I85PREP
⌘ K
NCJOSI study materials
NCJOSI study resources

NCJOSI practice questions

One question at a time. Build your NCJOSI understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network Security Fundamentals

In the OSI model, which layer is responsible for logical addressing and routing of packets between networks?

  1. Transport layer
  2. Session layer
  3. Network layer Correct answer.
  4. Data link layer

Explanation

The network layer handles logical addressing (such as IP addresses) and determines the path packets take across interconnected networks through routing. The data link layer deals with physical addressing and local delivery, while transport handles end-to-end connections.

Question 2Network Security Fundamentals

Which protocol operates at the transport layer and provides connection-oriented, reliable delivery with acknowledgments and retransmission?

  1. TCP Correct answer.
  2. ARP
  3. UDP
  4. ICMP

Explanation

TCP establishes a connection through a handshake and guarantees ordered, reliable delivery using sequence numbers, acknowledgments, and retransmission. UDP is connectionless, while ICMP and ARP operate at the network and link levels for diagnostics and address resolution.

Question 3Network Security Fundamentals

A security analyst wants to identify the well-known port used by HTTPS traffic by default. Which port should the analyst expect?

  1. 80
  2. 21
  3. 53
  4. 443 Correct answer.

Explanation

HTTPS uses TCP port 443 by default to carry HTTP over TLS. Port 80 is plain HTTP, port 21 is FTP control, and port 53 is DNS.

Question 4Network Security Fundamentals

Which device forwards frames based on MAC addresses and maintains a table mapping MAC addresses to switch ports?

  1. Router
  2. Layer 2 switch Correct answer.
  3. Hub
  4. Firewall

Explanation

A Layer 2 switch learns source MAC addresses and forwards frames only to the port associated with the destination MAC. A hub repeats frames to all ports, while a router forwards based on IP addresses.

Question 5Network Security Fundamentals

Which type of malware self-replicates across networks by exploiting vulnerabilities without requiring a user to open a file?

  1. Logic bomb
  2. Rootkit
  3. Worm Correct answer.
  4. Trojan

Explanation

A worm spreads autonomously by exploiting network vulnerabilities, requiring no user action to propagate. A Trojan relies on user execution, a logic bomb triggers on a condition, and a rootkit hides attacker presence.

Question 6Network Security Fundamentals

What is the primary purpose of a DMZ in a network architecture?

  1. To encrypt all internal traffic between endpoints
  2. To provide redundancy for core routers
  3. To assign IP addresses to internal hosts dynamically
  4. To isolate publicly accessible services from the internal network Correct answer.

Explanation

A DMZ is a segmented zone that hosts internet-facing services so that a compromise there does not directly expose the internal network. Traffic between the DMZ and the internal network is tightly controlled by firewalls.

Question 7Network Security Fundamentals

Which security principle states that a user should be granted only the access necessary to perform their job?

  1. Least privilege Correct answer.
  2. Zero trust
  3. Defense in depth
  4. Separation of duties

Explanation

Least privilege limits each account to the minimum rights required for its tasks, reducing the impact of compromise or misuse. Separation of duties divides critical tasks among multiple people to prevent fraud.

Question 8Network Security Fundamentals

Which record type in DNS maps a hostname to an IPv4 address?

  1. AAAA
  2. A Correct answer.
  3. CNAME
  4. MX

Explanation

An A record maps a hostname to an IPv4 address. AAAA records map to IPv6, MX records identify mail servers, and CNAME records alias one name to another.

Question 9Network Security Fundamentals

An attacker sends a flood of SYN packets with spoofed source addresses to a server, exhausting its connection table. Which attack is this?

  1. Ping of death
  2. DNS poisoning
  3. ARP spoofing
  4. SYN flood Correct answer.

Explanation

A SYN flood exploits the TCP handshake by sending many half-open connection requests so the server's backlog fills and legitimate clients cannot connect. Spoofed source addresses prevent completion of the handshake.

Question 10Network Security Fundamentals

A host receives an ARP reply claiming that the default gateway's IP address maps to an attacker's MAC address. Which attack is occurring?

  1. ARP spoofing Correct answer.
  2. MAC flooding
  3. VLAN hopping
  4. DNS tunneling

Explanation

ARP spoofing, also called ARP poisoning, sends forged ARP responses so victims send traffic to the attacker's MAC address, enabling man-in-the-middle interception. Dynamic ARP Inspection helps mitigate it.

Question 11Network Security Fundamentals

Which firewall capability tracks the state of active connections and allows return traffic for established sessions automatically?

  1. Stateful inspection Correct answer.
  2. Proxy authentication
  3. Stateless packet filtering
  4. Network address translation

Explanation

Stateful inspection maintains a connection table so replies to permitted outbound sessions are allowed without an explicit inbound rule. Stateless filtering evaluates each packet in isolation and requires rules in both directions.

Question 12Network Security Fundamentals

Which protocol provides confidentiality for web traffic by encrypting HTTP sessions between a browser and a server?

  1. SNMP
  2. SFTP
  3. SSH
  4. TLS Correct answer.

Explanation

TLS encrypts application data and authenticates the server via certificates, forming the secure layer under HTTPS. SSH secures remote shell sessions, SNMP manages network devices, and SFTP transfers files over SSH.

Question 13Network Security Fundamentals

A company wants to detect malicious traffic by comparing packets against known attack signatures in real time. Which technology best fits this requirement?

  1. Signature-based network intrusion detection system Correct answer.
  2. Vulnerability scanner
  3. Honeypot
  4. Syslog server

Explanation

A signature-based NIDS inspects traffic and raises alerts when packets match known attack patterns. A vulnerability scanner checks hosts for weaknesses, a honeypot lures attackers, and a syslog server collects logs.

Question 14Network Security Fundamentals

Which technique hides data inside unused or reserved fields of a protocol header to evade detection?

  1. Steganography in packets Correct answer.
  2. Session hijacking
  3. Brute forcing
  4. Port scanning

Explanation

Covert channel techniques such as protocol steganography embed data in header fields that are ignored or unused, so the payload appears legitimate. Detection often relies on anomaly analysis of field values.

Question 15Network Security Fundamentals

Which is the primary function of NAT in a typical perimeter network?

  1. Translating private IP addresses to a public address Correct answer.
  2. Authenticating users before granting access
  3. Encrypting traffic between sites
  4. Detecting malware in packet payloads

Explanation

NAT rewrites private source addresses to a routable public address, conserving address space and hiding internal addressing. It does not by itself provide encryption, malware detection, or user authentication.

Question 16Network Security Fundamentals

An organization needs to securely connect two branch offices over the internet so that all traffic between them is encrypted. Which technology should be implemented?

  1. Site-to-site VPN Correct answer.
  2. Load balancing
  3. Port mirroring
  4. VLAN trunking

Explanation

A site-to-site VPN establishes an encrypted tunnel between gateways at each location, protecting traffic as it crosses the internet. VLAN trunking, port mirroring, and load balancing operate within or between local segments without providing encryption across untrusted networks.

Question 17Network Security Fundamentals

Which mitigation most directly reduces the risk of successful brute-force attacks against a remote login service?

  1. Increasing password length requirements
  2. Enabling account lockout after repeated failures Correct answer.
  3. Using a flat network topology
  4. Disabling logging on the server

Explanation

Account lockout thresholds stop repeated authentication attempts after a set number of failures, directly limiting brute-force effectiveness. Length requirements help but do not throttle ongoing guesses.

Question 18Network Security Fundamentals

A packet capture shows an attacker sending many TCP segments with overlapping sequence numbers to confuse a target's reassembly. Which class of attack is this?

  1. ICMP redirect
  2. TCP segmentation and reassembly evasion Correct answer.
  3. TCP session hijacking
  4. DNS cache poisoning

Explanation

Overlapping segments exploit differences in how systems reassemble TCP streams, allowing attackers to slip data past an IDS while the target interprets it differently. This is an evasion technique rather than hijacking or name-resolution abuse.

Question 19Network Security Fundamentals

Which protocol is commonly used to securely transfer files over an encrypted channel and runs on port 22 by default?

  1. Telnet
  2. TFTP
  3. SFTP Correct answer.
  4. FTP

Explanation

SFTP transfers files over an SSH session on port 22, providing encryption and authentication. FTP and TFTP are unencrypted, and Telnet is an unencrypted remote access protocol.

Question 20Network Security Fundamentals

An analyst observes repeated DNS queries to a single external domain with long, high-entropy subdomain labels. Which activity is most likely indicated?

  1. ARP spoofing
  2. A SYN flood
  3. DNS tunneling for data exfiltration Correct answer.
  4. DNS cache poisoning

Explanation

Long random subdomains sent repeatedly to one domain are a hallmark of DNS tunneling, where data is encoded in query names to bypass egress filtering. Cache poisoning alters stored records, and the other attacks are unrelated to query content patterns.

Question 21Network Security Fundamentals

Why does network segmentation limit the spread of lateral movement after a host is compromised?

  1. It replaces the need for authentication on internal systems.
  2. It encrypts all traffic between segments automatically.
  3. It prevents the compromised host from generating any network traffic.
  4. It restricts which hosts can communicate, so an attacker cannot freely reach other systems. Correct answer.

Explanation

Segmentation places internal controls between zones so a compromised host can only reach permitted destinations, slowing or blocking lateral movement. Segmentation does not inherently encrypt traffic or eliminate authentication.

Question 22Network Security Fundamentals

A man-in-the-middle presents a forged certificate to intercept TLS traffic, but the browser shows a warning. Which control most directly caused the interception attempt to be detected?

  1. Stateful packet filtering
  2. Network address translation
  3. Port security on the switch
  4. Certificate chain validation against trusted roots Correct answer.

Explanation

Browsers validate the server certificate chain against trusted root authorities and check the hostname, so a forged or self-signed certificate triggers a warning. This validation is what exposes the interception.

Question 23Network Security Fundamentals

Which characteristic of UDP makes it attractive for certain denial-of-service amplification attacks?

  1. It guarantees ordered delivery of datagrams.
  2. It encrypts payloads by default.
  3. It is connectionless and allows spoofed source addresses with no handshake verification. Correct answer.
  4. It requires a three-way handshake before data transfer.

Explanation

Because UDP is connectionless, a sender can spoof the source address and trigger large responses to a victim without completing any handshake. Protocols like DNS and NTP can then amplify traffic toward the target.

Question 24Network Security Fundamentals

An IDS alerts on a packet with the TCP FIN and SYN flags set simultaneously. Why is this suspicious?

  1. It proves the packet is encrypted.
  2. It indicates a valid session teardown sequence.
  3. Such a flag combination is invalid and often used to probe or evade filtering devices. Correct answer.
  4. It shows the host is performing DNS resolution.

Explanation

Setting SYN and FIN together is an invalid TCP flag combination that does not occur in normal sessions, so it is often used in scans or evasion attempts to observe how devices respond. Legitimate connection setup and teardown never combine these flags.

Question 25Network Security Fundamentals

A security team must choose between an IDS and an IPS for a link where dropping malicious traffic is required. Which statement best justifies selecting the IPS?

  1. An IDS requires no tuning and therefore is preferred.
  2. An IPS stores more logs than an IDS.
  3. An IPS can block traffic inline when it matches malicious patterns, while an IDS only alerts. Correct answer.
  4. An IPS operates only in passive tap mode.

Explanation

An IPS sits inline and can drop or reset malicious traffic in real time, whereas an IDS is typically passive and only generates alerts. When active prevention is required, the inline enforcement capability is decisive.

Question 26Network Security Fundamentals

Which OSI model layer is responsible for logical addressing and routing of packets between networks?

  1. Session layer
  2. Data link layer
  3. Network layer Correct answer.
  4. Transport layer

Explanation

The network layer (layer 3) handles logical addressing and path selection, which is why IP addresses and routers operate at this layer. It decides how packets travel between distinct networks rather than how frames move on a single local segment.

Question 27Network Security Fundamentals

A network engineer needs to place a device that inspects traffic and can actively block malicious sessions inline between two network segments. Which deployment role fits this requirement?

  1. Syslog collector
  2. Inline intrusion prevention system Correct answer.
  3. Passive tap sensor
  4. Host-based antivirus agent

Explanation

An inline IPS sits directly in the traffic path, so it can drop or reset sessions that match malicious patterns. A passive sensor only observes a copy of traffic and cannot block it, and a logging collector only aggregates records.

Question 28Network Security Fundamentals

An organization wants to allow inbound HTTPS to a public web server while keeping internal database servers unreachable from the internet. Which control most directly enforces this separation?

  1. A DHCP reservation binding the web server to a fixed address
  2. A VLAN trunk carrying all server subnets to the perimeter switch
  3. A stateful firewall rule permitting only TCP 443 to the web server's address Correct answer.
  4. A DNS zone transfer restriction on the internal resolver

Explanation

A firewall rule scoped to the web server's address and port enforces which inbound flows reach which hosts, leaving database servers without an inbound path. The other choices affect name resolution, address assignment, or link aggregation, none of which restrict reachability of internal hosts.

Question 29Network Security Fundamentals

An analyst reviewing logs sees a workstation resolve an internal hostname to an address outside the organization's assigned ranges, and shortly afterward the workstation connects to that address on port 445. Which conclusion is best supported?

  1. The resolver is performing normal round-robin load balancing for the hostname.
  2. The traffic is a legitimate NTP synchronization exchange.
  3. The workstation is broadcasting ARP requests to locate the gateway.
  4. The workstation has been compromised and is being directed to an attacker-controlled host. Correct answer.

Explanation

A hostname resolving to an address outside the organization's own ranges indicates the resolution was altered or is attacker-controlled, and the follow-on SMB connection suggests the workstation is contacting that host. Legitimate internal names should resolve to internal ranges, so this pattern warrants incident response.

Question 30Network Security Fundamentals

A security architect is designing a remote-access solution for staff who must reach internal applications without exposing those applications directly to the internet. Which combination best satisfies the requirement while limiting attack surface?

  1. Require a VPN concentrator with strong authentication, then apply per-application authorization inside the network Correct answer.
  2. Rely on application-level passwords and leave the services reachable from any source address
  3. Expose the applications only over a nonstandard port and disable logging to reduce noise
  4. Publish each application on a public IP with host firewall rules limited to staff home address ranges

Explanation

Terminating remote access at a VPN concentrator with strong authentication keeps internal applications off the public internet, and per-application authorization limits what an authenticated user can reach. Home address ranges are unstable and easily spoofed or changed, so filtering by them is unreliable.

Question 31Threat Landscape and Attack Vectors

A SOC analyst receives an alert that an employee's workstation is beaconing to a newly registered domain every 60 seconds with small, fixed-size payloads. Which stage of the intrusion lifecycle does this behavior most directly indicate?

  1. Initial exploitation
  2. Privilege escalation
  3. Data exfiltration
  4. Command-and-control communication Correct answer.

Explanation

Regular, periodic callbacks with small fixed payloads are a classic signature of malware checking in with a command-and-control server. The consistent interval reflects an automated implant awaiting tasking rather than bulk data movement or an exploit attempt. Exfiltration would typically show larger, variable outbound volumes.

Question 32Threat Landscape and Attack Vectors

Which threat actor category is best described as financially motivated criminals who deploy ransomware and steal data for extortion, often operating as organized groups with affiliate programs?

  1. Hacktivists
  2. Nation-state espionage groups
  3. Organized cybercrime groups Correct answer.
  4. Insider threats

Explanation

Organized cybercrime groups pursue monetary gain, frequently through ransomware, double extortion, and access-broker affiliate models. Their defining motive is profit rather than ideology or espionage. This distinguishes them from state actors, hacktivists, and malicious insiders.

Question 33Threat Landscape and Attack Vectors

An attacker sends emails impersonating the CFO that instruct employees to urgently update direct-deposit banking details. This is best classified as which attack type?

  1. Credential stuffing
  2. Business email compromise Correct answer.
  3. DNS tunneling
  4. Watering hole

Explanation

Business email compromise relies on impersonation of executives or trusted parties to manipulate employees into fraudulent financial actions. The urgency and authority cues are typical social-engineering elements. The other options describe technical attack techniques rather than impersonation fraud.

Question 34Threat Landscape and Attack Vectors

What distinguishes a supply chain attack from a direct attack on an organization's own perimeter?

  1. It compromises a trusted third party so malicious code or access reaches the target through that trust Correct answer.
  2. It uses only physical intrusion methods
  3. It relies exclusively on insider collusion
  4. It attacks only cloud infrastructure

Explanation

A supply chain attack targets a vendor, software component, or service provider that the victim trusts, so compromise propagates through that relationship. This lets attackers bypass perimeter defenses because the malicious artifact appears legitimate. The defining feature is abuse of trust in a third party.

Question 35Threat Landscape and Attack Vectors

Which technique tricks a user into authorizing an OAuth application that then gains persistent access to their mailbox and files?

  1. Consent phishing Correct answer.
  2. Pass-the-hash
  3. SQL injection
  4. Cross-site scripting

Explanation

Consent phishing abuses OAuth authorization flows by persuading users to grant permissions to a malicious application. The granted tokens allow persistent access without stealing the password. This persistence is why the technique is favored by attackers targeting cloud services.

Question 36Threat Landscape and Attack Vectors

An attacker registers a lookalike domain such as 'paypa1-secure.com' to harvest credentials. Which attack category does this represent?

  1. Typosquatting and domain impersonation Correct answer.
  2. Session hijacking
  3. Man-in-the-middle interception
  4. Firmware rootkit

Explanation

Lookalike domains exploit visual similarity and typographical errors to impersonate legitimate brands. They are commonly used in phishing campaigns to host fake login pages. This is distinct from interception or session theft, which require access to live traffic or tokens.

Question 37Threat Landscape and Attack Vectors

Which of the following best describes a zero-day vulnerability?

  1. A flaw in antivirus signature databases
  2. A vulnerability that requires zero user interaction
  3. A previously unknown vulnerability with no vendor patch available Correct answer.
  4. A misconfiguration documented in vendor guides

Explanation

A zero-day is a vulnerability unknown to the vendor or without an available fix at the time of exploitation. Attackers can exploit it before defenders have signatures or patches. The term refers to the absence of a remediation window, not to interaction requirements.

Question 38Threat Landscape and Attack Vectors

A phishing campaign targets the personal email accounts of senior executives to gather information for later attacks on the company. Which term best describes this activity?

  1. Spear phishing
  2. Whaling Correct answer.
  3. Pharming
  4. Smishing

Explanation

Whaling is spear phishing aimed specifically at high-value targets such as executives. The focus on senior leadership distinguishes it from broader spear phishing. The goal of gathering intelligence for follow-on attacks is common in whaling campaigns.

Question 39Threat Landscape and Attack Vectors

An attacker gains a foothold on a workstation, then uses stolen Kerberos tickets to move laterally to a file server. Which attack phase does the lateral movement represent?

  1. Weaponization
  2. Resource development
  3. Reconnaissance
  4. Lateral movement Correct answer.

Explanation

Lateral movement covers techniques used to pivot from one compromised host to others within the environment. Using stolen tickets to reach a file server is a textbook example. Reconnaissance and weaponization occur earlier in the intrusion chain.

Question 40Threat Landscape and Attack Vectors

An attacker exploits a public-facing VPN appliance vulnerability to execute code without credentials. Which initial access technique does this most closely match?

  1. Replication through removable media
  2. Phishing a valid account
  3. Trusted relationship abuse
  4. Exploiting a public-facing application Correct answer.

Explanation

Exploiting a vulnerability in an internet-facing appliance such as a VPN gateway is the definition of public-facing application exploitation. No credentials or user action are needed beyond reaching the vulnerable service. The other options involve different access vectors.

Question 41Threat Landscape and Attack Vectors

Malware on a host encrypts files and appends a new extension, then displays a payment note. Which combination of impact goals does this demonstrate?

  1. Data encrypted for impact and extortion Correct answer.
  2. Defacement and misinformation
  3. Data destruction and denial of service
  4. Resource hijacking for cryptomining

Explanation

Ransomware encrypts data to deny access and demands payment, combining impact through encryption with financial extortion. The payment note confirms the extortion motive. Cryptomining or defacement would present different observable effects.

Question 42Threat Landscape and Attack Vectors

A security team observes a document that executes a macro which downloads a second-stage payload from a remote server. Which technique does the macro represent?

  1. Network sniffing
  2. OS credential dumping
  3. Account discovery
  4. User execution leading to download of tooling Correct answer.

Explanation

Macro execution depends on the user enabling content, after which it retrieves additional malware; this is user execution followed by tool or payload download. It is a common initial-stage pattern in malicious documents. Credential dumping and discovery occur after execution.

Question 43Threat Landscape and Attack Vectors

An attacker abuses a legitimate remote monitoring and management tool already installed in the environment to run commands on many endpoints. Why is this effective?

  1. It blends with legitimate administrative traffic and signed software Correct answer.
  2. It exploits an unpatched kernel bug
  3. It requires no network connectivity
  4. It disables disk encryption

Explanation

Abusing legitimate, signed administrative tools lets attackers operate within normal traffic patterns and avoid suspicion. This living-off-the-land approach reduces the chance of detection by signature-based controls. It does not depend on a kernel exploit or disabling encryption.

Question 44Threat Landscape and Attack Vectors

Which scenario most clearly indicates a credential-stuffing attack rather than a brute-force attack?

  1. Many accounts each receive one login attempt using leaked username-password pairs Correct answer.
  2. A single account receives thousands of password guesses
  3. An attacker exploits a SQL injection to dump a user table
  4. A user reuses a password across personal sites

Explanation

Credential stuffing replays previously breached username and password pairs across many accounts, typically one attempt per account to avoid lockouts. Brute force instead concentrates many guesses on a single account. Dumping a user table is data theft, not an authentication attack pattern.

Question 45Threat Landscape and Attack Vectors

A user connects to a coffee shop Wi-Fi named identically to the café's real network, and the attacker captures their traffic. Which attack is this?

  1. Tailgating
  2. Evil twin access point Correct answer.
  3. Vishing
  4. Bluesnarfing

Explanation

An evil twin is a rogue access point impersonating a legitimate network name to intercept or manipulate traffic. Users connect believing it is the real hotspot. The other options involve Bluetooth data theft, voice phishing, or physical entry.

Question 46Threat Landscape and Attack Vectors

An attacker sends a victim a link to a legitimate but compromised website that hosts an exploit kit. Which delivery method does this describe?

  1. Watering hole delivery Correct answer.
  2. Spear phishing attachment
  3. Supply chain implant
  4. Physical media drop

Explanation

Watering hole attacks compromise sites the target population is known to visit, then serve exploits to visitors. The victim is lured to a trusted but infected site. This differs from email attachments, physical drops, or vendor software implants.

Question 47Threat Landscape and Attack Vectors

During an intrusion, an attacker uses valid but stolen credentials to authenticate to cloud services without triggering password failures. Which detection challenge does this illustrate?

  1. Valid account abuse is hard to distinguish from normal activity Correct answer.
  2. Multi-factor authentication is always bypassed
  3. Cloud providers do not retain authentication logs
  4. Encrypted traffic cannot be logged

Explanation

Use of legitimate credentials produces successful logins that resemble normal user behavior, complicating detection. This is why behavioral analytics and impossible-travel checks matter. The other statements are factually inaccurate or too absolute.

Question 48Threat Landscape and Attack Vectors

An attacker manipulates a business email thread to insert fraudulent invoice details after establishing trust. Which social-engineering principle is primarily being exploited?

  1. Familiarity and established trust Correct answer.
  2. Authority and urgency
  3. Scarcity
  4. Intimidation through legal threats

Explanation

By hijacking an existing conversation, the attacker leverages the trust already established between the parties. The victim believes they are continuing a legitimate dialogue. Authority, scarcity, and legal intimidation are different persuasion levers not central here.

Question 49Threat Landscape and Attack Vectors

An attacker uses DNS queries to a controlled domain to smuggle commands out of a restricted network. Which technique is this?

  1. DNS tunneling Correct answer.
  2. BGP hijacking
  3. DHCP starvation
  4. ARP spoofing

Explanation

DNS tunneling encodes data or commands within DNS queries and responses to bypass egress filtering. Because DNS is often allowed outbound, it becomes a covert channel. The other options are local network or routing attacks.

Question 50Threat Landscape and Attack Vectors

A threat intelligence report describes an actor that maintains long-term, low-and-slow access to government networks to collect documents over months. Which actor profile fits best?

  1. Script kiddie
  2. Hacktivist collective
  3. Nation-state advanced persistent threat Correct answer.
  4. Ransomware affiliate

Explanation

Long-dwell espionage focused on document collection aligns with nation-state APT behavior. These actors prioritize stealth and persistence over quick monetization. Ransomware affiliates, amateurs, and hacktivists typically show different objectives and tempos.