I85PREP
⌘ K
LPI Security Essentials study materials
LPI Security Essentials study resources

LPI Security Essentials practice questions

One question at a time. Build your LPI Security Essentials understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Concepts

In the CIA triad, which property ensures that data has not been altered by an unauthorized party?

  1. Availability
  2. Integrity Correct answer.
  3. Non-repudiation
  4. Confidentiality

Explanation

Integrity means data remains accurate and complete and has not been modified without authorization. Confidentiality concerns keeping data hidden from unauthorized readers, and availability concerns timely access to resources.

Question 2Security Concepts

A phishing email asks a user to confirm a password by replying to the message. Which security principle is the attacker mainly trying to violate?

  1. Availability
  2. Confidentiality Correct answer.
  3. Integrity
  4. Redundancy

Explanation

The attacker wants the user to reveal a secret credential, which is a breach of confidentiality. Integrity and availability are not the primary target of a credential-harvesting message.

Question 3Security Concepts

Which authentication factor category does a hardware token that generates one-time codes belong to?

  1. Something you are
  2. Something you know
  3. Somewhere you are
  4. Something you have Correct answer.

Explanation

A hardware token is a physical object the user possesses, so it is a possession factor. Knowledge factors are memorized secrets, and inherence factors are biometric traits.

Question 4Security Concepts

What is the main security benefit of hashing passwords before storing them?

  1. It encrypts network traffic between client and server
  2. It guarantees the password meets complexity rules
  3. It allows administrators to recover forgotten passwords
  4. It makes the stored value impractical to reverse into the original password Correct answer.

Explanation

A cryptographic hash is one-way, so a stolen database does not directly reveal the plaintext passwords. Hashing does not protect data in transit and cannot restore forgotten passwords.

Question 5Security Concepts

Which practice best reduces the impact of a stolen password on other services?

  1. Storing all passwords in a shared spreadsheet
  2. Using a distinct password for each account Correct answer.
  3. Reusing one strong password everywhere
  4. Changing the password only once a year

Explanation

Unique credentials per account prevent a breach at one service from granting access to others. Reuse and shared storage spread the damage of a single compromise.

Question 6Security Concepts

What does the principle of least privilege require?

  1. Giving administrators full access to simplify troubleshooting
  2. Rotating all passwords every thirty days
  3. Granting each user only the access needed for their duties Correct answer.
  4. Encrypting every file on every workstation

Explanation

Least privilege limits rights to the minimum necessary to perform a job, reducing the damage from mistakes or compromise. Broad administrative access and unrelated controls do not satisfy this principle.

Question 7Security Concepts

Which type of malware typically encrypts a victim's files and demands payment for the decryption key?

  1. Rootkit
  2. Adware
  3. Ransomware Correct answer.
  4. Worm

Explanation

Ransomware encrypts data and demands payment to restore access. Rootkits hide attacker presence, worms self-propagate across networks, and adware displays unwanted advertising.

Question 8Security Concepts

Why should an organization keep tested offline backups?

  1. To eliminate the need for user authentication
  2. To restore data after ransomware or destructive attacks Correct answer.
  3. To speed up the network during peak hours
  4. To replace the need for antivirus software

Explanation

Offline backups that have been tested allow recovery when live systems are encrypted or destroyed. They complement, rather than replace, endpoint protection and access controls.

Question 9Security Concepts

A user receives a call from someone claiming to be IT support who asks for the user's password to fix an account issue. What is the best response?

  1. Refuse and verify the request through an official channel Correct answer.
  2. Provide the password since the caller claims to be internal IT
  3. Share a temporary password and change it later
  4. Email the password to the caller's address

Explanation

Legitimate support staff do not need a user's password, and requests should be verified independently through a known official channel. Sharing the secret in any form, even temporarily, exposes the account.

Question 10Security Concepts

Which control is an example of defense in depth?

  1. Relying solely on a perimeter firewall
  2. Disabling logging to reduce storage costs
  3. Combining endpoint protection, network filtering, and user training Correct answer.
  4. Using one shared administrator account

Explanation

Defense in depth layers independent controls so that failure of one does not expose the whole system. Single controls, reduced visibility, and shared accounts weaken overall protection.

Question 11Security Concepts

What is the primary purpose of multi-factor authentication?

  1. To log every keystroke on a workstation
  2. To replace passwords with longer passphrases
  3. To require two or more independent evidence types before access Correct answer.
  4. To encrypt stored files automatically

Explanation

MFA combines factors from different categories so a single stolen secret is insufficient for access. It does not encrypt data or monitor keystrokes.

Question 12Security Concepts

Which statement correctly distinguishes symmetric from asymmetric encryption?

  1. Symmetric is always slower than asymmetric for bulk data
  2. Symmetric uses a key pair, while asymmetric uses one shared key
  3. Asymmetric encryption cannot be used for digital signatures
  4. Symmetric uses the same key for encryption and decryption, while asymmetric uses a key pair Correct answer.

Explanation

Symmetric algorithms use one shared secret key, whereas asymmetric algorithms use a public and private key pair. Symmetric ciphers are generally faster and are used for bulk data.

Question 13Security Concepts

A web browser shows a valid HTTPS padlock. What does this confirm?

  1. The site's owner has been audited for privacy compliance
  2. The site's identity has been verified by a certificate authority and traffic is encrypted Correct answer.
  3. The site is free of malware and phishing content
  4. The content served is legally authorized in every country

Explanation

HTTPS with a valid certificate confirms the server's identity was vouched for by a trusted authority and that the channel is encrypted. It says nothing about the site's intentions, content safety, or legal status.

Question 14Security Concepts

Which action best protects a laptop against data theft if the device is lost?

  1. Full-disk encryption with a strong pre-boot credential Correct answer.
  2. A sticker with the owner's contact details
  3. A screen saver that activates after ten minutes
  4. Disabling the firewall while traveling

Explanation

Full-disk encryption makes the stored data unreadable without the credential, even if the drive is removed. Screen savers, labels, and disabled firewalls do not protect data at rest.

Question 15Security Concepts

An attacker sends emails that appear to come from a company's CEO to finance staff requesting an urgent wire transfer. Which attack is this?

  1. Cross-site scripting
  2. SQL injection
  3. Denial of service
  4. Business email compromise Correct answer.

Explanation

Business email compromise impersonates executives or trusted partners to trick staff into transferring funds or data. The other options are network or application attacks unrelated to impersonation fraud.

Question 16Security Concepts

What is the role of a salt when hashing passwords?

  1. It guarantees the password cannot be guessed
  2. It shortens the hash to save storage space
  3. It encrypts the hash with a server-wide secret key
  4. It adds unique random data so identical passwords produce different hashes Correct answer.

Explanation

A unique salt per password ensures that equal passwords yield different hash values, defeating precomputed rainbow tables. It does not encrypt the hash or guarantee resistance to guessing.

Question 17Security Concepts

Which practice most directly reduces the risk from a compromised user account?

  1. Disabling audit logging for that account
  2. Sharing the account credentials with the team
  3. Allowing the account to log in from any network without restriction
  4. Granting the account only the permissions its role requires Correct answer.

Explanation

Role-based minimal permissions limit what an attacker can do with a hijacked account. Unrestricted access, disabled logging, and shared credentials all increase the blast radius.

Question 18Security Concepts

Why is patching software a core security activity?

  1. Updates remove known vulnerabilities that attackers can exploit Correct answer.
  2. Updates permanently eliminate the need for firewalls
  3. Updates encrypt all data stored by the application
  4. Updates guarantee the software contains no bugs

Explanation

Patches close publicly known flaws that attackers routinely exploit. They do not replace network controls, encrypt data, or guarantee bug-free software.

Question 19Security Concepts

A user finds a USB drive in a parking lot and plugs it into a corporate workstation. Which risk is most directly introduced?

  1. Malware execution from untrusted removable media Correct answer.
  2. Brute-force guessing of the user's password
  3. Loss of availability due to a power failure
  4. Eavesdropping on encrypted Wi-Fi traffic

Explanation

Unknown removable media can carry malware that executes when connected, a common baiting technique. Power failures, Wi-Fi eavesdropping, and password guessing are unrelated to plugging in the drive.

Question 20Security Concepts

Which statement about a firewall is accurate?

  1. It filters traffic based on configured rules between network zones Correct answer.
  2. It verifies the identity of every user with biometrics
  3. It removes malware from files downloaded by users
  4. It encrypts files stored on user workstations

Explanation

A firewall enforces rules that permit or deny traffic between zones. It does not scan files for malware, encrypt local storage, or perform biometric authentication.

Question 21Security Concepts

An organization wants to detect unauthorized changes to critical system files. Which control best fits?

  1. File integrity monitoring that compares hashes against a baseline Correct answer.
  2. A network diagram update
  3. A quarterly phishing awareness email
  4. A password complexity policy

Explanation

File integrity monitoring detects modification by comparing current hashes with a trusted baseline. Password policy, awareness mailings, and documentation do not detect file tampering.

Question 22Security Concepts

A company must dispose of hard drives that held confidential data. Which approach best protects confidentiality?

  1. Quick formatting of each drive
  2. Moving the drives to a storage room
  3. Cryptographic erasure or physical destruction verified by a certificate of destruction Correct answer.
  4. Deleting the files through the operating system

Explanation

Cryptographic erasure destroys the keys protecting the data, and physical destruction removes the media entirely; both can be documented. Formatting and file deletion leave recoverable remnants.

Question 23Security Concepts

An administrator receives an alert that a service account attempted thousands of logins in one minute from a single address. Which conclusion is most justified?

  1. The correct response is to disable all audit logging to reduce noise
  2. A credential-guessing attack may be underway and the account should be locked or throttled Correct answer.
  3. The alert is a false positive because service accounts cannot be attacked
  4. The account is definitely compromised and data has been exfiltrated

Explanation

A burst of failed logins from one source is consistent with brute-force or password-spraying activity, so throttling or lockout is a proportionate first step. Exfiltration is not proven, and disabling logging would destroy evidence.

Question 24Security Concepts

Which design choice best mitigates a successful SQL injection against a login form?

  1. Storing passwords in plaintext for faster comparison
  2. Using parameterized queries and validating input Correct answer.
  3. Displaying detailed database errors to users
  4. Relying on client-side JavaScript validation only

Explanation

Parameterized queries separate code from data so injected input cannot alter the query structure, and server-side validation adds defense. Client-only checks and verbose errors increase exposure.

Question 25Security Concepts

A security team wants to limit the damage if an attacker gains a foothold on the internal network. Which strategy is most effective?

  1. Disabling host-based firewalls to simplify management
  2. Segmenting the network and enforcing least privilege between zones Correct answer.
  3. Using one administrator credential across all systems
  4. Flattening the network so all hosts can reach each other

Explanation

Segmentation and least privilege restrict lateral movement, so a single compromised host cannot reach every system. Flat networks, shared credentials, and disabled host firewalls accelerate spread.

Question 26Security Concepts

In the CIA triad, which security objective is violated when an unauthorized person reads a confidential report?

  1. Confidentiality Correct answer.
  2. Availability
  3. Integrity
  4. Non-repudiation

Explanation

Confidentiality ensures information is not disclosed to unauthorized individuals. Reading a confidential report without authorization is a direct breach of confidentiality. Integrity concerns unauthorized modification, and availability concerns timely access.

Question 27Security Concepts

Which term describes a weakness in software or configuration that could be exploited by a threat?

  1. Vulnerability Correct answer.
  2. Risk
  3. Exploit
  4. Threat

Explanation

A vulnerability is a flaw or weakness in a system that can be exploited. Risk is the potential for loss when a threat exploits a vulnerability. An exploit is the actual code or technique used to take advantage of the weakness.

Question 28Security Concepts

Which authentication factor category is represented by a fingerprint scan?

  1. Something you know
  2. Something you are Correct answer.
  3. Somewhere you are
  4. Something you have

Explanation

Authentication factors fall into categories such as knowledge, possession, and inherence. A fingerprint is a biometric trait, which is an inherence factor, often described as 'something you are'. Passwords are knowledge factors, and tokens are possession factors.

Question 29Security Concepts

What is the main security purpose of encrypting data at rest on a server?

  1. To ensure data remains available during a disk failure
  2. To prevent unauthorized reading if the storage media is accessed Correct answer.
  3. To verify the identity of users connecting to the server
  4. To speed up disk read and write operations

Explanation

Encryption at rest protects stored data from being read if the physical media or backups are stolen or improperly accessed. It does not provide availability during failures, nor does it authenticate users. Performance is typically reduced, not improved.

Question 30Security Concepts

A security policy states that access should be granted based on the user's job role rather than on individual discretion. Which access control model does this describe?

  1. Mandatory access control (MAC)
  2. Discretionary access control (DAC)
  3. Role-based access control (RBAC) Correct answer.
  4. Rule-based access control

Explanation

Role-based access control assigns permissions to roles and then assigns users to roles, so access follows job responsibilities. DAC lets resource owners set permissions at their discretion, while MAC uses system-wide labels and clearances. Rule-based access control applies global rules such as time-of-day restrictions.

Question 31Security Concepts

Which statement best describes the difference between a virus and a worm?

  1. A virus spreads without user action, while a worm requires a host file.
  2. A virus is always harmless, while a worm is always destructive.
  3. A worm self-propagates across networks, while a virus typically needs a host file and user action to spread. Correct answer.
  4. A worm only affects mobile devices, while a virus only affects servers.

Explanation

A worm is standalone malware that replicates itself across networks without needing a host program or user interaction. A virus attaches to a host file or program and usually requires the user to execute the infected file to spread. Both can be harmful and are not limited to particular device types.

Question 32Security Concepts

An organization wants to verify that a downloaded software package has not been altered since it was published. Which mechanism should be used?

  1. Checking the file's digital signature against the publisher's public key Correct answer.
  2. Compressing the package before installation
  3. Scanning the package with antivirus software
  4. Comparing the file size with the vendor's website

Explanation

A digital signature created with the publisher's private key can be verified with the corresponding public key. If verification succeeds and the key is trusted, it confirms the package's integrity and origin. Antivirus scanning and file size checks do not prove the file is unmodified.

Question 33Security Concepts

Which practice best reduces the risk of session hijacking on a web application?

  1. Setting the Secure and HttpOnly flags on session cookies Correct answer.
  2. Using longer session timeout values
  3. Storing session identifiers in URLs
  4. Allowing session identifiers to remain valid after logout

Explanation

The Secure flag prevents cookies from being sent over unencrypted HTTP, and HttpOnly prevents JavaScript from reading them, reducing theft via cross-site scripting. Session identifiers in URLs can leak through logs and referrers. Longer timeouts and persistent identifiers after logout increase exposure.

Question 34Security Concepts

What is the primary purpose of a DMZ in a network architecture?

  1. To encrypt all traffic between internal hosts
  2. To provide a high-speed link between internal departments
  3. To isolate internet-facing services from the internal network Correct answer.
  4. To replace the need for a firewall

Explanation

A DMZ is a segmented network that hosts public-facing services, limiting direct access to the internal network if those services are compromised. It does not encrypt internal traffic or eliminate firewalls; rather, it relies on firewall rules between zones.

Question 35Security Concepts

A user receives an email with a link to a login page that looks identical to the company's portal. The URL is https://company-portal.example.net instead of the legitimate https://portal.example.com. Which attack is most likely being attempted?

  1. Privilege escalation
  2. SQL injection
  3. Denial of service
  4. Phishing Correct answer.

Explanation

The email uses a look-alike domain to trick the user into entering credentials on a fraudulent site, which is a phishing attack. Denial of service targets availability, privilege escalation gains higher permissions, and SQL injection targets database queries.

Question 36Security Concepts

Which statement about hashing is correct?

  1. Hashing is reversible with the correct key.
  2. A good hash function produces the same output for any input.
  3. Hashing provides confidentiality by encrypting the input.
  4. Hashing produces a fixed-length output that changes significantly if the input changes. Correct answer.

Explanation

A cryptographic hash function maps any input to a fixed-length digest, and a small change in input should produce a very different output due to the avalanche effect. Hashing is one-way, not reversible, and it does not encrypt data for confidentiality.

Question 37Security Concepts

Which security control is an example of a preventive control?

  1. Sending an alert when unusual traffic is detected
  2. Installing a lock on a server room door Correct answer.
  3. Restoring data from backup after a failure
  4. Reviewing audit logs after an incident

Explanation

Preventive controls stop an incident from occurring, such as a physical lock that blocks unauthorized entry. Log review and alerting are detective controls, and restoring from backup is a corrective control.

Question 38Security Concepts

A company wants to reduce the risk of employees reusing the same password across work and personal accounts. Which measure most directly addresses this?

  1. Displaying a warning banner at login
  2. Deploying a password manager and banning reuse of known compromised passwords Correct answer.
  3. Requiring password changes every 30 days
  4. Enforcing a minimum password length of eight characters

Explanation

A password manager encourages unique passwords per site, and blocking known compromised passwords prevents reuse of credentials exposed in breaches. Frequent forced changes and short minimum lengths do not address reuse across sites. A warning banner has little effect on password behavior.

Question 39Security Concepts

An attacker obtains a dump of a password database and finds that each stored value is the hash of the password concatenated with a unique random value. What is the main benefit of this design?

  1. It makes each hash unique so precomputed rainbow tables cannot be reused across users. Correct answer.
  2. It encrypts the password so administrators can recover it.
  3. It allows the same hash to be used for all users to save space.
  4. It guarantees that weak passwords cannot be cracked.

Explanation

The unique random value is a salt, which ensures identical passwords produce different hashes. This defeats precomputed rainbow tables and prevents attackers from cracking many accounts with one computation. Salting does not make weak passwords uncrackable and is not encryption.

Question 40Security Concepts

A security team is designing a system where a compromised web server must not be able to read the database directly. Which combination best supports this goal?

  1. Storing database credentials in the web application source code
  2. Segmenting the network and granting the web server only the specific database operations it needs Correct answer.
  3. Placing the web server and database on the same host with full local access
  4. Using a reverse proxy that forwards all traffic without filtering

Explanation

Network segmentation limits reachability, and least-privilege database accounts restrict what a compromised web server can do even if it reaches the database. Co-locating services and embedding credentials increase the blast radius. A reverse proxy without filtering does not enforce database access control.

Question 41Encryption

Which property of a cryptographic hash function ensures that finding two different inputs producing the same digest is computationally infeasible?

  1. Collision resistance Correct answer.
  2. Preimage resistance
  3. Avalanche effect
  4. Key stretching

Explanation

Collision resistance is the specific property that makes it impractical to find any two distinct inputs with an identical hash output. Preimage resistance concerns reversing a single digest, and the avalanche effect describes output sensitivity to input changes.

Question 42Encryption

Which algorithm is a symmetric block cipher that encrypts data in 128-bit blocks and supports key sizes of 128, 192, or 256 bits?

  1. AES Correct answer.
  2. SHA-256
  3. Diffie-Hellman
  4. RSA

Explanation

AES is the standard symmetric block cipher operating on 128-bit blocks with selectable key lengths of 128, 192, or 256 bits. RSA and Diffie-Hellman are asymmetric schemes, and SHA-256 is a hash function rather than a cipher.

Question 43Encryption

In public-key cryptography, which key is used by a sender to encrypt a message intended only for a specific recipient?

  1. A shared symmetric session key
  2. The recipient's private key
  3. The sender's private key
  4. The recipient's public key Correct answer.

Explanation

Encrypting with the recipient's public key ensures that only the matching private key, held by the recipient, can decrypt the message. The sender's keys do not grant the recipient confidentiality in this scheme.

Question 44Encryption

What is the primary purpose of a digital signature on an electronic document?

  1. To encrypt the document so only the signer can read it
  2. To generate a random session key for the document
  3. To prove the signer's identity and detect any alteration of the content Correct answer.
  4. To compress the document for efficient storage

Explanation

A digital signature binds the signer's private key to the document, providing authenticity and integrity so any modification is detectable. It does not provide confidentiality of the content itself.

Question 45Encryption

Which statement best describes symmetric encryption?

  1. A public key encrypts and a private key decrypts
  2. It relies on a different key pair for every message block
  3. The same secret key is used for both encryption and decryption Correct answer.
  4. It cannot be combined with hash functions

Explanation

Symmetric encryption uses one shared secret key for both encryption and decryption, making key distribution the main challenge. Asymmetric schemes use separate public and private keys instead.

Question 46Encryption

A website is served over HTTPS. Which combination of cryptographic mechanisms does TLS primarily use to protect the connection?

  1. Asymmetric cryptography for key exchange and symmetric cryptography for bulk data Correct answer.
  2. Digital signatures for every packet and no session key
  3. Only a hash function to obscure the URL
  4. Symmetric cryptography for authentication and hashing for key exchange

Explanation

TLS uses asymmetric techniques during the handshake to authenticate the server and agree on a session key, then switches to symmetric encryption for efficient bulk data protection. Hashing supports integrity checks within the protocol.

Question 47Encryption

What does a certificate authority (CA) do when it issues a digital certificate?

  1. It encrypts the subscriber's website traffic on their behalf
  2. It generates the subscriber's private key and keeps a copy
  3. It revokes all other certificates in the same domain
  4. It binds a public key to an identity and signs the certificate with its own key Correct answer.

Explanation

A CA validates identity and issues a certificate that binds a public key to that identity, signing it so relying parties can verify authenticity. The subscriber normally retains sole control of the private key.

Question 48Encryption

Why should passwords be stored as salted hashes rather than as plaintext or unsalted hashes?

  1. Salting prevents identical passwords from producing identical stored hashes and defeats precomputed tables Correct answer.
  2. Salting guarantees the password cannot be guessed online
  3. Salting encrypts the password with the user's public key
  4. Salting makes the hash reversible for password recovery

Explanation

A unique salt per password ensures identical passwords yield different stored values and renders precomputed rainbow tables ineffective. Salting does not make hashes reversible nor stop online guessing entirely.

Question 49Encryption

A company wants to verify that a large file downloaded from a mirror has not been corrupted in transit. Which mechanism is the most appropriate?

  1. Encrypting the file with the mirror's public key
  2. Signing the file with the downloader's private key
  3. Comparing a published cryptographic hash of the file with a locally computed hash Correct answer.
  4. Compressing the file with a different algorithm

Explanation

Comparing a trusted published hash against a locally computed hash detects any change to the file contents. Encryption or compression alone does not give the downloader an integrity check against a reference value.

Question 50Encryption

Which mode of operation turns a block cipher into a stream-like construction where each ciphertext block is XORed with the previous ciphertext block before encryption?

  1. Counter (CTR)
  2. Output Feedback (OFB)
  3. Electronic Codebook (ECB)
  4. Cipher Block Chaining (CBC) Correct answer.

Explanation

In CBC mode, each plaintext block is XORed with the preceding ciphertext block before encryption, chaining blocks together. ECB encrypts blocks independently, while OFB and CTR generate keystreams.