I85PREP
⌘ K
HTB CJCA study materials
HTB CJCA study resources

HTB CJCA practice questions

One question at a time. Build your HTB CJCA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Fundamentals and Concepts

In the CIA triad, which property ensures that data has not been altered by an unauthorized party, whether in storage or in transit?

  1. Integrity Correct answer.
  2. Non-repudiation
  3. Availability
  4. Confidentiality

Explanation

Integrity guarantees that information remains accurate and complete and is changed only through authorized mechanisms such as hashing and digital signatures. Confidentiality concerns who may read data, availability concerns timely access, and non-repudiation is a separate property about proving an action occurred.

Question 2Security Fundamentals and Concepts

A penetration tester is authorized to test a web application but is explicitly barred from touching the production database server behind it. Which term best describes this limitation?

  1. Acceptable use policy
  2. Service level agreement
  3. Rules of engagement Correct answer.
  4. Chain of custody

Explanation

Rules of engagement define the scope, targets, timing, and prohibited actions for an authorized security assessment. They are agreed before testing begins and protect both the tester and the client from unintended impact.

Question 3Security Fundamentals and Concepts

Which security control type is a locked server-room door that physically prevents unauthorized individuals from reaching hardware?

  1. Administrative control
  2. Technical control
  3. Compensating control
  4. Physical control Correct answer.

Explanation

Physical controls use tangible barriers such as locks, fences, and guards to restrict access to facilities and equipment. Technical controls are implemented in software or hardware logic, while administrative controls are policies and procedures.

Question 4Security Fundamentals and Concepts

What is the primary purpose of hashing a password before storing it in a database?

  1. To compress the password so the database uses less storage
  2. To synchronize the password across multiple authentication servers
  3. To allow the password to be decrypted by administrators when needed
  4. To make the original password infeasible to recover from the stored value Correct answer.

Explanation

A cryptographic hash is a one-way function, so storing only the digest means a database leak does not directly reveal the passwords. Salting and slow hashing algorithms further resist precomputed and brute-force attacks.

Question 5Security Fundamentals and Concepts

Which of the following best describes the principle of least privilege?

  1. Requiring every user to change passwords at fixed intervals
  2. Granting each user or process only the access required to perform its assigned tasks Correct answer.
  3. Restricting system access to users located inside the corporate office
  4. Encrypting all data at rest with a single organization-wide key

Explanation

Least privilege limits rights to the minimum necessary for a role, reducing the blast radius if an account or process is compromised. It applies to users, services, and automated processes alike.

Question 6Security Fundamentals and Concepts

An attacker sends a victim a link to a page that closely imitates their bank's login portal to capture credentials. Which attack is this?

  1. Denial of service
  2. Cross-site scripting
  3. Phishing Correct answer.
  4. SQL injection

Explanation

Phishing uses deceptive messages and counterfeit pages to trick users into surrendering credentials or other sensitive data. The defining element is social engineering that lures the victim to a fraudulent site.

Question 7Security Fundamentals and Concepts

Which authentication factor category does a hardware token that generates a time-based one-time code represent?

  1. Somewhere you are
  2. Something you have Correct answer.
  3. Something you are
  4. Something you know

Explanation

A hardware token is a possession factor because access depends on physically holding the device. Knowledge factors are memorized secrets, inherence factors are biometric traits, and location is a contextual attribute.

Question 8Security Fundamentals and Concepts

What distinguishes a vulnerability from an exploit?

  1. A vulnerability is malicious code; an exploit is the patch that removes it
  2. A vulnerability is a detected intrusion; an exploit is the log that records it
  3. A vulnerability is a policy gap; an exploit is the audit that finds it
  4. A vulnerability is a weakness; an exploit is the technique or code that abuses it Correct answer.

Explanation

A vulnerability is a flaw or weakness in a system, while an exploit is the concrete method or payload that takes advantage of that weakness. A threat actor supplies the intent, and risk combines likelihood with impact.

Question 9Security Fundamentals and Concepts

A company wants to detect unauthorized changes to a set of critical configuration files. Which mechanism is most appropriate?

  1. A network intrusion prevention system
  2. File integrity monitoring using cryptographic hashes Correct answer.
  3. Multi-factor authentication for administrators
  4. Full-disk encryption of the server volume

Explanation

File integrity monitoring computes and compares hashes of files so any modification produces a detectable mismatch. Encryption and authentication reduce the chance of compromise but do not reveal that a file's contents changed.

Question 10Security Fundamentals and Concepts

A web application reflects user-supplied input into HTML without encoding it, allowing an attacker to run script in other users' browsers. Which vulnerability class is present?

  1. Directory traversal
  2. Cross-site scripting Correct answer.
  3. Server-side request forgery
  4. Insecure deserialization

Explanation

Cross-site scripting occurs when untrusted input reaches the browser as executable content without proper output encoding. Defenses include contextual output encoding and a restrictive Content Security Policy.

Question 11Security Fundamentals and Concepts

An application concatenates user input directly into a SQL query string. Which mitigation most directly removes the injection risk?

  1. Using parameterized queries with bound parameters Correct answer.
  2. Restricting the database port to internal networks
  3. Escaping single quotes in the input before concatenation
  4. Enabling verbose error messages for debugging

Explanation

Parameterized queries separate code from data so user input is treated as a value and cannot alter query structure. This is stronger than manual escaping, which is error-prone and dialect-dependent.

Question 12Security Fundamentals and Concepts

Which symmetric algorithm is designed to encrypt data using a single shared secret key and is widely used in AES-based disk and transport encryption?

  1. ECDSA
  2. RSA
  3. AES Correct answer.
  4. Diffie-Hellman

Explanation

AES is a symmetric block cipher that uses the same key for encryption and decryption. RSA and ECDSA are asymmetric algorithms, and Diffie-Hellman is a key agreement method rather than a bulk data cipher.

Question 13Security Fundamentals and Concepts

A security team wants to verify that a downloaded software package genuinely came from its vendor and was not modified. Which combination best achieves this?

  1. Compression of the package with a password
  2. A vendor digital signature verified with the vendor's public key Correct answer.
  3. TLS encryption of the download connection only
  4. A checksum published on the same download page

Explanation

A digital signature created with the vendor's private key and verified with the published public key provides both authenticity and integrity. TLS alone protects only the transport channel and a checksum on the same page can be altered alongside the file.

Question 14Security Fundamentals and Concepts

In an incident response process, which phase immediately follows detection and confirmation of a security incident?

  1. Containment Correct answer.
  2. Eradication
  3. Recovery
  4. Lessons learned

Explanation

After an incident is detected and validated, the team works to contain it to prevent further spread before eradication and recovery. Lessons learned is the final phase, performed after recovery.

Question 15Security Fundamentals and Concepts

Which access control model assigns permissions based on a user's job role rather than on individual identity?

  1. Attribute-based access control
  2. Role-based access control Correct answer.
  3. Mandatory access control
  4. Discretionary access control

Explanation

Role-based access control maps permissions to roles and then assigns users to roles, simplifying administration at scale. Discretionary control lets owners set permissions, mandatory control relies on system labels, and attribute-based control evaluates multiple attributes.

Question 16Security Fundamentals and Concepts

A security analyst observes repeated failed logins from a single IP against many usernames in a short window. Which activity does this pattern most likely indicate?

  1. Password spraying Correct answer.
  2. Ransomware encryption
  3. Phishing
  4. Privilege escalation

Explanation

Password spraying tries a small set of common passwords across many accounts to avoid lockout thresholds. It differs from brute force, which targets one account with many guesses.

Question 17Security Fundamentals and Concepts

Which of the following is the strongest reason to segment a corporate network into separate VLANs for different departments?

  1. It limits lateral movement by restricting which hosts can communicate directly Correct answer.
  2. It automatically encrypts traffic between all endpoints
  3. It increases the total available bandwidth for all users
  4. It removes the need for authentication on internal services

Explanation

Segmentation confines traffic so a compromised host cannot freely reach unrelated systems, reducing lateral movement. It complements, but does not replace, authentication and encryption.

Question 18Security Fundamentals and Concepts

What is the main security benefit of salting passwords before hashing?

  1. It replaces the need for a slow hashing algorithm
  2. It ensures identical passwords produce different stored hashes Correct answer.
  3. It allows the hash to be reversed with the salt
  4. It shortens the hash so lookups are faster

Explanation

A unique random salt per password means two users with the same password get different digests, defeating precomputed rainbow tables and shared-cracking economies. Salting complements, rather than replaces, slow algorithms such as bcrypt or Argon2.

Question 19Security Fundamentals and Concepts

A user receives an email that appears to come from the CEO asking for an urgent wire transfer. Which social engineering technique is being used?

  1. Business email compromise Correct answer.
  2. Shoulder surfing
  3. Watering hole attack
  4. Tailgating

Explanation

Business email compromise impersonates or hijacks an executive or trusted partner account to induce fraudulent payments or data disclosure. It exploits authority and urgency rather than technical vulnerabilities.

Question 20Security Fundamentals and Concepts

Which of the following best describes defense in depth?

  1. Outsourcing all security monitoring to a third-party provider
  2. Applying the same control uniformly to every system in the organization
  3. Layering multiple independent controls so a single failure does not lead to compromise Correct answer.
  4. Relying on the strongest single control available for each asset

Explanation

Defense in depth assumes any single control can fail and combines preventive, detective, and corrective layers across people, process, and technology. The goal is that an attacker must defeat several independent obstacles.

Question 21Security Fundamentals and Concepts

An organization replaces a vulnerable legacy protocol with a modern encrypted alternative but keeps the legacy service reachable for a few critical partners behind a tightly restricted firewall rule. Which concept does the restricted rule represent?

  1. A preventive control failure
  2. A false positive
  3. A compensating control Correct answer.
  4. A privilege escalation

Explanation

A compensating control is an alternative safeguard that reduces risk when the ideal control cannot be fully applied everywhere. Restricting reachability to a narrow partner set mitigates exposure while the legacy dependency persists.

Question 22Security Fundamentals and Concepts

An analyst reviews a TLS certificate and notices it was issued to a domain that differs slightly from the organization's real domain, yet the browser shows no warning. Which explanation is most plausible?

  1. The certificate uses an expired public key
  2. The server is using a self-signed certificate
  3. A valid certificate was obtained for a lookalike domain registered by the attacker Correct answer.
  4. The certificate chain fails to validate

Explanation

Attackers can legitimately obtain certificates for typo-squatted or lookalike domains, so the padlock proves only that the connection is encrypted to that domain, not that the domain is trustworthy. Users must verify the actual domain name, not just the lock icon.

Question 23Security Fundamentals and Concepts

A penetration tester discovers that a service account used by a backup application is a member of the domain administrators group. Which risk does this most directly illustrate?

  1. Inadequate logging of administrator activity
  2. Insufficient availability caused by redundant permissions
  3. Weak encryption of backup data at rest
  4. Violation of least privilege that expands the impact of a service compromise Correct answer.

Explanation

A service account rarely needs domain-wide administrative rights, so excessive permissions violate least privilege and turn a single service compromise into full domain control. The finding concerns authorization scope, not encryption or logging.

Question 24Security Fundamentals and Concepts

A team must choose between symmetric and asymmetric cryptography for encrypting a large volume of backup data at high speed. Which choice and reason are most appropriate?

  1. Asymmetric encryption, because it is always more secure
  2. Symmetric encryption, because it removes the need to protect keys
  3. Symmetric encryption, because it is far faster for bulk data Correct answer.
  4. Asymmetric encryption, because it avoids key distribution entirely

Explanation

Symmetric ciphers such as AES process bulk data efficiently and are used for the data itself, while asymmetric cryptography typically protects the symmetric key exchange. Key management remains necessary in either case.

Question 25Security Fundamentals and Concepts

During a tabletop exercise, an attacker gains access through a vendor's remote support tool and then moves to internal systems. Which lesson does this scenario most emphasize?

  1. Internal systems are safe once perimeter firewalls are correctly configured
  2. Vendor tools should be removed from all environments
  3. Incident response should begin only after data exfiltration is confirmed
  4. Third-party access paths must be inventoried and monitored as part of the attack surface Correct answer.

Explanation

Supply chain and vendor access routes are frequently used to bypass perimeter defenses, so they must be identified, least-privileged, and monitored. Assuming the internal network is trusted ignores the reality of trusted-path abuse.

Question 26Security Fundamentals and Concepts

A junior analyst asks why a hashed password cannot simply be reversed to recover the original plaintext. Which property of a cryptographic hash function is the analyst describing?

  1. Collision resistance, because two inputs never share a digest
  2. Avalanche effect, because small input changes alter the digest
  3. Keyed hashing, because a secret key is required to compute the digest
  4. Preimage resistance, because the digest cannot feasibly be inverted to the input Correct answer.

Explanation

Preimage resistance is the property that makes it computationally infeasible to find an input that produces a given digest, which is why hashing is one-way in practice. Collision resistance concerns finding two different inputs with the same digest, not reversing a single digest. The avalanche effect and keyed hashing describe output sensitivity and HMAC-style constructions respectively, neither of which explains irreversibility.

Question 27Security Fundamentals and Concepts

An organization classifies data so that public, internal, confidential, and restricted tiers each carry defined handling rules. Which security principle is being applied when staff are required to label and handle each dataset according to its tier?

  1. Separation of duties
  2. Data classification and handling Correct answer.
  3. Least privilege
  4. Non-repudiation

Explanation

Data classification assigns datasets to sensitivity tiers and attaches handling requirements such as storage, sharing, and destruction rules to each tier. Least privilege limits access rights, separation of duties splits conflicting tasks, and non-repudiation ensures actions cannot later be denied; none of those is the labeling-and-handling process itself.

Question 28Security Fundamentals and Concepts

A server room is protected by a badge reader at the door, a mantrap with a weighted interlock, and a security guard who checks photo identification. Which concept do these overlapping physical measures best illustrate?

  1. Environmental control of temperature and humidity
  2. Layered physical controls that delay and deter intrusion Correct answer.
  3. Single point of failure removal through redundancy of guards
  4. Administrative control of acceptable use policy

Explanation

Badge readers are technical controls, the mantrap is a physical barrier, and the guard is a personnel control; together they form overlapping layers that slow an intruder and increase the chance of detection. Redundancy of guards is not what the combination of reader, mantrap, and guard demonstrates, and temperature or acceptable-use policies are separate control categories.

Question 29Security Fundamentals and Concepts

A company must retain audit logs for seven years but rarely reads them after the first ninety days. Which storage approach best balances cost against the need to produce records during an investigation?

  1. Delete logs after ninety days to reduce exposure of sensitive entries
  2. Store logs only on the servers that generated them to simplify collection
  3. Keep all logs on high-performance primary storage for the full retention period
  4. Archive older logs to lower-cost immutable storage with integrity verification Correct answer.

Explanation

Moving aged logs to cheaper immutable archive storage with integrity checks preserves the records for the retention period while reducing cost, and immutability supports evidentiary trust. Primary storage for seven years is unnecessarily expensive, deletion violates the retention requirement, and leaving logs only on source hosts risks loss and tampering.

Question 30Security Fundamentals and Concepts

An architecture review finds that a single authentication service issues tokens for every internal application, and that compromise of that service would let an attacker mint valid tokens for all of them. Which design change most directly reduces this concentration of risk?

  1. Require users to change passwords more frequently across all applications
  2. Increase token lifetime so fewer renewal calls reach the authentication service
  3. Introduce per-application audience scoping and separate signing keys with short token lifetimes Correct answer.
  4. Add a second identical authentication service behind the same shared signing key

Explanation

Audience scoping limits each token to its intended application, and separate signing keys plus short lifetimes contain the blast radius so a single compromised key cannot mint tokens accepted everywhere. Longer lifetimes widen the window of misuse, a second service sharing the same key inherits the same single point of trust, and password rotation does not address token forgery.

Question 31Networking Fundamentals

Which protocol operates at the transport layer and provides reliable, connection-oriented delivery with sequencing and acknowledgements?

  1. ICMP
  2. TCP Correct answer.
  3. UDP
  4. ARP

Explanation

TCP is a connection-oriented transport protocol that establishes a session via a three-way handshake, numbers segments, acknowledges receipt, and retransmits lost data. UDP is connectionless and offers no delivery guarantees, while ICMP and ARP operate at the network and link layers respectively.

Question 32Networking Fundamentals

A workstation is configured with IP address 192.168.10.77 and subnet mask 255.255.255.192. Which address is the directed broadcast address of this subnet?

  1. 192.168.10.127 Correct answer.
  2. 192.168.10.128
  3. 192.168.10.64
  4. 192.168.10.63

Explanation

A /26 mask (255.255.255.192) creates blocks of 64 addresses. The host 192.168.10.77 falls in the block 192.168.10.64 through 192.168.10.127, where .64 is the network address and .127 is the broadcast address.

Question 33Networking Fundamentals

Which address range is reserved for link-local APIPA addressing when a DHCP client fails to obtain a lease?

  1. 10.0.0.0/8
  2. 192.168.0.0/16
  3. 172.16.0.0/12
  4. 169.254.0.0/16 Correct answer.

Explanation

When DHCP fails, Windows and many other stacks self-assign an address from 169.254.0.0/16, known as APIPA or link-local addressing. The other three ranges are RFC 1918 private address space normally assigned by DHCP.

Question 34Networking Fundamentals

During a TCP three-way handshake, which flags are set on the segment that the client sends first?

  1. SYN Correct answer.
  2. FIN and ACK
  3. ACK
  4. SYN and ACK

Explanation

The client initiates connection setup with a segment carrying only the SYN flag and an initial sequence number. The server answers with SYN and ACK, and the client completes the handshake with an ACK.

Question 35Networking Fundamentals

A technician must identify the MAC address that currently owns 10.20.30.40 on the local segment. Which protocol provides this mapping?

  1. DNS
  2. DHCP
  3. ARP Correct answer.
  4. NTP

Explanation

ARP broadcasts a request asking which device holds a given IPv4 address, and the owner replies with its MAC address. DNS maps names to addresses, DHCP assigns configuration, and NTP synchronizes time.

Question 36Networking Fundamentals

Which characteristic distinguishes a Layer 2 switch from a hub when forwarding frames?

  1. The switch builds a MAC address table and forwards frames only out the relevant port. Correct answer.
  2. The switch forwards every frame out all ports except the ingress port.
  3. The switch requires a routing table to move frames between its ports.
  4. The switch rewrites the destination IP address before forwarding.

Explanation

A switch learns source MAC addresses per port and forwards frames only toward the destination port, creating separate collision domains per port. A hub simply repeats every frame out all other ports, sharing one collision domain.

Question 37Networking Fundamentals

Which port number does HTTPS use by default?

  1. 443 Correct answer.
  2. 80
  3. 22
  4. 3389

Explanation

HTTPS runs HTTP over TLS and listens on TCP port 443 by default. Port 80 is plain HTTP, port 22 is SSH, and port 3389 is RDP.

Question 38Networking Fundamentals

A host with address 172.16.5.10/22 needs to reach 172.16.9.20. What does the host do with the packet?

  1. It ARPs for the destination and delivers the frame directly on the local segment. Correct answer.
  2. It sends the packet to its default gateway because the destination is on a different subnet.
  3. It drops the packet because the addresses are in different private ranges.
  4. It sends the packet to a DNS server for resolution first.

Explanation

A /22 mask covers 172.16.4.0 through 172.16.7.255, so 172.16.9.20 is outside that range and would normally be off-subnet. However the two addresses share the 172.16.0.0/16 space; with the stated /22, 172.16.9.20 is not local, so a router is required.

Question 39Networking Fundamentals

Which record type maps a fully qualified domain name to an IPv6 address?

  1. CNAME
  2. AAAA Correct answer.
  3. A
  4. MX

Explanation

An AAAA record stores a 128-bit IPv6 address for a hostname. An A record holds an IPv4 address, a CNAME aliases one name to another, and an MX record identifies mail exchangers.

Question 40Networking Fundamentals

Which statement best describes the role of the default gateway on a host?

  1. It is the next-hop router used for destinations outside the local subnet. Correct answer.
  2. It assigns IP addresses to hosts on the segment.
  3. It filters inbound traffic using access control lists.
  4. It resolves hostnames for the local machine.

Explanation

The default gateway is the router interface a host sends traffic to when the destination IP is not on the same subnet. Name resolution is DNS, address assignment is DHCP, and filtering is a firewall or ACL function.

Question 41Networking Fundamentals

An administrator sees a large number of TCP connections in SYN_RECEIVED state from many spoofed source addresses. Which attack does this indicate?

  1. ARP spoofing
  2. DNS cache poisoning
  3. SYN flood Correct answer.
  4. VLAN hopping

Explanation

A SYN flood exhausts the server's half-open connection table by sending many SYNs without completing the handshake, leaving sessions in SYN_RECEIVED. ARP spoofing manipulates MAC mappings, DNS cache poisoning corrupts resolver records, and VLAN hopping targets switch segmentation.

Question 42Networking Fundamentals

Which protocol provides connectionless, best-effort transport with no retransmission, commonly used for streaming and DNS queries?

  1. GRE
  2. UDP Correct answer.
  3. TCP
  4. SCTP

Explanation

UDP sends datagrams without handshakes, ordering, or retransmission, which keeps overhead low for streaming, voice, and single-packet DNS queries. TCP adds reliability, while SCTP and GRE serve other purposes.

Question 43Networking Fundamentals

A /28 subnet is required to hold 10 usable host addresses. How many usable hosts does a /28 provide?

  1. 16
  2. 14 Correct answer.
  3. 30
  4. 6

Explanation

A /28 leaves 4 host bits, giving 16 total addresses. Subtracting the network and broadcast addresses leaves 14 usable host addresses, which satisfies the requirement of 10.

Question 44Networking Fundamentals

Which device primarily limits the size of a broadcast domain?

  1. Repeater
  2. Layer 2 switch
  3. Hub
  4. Router Correct answer.

Explanation

Routers do not forward broadcast frames by default, so each router interface bounds a broadcast domain. Switches, hubs, and repeaters all extend a single broadcast domain across their ports.

Question 45Networking Fundamentals

Which mechanism allows multiple VLANs to traverse a single physical link between two switches?

  1. Link aggregation without tagging
  2. Port mirroring
  3. Spanning Tree Protocol
  4. 802.1Q trunking Correct answer.

Explanation

802.1Q trunking inserts a VLAN tag into each Ethernet frame so frames from multiple VLANs share one physical link. Port mirroring copies traffic for analysis, STP prevents loops, and untagged aggregation cannot separate VLANs.

Question 46Networking Fundamentals

A user can reach internal servers by IP address but cannot reach them by hostname. Which configuration is the most likely cause?

  1. Unreachable or misconfigured DNS server Correct answer.
  2. Duplicate MAC address on the segment
  3. Incorrect default gateway
  4. Blocked TCP port 443

Explanation

Successful access by IP but failure by name points to name resolution, so the DNS server setting or reachability is suspect. Gateway, MAC, and port-filtering faults would typically break IP-based access as well.

Question 47Networking Fundamentals

Which ICMP message type is returned when a packet's TTL reaches zero in transit?

  1. Redirect
  2. Echo request
  3. Destination unreachable
  4. Time exceeded Correct answer.

Explanation

Each router decrements the TTL, and when it hits zero the router discards the packet and returns an ICMP Time Exceeded message to the source. This behavior is what traceroute exploits to map hops.

Question 48Networking Fundamentals

Which IPv6 address type is the equivalent of an IPv4 link-local address and is automatically configured on every interface?

  1. Link-local (fe80::/10) Correct answer.
  2. Multicast
  3. Global unicast
  4. Unique local

Explanation

Every IPv6 interface autoconfigures a link-local address from fe80::/10, used for neighbor discovery and on-link communication. Global unicast is routable, unique local is private but not automatic per-link, and multicast targets groups.

Question 49Networking Fundamentals

A network uses 10.0.0.0/24 and must be divided into four equal subnets. What prefix length results?

  1. /25
  2. /26 Correct answer.
  3. /28
  4. /27

Explanation

Borrowing two host bits from a /24 yields four subnets and a /26 prefix, each with 64 addresses and 62 usable hosts. A /25 gives two subnets, a /27 gives eight, and a /28 gives sixteen.

Question 50Networking Fundamentals

Which statement accurately describes the difference between a routed network and a switched network at Layer 3 boundaries?

  1. Routers forward frames using MAC tables within a single subnet.
  2. Switches rewrite source IP addresses when forwarding between VLANs.
  3. Routers move packets between IP subnets and decrement the TTL at each hop. Correct answer.
  4. Switches decrement the TTL as frames cross VLANs.

Explanation

Routers make forwarding decisions based on destination IP networks, move packets between subnets, and decrement TTL per hop. Switches forward frames within a broadcast domain and do not modify TTL or IP addresses.