I85PREP
⌘ K
TS-C study materials
TS-C study resources

TS-C (NCCT) practice questions

One question at a time. Build your TS-C understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Foundational Concepts and Terminology

Which security property ensures that data has not been altered by an unauthorised party?

  1. Confidentiality
  2. Availability
  3. Non-repudiation
  4. Integrity Correct answer.

Explanation

Integrity means data is accurate, complete and has not been changed without authorisation. Confidentiality addresses unauthorised disclosure and availability addresses timely access.

Question 2Foundational Concepts and Terminology

In security terminology, what is a vulnerability?

  1. A weakness that can be exploited Correct answer.
  2. The measured likelihood of loss
  3. A threat actor's motive for attacking
  4. A control that reduces risk

Explanation

A vulnerability is a weakness in an asset, process or control that a threat could exploit. Risk combines that weakness with the likelihood of exploitation and the resulting impact.

Question 3Foundational Concepts and Terminology

A memorised password belongs to which authentication factor category?

  1. Something you are
  2. Somewhere you are
  3. Something you know Correct answer.
  4. Something you have

Explanation

Authentication factors are grouped as something you know, something you have, something you are and, in some models, somewhere you are. A memorised password is knowledge held by the user.

Question 4Foundational Concepts and Terminology

Which security objective does encryption of stored data primarily serve?

  1. Authenticity
  2. Confidentiality Correct answer.
  3. Integrity
  4. Availability

Explanation

Encryption converts readable plaintext into ciphertext so that only holders of the key can recover the content, which protects confidentiality.

Question 5Foundational Concepts and Terminology

A helpdesk operator is given only the permissions needed to reset passwords and nothing else. Which principle does this illustrate?

  1. Defence in depth
  2. Least privilege Correct answer.
  3. Separation of duties
  4. Mandatory access control

Explanation

Least privilege means granting each identity only the access required for its current duties. Extra permissions increase the impact of a mistake or compromise.

Question 6Foundational Concepts and Terminology

Which property distinguishes a cryptographic hash function from encryption?

  1. It always produces output shorter than the input
  2. It cannot be reversed to recover the input Correct answer.
  3. It requires a public and private key pair
  4. It uses a shared secret key

Explanation

A hash is a one-way function: it maps any input to a fixed-length digest and cannot practically be inverted, while encryption is reversible with the correct key.

Question 7Foundational Concepts and Terminology

Combining firewalls, endpoint protection and staff awareness training to protect an organisation is an example of which concept?

  1. Layered defence Correct answer.
  2. Least privilege
  3. Risk transference
  4. Single point of failure

Explanation

Layered defence, also called defence in depth, uses independent controls at several levels so that the failure of one control does not lead to compromise.

Question 8Foundational Concepts and Terminology

Which type of malware spreads across networks by itself without requiring a user to open a file?

  1. Trojan
  2. Worm Correct answer.
  3. Logic bomb
  4. Rootkit

Explanation

A worm self-propagates by exploiting network services and needs no user interaction. Viruses require a host file and normally a user action to spread.

Question 9Foundational Concepts and Terminology

Which statement best defines risk in an information security context?

  1. The set of controls applied to protect an asset
  2. The complete list of vulnerabilities found in an asset
  3. The number of audit findings raised against a process
  4. The likelihood of a threat exploiting a vulnerability, combined with the impact Correct answer.

Explanation

Risk expresses how likely a threat is to exploit a given weakness and how severe the resulting loss would be. Controls are then selected to reduce that risk to an acceptable level.

Question 10Foundational Concepts and Terminology

An assessor ranks identified risks as high, medium or low using expert judgement and no monetary values. Which type of analysis is being performed?

  1. Quantitative
  2. Qualitative Correct answer.
  3. Deterministic
  4. Probabilistic

Explanation

Qualitative risk analysis expresses risk in relative categories such as high, medium and low based on judgement and experience. Quantitative analysis assigns numeric values such as monetary loss.

Question 11Foundational Concepts and Terminology

Checking whether a signed-in user is allowed to delete a particular record is an example of which process?

  1. Accounting
  2. Identification
  3. Authentication
  4. Authorisation Correct answer.

Explanation

Authentication establishes who the user is, while authorisation determines what that verified identity may do with a resource.

Question 12Foundational Concepts and Terminology

What problem does asymmetric cryptography mainly solve when compared with symmetric cryptography?

  1. It is faster for bulk data
  2. It enables secure key exchange Correct answer.
  3. It removes the need for hashing
  4. It removes the need for key management

Explanation

Asymmetric algorithms allow two parties to agree on a symmetric key over an untrusted channel without sharing a secret beforehand, addressing the key distribution problem.

Question 13Foundational Concepts and Terminology

Signing a message with the sender's private key primarily provides which assurance to the recipient?

  1. Availability of the receiver
  2. Compression of the message
  3. Confidentiality of the message body
  4. Proof of origin and integrity Correct answer.

Explanation

A signature verified with the sender's public key proves the message came from the holder of the private key and that it was not altered, which also supports non-repudiation.

Question 14Foundational Concepts and Terminology

In which access control model does the system decide access using labels such as 'secret' and the user's clearance, without the user being able to change permissions?

  1. Discretionary access control
  2. Mandatory access control Correct answer.
  3. Role-based access control
  4. Attribute-based access control

Explanation

Mandatory access control enforces decisions centrally through security labels and clearances, so resource owners cannot grant access at their discretion.

Question 15Foundational Concepts and Terminology

Which pair of authenticators combines two genuinely different authentication factors?

  1. Password and PIN
  2. Two different passwords
  3. Fingerprint and one-time code Correct answer.
  4. Security question and PIN

Explanation

Multi-factor authentication requires factors from different categories. A fingerprint is a biometric trait and a one-time code from a token or app is a possession factor.

Question 16Foundational Concepts and Terminology

A device placed inline in the traffic path that analyses packets and drops malicious traffic is best described as which system?

  1. Honeypot
  2. Intrusion detection system
  3. Caching proxy
  4. Intrusion prevention system Correct answer.

Explanation

An intrusion prevention system inspects traffic in line and can block or drop traffic it judges malicious. An intrusion detection system only detects and alerts.

Question 17Foundational Concepts and Terminology

What is the term for code or a technique that takes advantage of a software flaw?

  1. An exploit Correct answer.
  2. A control
  3. A threat agent
  4. A vulnerability

Explanation

An exploit abuses a vulnerability to make a system behave in an unintended way. The vulnerability itself is only the underlying weakness.

Question 18Foundational Concepts and Terminology

Which metric defines the maximum acceptable amount of data loss, expressed as a period of time?

  1. Recovery point objective Correct answer.
  2. Recovery time objective
  3. Service level objective
  4. Maximum tolerable downtime

Explanation

The recovery point objective states how far back data may be lost, which drives backup frequency. The recovery time objective states how quickly the service must be restored.

Question 19Foundational Concepts and Terminology

In the incident response lifecycle, which activity follows detection and analysis?

  1. Lessons learned
  2. Containment Correct answer.
  3. Preparation
  4. Eradication

Explanation

Once an incident is detected and analysed, responders contain it to limit spread before removing the cause and recovering normal operations.

Question 20Foundational Concepts and Terminology

Which document states management's high-level intent and mandatory direction for information security?

  1. Policy Correct answer.
  2. Guideline
  3. Standard
  4. Procedure

Explanation

A policy sets out management's expectations and mandatory principles at a high level. Standards, procedures and guidelines then add increasing levels of detail.

Question 21Foundational Concepts and Terminology

Kerckhoffs's principle states that a cryptographic system should remain secure when which condition holds?

  1. A new algorithm is used for every message
  2. Only a small number of users know the algorithm
  3. Everything except the key may be public Correct answer.
  4. The key is published together with the algorithm

Explanation

Kerckhoffs's principle requires the security of a system to rest solely on the secrecy of the key, so the algorithm may be published and reviewed openly.

Question 22Foundational Concepts and Terminology

Adding a unique random value to each password before hashing primarily defends against which attack?

  1. Guessing a single user's password online
  2. Interception of credentials in transit
  3. Precomputed tables and rainbow tables Correct answer.
  4. Replay of a captured session token

Explanation

A unique salt per password means identical passwords hash differently and precomputed lookup tables become useless, forcing attackers to attack each entry separately.

Question 23Foundational Concepts and Terminology

Removing unnecessary network services from an internet-facing server directly reduces which of the following?

  1. The likelihood of insider fraud
  2. The recovery time objective of the service
  3. The impact of a phishing campaign
  4. The attack surface of the server Correct answer.

Explanation

Each exposed service is a potential entry point, so disabling unneeded ones shrinks the attack surface available to an adversary.

Question 24Foundational Concepts and Terminology

Requiring two administrators to approve a large payment before it is released is an example of which control technique?

  1. Dual control Correct answer.
  2. Job rotation
  3. Least privilege
  4. Defence in depth

Explanation

Dual control, also called two-person rule, requires two people to act together to complete a sensitive transaction. Separation of duties divides a process between different roles.

Question 25Foundational Concepts and Terminology

Why do digital signature schemes normally sign a hash of the message rather than the message itself?

  1. It is computationally cheaper and works on a fixed-size input Correct answer.
  2. It removes the need for the signer to hold a private key
  3. It allows the signature to be verified with the private key
  4. Hashing encrypts the message so its content stays secret

Explanation

Hashing reduces a message of any length to a fixed-size digest, so the expensive asymmetric operation is applied to a short, constant-length value that still binds the whole message.

Question 26Foundational Concepts and Terminology

An attacker alters the content of a company's public website so that it displays false information. Which element of the CIA triad is primarily affected?

  1. Confidentiality
  2. Non-repudiation
  3. Availability
  4. Integrity Correct answer.

Explanation

Integrity concerns the accuracy and completeness of data and systems, so unauthorised modification of web content is an integrity failure. Confidentiality concerns disclosure, availability concerns timely access, and non-repudiation concerns proving an action occurred.

Question 27Foundational Concepts and Terminology

Which type of malware presents itself as legitimate software so that a user installs it deliberately?

  1. Adware
  2. Rootkit
  3. Worm
  4. Trojan Correct answer.

Explanation

A Trojan disguises itself as desirable or legitimate software and relies on the user installing and running it. Its defining characteristic is deception of the user rather than self-propagation.

Question 28Foundational Concepts and Terminology

A server runs an outdated web application that contains a known flaw allowing remote code execution. In risk terminology, the outdated software is best described as which of the following?

  1. A risk
  2. A control
  3. A vulnerability Correct answer.
  4. A threat

Explanation

A vulnerability is a weakness in an asset or control that can be exploited by a threat. The outdated code with a known flaw is the weakness itself, not the actor that exploits it nor the combined measure of likelihood and impact.

Question 29Foundational Concepts and Terminology

A user types a username to claim an account before proving who they are. Within the AAA framework, this first step is called which of the following?

  1. Accounting
  2. Authentication
  3. Identification Correct answer.
  4. Authorization

Explanation

Identification is the act of a subject claiming an identity, typically by supplying a username or similar identifier. Authentication then verifies that claim, authorization determines what the verified subject may do, and accounting records what was done.

Question 30Foundational Concepts and Terminology

Which type of document provides step-by-step instructions that staff must follow to carry out a specific security task?

  1. Guideline
  2. Standard
  3. Procedure Correct answer.
  4. Policy

Explanation

A procedure is a detailed, sequential description of how to perform a task, and it is normally mandatory. Policies state intent, standards set mandatory requirements such as configurations, and guidelines offer recommended advice.

Question 31Foundational Concepts and Terminology

An organisation buys a cyber insurance policy to cover the financial losses that would follow a data breach. Which risk treatment option does this represent?

  1. Avoidance
  2. Acceptance
  3. Transfer Correct answer.
  4. Mitigation

Explanation

Risk transfer shifts the financial consequences of a risk to a third party, and insurance is the classic example. The risk itself still occurs, but the loss is borne elsewhere.

Question 32Foundational Concepts and Terminology

In which access control model are permissions attached to job functions, so that users gain access by being placed into a function rather than being granted rights individually?

  1. Discretionary access control
  2. Role-based access control Correct answer.
  3. Mandatory access control
  4. Rule-based access control

Explanation

In role-based access control, rights are assigned to roles that reflect job functions, and users inherit the rights of the roles they hold. This makes administration simpler because access changes when a user's role changes.

Question 33Foundational Concepts and Terminology

A security analyst reviews firewall and server logs each morning to identify suspicious connections. Which type of control does this activity represent?

  1. Preventive
  2. Deterrent
  3. Corrective
  4. Detective Correct answer.

Explanation

Detective controls identify and record events after or while they occur, and log review is a standard example. It does not block the activity itself, which is the role of preventive controls.

Question 34Foundational Concepts and Terminology

During a TLS session the client and server use asymmetric cryptography only briefly and then protect the session with a shared symmetric key. Why is this hybrid approach used?

  1. Symmetric keys can be shared openly because they are short-lived and random
  2. Symmetric keys are needed so that the client can verify the identity of the server
  3. Asymmetric ciphers cannot provide confidentiality for any traffic on their own
  4. Symmetric ciphers are much faster, so they protect the bulk of the traffic Correct answer.

Explanation

Symmetric algorithms are far more efficient than asymmetric ones, so they are used for the large volume of session data. Asymmetric cryptography is used only for the small operations needed to authenticate the server and agree the session key.

Question 35Foundational Concepts and Terminology

What is the primary purpose of a digital certificate issued by a certificate authority?

  1. It encrypts all traffic sent to the owner's web server
  2. It stores the owner's private key so the key can be recovered if lost
  3. It records every transaction signed with the owner's key
  4. It binds a public key to the identity of its owner Correct answer.

Explanation

A certificate is a signed statement by a certificate authority that a particular public key belongs to a named subject. Relying parties trust the authority's signature and can therefore use the key knowing whose it is.

Question 36Foundational Concepts and Terminology

Which statement best describes the difference between a vulnerability scan and a penetration test?

  1. A vulnerability scan exploits flaws to prove business impact, whereas a penetration test merely lists them for the owner
  2. A penetration test never uses automated tooling of any kind and relies purely on manual effort
  3. Both activities are identical in scope and differ only in whether an internal or external team performs them
  4. A scan identifies possible weaknesses, whereas a test attempts to exploit them Correct answer.

Explanation

A vulnerability scan compares systems against known weaknesses and reports potential exposures without exploiting them. A penetration test goes further by attempting to exploit weaknesses, often chaining them, to demonstrate real impact.

Question 37Foundational Concepts and Terminology

Which of the following best describes the focus of a disaster recovery plan?

  1. It records which employees have completed the mandatory awareness training module
  2. It lists the approved configuration hardening settings for each server build
  3. It covers restoring critical IT systems and data after a disruption Correct answer.
  4. It sets out the disciplinary measures applied when staff breach security policy

Explanation

Disaster recovery planning concentrates on the technical recovery of systems, data and supporting infrastructure within agreed timeframes. Business continuity planning is broader and addresses keeping essential business functions running during and after a disruption.

Question 38Foundational Concepts and Terminology

A network access control appliance is meant to block unauthorised traffic. If its policy engine crashes and it begins forwarding all traffic, which weakness does this illustrate?

  1. It enforces separation of duties across too many administrator accounts
  2. It fails closed and therefore blocks all legitimate business traffic
  3. It applies least privilege more strictly than the designer intended
  4. It fails open, permitting access when the control fails Correct answer.

Explanation

A control that grants access when it breaks is said to fail open, which violates the principle that security mechanisms should default to a safe state on failure. A safer design fails closed, denying access until the control is working again.

Question 39Foundational Concepts and Terminology

Which combination of properties must a reference monitor satisfy to be effective?

  1. It must be tamper-proof, always invoked and small enough to be verified Correct answer.
  2. It must be configurable by end users and easy to modify while the system is running
  3. It must run on the same host as the application it is protecting in all deployments
  4. It must log events only when an administrator enables auditing for the whole system

Explanation

A reference monitor mediates every access to the objects it protects and must be impossible for other code to bypass or subvert. It must also be small and simple enough that its correctness can be thoroughly analysed and tested.

Question 40Foundational Concepts and Terminology

An organisation overwrites and degausses disk drives before disposing of them. Which risk is this control primarily intended to address?

  1. Residual data remaining readable on decommissioned media Correct answer.
  2. Sensitive data being altered in transit between two internal systems
  3. Backup tapes being stolen from an offsite storage vault by an attacker
  4. Users sharing their passwords with colleagues in the same team

Explanation

Data remanence is the residue of data that can remain recoverable on storage media after deletion or reformatting. Overwriting and degaussing aim to destroy that residue so that disposed media cannot be read by others.

Question 41Planning, Design, and Configuration

A company places firewalls at the perimeter, host-based antivirus on endpoints, and requires multifactor authentication for remote access. Which design principle does this best illustrate?

  1. Zero trust
  2. Least privilege
  3. Defense in depth Correct answer.
  4. Separation of duties

Explanation

Defense in depth layers multiple independent controls so that the failure of one control does not expose the whole environment. Perimeter firewalls, endpoint protection, and MFA each address different attack paths. The combination, not any single control, is what implements the principle.

Question 42Planning, Design, and Configuration

What is the primary purpose of a DMZ in a network design?

  1. To host public services while shielding the internal network Correct answer.
  2. To host domain controllers for internal authentication
  3. To store encrypted backups offline
  4. To aggregate VLAN traffic between switches

Explanation

A DMZ is a buffer zone between the untrusted internet and the trusted internal network. Public-facing services are placed there so that a compromise does not give direct access to internal systems. Traffic between the DMZ and the internal network is tightly restricted.

Question 43Planning, Design, and Configuration

A help desk analyst is granted only the permissions needed to reset user passwords and nothing more. Which principle does this apply?

  1. Mandatory access control
  2. Job rotation
  3. Least privilege Correct answer.
  4. Separation of duties

Explanation

Least privilege grants an identity only the access required to perform its assigned function. Password reset rights for a help desk role illustrate a narrowly scoped permission set. This limits the damage an account can cause if it is misused or compromised.

Question 44Planning, Design, and Configuration

Which metric defines the maximum acceptable time a system may be unavailable after a disruption?

  1. Recovery time objective (RTO) Correct answer.
  2. Recovery point objective (RPO)
  3. Mean time between failures (MTBF)
  4. Mean time to repair (MTTR)

Explanation

The recovery time objective is the target duration within which a service must be restored after an outage. It is set by the business, not measured from past events. RTO drives choices such as site type and failover automation.

Question 45Planning, Design, and Configuration

An RPO of 15 minutes for a database means which of the following?

  1. No more than 15 minutes of data may be lost in a disruption Correct answer.
  2. The database must be back online within 15 minutes
  3. The database may be down 15 minutes per month
  4. Backups must be verified every 15 minutes

Explanation

The recovery point objective states the maximum acceptable amount of data loss expressed as time. An RPO of 15 minutes means recovery must restore data to within 15 minutes of the failure. It therefore dictates backup or replication frequency.

Question 46Planning, Design, and Configuration

Which statement correctly describes the 3-2-1 backup rule?

  1. Three copies of data, on two media types, with one copy offsite Correct answer.
  2. Two copies of data, on three media types, with one copy onsite
  3. Three copies of data, on three media types, with no offsite copy
  4. One copy of data, on two media types, with two offsite copies

Explanation

The 3-2-1 rule calls for three copies of data, stored on two different media types, with one copy kept offsite. The offsite copy protects against site-wide events such as fire or flood. Media diversity reduces the chance that a single failure mode destroys all copies.

Question 47Planning, Design, and Configuration

An electronic door controller loses power and keeps the door locked, denying entry. Which failure mode is this?

  1. Failover
  2. Failback
  3. Fail-open
  4. Fail-secure Correct answer.

Explanation

Fail-secure means the control defaults to the protective state when it fails, here keeping the door locked. Fail-open would release the lock and permit entry. Security designs choose between these modes based on whether safety or asset protection dominates.

Question 48Planning, Design, and Configuration

Which step is required before implementing a significant configuration change on production systems?

  1. A full data wipe of the affected systems
  2. Removal of the system from the asset inventory
  3. Disabling logging to reduce event volume
  4. Approval through the change management process Correct answer.

Explanation

Change management requires that proposed changes be documented, reviewed, tested, and approved before deployment. This provides accountability and a rollback plan if the change causes outages. Emergency changes still follow an abbreviated approval path.

Question 49Planning, Design, and Configuration

What is the primary security benefit of dividing a flat network into VLANs based on function?

  1. It automatically encrypts traffic between VLANs
  2. It eliminates the need for firewalls
  3. It removes the need for user authentication
  4. It limits lateral movement between trust zones Correct answer.

Explanation

Segmenting a network into zones by function or trust level constrains how far an attacker can move after compromising one host. Access between segments can then be mediated by firewalls or ACLs. Segmentation is a containment control, not a replacement for other defenses.

Question 50Planning, Design, and Configuration

Which statement best describes a zero trust architecture?

  1. Only external users are required to authenticate
  2. Trust is established once per session and then cached
  3. Each access request is verified regardless of network location Correct answer.
  4. All internal traffic is trusted after the perimeter check

Explanation

Zero trust removes implicit trust based on network position; every request is authenticated and authorized using context such as identity and device posture. Access decisions are continuous rather than granted once. Segmentation and least privilege support this model.