I85PREP
⌘ K
WBCHSE HS Cyber Security study materials
WBCHSE HS Cyber Security study resources

WBCHSE HS Cyber Security practice questions

One question at a time. Build your WBCHSE HS Cyber Security understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Introduction to Cyber Security and Cyber Threats

In cyber security terminology, what does the term 'malware' refer to?

  1. Any software written specifically to damage, disrupt, or gain unauthorised access to a system Correct answer.
  2. Any file that has been compressed to reduce its storage size
  3. Any program that has been digitally signed by a trusted certificate authority
  4. Any software that is distributed free of charge over the internet

Explanation

Malware is an umbrella term for software whose purpose is harmful or unauthorised: it damages systems, steals data, or gives an attacker control. Legitimate freeware, signed programs, and compressed archives are not malware merely because of those traits.

Question 2Introduction to Cyber Security and Cyber Threats

A student receives an email that appears to come from the school office and asks them to click a link and re-enter their login password. The link actually leads to a fake copy of the school portal. Which type of attack is this?

  1. Phishing Correct answer.
  2. Denial of service
  3. Brute force
  4. SQL injection

Explanation

Phishing deceives a user into handing over credentials by impersonating a trusted party, often through a look-alike login page. The deception of the human target, not technical exploitation of a server, is the defining feature here.

Question 3Introduction to Cyber Security and Cyber Threats

Which of the following best describes the confidentiality aspect of the CIA triad?

  1. Ensuring data is not altered by anyone other than authorised parties
  2. Ensuring information is accessible only to those who are authorised to view it Correct answer.
  3. Ensuring data is available to authorised users whenever they need it
  4. Ensuring every user can verify the identity of every other user

Explanation

Confidentiality means preventing disclosure of information to unauthorised people, typically through encryption and access control. Availability and integrity are separate goals, and identity verification belongs to authentication.

Question 4Introduction to Cyber Security and Cyber Threats

A program installs itself on a computer, copies itself to other machines over the network, and spreads without any user action. What is this program called?

  1. A worm Correct answer.
  2. A rootkit
  3. A logic bomb
  4. A trojan horse

Explanation

A worm is self-replicating malware that spreads across networks automatically without needing a host file or user interaction. Its independent propagation is what separates it from trojans and logic bombs.

Question 5Introduction to Cyber Security and Cyber Threats

What is the main purpose of a firewall on a network?

  1. To filter incoming and outgoing traffic according to a defined set of rules Correct answer.
  2. To encrypt files stored on the hard disk
  3. To create backups of critical data at regular intervals
  4. To scan email attachments for malicious macros

Explanation

A firewall sits between networks and permits or blocks traffic based on configured rules such as addresses, ports, and protocols. Disk encryption, attachment scanning, and backups are performed by other controls.

Question 6Introduction to Cyber Security and Cyber Threats

Which practice most directly reduces the risk of unauthorised access to an online bank account?

  1. Sharing the password only with close friends
  2. Writing the password on a note kept near the computer
  3. Using a strong unique password together with two-factor authentication Correct answer.
  4. Reusing one long password across all accounts

Explanation

A strong unique password limits guessing and credential-stuffing, while two-factor authentication blocks access even if the password leaks. Combining both controls gives layered protection for the account.

Question 7Introduction to Cyber Security and Cyber Threats

In cyber security, what is an 'asset'?

  1. Any piece of software that is installed without a licence
  2. Any attacker who targets a network
  3. Any device or data that has value to an organisation and needs protection Correct answer.
  4. Any rule written in a security policy document

Explanation

An asset is anything of value to the organisation, such as data, hardware, software, or reputation, and it is what security controls are designed to protect. Risk assessment begins by identifying assets and their value.

Question 8Introduction to Cyber Security and Cyber Threats

A user gets a phone call from someone claiming to be from the IT helpdesk who asks for the one-time password just sent to the user's phone. Which social engineering technique is this?

  1. Vishing Correct answer.
  2. Tailgating
  3. Pharming
  4. Shoulder surfing

Explanation

Vishing is voice phishing: the attacker uses a telephone call to impersonate a trusted person and extract sensitive information. The channel, a voice call, distinguishes it from email phishing and from physical techniques.

Question 9Introduction to Cyber Security and Cyber Threats

Which statement correctly distinguishes a virus from a worm?

  1. A virus needs a host file and user action to spread, while a worm spreads on its own across networks Correct answer.
  2. A virus targets servers, while a worm targets only mobile phones
  3. A virus spreads only through email, while a worm spreads only through USB drives
  4. A virus is always harmless, while a worm is always destructive

Explanation

A virus attaches to a host file or program and typically requires the user to run that host before it can replicate. A worm is standalone and propagates automatically through network connections without user action.

Question 10Introduction to Cyber Security and Cyber Threats

An attacker floods a web server with a huge volume of requests from thousands of compromised machines so that genuine users cannot connect. What is this attack called?

  1. Man-in-the-middle
  2. Cross-site scripting
  3. Distributed denial of service Correct answer.
  4. Privilege escalation

Explanation

A distributed denial of service attack uses many compromised hosts, often a botnet, to exhaust a target's resources and deny service to legitimate users. The use of many sources is what makes it distributed.

Question 11Introduction to Cyber Security and Cyber Threats

Why is symmetric encryption alone often combined with asymmetric encryption in secure communication?

  1. Because asymmetric encryption is faster for large files and symmetric encryption is only for passwords
  2. Because asymmetric encryption is used to exchange or protect the symmetric key, which then encrypts the bulk data quickly Correct answer.
  3. Because symmetric keys never need to be kept secret once exchanged
  4. Because symmetric encryption cannot protect more than one file at a time

Explanation

Symmetric ciphers are fast but require both parties to share a secret key securely, while asymmetric ciphers solve key distribution but are slow for bulk data. Hybrid schemes use asymmetric cryptography to protect the symmetric session key and then encrypt the data symmetrically.

Question 12Introduction to Cyber Security and Cyber Threats

What does the principle of least privilege require?

  1. All permissions should be reviewed once every five years
  2. Users and programs should receive only the permissions needed for their assigned tasks Correct answer.
  3. Passwords should be at least eight characters long
  4. Every user should be given administrator rights to avoid delays

Explanation

Least privilege limits each account or process to the minimum access required to do its job, which shrinks the damage an attacker or a mistake can cause. It applies to people, services, and applications alike.

Question 13Introduction to Cyber Security and Cyber Threats

A website stores user input in its database without validating it, and an attacker submits a crafted input that causes the database to return all user records. Which vulnerability has been exploited?

  1. SQL injection Correct answer.
  2. Buffer overflow
  3. Session fixation
  4. Cross-site request forgery

Explanation

SQL injection occurs when untrusted input is concatenated into a database query so that the attacker can change the query's logic. Parameterised queries and input validation are the standard defences.

Question 14Introduction to Cyber Security and Cyber Threats

What is the primary role of a digital signature on a software update package?

  1. To compress the package so that it downloads faster
  2. To guarantee that the software contains no programming bugs
  3. To confirm the source of the package and detect any alteration of its contents Correct answer.
  4. To hide the package contents from network monitoring tools

Explanation

A digital signature uses the publisher's private key so that recipients can verify authenticity and integrity with the public key. If even one byte changes, verification fails.

Question 15Introduction to Cyber Security and Cyber Threats

Which of the following is the best example of a strong authentication factor based on 'something you are'?

  1. A hardware token that generates codes
  2. A PIN written on a card
  3. A memorised passphrase
  4. A fingerprint scanned by a sensor Correct answer.

Explanation

Authentication factors fall into categories: something you know, something you have, and something you are. A fingerprint is a biometric trait, so it belongs to the inherence category.

Question 16Introduction to Cyber Security and Cyber Threats

An organisation discovers that an employee's laptop was stolen. Which control most directly protects the data on the disk from being read by the thief?

  1. An intrusion detection system
  2. A host-based firewall
  3. Full-disk encryption Correct answer.
  4. A screen lock timeout

Explanation

Full-disk encryption renders the stored data unreadable without the decryption key, so removing the drive does not expose its contents. The other controls act on sessions or network traffic and do not protect data at rest.

Question 17Introduction to Cyber Security and Cyber Threats

Which sequence correctly orders the phases of a typical cyber attack from the attacker's perspective?

  1. Weaponisation, command and control, reconnaissance, exploitation
  2. Reconnaissance, exploitation, weaponisation, command and control
  3. Exploitation, reconnaissance, command and control, weaponisation
  4. Reconnaissance, weaponisation, exploitation, command and control Correct answer.

Explanation

Attackers first gather information about the target, then prepare a payload or tool, then exploit a weakness, and finally establish command and control for continued access. Reconnaissance must precede weaponisation because the tool is tailored to what was learned.

Question 18Introduction to Cyber Security and Cyber Threats

A company wants to reduce risk from unknown software vulnerabilities on its public website. Which practice contributes most directly?

  1. Allowing all outbound traffic without restriction
  2. Increasing the monitor's screen resolution
  3. Storing backups on the same server as the live site
  4. Applying security patches promptly and removing unused services Correct answer.

Explanation

Patching closes known vulnerabilities, and removing unused services shrinks the attack surface that an unknown flaw could affect. Together they reduce exposure to both known and undiscovered weaknesses.

Question 19Introduction to Cyber Security and Cyber Threats

What distinguishes a threat from a vulnerability in risk analysis?

  1. A threat is a potential cause of harm, while a vulnerability is a weakness that the threat could exploit Correct answer.
  2. A threat is a weakness in a system, while a vulnerability is a potential attacker
  3. A threat is a control that has failed, while a vulnerability is a control that works
  4. A threat is always internal, while a vulnerability is always external

Explanation

A threat is anything that could cause harm, such as an attacker, malware, or a flood, while a vulnerability is a weakness in a system that a threat can exploit. Risk arises when a threat can act on a vulnerability with some impact.

Question 20Introduction to Cyber Security and Cyber Threats

An attacker installs software that secretly records every keystroke and sends the log to a remote server. What is this software called?

  1. A boot sector virus
  2. A packet sniffer
  3. A rootkit
  4. A keylogger Correct answer.

Explanation

A keylogger captures keystrokes to steal credentials and other typed data, then exfiltrates the log. It targets input rather than network packets or boot code.

Question 21Introduction to Cyber Security and Cyber Threats

Why does salting passwords before hashing them improve storage security?

  1. It shortens the hash so that storage costs are reduced
  2. It makes each stored hash unique so precomputed rainbow tables cannot be reused across users Correct answer.
  3. It allows the original password to be recovered if the user forgets it
  4. It encrypts the password with a public key that only the server can decrypt

Explanation

A salt is a random value added to each password before hashing, so identical passwords produce different hashes and precomputed tables become useless. Salting also prevents an attacker from cracking many accounts with one computation.

Question 22Introduction to Cyber Security and Cyber Threats

A network switch has been configured so that each department's traffic is isolated, even though all departments share the same physical switch. Which concept does this illustrate?

  1. Redundancy
  2. Load balancing
  3. Network segmentation Correct answer.
  4. Defence in depth

Explanation

Segmentation divides a network into zones so that traffic cannot move freely between them, limiting lateral spread of an attack. VLANs on a shared switch are a common way to implement it.

Question 23Introduction to Cyber Security and Cyber Threats

An attacker intercepts traffic between a user and a public Wi-Fi access point, relaying messages to the real site while reading and modifying them. Which property of the connection is primarily defeated?

  1. Availability
  2. Confidentiality and integrity Correct answer.
  3. Non-repudiation only
  4. Integrity only

Explanation

A man-in-the-middle position lets the attacker read traffic, breaking confidentiality, and alter it before forwarding, breaking integrity. Properly implemented TLS with certificate validation is the usual defence.

Question 24Introduction to Cyber Security and Cyber Threats

A zero-day vulnerability is best described as which of the following?

  1. A flaw that affects only devices that are switched off
  2. A flaw that has existed for less than twenty-four hours
  3. A flaw for which no patch is yet available and which may be unknown to the vendor Correct answer.
  4. A flaw that is discovered by the vendor before any attacker finds it

Explanation

A zero-day is a vulnerability with no available fix at the time of exploitation, often because the vendor does not yet know about it. The name refers to zero days of defender warning, not to the age of the code.

Question 25Introduction to Cyber Security and Cyber Threats

An organisation receives a ransom demand after files on several servers are encrypted and a note is left demanding payment for the decryption key. Which term describes this attack, and which control best prepares the organisation to recover without paying?

  1. A logic bomb; a firewall rule
  2. Spyware; a stronger password policy
  3. Ransomware; tested offline backups Correct answer.
  4. Adware; a pop-up blocker

Explanation

Ransomware encrypts data and demands payment for the key, so recovery depends on restoring from backups that the attacker cannot reach. Backups must be kept offline or immutable and tested regularly to be reliable.

Question 26Introduction to Cyber Security and Cyber Threats

A student receives an email that appears to come from the school office, urging immediate payment of a fee through a link. The link opens a page that copies the school portal's layout but has a different address. Which term best describes this attempt to obtain the student's credentials?

  1. Smishing
  2. Spamming
  3. Pharming
  4. Phishing Correct answer.

Explanation

Phishing is a social-engineering attack in which a fraudulent message impersonates a trusted entity and pushes the recipient toward a fake page or disclosure of credentials. The key features here are the deceptive email, the sense of urgency, and the look-alike login page.

Question 27Introduction to Cyber Security and Cyber Threats

A cyber security team classifies a person who merely explores a system out of curiosity without damaging it, and another who breaks in to steal data. In threat terminology, which pairing correctly describes these two actors?

  1. The curious explorer is a white-hat hacker and the data thief is a black-hat hacker.
  2. Both are crackers because both gain access without permission.
  3. The curious explorer is a script kiddie and the data thief is a hacktivist.
  4. The curious explorer is a grey-hat hacker and the data thief is a black-hat hacker. Correct answer.

Explanation

A grey-hat hacker accesses systems without authorisation but without malicious intent and without permission from the owner, while a black-hat hacker acts with criminal intent such as theft. White hats act with authorisation, so intent alone does not make the explorer a white hat.

Question 28Introduction to Cyber Security and Cyber Threats

An employee plugs a personal USB drive found in the office car park into a workstation. The drive contains a file that, when opened, installs a hidden program giving an outsider remote control of the machine. Which category of malware does that hidden program represent, and why?

  1. A Trojan horse, because the drive itself was disguised as a harmless lost item.
  2. A rootkit, because it hides the attacker's presence by modifying the operating system kernel.
  3. A logic bomb, because it triggers only when a specific date or condition is reached.
  4. A backdoor, because it opens a persistent remote channel for the attacker while the machine appears normal. Correct answer.

Explanation

A backdoor is code that bypasses normal authentication and gives an attacker continued remote access to a compromised host. The described program grants an outsider remote control, which matches that definition. A Trojan may be the delivery disguise, but the persistent remote-access capability is the backdoor.

Question 29Introduction to Cyber Security and Cyber Threats

A hospital's patient database is encrypted by ransomware. The hospital has offline backups from the previous night. Which combination of controls most directly reduces the impact of this incident and the chance of recurrence?

  1. Disconnecting the server permanently and moving all records to paper files.
  2. Paying the ransom quickly and installing a free antivirus scanner afterwards.
  3. Restoring from the offline backup and then patching the entry vulnerability and segmenting the network. Correct answer.
  4. Changing all user passwords and informing patients about the breach.

Explanation

Impact is reduced by recovery from a clean, isolated backup, while recurrence is reduced by removing the exploited weakness and limiting lateral movement through segmentation. Together these address both the recovery and prevention sides of the risk. Password changes and notification matter, but they do not restore data or close the entry path.

Question 30Introduction to Cyber Security and Cyber Threats

A company's web application accepts a numeric order identifier in a URL. An attacker changes the value from 1001 to 1002 and views another customer's order. Which vulnerability class is being exploited, and which control best addresses it?

  1. Cross-site request forgery; add a per-session anti-CSRF token to forms.
  2. Cross-site scripting; encode all output rendered in the browser.
  3. Insecure direct object reference; enforce server-side authorisation checks on each requested object. Correct answer.
  4. SQL injection; use parameterised queries for every database call.

Explanation

Insecure direct object reference occurs when an application exposes an internal identifier and relies on the client to request only permitted records. The attacker simply alters the identifier, so the decisive fix is a server-side check that the authenticated user is authorised for that specific object. Parameterised queries and output encoding solve different problems.

Question 31Networking Fundamentals and Network Security

In the TCP/IP model, which layer is responsible for logical addressing and routing of packets between different networks?

  1. Application layer
  2. Internet layer Correct answer.
  3. Network access layer
  4. Transport layer

Explanation

The Internet layer of the TCP/IP model handles logical addressing through IP addresses and decides the path packets take between networks. Routing protocols operate at this layer to forward packets toward their destination network.

Question 32Networking Fundamentals and Network Security

A workstation is configured with the IPv4 address 192.168.10.45 and subnet mask 255.255.255.0. Which address is the directed broadcast address of this subnet?

  1. 192.168.10.255 Correct answer.
  2. 192.168.11.255
  3. 192.168.10.0
  4. 192.168.10.1

Explanation

With a /24 mask the host portion is the last octet, so the subnet spans 192.168.10.0 to 192.168.10.255. The all-ones host portion gives the broadcast address 192.168.10.255.

Question 33Networking Fundamentals and Network Security

Which port number is the default well-known port for HTTPS traffic?

  1. 443 Correct answer.
  2. 8080
  3. 80
  4. 21

Explanation

HTTPS uses TCP port 443 by default, wrapping HTTP inside a TLS session. Port 80 is plain HTTP, and port 21 is FTP control, so 443 is the standard secure web port.

Question 34Networking Fundamentals and Network Security

Which device forwards frames based on MAC addresses and keeps a table mapping MAC addresses to switch ports?

  1. Router
  2. Repeater
  3. Layer 2 switch Correct answer.
  4. Hub

Explanation

A Layer 2 switch learns source MAC addresses and forwards frames only out of the port associated with the destination MAC. Routers work with IP addresses, while hubs and repeaters simply regenerate signals to all ports.

Question 35Networking Fundamentals and Network Security

Which protocol automatically assigns IP addresses, subnet masks, default gateways, and DNS server addresses to hosts on a network?

  1. DHCP Correct answer.
  2. ARP
  3. DNS
  4. ICMP

Explanation

DHCP uses a lease process to hand out IP configuration parameters such as address, mask, gateway, and DNS servers. DNS resolves names, ARP maps IP to MAC, and ICMP carries diagnostic messages.

Question 36Networking Fundamentals and Network Security

Which statement correctly describes the difference between TCP and UDP at the transport layer?

  1. TCP is connectionless and unreliable, while UDP guarantees ordered delivery.
  2. TCP establishes a connection and provides reliable, ordered delivery, while UDP is connectionless with no delivery guarantee. Correct answer.
  3. Both TCP and UDP perform a three-way handshake before data transfer.
  4. UDP uses sequence numbers and acknowledgements to recover lost segments.

Explanation

TCP performs a handshake, uses sequence numbers and acknowledgements, and retransmits lost data to give reliable ordered delivery. UDP sends datagrams without a connection or delivery guarantee, which suits low-latency traffic.

Question 37Networking Fundamentals and Network Security

Which organisation type issues public TLS certificates that browsers trust by default through its root programme?

  1. A certificate authority Correct answer.
  2. An internet service provider
  3. A regional internet registry
  4. A domain name registrar

Explanation

A certificate authority signs public key certificates and its root is trusted by browsers, so a valid chain proves the server's identity. Registries allocate address blocks, ISPs carry traffic, and registrars manage domain names.

Question 38Networking Fundamentals and Network Security

An organisation uses the private address block 10.20.0.0/16. A subnet must support at least 500 usable host addresses. Which subnet mask should be chosen?

  1. 255.255.254.0 Correct answer.
  2. 255.255.255.0
  3. 255.255.252.0
  4. 255.255.248.0

Explanation

A /23 mask leaves 9 host bits, giving 512 addresses and 510 usable hosts, which meets the 500-host requirement. A /24 gives only 254 usable hosts, so it is too small.

Question 39Networking Fundamentals and Network Security

A host with IP 172.16.5.20 and mask 255.255.255.192 needs to send a packet to 172.16.5.130. What does the host do?

  1. It sends an ARP request for the gateway before comparing subnet addresses.
  2. It sends the packet directly to the destination because both addresses are in the same subnet.
  3. It sends the packet to its default gateway because the destination is on a different subnet. Correct answer.
  4. It discards the packet because the destination is a broadcast address.

Explanation

The /26 mask creates subnets of 64 addresses, so 172.16.5.20 lies in 172.16.5.0/26 and 172.16.5.130 lies in 172.16.5.128/26. Because the destination is on another subnet, the host forwards the packet to its default gateway.

Question 40Networking Fundamentals and Network Security

Which sequence correctly describes the TCP three-way handshake used to open a connection?

  1. SYN-ACK, SYN, ACK
  2. SYN, ACK, SYN-ACK
  3. SYN, SYN-ACK, ACK Correct answer.
  4. ACK, SYN, SYN-ACK

Explanation

The client sends SYN, the server replies with SYN-ACK acknowledging the client's sequence number and sending its own, and the client completes with ACK. This exchange synchronises sequence numbers before data flows.

Question 41Networking Fundamentals and Network Security

A firewall rule set permits inbound TCP port 443 to a web server but blocks all other inbound traffic. Which statement best describes the security effect?

  1. All inbound traffic is allowed because the web server is trusted.
  2. Only HTTPS connections to the server are permitted inbound, reducing the exposed attack surface. Correct answer.
  3. The rule blocks HTTPS and allows every other inbound service.
  4. Outbound traffic from the server is also blocked by the same rule.

Explanation

A default-deny policy with an explicit permit for TCP 443 exposes only the HTTPS service to inbound connections. Other inbound ports are dropped, which shrinks the attack surface of the server.

Question 42Networking Fundamentals and Network Security

Which attack involves an attacker intercepting and possibly altering traffic between two parties who believe they are communicating directly?

  1. Man-in-the-middle attack Correct answer.
  2. SQL injection attack
  3. Denial-of-service attack
  4. Brute-force attack

Explanation

In a man-in-the-middle attack the adversary positions itself between two endpoints, relaying or modifying traffic while each side believes it talks to the other. TLS with certificate validation is a primary defence against it.

Question 43Networking Fundamentals and Network Security

A user types a bank's web address but is redirected to a look-alike site with a valid certificate for a different domain. Which control most directly detects this deception?

  1. Using HTTP instead of HTTPS
  2. Checking that the certificate's subject matches the exact domain being visited Correct answer.
  3. Increasing the local firewall's outbound port range
  4. Disabling the browser's padlock indicator

Explanation

A valid certificate only proves control of the name it was issued for, so the subject must match the domain in the address bar. A certificate issued for a look-alike domain will not match the intended bank name, revealing the deception.

Question 44Networking Fundamentals and Network Security

Which protocol resolves a known IPv4 address to a MAC address on a local Ethernet segment?

  1. DNS
  2. ARP Correct answer.
  3. NTP
  4. RARP

Explanation

ARP broadcasts a request asking which device owns a given IP address, and the owner replies with its MAC address. This mapping is needed to build the Ethernet frame for local delivery.

Question 45Networking Fundamentals and Network Security

An administrator wants to segment a LAN into separate broadcast domains without changing the physical cabling. Which approach achieves this?

  1. Configuring VLANs on the switch Correct answer.
  2. Adding more repeaters to each segment
  3. Increasing the DHCP lease time
  4. Replacing the switch with a hub

Explanation

VLANs logically partition a switch into separate Layer 2 broadcast domains while sharing the same physical hardware. Traffic between VLANs must then pass through a router or Layer 3 switch.

Question 46Networking Fundamentals and Network Security

Which record type in DNS maps a hostname to an IPv6 address?

  1. AAAA Correct answer.
  2. A
  3. CNAME
  4. MX

Explanation

An AAAA record stores a 128-bit IPv6 address for a hostname, while an A record stores a 32-bit IPv4 address. MX records name mail servers and CNAME records alias one name to another.

Question 47Networking Fundamentals and Network Security

A network administrator notices a sudden flood of SYN packets from many spoofed source addresses to a web server, leaving many half-open connections. Which attack is this?

  1. SYN flood attack Correct answer.
  2. ARP spoofing
  3. Password spraying
  4. Cross-site scripting

Explanation

A SYN flood exhausts the server's connection table by sending many SYNs without completing the handshake, often with spoofed sources. Defences include SYN cookies and rate limiting at the firewall.

Question 48Networking Fundamentals and Network Security

Which mechanism allows a remote employee to send private traffic over the public internet by creating an encrypted tunnel to the corporate network?

  1. A proxy cache
  2. A virtual private network Correct answer.
  3. A load balancer
  4. A network address translation pool

Explanation

A VPN encrypts traffic between the client and a VPN gateway, creating a tunnel that protects data as it crosses untrusted networks. The employee's traffic then appears to originate inside the corporate network.

Question 49Networking Fundamentals and Network Security

Which statement best explains why WPA2 with AES-CCMP is preferred over WEP on a wireless network?

  1. WEP encrypts traffic but its weak key scheduling and short IVs allow keys to be recovered, while WPA2 uses stronger encryption with per-session keys. Correct answer.
  2. WEP requires a certificate authority, while WPA2 uses only preshared keys.
  3. WPA2 sends all traffic unencrypted, which simplifies troubleshooting.
  4. WEP uses stronger encryption but is slower, so WPA2 is chosen only for performance.

Explanation

WEP's flawed RC4 implementation and 24-bit IVs let attackers recover keys from captured traffic in minutes. WPA2 with AES-CCMP derives fresh session keys and uses a robust cipher, so it resists those attacks.

Question 50Networking Fundamentals and Network Security

A packet capture shows an internal host repeatedly connecting to an external IP on TCP port 4444 at regular intervals with small encrypted payloads. Which interpretation is most consistent with a compromised host?

  1. The host is receiving an inbound HTTPS request from a client.
  2. The host is performing routine DNS lookups.
  3. The host is synchronising its clock with a time server.
  4. The host is beaconing to a command-and-control server, indicating possible malware. Correct answer.

Explanation

Periodic outbound connections to an unusual high port with small payloads match the beaconing pattern of malware contacting a command-and-control server. DNS uses port 53 and NTP uses UDP 123, so neither fits the observed traffic.