrinks the link-state database on access routers. Timer and priority changes affect adjacency behaviour, not database size.

Question 12Information Discipline (content domains not enumerated in source)

A data centre is being designed with leaf-spine topology. Which statement correctly describes why this topology is preferred over a three-tier design for east-west traffic?

  1. Every leaf is a fixed number of hops from every other leaf, giving predictable latency Correct answer.
  2. The topology removes the need for IP routing within the data centre
  3. Spine switches run Spanning Tree to prevent loops between leaves
  4. Leaf switches must connect only to servers and never to other leaves

Explanation

In a leaf-spine fabric each leaf connects to every spine, so any server-to-server path traverses exactly two hops regardless of which leaves are involved, producing predictable and uniform latency. Routing protocols such as BGP or OSPF are normally used with ECMP rather than Spanning Tree.

Question 13Information Discipline (content domains not enumerated in source)

A web application stores user session identifiers in cookies. Which measure most directly mitigates session hijacking through cross-site scripting?

  1. Setting the HttpOnly and Secure attributes on the session cookie Correct answer.
  2. Storing the session identifier in local storage
  3. Increasing the session timeout to eight hours
  4. Disabling HTTPS for static content only

Explanation

The HttpOnly attribute prevents client-side scripts from reading the cookie, which blocks theft via injected script, and Secure ensures the cookie is only sent over TLS. Longer timeouts and local storage increase exposure rather than reduce it.

Question 14Information Discipline (content domains not enumerated in source)

An organisation plans to migrate a latency-sensitive trading application to a public cloud region. Which factor is the most important to evaluate first?

  1. Network round-trip latency between the cloud region and the trading venues Correct answer.
  2. The number of availability zones offered by the region
  3. The range of instance families available in the region
  4. The cloud provider's object storage durability figure

Explanation

For latency-sensitive trading, the physical and network distance to the venues determines round-trip latency, which directly affects execution quality and cannot be remedied by configuration. Durability and instance variety matter but are secondary to the latency constraint.

Question 15Information Discipline (content domains not enumerated in source)

In a relational database supporting an order-processing system, which normal form is violated if a non-key column depends on only part of a composite primary key?

  1. Second normal form Correct answer.
  2. First normal form
  3. Boyce-Codd normal form
  4. Third normal form

Explanation

Second normal form requires that every non-key attribute depend on the whole of a composite primary key, eliminating partial dependencies. First normal form concerns atomic values, while third and Boyce-Codd normal forms address transitive dependencies from non-key determinants.

Question 16Information Discipline (content domains not enumerated in source)

A backup strategy uses daily full backups and hourly incremental backups. A disk failure occurs at 14:20, and the last full backup completed at 01:00. Which set of backups is needed to restore to the most recent state?

  1. The last full backup plus the single most recent incremental
  2. The last full backup plus every hourly incremental since 01:00 Correct answer.
  3. The last full backup only
  4. The most recent hourly incremental only

Explanation

Incremental backups capture only changes since the previous backup of any type, so a restore requires the base full backup followed by each incremental in sequence to reach the latest consistent state. Using only the latest incremental omits intermediate changes.

Question 17Information Discipline (content domains not enumerated in source)

Which practice in a DevOps pipeline provides the strongest assurance that a code change will not degrade production performance before release?

  1. Automated performance regression testing in a production-like environment Correct answer.
  2. Static analysis of source code style rules
  3. Weekly deployment approval meetings
  4. Manual code review by a senior developer

Explanation

Automated performance regression tests executed in a production-like environment exercise realistic workloads and detect degradation that source-level checks cannot reveal. Code review and static analysis find defects but do not measure runtime performance under load.

Question 18Information Discipline (content domains not enumerated in source)

A wireless LAN design must support dense lecture theatres with hundreds of concurrent clients. Which configuration choice most improves aggregate capacity and reduces co-channel interference?

  1. Deploying more access points on 5 GHz with reduced transmit power and 20/40 MHz channels Correct answer.
  2. Deploying fewer access points at maximum transmit power on 2.4 GHz
  3. Using 80 MHz channels throughout the lecture theatre
  4. Enabling a single SSID with band steering disabled

Explanation

More access points on the wider 5 GHz band with lower transmit power create smaller cells, allowing greater spatial reuse and reducing co-channel interference. Maximum power on 2.4 GHz and very wide channels both increase contention and interference.

Question 19Information Discipline (content domains not enumerated in source)

An engineer must choose between a stateful packet inspection firewall and a web application firewall for protecting a public-facing API. Which statement best describes the complementary roles?

  1. The WAF replaces the need for any Layer 3 filtering
  2. The firewall filters at Layers 3 and 4, while the WAF inspects HTTP request content at Layer 7 Correct answer.
  3. Both devices perform identical functions and one is redundant
  4. The firewall inspects HTTP payloads while the WAF filters IP addresses

Explanation

A stateful firewall tracks connections and enforces policy on addresses and ports at Layers 3 and 4, whereas a WAF parses HTTP requests and responses to detect application-layer attacks such as injection or cross-site scripting. Deploying both gives defence in depth.

Question 20Information Discipline (content domains not enumerated in source)

In IT service management, which process owns the activity of diagnosing the root cause of recurring incidents and raising a known error record?

  1. Service level management
  2. Problem management Correct answer.
  3. Change enablement
  4. Incident management

Explanation

Problem management investigates the underlying causes of incidents, maintains known error records and drives permanent fixes. Incident management restores service quickly, while change enablement controls modifications and service level management governs agreements.

Question 21Information Discipline (content domains not enumerated in source)

An organisation must demonstrate that its information security management system conforms to ISO/IEC 27001. Which activity provides the formal evidence of conformity recognised by the standard?

  1. An internal gap analysis performed by the IT team
  2. A business impact analysis covering critical systems
  3. A penetration test of the internet-facing estate
  4. A certification audit by an accredited certification body Correct answer.

Explanation

ISO/IEC 27001 certification is granted after a successful audit by an accredited certification body, which provides independent evidence of conformity. Internal audits and technical tests support the management system but do not constitute certification.

Question 22Information Discipline (content domains not enumerated in source)

A team is estimating a software project using story points. Which statement best explains why story points are preferred over hours for relative estimation?

  1. They eliminate the need for any historical velocity data
  2. They map directly to elapsed calendar time for each developer
  3. They capture relative size and complexity while avoiding false precision about individual productivity Correct answer.
  4. They allow estimates to be compared across unrelated organisations

Explanation

Story points express relative size and complexity rather than absolute duration, so estimates are not distorted by individual productivity differences and do not imply false precision. Velocity, derived from historical data, is still needed to convert points into time forecasts.

Question 23Information Discipline (content domains not enumerated in source)

A storage architect is comparing RAID 6 and RAID 10 for a database volume on large-capacity drives. Which consideration most strongly favours RAID 6 in this scenario?

  1. RAID 6 provides better random write performance than RAID 10
  2. RAID 6 offers lower rebuild times than RAID 10
  3. RAID 6 requires fewer drives than a RAID 10 mirror pair
  4. RAID 6 tolerates two simultaneous drive failures while RAID 10 may lose a mirror pair Correct answer.

Explanation

RAID 6 uses dual parity, so it survives two drive failures, whereas RAID 10 can lose data if both drives in the same mirror fail. With large-capacity drives and long rebuild times, this added fault tolerance is the decisive advantage, even though RAID 10 writes faster.

Question 24Information Discipline (content domains not enumerated in source)

A network uses BGP with two upstream providers. The engineer wants inbound traffic to prefer one provider while ensuring automatic failover. Which approach is most effective and operationally sound?

  1. Rely on MED values sent to both providers
  2. Advertise a default route to both providers
  3. Use only local preference on the primary router
  4. Advertise more specific prefixes and prepend the AS path on the secondary provider Correct answer.

Explanation

Inbound traffic engineering is controlled by what is advertised to neighbours, so advertising a more specific prefix via the preferred provider and lengthening the AS path on the secondary influences remote path selection and fails over automatically if the primary withdraws. Local preference and MED affect outbound or inter-provider selection and are not honoured uniformly by remote networks.

Question 25Information Discipline (content domains not enumerated in source)

An engineer is evaluating whether to virtualise a latency-critical industrial control system onto a general-purpose hypervisor. Which technical concern is most significant?

  1. Non-deterministic scheduling jitter introduced by the hypervisor can violate real-time deadlines Correct answer.
  2. Virtual machines cannot use physical network interfaces
  3. Virtualisation prevents the use of redundant hardware
  4. Hypervisors cannot run operating systems with device drivers

Explanation

General-purpose hypervisors introduce scheduling and interrupt latency that is not deterministic, which can breach the hard real-time deadlines of industrial control loops. Real-time-capable hypervisors or dedicated hardware may be required instead.

Question 26Information Discipline (content domains not enumerated in source)

Under the Personal Data (Privacy) Ordinance of Hong Kong, which principle requires that personal data be collected by means that are lawful and fair, and that the collection be adequate but not excessive for the purpose?

  1. Data Protection Principle 1 (purpose and manner of collection) Correct answer.
  2. Data Protection Principle 6 (access and correction)
  3. Data Protection Principle 4 (security of personal data)
  4. Data Protection Principle 2 (accuracy and retention)

Explanation

DPP1 governs the purpose and manner of collection, requiring lawful and fair means, adequacy without excessiveness, and notification of the data subject. DPP2 addresses accuracy and retention period, DPP4 addresses security, and DPP6 addresses access and correction rights. Only DPP1 speaks to how data is gathered in the first place.

Question 27Information Discipline (content domains not enumerated in source)

An engineer is documenting a structured cabling system for a new office. Which standard is the primary international reference for generic customer premises cabling design covering balanced twisted-pair and optical fibre?

  1. ISO/IEC 11801 Correct answer.
  2. TIA-942
  3. ISO/IEC 27001
  4. IEEE 802.3

Explanation

ISO/IEC 11801 specifies generic cabling for customer premises, including channel and permanent link performance classes for copper and fibre. ISO/IEC 27001 is an information security management standard, IEEE 802.3 defines Ethernet, and TIA-942 addresses data centre infrastructure rather than generic office cabling.

Question 28Information Discipline (content domains not enumerated in source)

A team is adopting a formal project methodology for a large information systems implementation. Which responsibility belongs to the project sponsor rather than the project manager?

  1. Scheduling individual engineering resources
  2. Producing the detailed work breakdown structure
  3. Maintaining the risk and issue log day to day
  4. Owning the business case and authorising release of funding Correct answer.

Explanation

The sponsor is the senior owner of the business case and provides the authority and funding decisions that let the project proceed. The project manager handles planning artefacts such as the work breakdown structure, the risk log, and resource scheduling. Separating these roles preserves clear accountability for benefits realisation.

Question 29Information Discipline (content domains not enumerated in source)

An engineer is selecting a cable for a run that passes through an area with heavy electrical machinery. Which characteristic of shielded twisted-pair cabling most directly justifies the added cost in this environment?

  1. Lower attenuation at all frequencies than unshielded cable
  2. Reduced susceptibility to electromagnetic interference through a grounded shield Correct answer.
  3. Higher maximum tensile strength during pulling
  4. Automatic support for Power over Ethernet at higher wattage

Explanation

The shield and drain wire divert induced electromagnetic noise to ground, which is the main benefit in electrically noisy industrial areas. Shielding does not inherently improve tensile strength, guarantee lower attenuation, or enable higher PoE wattage. Those properties depend on conductor gauge and design, not shielding alone.

Question 30Information Discipline (content domains not enumerated in source)

In a virtualised server environment, which component allows multiple virtual machines to share a single physical network interface while presenting separate virtual NICs to each guest?

  1. A hardware security module
  2. A storage area network fabric
  3. A virtual switch Correct answer.
  4. A load balancer appliance

Explanation

A virtual switch operates inside the hypervisor, connecting virtual NICs to physical uplinks and enforcing policies such as VLAN tagging. A SAN fabric provides block storage, a load balancer distributes application traffic, and an HSM manages cryptographic keys. Only the virtual switch performs the NIC-sharing function described.

Question 31Information Discipline (content domains not enumerated in source)

An organisation is defining recovery objectives for a critical database. Which pair of metrics correctly expresses the maximum tolerable data loss and the maximum tolerable outage respectively?

  1. Recovery time objective and recovery point objective
  2. Recovery point objective and service level agreement
  3. Service level objective and recovery point objective
  4. Recovery point objective and recovery time objective Correct answer.

Explanation

The recovery point objective defines how much data loss is tolerable, expressed as a time window back to the last recoverable copy. The recovery time objective defines the maximum acceptable duration of the outage. Keeping the two in the correct order is essential when designing backup frequency and failover automation.

Question 32Information Discipline (content domains not enumerated in source)

An engineer is asked to explain why a fibre optic link is preferred over copper for a run between two buildings separated by 2 km. Which property of optical fibre is the primary technical reason?

  1. Ability to carry electrical power to remote devices
  2. Very low attenuation per unit length at the operating wavelength Correct answer.
  3. Lower installation cost per metre than copper
  4. Immunity of copper to lightning-induced surges

Explanation

Optical fibre exhibits far lower attenuation than copper, allowing long runs without repeaters, and it is immune to electromagnetic interference. Copper cannot match the reach at 2 km for high bandwidth. Fibre does not carry power for typical data links and is generally not cheaper per metre.

Question 33Information Discipline (content domains not enumerated in source)

A developer must store user passwords for an authentication system. Which approach best follows current good practice?

  1. Store a salted hash produced by a memory-hard algorithm such as Argon2id Correct answer.
  2. Store the password in plaintext within a restricted database table
  3. Store a fast unsalted hash such as a single round of SHA-256
  4. Store the password encrypted with a symmetric key held in the application

Explanation

Memory-hard password hashing with a unique per-user salt slows offline guessing and defeats precomputed rainbow tables. Symmetric encryption is reversible, so a key compromise exposes all passwords. Fast unsalted hashes are cheap to brute force, and plaintext storage is unacceptable.

Question 34Information Discipline (content domains not enumerated in source)

A service desk records a recurring pattern of failures on the same server model. Which ITIL practice is responsible for identifying the underlying cause and proposing a permanent fix?

  1. Change enablement
  2. Service catalogue management
  3. Incident management
  4. Problem management Correct answer.

Explanation

Problem management investigates the root cause of recurring incidents and raises known errors and change requests for permanent resolution. Incident management restores service quickly, change enablement authorises changes, and service catalogue management documents available services. Root cause analysis is the defining activity of problem management.

Question 35Information Discipline (content domains not enumerated in source)

A network designer must connect 40 access switches to two core switches with redundant paths and fast convergence. Which topology best meets this requirement while avoiding spanning tree blocking on redundant links?

  1. A single large Layer 2 domain with all switches chained
  2. A hub-and-spoke design with one uplink per access switch
  3. A Layer 3 routed spine-and-leaf design with equal-cost multipath Correct answer.
  4. A ring topology relying on rapid spanning tree

Explanation

A routed spine-and-leaf design uses Layer 3 links with equal-cost multipath so all paths forward traffic actively, avoiding blocked redundant links. Chaining, single uplinks, and rings either lack redundancy or rely on spanning tree, which blocks paths and converges more slowly.

Question 36Information Discipline (content domains not enumerated in source)

An engineer is comparing synchronous and asynchronous replication for a disaster recovery site 300 km from the primary data centre. Which statement correctly describes the trade-off?

  1. Synchronous replication always requires less bandwidth than asynchronous replication
  2. Asynchronous replication eliminates the need for a recovery point objective
  3. Asynchronous replication guarantees zero data loss but requires lower bandwidth
  4. Synchronous replication guarantees zero data loss but adds round-trip latency to writes Correct answer.

Explanation

Synchronous replication acknowledges a write only after the remote site confirms it, giving a zero recovery point objective at the cost of added write latency proportional to distance. Asynchronous replication avoids that latency but can lose recent writes. Bandwidth and RPO planning remain necessary in both cases.

Question 37Information Discipline (content domains not enumerated in source)

A web service must expose an API to partner systems. Which control most directly limits the impact of a compromised partner credential?

  1. Publishing the API documentation to all partners
  2. Enabling verbose error messages for troubleshooting
  3. Storing the credential in the public source repository for easy access
  4. Scoping the credential to the minimum required operations and rate limiting its use Correct answer.

Explanation

Least-privilege scoping confines a compromised credential to a narrow set of operations, and rate limiting constrains the volume of abuse possible before detection. Documentation, verbose errors, and public storage of secrets either do not limit impact or actively increase risk. These controls align with zero trust and least privilege principles.

Question 38Information Discipline (content domains not enumerated in source)

A database administrator is choosing a RAID level for a volume that must survive two simultaneous drive failures while remaining cost-efficient on large drives. Which choice best fits?

  1. RAID 0
  2. RAID 1
  3. RAID 5
  4. RAID 6 Correct answer.

Explanation

RAID 6 uses dual parity, allowing the array to survive two drive failures, which matters as rebuild times grow with large capacity drives. RAID 5 tolerates only one failure, RAID 1 mirrors and tolerates one failure per mirror pair, and RAID 0 provides no redundancy. RAID 6 is the only listed option meeting the two-failure requirement.

Question 39Information Discipline (content domains not enumerated in source)

An engineer is planning an IPv4 addressing scheme for a site that needs 500 hosts per subnet with room to double. Which prefix length provides the closest fit without wasting excessive address space?

  1. /23 Correct answer.
  2. /22
  3. /21
  4. /24

Explanation

A /23 provides 510 usable host addresses, which fits 500 hosts immediately and leaves only modest headroom. A /24 provides 254 usable addresses and is too small, while /22 and /21 provide far more addresses than needed and waste space. The /23 is the tightest fit that still meets the requirement.

Question 40Information Discipline (content domains not enumerated in source)

A security team is designing segmentation for a data centre hosting a payment application. Which approach best applies the principle of least privilege at the network layer?

  1. Default-deny policies between zones with explicit allow rules for required flows Correct answer.
  2. Allowing any traffic between application tiers to simplify troubleshooting
  3. A flat network with host-based firewalls only
  4. Permitting all internal traffic and filtering only at the internet edge

Explanation

Default-deny zone policies with explicit allow rules limit lateral movement, so a compromised host cannot reach unrelated systems. A flat network, edge-only filtering, and unrestricted tier traffic all permit broad lateral movement. Segmentation combined with least privilege is the recognised mitigation for payment environments.

Question 41Information Discipline (content domains not enumerated in source)

A cloud architect must design an application that tolerates the loss of an entire availability zone. Which design element is essential?

  1. Deploying all instances in one availability zone with frequent snapshots
  2. Deploying stateless instances across at least two availability zones behind a load balancer Correct answer.
  3. Relying on a single large instance with automatic restart
  4. Storing session state only in local instance memory

Explanation

Spreading stateless instances across multiple availability zones lets the load balancer route around a zone failure. Keeping everything in one zone, relying on a single instance, or holding session state locally means a zone outage causes an outage. Statelessness and multi-zone placement together provide the required resilience.

Question 42Information Discipline (content domains not enumerated in source)

A team is estimating work using story points. Which statement best explains why story points are preferred over absolute hours for relative estimation?

  1. They measure relative size and complexity, reducing false precision across differing skill levels Correct answer.
  2. They eliminate the need to refine requirements before estimating
  3. They guarantee that estimates remain stable throughout the project
  4. They allow direct comparison of productivity between separate teams

Explanation

Story points express relative size and complexity on a team-specific scale, avoiding the false precision of hour estimates that vary with individual skill and familiarity. They do not remove the need for requirement refinement, are not comparable across teams, and do not guarantee stability. The purpose is to support consistent relative sizing within a team.

Question 43Information Discipline (content domains not enumerated in source)

An engineer is evaluating a wireless LAN for a warehouse with metal racking and moving forklifts. Which design decision most improves reliable coverage in this environment?

  1. Conducting an on-site site survey and placing access points to account for multipath and obstruction Correct answer.
  2. Increasing transmit power on all access points to maximum
  3. Disabling all 5 GHz channels to simplify the design
  4. Using a single access point with an omnidirectional antenna at the centre

Explanation

Metal racking and moving vehicles cause multipath and shadowing, so an on-site survey is needed to place access points and set channels realistically. Maximum power can worsen co-channel interference and client imbalance, disabling 5 GHz removes the band with better propagation for dense use, and a single access point cannot cover a warehouse reliably.

Question 44Information Discipline (content domains not enumerated in source)

An engineer must choose between a stateful inspection firewall and a web application firewall for a public-facing web service. Which statement correctly distinguishes their roles?

  1. The stateful firewall controls connections by protocol and port, while the WAF inspects HTTP payloads for application attacks Correct answer.
  2. Both devices perform identical functions and differ only in throughput
  3. The stateful firewall inspects HTTP request bodies, while the WAF tracks TCP sessions
  4. The WAF controls IP routing decisions, while the stateful firewall filters HTTP parameters

Explanation

A stateful inspection firewall tracks connection state and filters by addresses, ports, and protocol, while a WAF understands HTTP semantics and can block injection or cross-site scripting attempts. The two are complementary rather than identical. The WAF does not perform routing, and the stateful firewall does not parse HTTP payloads.

Question 45Information Discipline (content domains not enumerated in source)

A financial firm must demonstrate that its information security management system conforms to ISO/IEC 27001. Which activity provides the required evidence of conformance?

  1. Purchasing a firewall with the highest available throughput
  2. Appointing a single part-time security officer
  3. Completing an internal audit programme and a management review of the ISMS Correct answer.
  4. Publishing the security policy on the corporate intranet

Explanation

Conformance is evidenced through systematic internal audits and management reviews that verify the ISMS operates as defined and drives continual improvement. Hardware selection, policy publication, and staffing alone do not demonstrate that the management system is effective. Certification bodies examine these audit and review records during assessment.

Question 46Information Discipline (content domains not enumerated in source)

An engineer is designing a data centre with a leaf-spine fabric. Which statement correctly explains why this topology suits east-west traffic?

  1. It concentrates all traffic through a single aggregation chassis
  2. It requires each server to connect to every spine switch directly
  3. It relies on spanning tree to block redundant links and prevent loops
  4. Every leaf is one hop from every other leaf, giving predictable latency and even path utilisation Correct answer.

Explanation

In a leaf-spine fabric each leaf connects to every spine, so any leaf-to-leaf path traverses exactly two hops with consistent latency and multipath utilisation. Spanning tree blocking is avoided because the fabric is routed, traffic is not funnelled through one chassis, and servers connect only to leaves. This design scales east-west bandwidth predictably.

Question 47Information Discipline (content domains not enumerated in source)

An engineer must reduce the risk of a successful phishing campaign against staff who handle payments. Which combination of controls addresses the human and technical aspects most effectively?

  1. Increasing mailbox storage quotas and archiving older messages
  2. Blocking all external email to eliminate the threat
  3. Relying solely on an annual security awareness briefing
  4. Regular simulated phishing with targeted training plus enforced multi-factor authentication Correct answer.

Explanation

Simulated phishing with targeted training builds recognition of social engineering, while enforced multi-factor authentication limits the value of any stolen credential. Storage changes do nothing for phishing, blocking all external email is impractical, and a single annual briefing is too infrequent to change behaviour. Layered human and technical controls are the recognised approach.

Question 48Information Discipline (content domains not enumerated in source)

A network uses BGP with two upstream providers. The engineer wants inbound traffic to prefer one provider while keeping the other as backup. Which technique most directly influences inbound path selection?

  1. Increasing the BGP keepalive timer on the backup session
  2. Advertising a longer AS path to the backup provider via AS path prepending Correct answer.
  3. Lowering the multi-exit discriminator value sent to the backup provider
  4. Setting a higher local preference on routes learned from the backup provider

Explanation

AS path prepending makes the advertised route appear longer to the backup provider, so remote networks prefer the primary path. Local preference affects outbound selection within the local autonomous system, not inbound path choice by remote networks. MED is a hint to a single neighbouring AS, and timers do not influence path preference.

Question 49Information Discipline (content domains not enumerated in source)

A control systems engineer is considering virtualising a latency-critical industrial controller onto a general-purpose hypervisor. Which factor is the most significant technical risk to evaluate first?

  1. The availability of graphical management consoles for the hypervisor
  2. Deterministic scheduling and interrupt latency introduced by the hypervisor and host sharing Correct answer.
  3. The colour depth supported by the remote console session
  4. The number of virtual machines the host can theoretically support

Explanation

Industrial control loops depend on deterministic timing, and a general-purpose hypervisor with shared host resources can introduce scheduling jitter and interrupt latency that violate control deadlines. Console availability, nominal VM capacity, and display settings are secondary operational concerns. Timing determinism is the gating technical risk for this decision.

Question 50Information Discipline (content domains not enumerated in source)

An engineer is troubleshooting intermittent packet loss on a fibre uplink between two switches. Which sequence of diagnostic steps is most appropriate?

  1. Disable error logging to reduce noise and observe whether loss continues
  2. Immediately replace both switches to rule out hardware failure
  3. Check interface error counters and optical receive power, then test the patch leads and connectors Correct answer.
  4. Increase the MTU on both interfaces and retest

Explanation

Intermittent loss on fibre commonly stems from dirty or damaged connectors, marginal receive power, or CRC errors, so checking error counters and optical levels before swapping hardware is the efficient path. Replacing switches is premature, changing MTU does not address physical-layer loss, and disabling logging removes the evidence needed for diagnosis.