I85PREP
⌘ K
UPMSP High School Security study materials
UPMSP High School Security study resources

UPMSP High School Security practice questions

One question at a time. Build your UPMSP High School Security understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Concepts and Principles

In the CIA triad used to describe security objectives, which property ensures that data has not been altered by an unauthorized party?

  1. Integrity Correct answer.
  2. Confidentiality
  3. Availability
  4. Non-repudiation

Explanation

Integrity guarantees that information remains accurate and complete and has not been modified without authorization. Confidentiality concerns preventing unauthorized disclosure, while availability concerns timely access. Non-repudiation is a separate assurance about proving an action occurred.

Question 2Security Concepts and Principles

A hospital's patient records system is rendered unreachable by a ransomware attack. Which element of the CIA triad is most directly affected?

  1. Availability Correct answer.
  2. Confidentiality
  3. Authenticity
  4. Integrity

Explanation

Availability is the property that systems and data are accessible to authorized users when needed. When ransomware blocks access, the immediate and most direct impact is loss of availability. Confidentiality and integrity may also be affected later, but the scenario describes loss of access.

Question 3Security Concepts and Principles

Which principle states that a user should be granted only the access necessary to perform their job and nothing more?

  1. Fail-safe defaults
  2. Least privilege Correct answer.
  3. Defense in depth
  4. Separation of duties

Explanation

The principle of least privilege limits each subject to the minimum rights required for its function, reducing the damage from errors or compromise. Separation of duties divides tasks among people, and defense in depth layers controls. Fail-safe defaults deny access unless explicitly granted.

Question 4Security Concepts and Principles

An organization requires that the person who creates a payment request cannot also approve it. Which security principle does this implement?

  1. Need to know
  2. Separation of duties Correct answer.
  3. Zero trust
  4. Least privilege

Explanation

Separation of duties splits a sensitive process across multiple people so that no single individual can complete it alone, preventing fraud and error. Least privilege limits the scope of rights but does not require dividing a process between people. Need to know addresses access to information, and zero trust is an architecture model.

Question 5Security Concepts and Principles

Which concept describes granting access based on the sensitivity of the information and the subject's demonstrated requirement to use it for a task?

  1. Privilege escalation
  2. Need to know Correct answer.
  3. Mandatory access control
  4. Role-based access control

Explanation

Need to know limits access to information to subjects who require it to perform their assigned task, independent of clearance level. Mandatory access control uses labels and clearances, and role-based access control uses job roles. Privilege escalation is an attack outcome, not an access concept.

Question 6Security Concepts and Principles

A security team places firewalls, endpoint detection, and network monitoring at multiple layers so that a single control failure does not expose the whole environment. Which principle is this?

  1. Single point of failure
  2. Least privilege
  3. Defense in depth Correct answer.
  4. Implicit trust

Explanation

Defense in depth uses multiple overlapping controls at different layers so that if one fails, others still protect the asset. Least privilege limits rights rather than layering controls. A single point of failure is what defense in depth aims to avoid, and implicit trust is the opposite of a layered verification approach.

Question 7Security Concepts and Principles

What does the principle of fail-safe defaults require of an access control system?

  1. Encrypt all stored credentials
  2. Require multi-factor authentication
  3. Deny access when a decision cannot be made Correct answer.
  4. Log all failed login attempts

Explanation

Fail-safe defaults require that the system deny access unless a subject is explicitly permitted, so errors result in refusal rather than exposure. Logging, credential encryption, and multi-factor authentication are useful controls but do not define this principle.

Question 8Security Concepts and Principles

Which statement best describes the role of authentication in a security system?

  1. It verifies that a subject is who it claims to be Correct answer.
  2. It determines which resources a subject may use
  3. It encrypts data while it is in transit
  4. It records the actions a subject performs

Explanation

Authentication establishes and verifies identity, typically through something you know, have, or are. Authorization then decides what the authenticated subject may access. Accounting or auditing records actions, and encryption protects data in transit.

Question 9Security Concepts and Principles

A user logs in with a password and then is asked for a code from a hardware token. Which authentication factor categories are being combined?

  1. Something you have and somewhere you are
  2. Something you know and something you have Correct answer.
  3. Something you know and something you are
  4. Something you are and something you do

Explanation

A password is knowledge, and a hardware token is a physical possession, so the combination is knowledge plus possession. Biometrics would be something you are, and location or behavior are separate factor categories. Combining distinct categories is what makes multi-factor authentication strong.

Question 10Security Concepts and Principles

Which type of malware self-replicates across networks without requiring a user to open a file or run a program?

  1. Rootkit
  2. Logic bomb
  3. Worm Correct answer.
  4. Trojan horse

Explanation

A worm is self-propagating malware that spreads across networks by exploiting vulnerabilities, without user action. A Trojan disguises itself as legitimate software and needs user execution. A logic bomb triggers on a condition, and a rootkit hides attacker presence.

Question 11Security Concepts and Principles

An attacker sends emails that appear to come from a bank's domain, hoping recipients will enter credentials on a lookalike site. Which attack is this?

  1. Privilege escalation
  2. SQL injection
  3. Phishing Correct answer.
  4. Denial of service

Explanation

Phishing uses fraudulent messages that impersonate a trusted entity to trick recipients into revealing credentials or other sensitive data. Denial of service targets availability, SQL injection targets databases, and privilege escalation targets rights on a system.

Question 12Security Concepts and Principles

Which social engineering technique relies on a plausible but false story to persuade a target to disclose information?

  1. Tailgating
  2. Dumpster diving
  3. Shoulder surfing
  4. Pretexting Correct answer.

Explanation

Pretexting invents a scenario or identity to make a request seem legitimate, persuading the target to cooperate. Shoulder surfing is direct observation, tailgating is following someone through a door, and dumpster diving is searching discarded material.

Question 13Security Concepts and Principles

A website accepts user input that is passed directly into a database query, allowing an attacker to retrieve records. Which vulnerability is present?

  1. Cross-site request forgery
  2. Cross-site scripting
  3. SQL injection Correct answer.
  4. Buffer overflow

Explanation

SQL injection occurs when untrusted input is concatenated into a query so that it alters the query's logic. Cross-site scripting targets browser-rendered content, cross-site request forgery abuses a user's session, and buffer overflow writes beyond allocated memory.

Question 14Security Concepts and Principles

Why is input validation considered a fundamental security control?

  1. It encrypts data at rest using strong algorithms
  2. It records all user actions for later review
  3. It authenticates users before they access the application
  4. It rejects malformed or malicious data before it reaches sensitive processing Correct answer.

Explanation

Input validation checks data against expected format, type, and range, blocking malformed or malicious values before they reach interpreters or storage. Encryption, authentication, and logging are separate controls that address different threats.

Question 15Security Concepts and Principles

Which practice best protects stored user passwords if a database is stolen?

  1. Storing salted hashes produced by a slow algorithm Correct answer.
  2. Storing passwords encoded with Base64
  3. Storing passwords encrypted with a shared key kept on the same server
  4. Storing passwords in plain text with file permissions restricted

Explanation

Salted hashes with a deliberately slow algorithm make offline guessing impractical and prevent precomputed table attacks. Encryption with a key stored alongside the data fails once the server is compromised, and encoding is reversible and offers no protection.

Question 16Security Concepts and Principles

What is the primary purpose of a digital signature?

  1. To guarantee the message will be delivered
  2. To keep the message contents secret from eavesdroppers
  3. To prove the origin and integrity of a message Correct answer.
  4. To compress the message for efficient transmission

Explanation

A digital signature uses the sender's private key so that recipients can verify origin and detect any change to the message. Confidentiality requires encryption, and neither compression nor delivery guarantees are provided by signatures.

Question 17Security Concepts and Principles

Which property of a cryptographic hash function ensures that finding two different inputs with the same output is computationally infeasible?

  1. Salting
  2. Perfect forward secrecy
  3. Collision resistance Correct answer.
  4. Key length

Explanation

Collision resistance means it is impractical to find two distinct inputs producing the same hash. Key length applies to encryption keys, perfect forward secrecy concerns session key compromise, and salting adds unique data before hashing.

Question 18Security Concepts and Principles

In symmetric encryption, which statement about the key is accurate?

  1. The same key is used to encrypt and to decrypt Correct answer.
  2. A public key encrypts and a private key decrypts
  3. The key is only used to compute a hash of the message
  4. Each party uses a different key that cannot be derived from the other

Explanation

Symmetric algorithms use one shared secret key for both encryption and decryption, which makes them fast but requires secure key distribution. Public and private key pairs belong to asymmetric cryptography, and hashing does not use an encryption key in this way.

Question 19Security Concepts and Principles

A company wants to protect data while it is being transmitted over an untrusted network. Which control directly addresses this requirement?

  1. Full-disk encryption of the server
  2. TLS encryption of the connection Correct answer.
  3. Role-based access control
  4. Regular vulnerability scanning

Explanation

Transport Layer Security encrypts data in transit, preventing eavesdropping and tampering on untrusted networks. Full-disk encryption protects data at rest, access control limits who may use resources, and scanning identifies weaknesses rather than protecting traffic.

Question 20Security Concepts and Principles

Which security model enforces access decisions by comparing the classification label of an object with the clearance of a subject, independent of the subject's discretion?

  1. Attribute-based access control
  2. Discretionary access control
  3. Role-based access control
  4. Mandatory access control Correct answer.

Explanation

Mandatory access control uses system-assigned labels and clearances, so owners cannot override the policy. Discretionary access control lets owners set permissions, role-based access control uses job roles, and attribute-based access control evaluates attributes through policy rules.

Question 21Security Concepts and Principles

In the access control rule set shown here in words, a firewall permits only TCP port 443 inbound and denies everything else. Which principle does the deny rule support?

  1. Least common mechanism
  2. Fail-safe defaults Correct answer.
  3. Separation of duties
  4. Open design

Explanation

Ending an access control list with an explicit deny implements fail-safe defaults, because anything not expressly permitted is refused. Separation of duties concerns dividing tasks, least common mechanism concerns shared resources, and open design concerns transparency of the design rather than secrecy.

Question 22Security Concepts and Principles

What distinguishes a vulnerability from a threat?

  1. A vulnerability is a control, while a threat is a countermeasure
  2. A vulnerability is a realized attack, while a threat is a security policy
  3. A vulnerability is a weakness that can be exploited, while a threat is a potential cause of harm Correct answer.
  4. A vulnerability is an attacker, while a threat is a weakness in a system

Explanation

A vulnerability is a weakness in a system, and a threat is any potential event or actor that could exploit it to cause harm. Risk combines the likelihood of a threat exploiting a vulnerability with the resulting impact. Attackers are threat agents, not vulnerabilities.

Question 23Security Concepts and Principles

A team rates a risk as high because an unpatched server is exposed to the internet and exploitation would expose customer data. Which factor combination produces this rating?

  1. High likelihood of exploitation combined with negligible impact
  2. Low likelihood of exploitation combined with high impact
  3. High likelihood of exploitation combined with high impact Correct answer.
  4. Low likelihood of exploitation combined with low impact

Explanation

Risk reflects both the likelihood that a threat exploits a vulnerability and the impact if it occurs. Internet exposure raises likelihood, and exposure of customer data raises impact, so both are high. The other combinations would yield lower or different ratings.

Question 24Security Concepts and Principles

Which action is an example of risk mitigation rather than risk acceptance?

  1. Documenting that a low-value risk will be tolerated
  2. Deciding to stop offering the affected service
  3. Purchasing insurance to transfer financial loss
  4. Applying a patch that removes the exploitable weakness Correct answer.

Explanation

Mitigation reduces risk by lowering likelihood or impact, for example by patching a vulnerability. Accepting a risk means tolerating it, transferring shifts financial loss to another party, and avoiding eliminates the activity entirely.

Question 25Security Concepts and Principles

Why does an organization combine preventive, detective, and corrective controls?

  1. Detective controls replace the need for preventive controls
  2. Each type is required by law in all jurisdictions
  3. Only preventive controls matter, and the others are optional
  4. Each type addresses a different phase, so together they reduce overall exposure Correct answer.

Explanation

Preventive controls stop incidents, detective controls identify them, and corrective controls restore normal operation. Layering them ensures that failures in one phase are caught by another. No universal legal rule requires all three, and detection cannot substitute for prevention.

Question 26Security Concepts and Principles

Which term describes the assurance that data has not been altered, whether accidentally or maliciously, between the moment it was created and the moment it is used?

  1. Confidentiality
  2. Non-repudiation
  3. Integrity Correct answer.
  4. Availability

Explanation

Integrity means data remains accurate and complete and has not been changed by an unauthorized party or by error. It is distinct from confidentiality, which limits who may read data, and from availability, which guarantees timely access to it.

Question 27Security Concepts and Principles

A hospital must keep patient records readable to clinicians during a ransomware outbreak. Which security objective is most directly threatened when the records are encrypted by the attacker?

  1. Availability Correct answer.
  2. Confidentiality
  3. Integrity
  4. Accountability

Explanation

Ransomware encryption denies legitimate users access to their own data, so the immediate harm is to availability. Confidentiality would be the concern if the attacker read or leaked the records, and integrity would be the concern if the attacker silently altered their contents.

Question 28Security Concepts and Principles

A developer stores a customer's full credit card number in a log file so that failed payments can be debugged later. Which principle does this practice most clearly violate?

  1. Defense in depth
  2. Least privilege
  3. Data minimization Correct answer.
  4. Separation of duties

Explanation

Data minimization requires collecting and retaining only the data actually needed for a stated purpose. Copying a full card number into logs spreads sensitive data to a low-protection location that many staff can read, increasing exposure without a justified need.

Question 29Security Concepts and Principles

An employee who approves vendor payments is also the only person who can create new vendors in the finance system. Which control weakness does this arrangement create?

  1. Lack of network segmentation
  2. Excessive failed logon attempts
  3. Absence of separation of duties Correct answer.
  4. Insufficient encryption strength

Explanation

Separation of duties requires that no single person control both the creation of a payee and the approval of payments to it. Combining both lets one person fabricate a vendor and pay it without a second check, which is a classic fraud path.

Question 30Security Concepts and Principles

A small firm identifies a risk but decides to buy an insurance policy that will cover financial losses if the event occurs. Which risk treatment strategy is this?

  1. Risk avoidance
  2. Risk acceptance
  3. Risk transfer Correct answer.
  4. Risk mitigation

Explanation

Risk transfer shifts the financial consequence of a risk to a third party, typically through insurance or a contractual clause, while the underlying risk still exists. Avoidance would mean stopping the activity entirely, mitigation would reduce likelihood or impact through controls, and acceptance would mean bearing the loss without any arrangement.

Question 31Physical Security and Access Control

In a layered physical security design, which control is best described as the outermost boundary that delays an intruder before the building perimeter is reached?

  1. The locked filing cabinet inside an office
  2. The reception desk staffed during office hours
  3. The perimeter fence line with its associated gates and lighting Correct answer.
  4. The server room door with a card reader

Explanation

Layered defense places detection and delay controls at successive boundaries, and the fence line with gates and lighting forms the first line an intruder meets. Interior controls such as card-reader doors, reception staff, and locked cabinets belong to inner layers that only matter after the outer boundary is crossed.

Question 32Physical Security and Access Control

A facility wants visitors to enter only through one controlled point while fire codes require rapid exit. Which configuration meets both needs?

  1. Visitor badges issued at any exterior door on request
  2. A single monitored entrance with doors that release freely from inside Correct answer.
  3. All exterior doors left unlocked during business hours
  4. A single entrance chained shut with a guard holding the key

Explanation

Life-safety codes require free egress, so exit hardware must allow occupants to leave without a key or card. Concentrating entry at one monitored point satisfies access control while free-release egress hardware satisfies the fire requirement.

Question 33Physical Security and Access Control

Which statement correctly describes the purpose of a mantrap or interlocking door at a controlled entrance?

  1. It stores visitor badges for later reuse
  2. It prevents two people from passing on one authorization and stops tailgating Correct answer.
  3. It records the weight of each person entering the facility
  4. It provides a fire-rated exit path during an evacuation

Explanation

An interlocking door arrangement admits one authorized person at a time and holds the second door until the first closes, which defeats piggybacking. It is an anti-tailgating control rather than a weighing device, egress route, or badge storage point.

Question 34Physical Security and Access Control

A badge reader at a door authenticates a valid credential but the door fails to unlock. Which physical access control element should be checked first?

  1. The CCTV recording retention period
  2. The fence line lighting schedule
  3. The electric strike or lock hardware and its power supply Correct answer.
  4. The visitor logbook at reception

Explanation

When authentication succeeds but the door does not open, the fault lies downstream of the reader in the locking hardware or its power circuit. The controller may have granted access while the strike, maglock, or power supply failed to release.

Question 35Physical Security and Access Control

What is the primary security purpose of a clean-desk policy in an office area?

  1. Reducing exposure of sensitive documents and removable media to unauthorized viewing or removal Correct answer.
  2. Satisfying fire code occupancy limits
  3. Improving janitorial efficiency after hours
  4. Extending the life of office furniture

Explanation

A clean-desk policy requires sensitive papers and media to be secured when unattended, which limits casual viewing and theft. The control addresses information exposure in the physical workspace rather than cleaning, furniture life, or occupancy limits.

Question 36Physical Security and Access Control

Which device is designed to detect an intruder crossing a defined outdoor area using infrared beams between transmitter and receiver units?

  1. An active infrared perimeter detector Correct answer.
  2. A vibration sensor on a wall
  3. A passive infrared motion sensor
  4. A door position switch

Explanation

An active infrared detector projects a beam to a receiver and alarms when the beam is interrupted, making it suitable for perimeter lines. Passive infrared senses body heat, vibration sensors detect physical shock, and door switches report door state.

Question 37Physical Security and Access Control

What does the principle of least privilege mean when applied to physical access control?

  1. Access is granted to all employees for all areas by default
  2. Everyone receives master keys for convenience
  3. People receive only the access needed for their current duties and no more Correct answer.
  4. Access rights are never reviewed after onboarding

Explanation

Least privilege limits each person's access to the areas and times required by their role, reducing insider and lateral risk. Granting master keys, default broad access, or skipping reviews all contradict the principle.

Question 38Physical Security and Access Control

A security officer finds a propped-open fire exit door in a restricted corridor. What is the most appropriate immediate action?

  1. Close and secure the door, then report the incident for follow-up Correct answer.
  2. Leave it open because staff may be using it
  3. Prop it wider to improve airflow
  4. Remove the door from its hinges for maintenance

Explanation

A propped door defeats the access control boundary and is a common intrusion vector, so it should be secured immediately and documented. Leaving it open, widening it, or removing it all worsen the exposure and remove the control.

Question 39Physical Security and Access Control

A data center requires that a person's identity be verified by a card plus a fingerprint before entry. Which authentication model is in use?

  1. Multi-factor authentication combining something held with something inherent Correct answer.
  2. Single-factor authentication using something held
  3. Knowledge-based authentication using a shared password
  4. Anonymous access based on a visitor badge

Explanation

A card is a possession factor and a fingerprint is a biometric inherence factor, so using both is multi-factor authentication. A card alone would be single-factor, and the scenario involves no password or anonymous badge.

Question 40Physical Security and Access Control

Why should an access control system log both granted and denied entry attempts?

  1. Granted events are legally required while denials are optional
  2. Denied attempts prove the reader is malfunctioning
  3. Logging denials reduces the storage cost of video evidence
  4. Denied attempts reveal probing or misuse that granted events alone would hide Correct answer.

Explanation

Denied attempts can show someone repeatedly testing credentials or a wrong-area attempt, which is valuable for investigation and tuning. Logging only successful entries conceals that behavior and weakens audit and incident response.

Question 41Physical Security and Access Control

A site installs bollards in front of its main lobby. Which threat does this control primarily mitigate?

  1. Unauthorized entry through a turnstile
  2. Eavesdropping on lobby conversations
  3. Vehicle-borne ramming into the building facade Correct answer.
  4. Theft of laptops from unoccupied desks

Explanation

Bollards are rigid barriers that keep vehicles at a standoff distance from a structure, mitigating ram attacks. They do not control pedestrian entry, prevent conversation eavesdropping, or secure loose equipment inside.

Question 42Physical Security and Access Control

A badge system shows an employee entering a secure lab at 02:00 even though the employee is on approved leave. Which interpretation is most reasonable for the investigator?

  1. The log is always wrong and should be discarded
  2. The reader clock is irrelevant to the anomaly
  3. The credential may have been shared, cloned, or used by someone else and warrants investigation Correct answer.
  4. The employee definitely returned early from leave

Explanation

An access event that conflicts with known personnel status suggests credential misuse, sharing, or cloning and should trigger review of video and door records. Discarding the log or assuming an early return ignores the evidence and the possibility of compromise.

Question 43Physical Security and Access Control

Which practice best protects physical keys and mechanical lock hardware in a large facility?

  1. A key control register with signed issuance, return, and periodic audit Correct answer.
  2. Issuing master keys to all contractors without records
  3. Storing spare keys in an unlocked reception drawer
  4. Replacing locks only after a theft is confirmed

Explanation

A documented key register with signatures and periodic audits provides accountability and detects lost or unreturned keys. Unlocked storage, unrecorded master keys, and reactive lock changes all leave key control unmanaged.

Question 44Physical Security and Access Control

A CCTV camera covers an entrance but the recorded image cannot identify faces at night. Which corrective action addresses the root cause?

  1. Reduce the frame rate to save storage
  2. Improve lighting and adjust camera placement or lens settings for the identification zone Correct answer.
  3. Add more monitors at the guard desk
  4. Increase the video retention period to one year

Explanation

Identification requires adequate light and correct placement and focal length at the capture point; retention, monitoring, and frame rate do not fix poor image capture. Adjusting lighting and optics addresses the actual cause of unusable footage.

Question 45Physical Security and Access Control

What is the security rationale for requiring two authorized people to be present when a high-value vault is opened?

  1. It enforces separation of duties so no single person can access the asset alone Correct answer.
  2. It doubles the speed of vault operations
  3. It allows one person to hold both credentials
  4. It removes the need for any access log

Explanation

Two-person integrity splits control so a single insider cannot remove assets without a witness, which is a separation-of-duties control. It slows rather than speeds operations and does not replace logging.

Question 46Physical Security and Access Control

A guard observes a person following an employee through a controlled door without badging. Which control failed and what should the guard do?

  1. The fire alarm failed; the guard should evacuate the floor
  2. The CCTV retention failed; the guard should erase footage
  3. The lighting schedule failed; the guard should wait until morning
  4. Anti-tailgating control failed; the guard should challenge the person and verify authorization Correct answer.

Explanation

Following an authorized person through a door without badging is tailgating, so the anti-tailgating control did not prevent it. The appropriate response is to challenge the individual politely and confirm authorization, then document the event.

Question 47Physical Security and Access Control

Which element of a physical access control system decides whether a presented credential is valid and whether the door should release?

  1. The request-to-exit sensor
  2. The door closer
  3. The access control panel or controller Correct answer.
  4. The badge printer

Explanation

The controller compares the presented credential against its authorization database and issues the unlock decision to the door hardware. The door closer, exit sensor, and badge printer perform mechanical or administrative functions, not the authorization decision.

Question 48Physical Security and Access Control

A facility must protect against an intruder who cuts through a chain-link fence. Which upgrade most directly increases delay at that boundary?

  1. Repainting the fence posts
  2. Replacing the gate sign with a larger one
  3. Adding taut wire or a fence-mounted detection fabric with alarmed mesh Correct answer.
  4. Increasing the number of interior cameras

Explanation

Taut wire or alarmed mesh turns the fence itself into a detection and delay layer that reacts to cutting or climbing. Cosmetic changes and interior cameras do not add resistance or detection at the fence line.

Question 49Physical Security and Access Control

Why is a request-to-exit sensor paired with a card reader at an interior secure door?

  1. It replaces the need for a locking mechanism
  2. It authenticates visitors before they enter
  3. It allows free egress from the secure side while entry still requires a credential Correct answer.
  4. It records the identity of the person leaving the area

Explanation

A request-to-exit sensor releases the lock when someone approaches from the secure side, satisfying egress needs without a credential. Entry from the other side still requires a valid card, so the sensor does not authenticate people or replace the lock.

Question 50Physical Security and Access Control

A security manager is comparing a guard force with electronic access control for a remote gate. Which factor most directly favors electronic control?

  1. Immediate physical response to a confrontation
  2. Consistent enforcement of credential checks at all hours Correct answer.
  3. Ability to assess intent from body language
  4. Flexibility to handle unusual visitor situations

Explanation

Electronic access control enforces the same credential rule every time, without fatigue or distraction, which suits a remote gate with predictable traffic. Human judgment, intent assessment, and physical response are advantages of guards rather than of electronics.