I85PREP
⌘ K
ICYB study materials
ICYB study resources

ICYB practice questions

One question at a time. Build your ICYB understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cybersecurity Fundamentals and Threat Landscape

In the CIA triad, which property is directly violated when an unauthorized user reads a confidential payroll file without altering it?

  1. Integrity
  2. Availability
  3. Confidentiality Correct answer.
  4. Non-repudiation

Explanation

Confidentiality concerns preventing unauthorized disclosure of information, so mere reading by an unauthorized party breaches it even if data is unchanged. Integrity covers unauthorized modification, availability covers timely access, and non-repudiation concerns proving an action occurred.

Question 2Cybersecurity Fundamentals and Threat Landscape

A ransomware attack encrypts a hospital's patient records and demands payment. Which element of the CIA triad is most directly and immediately harmed?

  1. Confidentiality
  2. Integrity
  3. Authentication
  4. Availability Correct answer.

Explanation

Ransomware denies legitimate users access to their own data, which is an availability impact. Confidentiality may be threatened by exfiltration and integrity by tampering, but the defining immediate harm is loss of access.

Question 3Cybersecurity Fundamentals and Threat Landscape

Which term describes a weakness in software, configuration, or design that could be exploited to cause harm?

  1. Exploit
  2. Risk
  3. Vulnerability Correct answer.
  4. Threat

Explanation

A vulnerability is the weakness itself, such as a missing patch or flawed configuration. A threat is an actor or event that could exploit it, an exploit is the technique or code that does so, and risk combines likelihood and impact.

Question 4Cybersecurity Fundamentals and Threat Landscape

Which control type is a security awareness training program for employees?

  1. Compensating
  2. Preventive Correct answer.
  3. Corrective
  4. Detective

Explanation

Awareness training aims to stop incidents before they occur by shaping user behavior, making it preventive. Detective controls identify events, corrective controls restore after incidents, and compensating controls substitute for other controls.

Question 5Cybersecurity Fundamentals and Threat Landscape

Which attack involves deceiving a user into revealing credentials through a fraudulent email that mimics a trusted brand?

  1. Fuzzing
  2. Pivoting
  3. Phishing Correct answer.
  4. Smurfing

Explanation

Phishing uses spoofed communications that impersonate trusted entities to trick recipients into disclosing information or clicking malicious links. Smurfing is an amplification attack, pivoting is lateral movement, and fuzzing is a testing technique.

Question 6Cybersecurity Fundamentals and Threat Landscape

Which malware characteristic distinguishes a worm from a virus?

  1. A worm only infects boot sectors
  2. A worm requires a host file to replicate
  3. A worm is always non-destructive
  4. A worm self-propagates across networks without user action Correct answer.

Explanation

Worms spread autonomously through networks by exploiting services, whereas viruses need a host file and typically require user action to propagate. The other options describe neither worms accurately nor a reliable distinction.

Question 7Cybersecurity Fundamentals and Threat Landscape

Which of the following best describes the role of a firewall at the network perimeter?

  1. It encrypts all data at rest on servers
  2. It detects malicious behavior inside host memory
  3. It issues and manages digital certificates
  4. It filters traffic between networks according to defined rules Correct answer.

Explanation

A firewall enforces an access-control policy on network traffic passing between zones. Encryption at rest, host memory analysis, and certificate issuance are handled by other technologies such as disk encryption, EDR, and a PKI.

Question 8Cybersecurity Fundamentals and Threat Landscape

What does the principle of least privilege require?

  1. Users receive only the access needed to perform their duties Correct answer.
  2. Access is based on the user's seniority level
  3. Privileges are granted permanently to reduce support tickets
  4. All users share a single administrative account

Explanation

Least privilege limits rights to the minimum necessary for a task, reducing the blast radius of misuse or compromise. Shared accounts, permanent excess rights, and seniority-based access all violate the principle.

Question 9Cybersecurity Fundamentals and Threat Landscape

An attacker sends crafted input to a web form and the application returns a database error revealing table names. Which threat category does this behavior represent?

  1. Cross-site request forgery
  2. Directory traversal
  3. SQL injection Correct answer.
  4. Cross-site scripting

Explanation

Injecting data that alters a database query and produces database errors is characteristic of SQL injection. XSS targets other users' browsers, CSRF abuses a victim's session, and traversal reads files outside the web root.

Question 10Cybersecurity Fundamentals and Threat Landscape

Which characteristic most reliably indicates that an email is a phishing attempt?

  1. The message includes a company logo
  2. The display name differs from the actual sending domain Correct answer.
  3. The message was sent during business hours
  4. The message contains a signature block

Explanation

Phishing often spoofs a trusted display name while the underlying sending domain differs, so checking the real domain is a reliable indicator. Logos, timing, and signatures can all appear in legitimate mail.

Question 11Cybersecurity Fundamentals and Threat Landscape

An organization's server room floods, destroying hardware. Which category of threat does this represent?

  1. Environmental Correct answer.
  2. Nation-state
  3. Malicious insider
  4. Supply chain

Explanation

Flooding is an environmental threat, arising from natural or facility conditions rather than an adversary. Insider, supply chain, and nation-state threats all involve intentional human actors.

Question 12Cybersecurity Fundamentals and Threat Landscape

Which practice best mitigates the risk of credential stuffing against a customer portal?

  1. Enforcing multi-factor authentication and detecting anomalous login patterns Correct answer.
  2. Increasing the minimum password length to eight characters
  3. Storing passwords with reversible encryption
  4. Requiring users to change passwords every 30 days

Explanation

Credential stuffing reuses breached passwords, so MFA blocks takeover even when a password is valid, and anomaly detection catches automated attempts. Length alone, forced frequent rotation, and reversible storage do not stop reused valid credentials.

Question 13Cybersecurity Fundamentals and Threat Landscape

What is the primary purpose of network segmentation in a defense-in-depth architecture?

  1. To replace endpoint protection entirely
  2. To limit lateral movement between zones if one host is compromised Correct answer.
  3. To eliminate the need for authentication
  4. To increase available bandwidth for all users

Explanation

Segmentation divides networks into zones with controlled traffic between them, so a compromise in one zone cannot spread freely. It complements rather than replaces authentication and endpoint controls and does not guarantee bandwidth.

Question 14Cybersecurity Fundamentals and Threat Landscape

Which indicator most strongly suggests a domain generated by a domain generation algorithm used by malware?

  1. A domain registered more than ten years ago
  2. A long, high-entropy string with no dictionary words Correct answer.
  3. A short domain matching the company name
  4. A domain hosted on a well-known cloud provider

Explanation

DGAs produce many pseudo-random domains, so long high-entropy names without meaningful words are characteristic. Brand-matching names, common hosting, and old registration dates are typical of legitimate domains.

Question 15Cybersecurity Fundamentals and Threat Landscape

A user reports that their files have been renamed with an unfamiliar extension and a ransom note appeared. Which first response best aligns with containment?

  1. Reboot the machine repeatedly until it behaves normally
  2. Immediately pay the ransom to recover files
  3. Isolate the affected host from the network while preserving evidence Correct answer.
  4. Delete all files to remove the malware

Explanation

Isolating the host stops further encryption and spread while preserving evidence for investigation. Paying, deleting data, and repeated reboots either fund attackers, destroy evidence, or fail to remove the malware.

Question 16Cybersecurity Fundamentals and Threat Landscape

Which type of access control model assigns permissions based on the user's job function within the organization?

  1. Mandatory access control
  2. Role-based access control Correct answer.
  3. Discretionary access control
  4. Rule-based access control

Explanation

RBAC grants permissions to roles, and users inherit permissions through role assignment tied to job duties. DAC lets owners set permissions, MAC uses labels and clearances, and rule-based control uses conditional rules.

Question 17Cybersecurity Fundamentals and Threat Landscape

Which cryptographic practice best protects data at rest on a stolen laptop?

  1. Encoding files in Base64
  2. Compressing files with ZIP
  3. Full-disk encryption with keys protected by a TPM Correct answer.
  4. Hashing files with SHA-256

Explanation

Full-disk encryption renders the data unreadable without the key, and a TPM helps protect that key. Hashing is one-way and cannot protect content, Base64 is merely encoding, and compression offers no confidentiality.

Question 18Cybersecurity Fundamentals and Threat Landscape

An analyst sees repeated failed logins from a single IP across many accounts in a short window. Which attack does this pattern most likely indicate?

  1. Password spraying Correct answer.
  2. Watering hole
  3. Typosquatting
  4. Shoulder surfing

Explanation

Password spraying tries a few common passwords across many accounts to avoid lockouts, producing many failures spread across usernames from one source. Watering holes compromise websites, typosquatting registers look-alike domains, and shoulder surfing observes screens.

Question 19Cybersecurity Fundamentals and Threat Landscape

Which statement correctly distinguishes a vulnerability scan from a penetration test?

  1. A scan always exploits findings, while a penetration test only reports them
  2. A scan enumerates potential weaknesses, while a penetration test attempts to exploit them in a scoped engagement Correct answer.
  3. A scan requires legal authorization, while a penetration test does not
  4. A penetration test is fully automated, while a scan requires manual exploitation

Explanation

Vulnerability scanning identifies and reports possible weaknesses, often with false positives. A penetration test, performed under explicit authorization and scope, chains and exploits weaknesses to demonstrate real impact.

Question 20Cybersecurity Fundamentals and Threat Landscape

Which security model enforces access decisions by comparing the classification of a resource with the clearance of the subject?

  1. Discretionary access control
  2. Attribute-based access control
  3. Role-based access control
  4. Mandatory access control Correct answer.

Explanation

MAC uses labels on objects and clearances held by subjects, and the system, not the owner, enforces the policy. RBAC uses roles, DAC uses owner discretion, and ABAC evaluates multiple attributes in policy.

Question 21Cybersecurity Fundamentals and Threat Landscape

An attacker registers a domain that differs from a bank's domain by one character and hosts a login page there. Which technique is this?

  1. DNS cache poisoning
  2. Typosquatting Correct answer.
  3. Domain fronting
  4. Subdomain takeover

Explanation

Typosquatting exploits user typing errors by registering look-alike domains to host phishing pages. Domain fronting hides traffic behind CDNs, cache poisoning corrupts resolver records, and subdomain takeover abuses dangling DNS records.

Question 22Cybersecurity Fundamentals and Threat Landscape

In a defense-in-depth strategy, why is relying solely on a signature-based antivirus product insufficient?

  1. Signatures block all fileless attacks
  2. Novel or heavily obfuscated malware may not match known signatures Correct answer.
  3. Signatures always produce false negatives on known malware
  4. Antivirus products cannot run on endpoints

Explanation

Signature detection depends on known patterns, so new or obfuscated malware can evade it. Layered controls such as behavioral detection, patching, and least privilege cover gaps that signatures leave.

Question 23Cybersecurity Fundamentals and Threat Landscape

An attacker compromises a low-privilege web server, then uses it to reach internal database servers. Which term best describes this movement?

  1. Reconnaissance
  2. Lateral movement Correct answer.
  3. Exfiltration
  4. Privilege escalation

Explanation

Lateral movement is the progression from one compromised host to other systems in the environment. Privilege escalation raises rights on a host, reconnaissance gathers information, and exfiltration removes data.

Question 24Cybersecurity Fundamentals and Threat Landscape

A security team wants to reduce the risk of a compromised vendor update pipeline delivering malicious code. Which control most directly addresses this threat?

  1. Relying on perimeter firewalls alone
  2. Disabling automatic operating system updates
  3. Blocking all outbound DNS queries from servers
  4. Verifying code signatures and validating build provenance before deployment Correct answer.

Explanation

Supply chain attacks abuse trusted update channels, so signature verification and provenance validation help confirm artifacts are authentic and unmodified. Blocking DNS, disabling updates, and perimeter-only defense do not address trust in software artifacts.

Question 25Cybersecurity Fundamentals and Threat Landscape

An analyst must prioritize remediation. A critical internet-facing server has a remotely exploitable flaw with public exploit code, while an isolated test server has a moderate flaw. Which prioritization is most defensible?

  1. Defer both until the next annual cycle
  2. Remediate the test server first because it is easier to access
  3. Remediate neither, since both are only theoretical
  4. Remediate the internet-facing server first due to exposure and exploit availability Correct answer.

Explanation

Risk-based prioritization weighs exposure, exploitability, and impact, so an internet-facing host with public exploit code presents the greatest near-term risk. Isolation reduces the test server's exposure, and deferral ignores active risk.

Question 26Cybersecurity Fundamentals and Threat Landscape

In the CIA triad, which property is directly compromised when an attacker alters the balance figures in a financial database without being detected?

  1. Integrity Correct answer.
  2. Availability
  3. Non-repudiation
  4. Confidentiality

Explanation

Integrity refers to the accuracy and completeness of data and the assurance that it has not been modified in an unauthorized way. Unauthorized alteration of stored financial records is the textbook integrity violation, regardless of whether the attacker also read the data.

Question 27Cybersecurity Fundamentals and Threat Landscape

Which threat actor category is best characterized by long-term, well-resourced intrusion campaigns driven by state or geopolitical objectives rather than financial gain?

  1. Advanced persistent threat group Correct answer.
  2. Script kiddie
  3. Insider threat
  4. Hacktivist collective

Explanation

Advanced persistent threat (APT) groups are distinguished by sustained, stealthy access over long periods and by resources and motives aligned with nation-state or strategic goals. Their emphasis on persistence and espionage separates them from opportunistic or ideologically driven actors.

Question 28Cybersecurity Fundamentals and Threat Landscape

An analyst is reviewing a suspicious executable and sees that it unpacks a compressed payload into memory at runtime, evading the static signatures that a scanner would match on disk. Which malware evasion technique does this behavior describe?

  1. Packing with runtime unpacking Correct answer.
  2. Process hollowing into a trusted process
  3. Polymorphic encryption of the file header
  4. Living off the land using signed system binaries

Explanation

Packing compresses or encrypts the original payload, and a small stub decompresses it into memory at execution, so the on-disk bytes do not match known signatures. Analysts must then either unpack it dynamically or detect the stub behavior.

Question 29Cybersecurity Fundamentals and Threat Landscape

A company must classify the risk that a trusted employee with legitimate access copies customer records to personal storage before resigning. Which threat category and control focus best fit this scenario?

  1. Natural disaster affecting availability; offsite backups
  2. Supply chain compromise; vendor risk assessment
  3. Insider threat involving data exfiltration; data loss prevention and least privilege Correct answer.
  4. External attacker exploiting a public-facing vulnerability; patch management

Explanation

The actor already holds authorized access, so the risk is an insider threat centered on exfiltration of sensitive data. Controls that fit are data loss prevention, least privilege, and monitoring of bulk transfers rather than perimeter patching.

Question 30Cybersecurity Fundamentals and Threat Landscape

A SOC analyst observes that a compromised host beacons to its command-and-control server at irregular intervals with randomized sleep times, and that the destination resolves through a fast-flux network of frequently changing IP addresses. Which combination best explains the attacker's design goal?

  1. Maximizing bandwidth for data theft while minimizing encryption overhead
  2. Reducing the host's CPU usage so the implant remains undetected by performance monitoring
  3. Evading pattern-based network detection and resisting IP-based blocking Correct answer.
  4. Ensuring reliable delivery of patches to the host during the campaign

Explanation

Jittered beacon intervals break fixed-periodicity signatures, while fast-flux rotates resolving addresses so blocklists age quickly. Together they target detection and containment rather than throughput or host performance.

Question 31Network Security and Perimeter Defense

A perimeter firewall rule set processes traffic in the order listed and stops at the first match. Rule 1 permits TCP 443 from any source to the web server. Rule 2 denies TCP 443 from any source to any host. A remote client connects to the web server on port 443. What happens?

  1. The connection is permitted only if the client is on the management VLAN
  2. The connection is denied because rule 2 covers all hosts
  3. The connection is permitted because rule 1 matches first Correct answer.
  4. The connection is dropped because deny rules always take precedence

Explanation

First-match firewalls evaluate rules top-down and act on the first rule whose criteria match the packet, then stop. Because rule 1 explicitly permits TCP 443 to the web server and appears above the broader deny, the session is allowed. Rule order, not rule specificity, determines the outcome.

Question 32Network Security and Perimeter Defense

Which statement best describes the function of a DMZ in a segmented network architecture?

  1. It isolates internet-facing services from the internal network so a compromised host does not directly expose internal systems Correct answer.
  2. It encrypts all traffic between internal users and the internet gateway
  3. It stores offline backups of critical systems for ransomware recovery
  4. It replaces the need for host-based firewalls on internal servers

Explanation

A DMZ is a buffer segment that hosts externally reachable services while enforcing a boundary between them and the trusted internal network. If a public-facing host is compromised, the attacker still faces an additional control layer before reaching internal assets. Encryption, host firewalls, and backup retention are separate controls.

Question 33Network Security and Perimeter Defense

An IDS is deployed on a SPAN port that mirrors traffic from a core switch. Which limitation should the analyst expect from this design?

  1. The sensor cannot decode application-layer protocols
  2. The sensor cannot log alerts to a central SIEM
  3. The sensor cannot inspect encrypted TLS sessions
  4. The sensor cannot block malicious packets inline Correct answer.

Explanation

A passive sensor fed by a SPAN or TAP receives copies of packets and has no place in the forwarding path, so it can detect and alert but cannot drop traffic. Inline blocking requires a device deployed in the traffic path, such as an IPS. Protocol decoding, logging, and TLS visibility are separate capabilities.

Question 34Network Security and Perimeter Defense

A company wants remote staff to reach internal applications without exposing those applications directly to the internet. Which control best matches this requirement?

  1. A DHCP relay that forwards address requests across subnets
  2. A network TAP that copies internal traffic for monitoring
  3. A VPN concentrator that authenticates users before granting access to internal subnets Correct answer.
  4. A public-facing reverse proxy that forwards all ports to internal servers

Explanation

A VPN terminates an authenticated, encrypted tunnel and then grants access to internal resources according to policy, keeping those resources off the public internet. It combines authentication with perimeter enforcement. The other options either expose services, observe traffic, or perform addressing functions.

Question 35Network Security and Perimeter Defense

Which protocol and port combination is used by a standard IPsec IKEv2 VPN when NAT traversal is required?

  1. UDP 500 for IKE and UDP 4500 for NAT-T encapsulated ESP Correct answer.
  2. TCP 1723 for IKE and GRE for ESP
  3. TCP 443 for IKE and TCP 4500 for ESP
  4. UDP 1194 for IKE and UDP 500 for ESP

Explanation

IKEv2 negotiates over UDP 500, and when a NAT device is detected the peers switch to UDP 4500 so the ESP payload can be encapsulated and the NAT mapping kept alive. The other pairings mix ports and protocols used by unrelated technologies.

Question 36Network Security and Perimeter Defense

Which statement distinguishes stateful packet inspection from stateless packet filtering?

  1. Stateful inspection tracks connection state so return traffic is permitted without an explicit inbound rule Correct answer.
  2. Stateful inspection operates only at Layer 2 while stateless filtering operates at Layer 3
  3. Stateful inspection requires a proxy process for every protocol while stateless filtering does not
  4. Stateful inspection inspects only packet headers while stateless filtering inspects payloads

Explanation

A stateful firewall maintains a session table and automatically allows packets belonging to an established flow, so administrators do not need to write mirror-image rules for return traffic. Stateless filters evaluate each packet independently against static criteria. The other statements invert or misstate the capabilities of each model.

Question 37Network Security and Perimeter Defense

An organization wants to reduce the attack surface of its perimeter by allowing only the services that business units have formally requested. Which approach implements this principle?

  1. Permitting all outbound traffic and filtering only inbound connections
  2. Blocking only traffic from countries where the company has no offices
  3. Default-deny egress and ingress with explicit allow rules for approved services Correct answer.
  4. Default-permit with explicit deny rules for known malicious addresses

Explanation

A default-deny posture blocks everything not explicitly approved, which minimizes exposed services and unauthorized outbound channels. Allow lists are built from documented business requirements. Blocklists and geographic filtering only stop known-bad traffic and leave the rest open.

Question 38Network Security and Perimeter Defense

What is the primary security purpose of network address translation at the internet edge?

  1. It authenticates users before they reach internal servers
  2. It encrypts payloads between internal hosts and external peers
  3. It detects malware in downloaded files
  4. It hides internal addressing from direct external reachability Correct answer.

Explanation

NAT rewrites addresses so internal hosts are not directly addressable from outside, which incidentally reduces unsolicited inbound reachability. It is not an authentication, encryption, or content-inspection mechanism and should not be treated as a substitute for a firewall.

Question 39Network Security and Perimeter Defense

A security team wants to detect port scans that probe many ports on a single host within a short window. Which detection method is most appropriate?

  1. Static ARP inspection on the access switch
  2. Threshold-based correlation of connection attempts per source over a time window Correct answer.
  3. Signature matching against known malware file hashes
  4. DNS sinkholing of known command-and-control domains

Explanation

Port scanning is behavioral: it is characterized by many connection attempts across ports in a short period, so rate or threshold correlation over time is the fitting detection. Hash signatures, DNS sinkholes, and ARP inspection address different threat classes.

Question 40Network Security and Perimeter Defense

An engineer must allow DNS queries from an internal resolver to authoritative servers on the internet while blocking all other outbound traffic. Which rule set achieves this with least privilege?

  1. Permit TCP 53 from any internal host, then deny all other egress
  2. Permit UDP and TCP 53 from the resolver to any external address, then deny all other egress Correct answer.
  3. Permit all UDP from the resolver, then deny all other egress
  4. Permit UDP 53 from any internal host to any external address, then deny all other egress

Explanation

Least privilege scopes the rule to the specific source (the resolver), the specific service (DNS on UDP and TCP 53), and the destination class needed. DNS uses TCP for large responses and zone transfers, so permitting both transports is appropriate. Broadening the source or protocol exceeds the requirement.

Question 41Network Security and Perimeter Defense

A web application firewall is deployed in reverse-proxy mode in front of an application. Which benefit does this placement provide compared with an inline transparent bridge?

  1. The WAF removes the need for TLS between the client and the load balancer
  2. The WAF eliminates the need for input validation in the application
  3. The WAF automatically patches vulnerabilities in the backend application code
  4. The WAF terminates the client TLS session and can inspect decrypted HTTP content before re-encrypting to the backend Correct answer.

Explanation

In reverse-proxy mode the WAF is the TLS endpoint, so it can examine decrypted HTTP requests and responses and then establish a separate connection to the backend. This gives full application-layer visibility. It does not remove the need for encryption elsewhere, patch code, or replace secure coding.

Question 42Network Security and Perimeter Defense

An analyst sees repeated alerts for a signature matching a known exploit against an internal service that was decommissioned six months ago. What is the most likely explanation?

  1. The alerts indicate a successful compromise of the decommissioned service
  2. The signature is producing false positives because the vulnerable service no longer exists Correct answer.
  3. The service was silently reinstalled on the host
  4. The sensor clock is misconfigured

Explanation

When the targeted service is confirmed absent, a signature that continues to fire is likely matching benign traffic that resembles the exploit pattern, which is a false positive. Tuning or disabling the rule after verification is appropriate. Reinstallation or compromise would need independent evidence, and a clock error would not create recurring matches.

Question 43Network Security and Perimeter Defense

Which control most directly mitigates ARP spoofing on a switched internal network?

  1. Dynamic ARP inspection with DHCP snooping bindings Correct answer.
  2. Spanning Tree Protocol root guard
  3. 802.1X authentication of supplicants
  4. Port security limiting MAC addresses per port

Explanation

Dynamic ARP inspection validates ARP packets against a trusted binding table built from DHCP snooping, dropping replies that map an IP to the wrong MAC. Port security, 802.1X, and root guard address different Layer 2 risks such as MAC flooding, unauthorized access, and rogue bridges.

Question 44Network Security and Perimeter Defense

A company must give a third-party vendor access to a single internal application. Which design best limits the vendor's reach?

  1. A dedicated VPN tunnel with firewall rules permitting only the application's host and port Correct answer.
  2. A jump host placed directly on the internet with password authentication
  3. A shared site-to-site tunnel that exposes the entire internal address space
  4. A port-forward on the edge router to the application server

Explanation

Scoping the tunnel to the vendor and pairing it with rules limited to one destination host and port enforces least privilege for third-party access. Shared tunnels, internet-exposed jump hosts, and router port-forwards all broaden exposure.

Question 45Network Security and Perimeter Defense

During a review, an analyst finds that the firewall permits inbound TCP 3389 from any source to a terminal server. Which remediation is most appropriate?

  1. Enable logging on the existing permit rule
  2. Restrict the rule to a management subnet or VPN address pool and require multi-factor authentication Correct answer.
  3. Change the rule to permit only UDP 3389 from any source
  4. Add a rule denying TCP 3389 below the existing permit

Explanation

Remote desktop exposed to the internet is a common ransomware entry point, so the fix is to narrow the source to trusted administrative networks or require VPN access with strong authentication. Because first-match firewalls stop at the permit, a deny placed below it has no effect. Logging and protocol changes do not reduce exposure.

Question 46Network Security and Perimeter Defense

Which statement correctly describes the role of an Extensible Authentication Protocol method in 802.1X?

  1. EAP replaces the need for a RADIUS server
  2. EAP carries authentication exchanges between the supplicant and the authentication server, tunneled by the authenticator Correct answer.
  3. EAP encrypts all user data traffic after the port opens
  4. EAP assigns VLANs to the switch independent of the authentication result

Explanation

In 802.1X the supplicant and RADIUS server run an EAP conversation while the switch or wireless controller acts as authenticator, relaying EAP messages. Data confidentiality after authorization is handled by link-layer ciphers, and dynamic VLAN assignment is an authorization outcome.

Question 47Network Security and Perimeter Defense

A network team deploys a TAP instead of a SPAN session for a new intrusion detection sensor. What is the primary advantage?

  1. The TAP can block malicious traffic inline
  2. The TAP passes full-duplex traffic without dropping packets due to oversubscription Correct answer.
  3. The TAP assigns IP addresses to monitored hosts
  4. The TAP decrypts TLS sessions automatically

Explanation

A hardware TAP splits the physical signal and delivers all frames to the monitoring port, avoiding the contention and oversubscription that can cause a SPAN port to drop copies under load. TAPs remain passive and do not block, decrypt, or address hosts.

Question 48Network Security and Perimeter Defense

Which practice best hardens the management plane of perimeter devices?

  1. Using a shared administrator account to simplify auditing
  2. Allowing administrative access from any internal subnet for convenience
  3. Disabling logging to reduce device CPU load
  4. Restricting administrative access to a dedicated management network with strong authentication and logging Correct answer.

Explanation

Management-plane hardening isolates administrative interfaces on a dedicated network, requires strong authentication, and records administrative actions for accountability. Broad access, shared accounts, and disabled logging each undermine confidentiality, integrity, or auditability.

Question 49Network Security and Perimeter Defense

A SIEM correlates a spike in outbound connections to a single external IP on port 443 across many internal hosts. Which hypothesis should the analyst test first?

  1. A DNS server is misconfigured
  2. Internal hosts may be beaconing to a command-and-control server Correct answer.
  3. A switch is experiencing a broadcast storm
  4. An NTP server has drifted

Explanation

Many internal hosts contacting one external address on a common port at scale is consistent with malware beaconing to command-and-control infrastructure. The analyst should validate the destination reputation, payload patterns, and host process telemetry. DNS misconfiguration, broadcast storms, and time drift produce different observable symptoms.

Question 50Network Security and Perimeter Defense

An organization is choosing between inline IPS and passive IDS for a critical internet edge. Which consideration favors inline IPS?

  1. It cannot be bypassed by encrypted traffic
  2. It requires no tuning of signatures
  3. It eliminates the need for firewall rules
  4. It can drop malicious traffic before it reaches protected hosts Correct answer.

Explanation

An inline IPS sits in the forwarding path and can block traffic that matches a signature, providing preventive control rather than detection alone. It still requires tuning, does not see inside encrypted sessions without decryption, and complements rather than replaces firewall policy.