I85PREP
⌘ K
NCCSA study materials
NCCSA study resources

NCCSA practice questions

One question at a time. Build your NCCSA understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Principles and Concepts

In the CIA triad, which property ensures that data has not been altered by an unauthorized party?

  1. Availability
  2. Non-repudiation
  3. Confidentiality
  4. Integrity Correct answer.

Explanation

Integrity guarantees that information remains accurate and complete and has not been modified without authorization. Confidentiality concerns preventing unauthorized disclosure, while availability concerns timely access to resources.

Question 2Security Principles and Concepts

A user receives an email that appears to come from the IT helpdesk and asks them to confirm their password via a link. Which attack does this describe?

  1. Ping sweep
  2. Shoulder surfing
  3. Phishing Correct answer.
  4. Tailgating

Explanation

Phishing is a social-engineering attack that uses fraudulent messages to trick recipients into revealing credentials or clicking malicious links. The spoofed sender and credential request are classic phishing indicators.

Question 3Security Principles and Concepts

Which access control model grants permissions based on the user's job function within the organization?

  1. Rule-Based Access Control
  2. Discretionary Access Control (DAC)
  3. Role-Based Access Control (RBAC) Correct answer.
  4. Mandatory Access Control (MAC)

Explanation

RBAC assigns rights to roles that reflect job duties, and users inherit permissions through role membership. This simplifies administration and enforces least privilege by function.

Question 4Security Principles and Concepts

Which principle states that a user should be given only the access necessary to perform their assigned work?

  1. Least privilege Correct answer.
  2. Separation of duties
  3. Zero trust
  4. Defense in depth

Explanation

Least privilege limits each account to the minimum rights needed for its tasks, reducing the impact of misuse or compromise. Separation of duties instead divides critical tasks among multiple people.

Question 5Security Principles and Concepts

What is the primary purpose of encrypting data at rest?

  1. To ensure data arrives at its destination without errors
  2. To prevent unauthorized reading of stored data if the media is lost or stolen Correct answer.
  3. To verify the identity of users logging on to a system
  4. To record every access to a file for auditing

Explanation

Encryption at rest protects stored data by making it unreadable without the correct key, which mitigates risks from stolen disks or breached storage. It does not authenticate users or provide audit logging.

Question 6Security Principles and Concepts

Which type of malware self-replicates across networks without requiring a host file or user action?

  1. Worm Correct answer.
  2. Rootkit
  3. Trojan
  4. Logic bomb

Explanation

A worm is standalone malware that spreads automatically across networks by exploiting vulnerabilities, without attaching to a host file. A Trojan instead disguises itself as legitimate software and relies on user execution.

Question 7Security Principles and Concepts

Which control is an example of a physical security safeguard?

  1. Full-disk encryption on a laptop
  2. A password complexity policy
  3. A badge reader on the server room door Correct answer.
  4. A firewall rule blocking inbound traffic

Explanation

Physical controls protect facilities and hardware, and a badge reader restricting entry to a server room is a physical access control. Firewalls, policies, and encryption are logical or administrative controls.

Question 8Security Principles and Concepts

What does the term 'attack surface' refer to in security risk assessment?

  1. The sum of all points where an attacker could attempt to enter or extract data from a system Correct answer.
  2. The total number of security incidents in a year
  3. The list of employees with administrative privileges
  4. The physical perimeter fence surrounding a data center

Explanation

The attack surface is the aggregate of exposed entry points, such as services, interfaces, and user interactions, that an adversary could exploit. Reducing it lowers the number of exploitable paths.

Question 9Security Principles and Concepts

An organization requires two administrators to approve any wire transfer above a threshold. Which principle does this enforce?

  1. Separation of duties Correct answer.
  2. Least privilege
  3. Need to know
  4. Data minimization

Explanation

Separation of duties divides a sensitive transaction so that no single person can complete it alone, reducing fraud risk. The dual-approval requirement is a direct application of this principle.

Question 10Security Principles and Concepts

Which authentication factor category does a fingerprint scan belong to?

  1. Somewhere you are
  2. Something you are Correct answer.
  3. Something you have
  4. Something you know

Explanation

Biometric traits such as fingerprints fall under 'something you are,' an inherence factor. Passwords are 'something you know,' tokens are 'something you have,' and location is a contextual factor.

Question 11Security Principles and Concepts

A security team places a decoy server in a network segment to detect intruders and study their behavior. What is this called?

  1. A bastion host
  2. A demilitarized zone
  3. A honeypot Correct answer.
  4. A proxy server

Explanation

A honeypot is a deliberately exposed decoy system designed to attract attackers, alert defenders, and gather intelligence about tactics. It has no production role, so any interaction with it is suspicious.

Question 12Security Principles and Concepts

Which cryptographic property of a hash function makes it impractical to find two different inputs producing the same output?

  1. Perfect forward secrecy
  2. Collision resistance Correct answer.
  3. Salting
  4. Key escrow

Explanation

Collision resistance means it is computationally infeasible to find two distinct inputs with the same hash value, which is essential for integrity checks. Salting and forward secrecy address different problems.

Question 13Security Principles and Concepts

An employee plugs an unknown USB drive found in the parking lot into a workstation. Which threat is most directly enabled?

  1. A man-in-the-middle attack on wireless traffic
  2. Introduction of malware such as a Trojan or worm Correct answer.
  3. An SQL injection against the web application
  4. A denial-of-service flood against the network

Explanation

Removable media from untrusted sources can deliver malicious code that executes when the device is connected, a common baiting technique. The other threats require different vectors such as network flooding or crafted web input.

Question 14Security Principles and Concepts

Which statement best describes the difference between a vulnerability and a risk?

  1. A vulnerability is an active attack, while risk is a passive monitoring event
  2. A vulnerability applies only to software, while risk applies only to people
  3. A vulnerability is a weakness, while risk is the potential for loss when that weakness is exploited Correct answer.
  4. A vulnerability is always exploitable remotely, while risk is limited to insiders

Explanation

A vulnerability is a flaw or weakness in a system, whereas risk combines the likelihood and impact of a threat exploiting that weakness. Risk therefore depends on context such as threat activity and asset value.

Question 15Security Principles and Concepts

A company wants to verify that a downloaded software package has not been tampered with. Which mechanism should be used?

  1. Compressing the file before distribution
  2. Comparing the file's hash against the publisher's published checksum Correct answer.
  3. Encrypting the file with a shared symmetric key
  4. Renaming the file with a version suffix

Explanation

A cryptographic hash acts as a fingerprint; comparing the downloaded file's hash to the publisher's trusted value reveals any alteration. Encryption provides confidentiality but does not by itself prove integrity to the recipient.

Question 16Security Principles and Concepts

Which practice most directly mitigates the risk of credential stuffing against a login service?

  1. Enforcing multi-factor authentication and monitoring for anomalous login patterns Correct answer.
  2. Publishing the password policy on the login page
  3. Allowing users to reuse passwords across services
  4. Increasing the password maximum length

Explanation

Credential stuffing succeeds when stolen username-password pairs are replayed, so requiring a second factor blocks reuse of compromised passwords. Detecting anomalous patterns such as impossible travel adds further defense.

Question 17Security Principles and Concepts

What is the role of a certificate authority (CA) in a public key infrastructure?

  1. It issues and digitally signs certificates that bind a public key to an identity Correct answer.
  2. It assigns IP addresses to network devices
  3. It stores the private keys of all subscribers for recovery
  4. It encrypts all traffic between clients and servers

Explanation

A CA validates an applicant's identity and signs a certificate that associates that identity with a public key, enabling trust decisions. Private keys normally remain with the subscriber, not the CA.

Question 18Security Principles and Concepts

An analyst classifies a risk by multiplying the likelihood of an event by its potential impact. Which concept does this calculation represent?

  1. Risk appetite
  2. Residual risk
  3. Risk exposure Correct answer.
  4. Inherent risk

Explanation

Risk exposure estimates the magnitude of potential loss by combining likelihood and impact. Residual risk is what remains after controls, appetite is the tolerance level, and inherent risk is the level before controls.

Question 19Security Principles and Concepts

Which network segmentation approach best limits lateral movement after a workstation is compromised?

  1. Disabling host-based firewalls on servers
  2. Assigning all devices to a single flat VLAN
  3. Using a shared administrator account across all zones
  4. Dividing the network into zones with rules that restrict traffic between them Correct answer.

Explanation

Segmentation into zones with enforced inter-zone rules prevents an attacker on one host from freely reaching other systems. Flat networks and shared accounts instead make lateral movement easier.

Question 20Security Principles and Concepts

A web application reflects user input directly into HTML without encoding. Which vulnerability is most likely?

  1. Cross-site scripting Correct answer.
  2. Race condition
  3. Buffer overflow
  4. Privilege escalation

Explanation

Reflecting unencoded user input into HTML lets an attacker inject scripts that execute in victims' browsers, which is cross-site scripting. Output encoding and input validation are the standard mitigations.

Question 21Security Principles and Concepts

Which statement correctly distinguishes symmetric from asymmetric encryption?

  1. Symmetric encryption uses a key pair, while asymmetric encryption uses a single shared key
  2. Symmetric encryption uses one shared key, while asymmetric encryption uses a public and private key pair Correct answer.
  3. Symmetric encryption is always slower than asymmetric encryption
  4. Symmetric encryption provides non-repudiation, while asymmetric encryption cannot

Explanation

Symmetric algorithms use the same secret key for encryption and decryption, whereas asymmetric algorithms use mathematically related public and private keys. Symmetric operations are typically much faster, so they often protect bulk data.

Question 22Security Principles and Concepts

An organization applies layered controls so that if a firewall fails, endpoint protection and monitoring still detect or block an intrusion. Which principle does this illustrate?

  1. Single sign-on
  2. Implicit trust
  3. Defense in depth Correct answer.
  4. Security through obscurity

Explanation

Defense in depth stacks independent controls so no single failure leads to compromise. Relying on one control, or on secrecy of design, leaves a single point of failure.

Question 23Security Principles and Concepts

A penetration tester finds that an intern account can read the payroll database because permissions were copied from an HR role. Which control failure is most directly implicated?

  1. Absence of a disaster recovery plan
  2. Weak password hashing in the directory
  3. Insufficient encryption of data in transit
  4. Excessive permissions violating least privilege Correct answer.

Explanation

Granting the intern account rights beyond its job needs is an excess-privilege problem that violates least privilege. Role assignment should be reviewed so permissions match actual duties.

Question 24Security Principles and Concepts

Which scenario best demonstrates a residual risk after controls are implemented?

  1. An employee completes mandatory security awareness training
  2. A backup is restored successfully during a test
  3. A firewall blocks all inbound traffic on unused ports
  4. A patched server remains exposed to a zero-day flaw not yet publicly known Correct answer.

Explanation

Residual risk is what remains after controls are applied; even a fully patched system carries unknown-vulnerability exposure. Successful blocking, training, and restore tests indicate controls working, not residual risk.

Question 25Security Principles and Concepts

A digital signature provides which combination of security services?

  1. Confidentiality of the message body and availability of the server
  2. Authentication of the signer and integrity of the signed data Correct answer.
  3. Encryption of the private key and rotation of the certificate
  4. Anonymity of the signer and compression of the payload

Explanation

A digital signature is created with the signer's private key and verified with the public key, proving origin and detecting alteration. It also supports non-repudiation but does not by itself hide the message content.

Question 26Security Principles and Concepts

Which security principle limits an employee's access to only the information needed to perform their assigned job duties?

  1. Non-repudiation
  2. Defense in depth
  3. Least privilege Correct answer.
  4. Separation of duties

Explanation

Least privilege grants users only the minimum access required to complete their tasks, reducing the potential damage from error or misuse. It is applied at the individual account level and is distinct from organizational controls that split tasks among people.

Question 27Security Principles and Concepts

An organization classifies data as public, internal, confidential, and restricted. What is the primary purpose of applying these labels?

  1. To encrypt every data set with the same algorithm regardless of sensitivity
  2. To determine the handling and protection requirements appropriate to each data set Correct answer.
  3. To reduce the total volume of data stored on production servers
  4. To assign each data set to a single employee for permanent ownership

Explanation

Data classification drives the controls applied to information, so more sensitive labels carry stricter handling, storage, transmission, and access rules. The label itself does not encrypt data or change ownership; it tells staff which protections are required.

Question 28Security Principles and Concepts

A user receives an email that appears to come from the IT help desk and asks them to confirm their password via a linked form. Which term best describes this attack?

  1. Brute force
  2. Phishing Correct answer.
  3. Shoulder surfing
  4. Tailgating

Explanation

Phishing uses a fraudulent message that impersonates a trusted party to trick the recipient into revealing credentials or clicking a malicious link. The deception of the sender identity and the request for credentials are the defining features here.

Question 29Security Principles and Concepts

A server room uses a badge reader at the door, and entry logs are reviewed weekly. Which security service do the entry logs primarily support?

  1. Accountability Correct answer.
  2. Availability
  3. Confidentiality
  4. Integrity

Explanation

Entry logs tie each access event to an identified badge holder, so actions can later be attributed to a specific individual; this is accountability. Confidentiality, integrity, and availability describe protection of the data itself, not the attribution of who performed an action.

Question 30Security Principles and Concepts

An application stores user passwords as fast unsalted hashes. An attacker who obtains the password database is able to match many entries to precomputed values. Which change most directly addresses this weakness?

  1. Require users to change their passwords every thirty days
  2. Increase the minimum password length from eight to twelve characters
  3. Encrypt the password column with a symmetric key stored on the same database server
  4. Hash each password with a unique random salt using a deliberately slow key-derivation function Correct answer.

Explanation

A unique per-user salt defeats precomputed lookup tables because identical passwords no longer produce identical stored values, and a slow key-derivation function raises the cost of offline guessing. Together these properties target exactly the attack described.

Question 31Network Security Fundamentals

In network security, which term describes the assurance that data has not been altered in transit by an unauthorized party?

  1. Integrity Correct answer.
  2. Non-repudiation
  3. Confidentiality
  4. Availability

Explanation

Integrity guarantees that data remains accurate and unmodified except by authorized processes, and it is typically verified with hashes or message authentication codes. Confidentiality hides data from unauthorized readers, availability ensures timely access, and non-repudiation prevents denial of an action.

Question 32Network Security Fundamentals

A workstation resolves the hostname of a server by sending a recursive query to a DNS resolver. Which UDP port does the resolver normally listen on for these client queries?

  1. 389
  2. 123
  3. 53 Correct answer.
  4. 161

Explanation

DNS uses UDP port 53 for standard queries and responses, falling back to TCP 53 for zone transfers and large responses. Port 123 is NTP, 161 is SNMP, and 389 is LDAP.

Question 33Network Security Fundamentals

Which device primarily segments a network into separate broadcast domains while forwarding frames based on MAC addresses?

  1. A repeater
  2. A hub
  3. A switch Correct answer.
  4. A media converter

Explanation

A switch learns MAC addresses and forwards frames only to the port where the destination resides, and each switch port forms its own broadcast domain. Hubs, repeaters, and media converters operate at the physical layer and extend a single collision and broadcast domain.

Question 34Network Security Fundamentals

Which protocol provides connection-oriented, reliable delivery with sequencing and acknowledgments at the transport layer?

  1. ARP
  2. TCP Correct answer.
  3. UDP
  4. ICMP

Explanation

TCP establishes a session with a three-way handshake and uses sequence numbers and acknowledgments to guarantee ordered, reliable delivery. UDP is connectionless and best-effort, while ICMP and ARP operate at other layers for diagnostics and address resolution.

Question 35Network Security Fundamentals

What is the primary purpose of a DMZ in a network architecture?

  1. To encrypt all internal traffic between user workstations
  2. To centralize user authentication for remote access
  3. To provide redundant power to core routers
  4. To host externally reachable services while isolating them from the internal network Correct answer.

Explanation

A DMZ is a segmented zone that hosts internet-facing services so that a compromise of those services does not grant direct access to the internal network. Traffic between the DMZ and internal networks is restricted by firewall policy.

Question 36Network Security Fundamentals

Which attack involves an adversary intercepting and potentially altering traffic between two parties who believe they are communicating directly?

  1. Smurf attack
  2. SYN flood
  3. Ping of death
  4. Man-in-the-middle attack Correct answer.

Explanation

In a man-in-the-middle attack the adversary positions itself between two endpoints, relaying or modifying traffic while each side believes it talks to the other. SYN floods, Smurf attacks, and ping-of-death attacks are denial-of-service techniques rather than interception.

Question 37Network Security Fundamentals

Which security control is an example of multifactor authentication?

  1. Two different passwords entered in sequence
  2. A password combined with a one-time code from an authenticator app Correct answer.
  3. A password combined with a username
  4. A password combined with a security question

Explanation

Multifactor authentication requires factors from different categories, such as something you know plus something you have. A password and an app-generated one-time code combine knowledge with possession, which satisfies that requirement.

Question 38Network Security Fundamentals

Which wireless security protocol introduced Simultaneous Authentication of Equals and removes offline dictionary attacks against the handshake?

  1. WPA3 Correct answer.
  2. WEP
  3. WPA
  4. WPA2-Personal

Explanation

WPA3-Personal replaces the pre-shared key handshake with SAE, a dragonfly-based exchange that resists offline guessing of captured handshakes. WEP, WPA, and WPA2-Personal all rely on weaker key derivation and handshake designs.

Question 39Network Security Fundamentals

An organization wants to detect a port scan against its public subnet and alert administrators in real time. Which control best fits this requirement?

  1. A password vault for administrative credentials
  2. A host-based antivirus agent on each server
  3. A network intrusion detection system monitoring the subnet Correct answer.
  4. A file integrity monitor on the database server

Explanation

A network intrusion detection system inspects traffic on a monitored segment and can raise alerts when it recognizes scanning patterns. Host antivirus, file integrity monitoring, and password vaults address endpoint malware, file tampering, and credential storage respectively, not network reconnaissance.

Question 40Network Security Fundamentals

A firewall rule set allows inbound TCP 443 from any source to a web server and denies everything else. Which additional rule is needed so administrators can manage the server over SSH from the internal network only?

  1. Allow UDP 22 from any source to the server
  2. Allow TCP 22 from the internal management subnet to the server Correct answer.
  3. Allow TCP 3389 from any source to the server
  4. Allow TCP 22 from any source to the server

Explanation

SSH management should be permitted only from the trusted internal management subnet, which keeps the rule as restrictive as the requirement demands. Opening SSH to any source or using the wrong transport or port would violate least privilege and the stated need.

Question 41Network Security Fundamentals

During a TCP three-way handshake, which sequence correctly establishes the connection?

  1. SYN-ACK, SYN, ACK
  2. SYN, SYN-ACK, ACK Correct answer.
  3. ACK, SYN, ACK
  4. SYN, ACK, SYN-ACK

Explanation

The client sends a SYN, the server replies with a SYN-ACK acknowledging the client sequence and offering its own, and the client completes with an ACK. This exchange synchronizes sequence numbers in both directions before data flows.

Question 42Network Security Fundamentals

Which description best characterizes a reflected amplification attack such as DNS amplification?

  1. The attacker spoofs the victim's source address and sends queries to open resolvers that return large responses to the victim Correct answer.
  2. The attacker guesses credentials against the victim's login portal
  3. The attacker injects script into a web page viewed by the victim's users
  4. The attacker encrypts files on the victim's hosts and demands payment

Explanation

Reflection relies on spoofing the victim's address so third-party servers direct their replies to the victim, and amplification makes the response far larger than the request. The other options describe ransomware, credential brute force, and cross-site scripting.

Question 43Network Security Fundamentals

Why is NAT alone insufficient as a network security control for an internal network?

  1. NAT hides internal addressing but does not inspect traffic or block malicious content Correct answer.
  2. NAT encrypts all outbound sessions, which prevents inspection
  3. NAT assigns public addresses to every internal host
  4. NAT operates only on wireless links

Explanation

NAT translates addresses and incidentally hides internal topology, but it does not perform stateful inspection, content filtering, or access control. Security policy must come from firewalls, IDS/IPS, and related controls.

Question 44Network Security Fundamentals

A security analyst observes repeated failed logins from a single external address against many usernames within a few minutes. Which activity does this pattern most likely indicate?

  1. ARP poisoning
  2. DNS tunneling
  3. VLAN hopping
  4. Password spraying Correct answer.

Explanation

Password spraying tries a small set of common passwords across many accounts to avoid lockout thresholds triggered by repeated failures on one account. VLAN hopping, ARP poisoning, and DNS tunneling are layer 2 or covert-channel techniques unrelated to broad authentication attempts.

Question 45Network Security Fundamentals

Which protocol should be used instead of Telnet for encrypted remote command-line administration of network devices?

  1. TFTP
  2. SNMPv1
  3. SSH Correct answer.
  4. HTTP

Explanation

SSH provides encrypted authentication and an encrypted channel for remote command-line sessions, replacing cleartext Telnet. TFTP and HTTP are cleartext, and SNMPv1 uses community strings sent in cleartext.

Question 46Network Security Fundamentals

Which control most directly mitigates ARP spoofing on a switched local network?

  1. Enabling WPA2-Personal on the wireless LAN
  2. Deploying DNSSEC on internal resolvers
  3. Dynamic ARP Inspection with DHCP snooping Correct answer.
  4. Applying disk encryption to endpoints

Explanation

Dynamic ARP Inspection validates ARP packets against a trusted DHCP snooping binding table, dropping replies that map an IP to the wrong MAC. Wireless encryption, DNSSEC, and disk encryption address different threats and do not validate ARP on the LAN.

Question 47Network Security Fundamentals

What is the main security benefit of placing a reverse proxy in front of internal web servers?

  1. It encrypts database files at rest on the backend servers
  2. It replaces the need for authentication on the web application
  3. It guarantees availability during a denial-of-service flood
  4. It terminates client connections and shields backend servers from direct exposure to untrusted networks Correct answer.

Explanation

A reverse proxy accepts client connections on behalf of backend servers, so the servers need not be directly reachable and the proxy can enforce TLS, filtering, and request normalization. It does not encrypt stored database files, remove the need for authentication, or guarantee availability.

Question 48Network Security Fundamentals

Which practice best limits the impact of a compromised VPN account?

  1. Allowing split tunneling to all internal subnets without restriction
  2. Disabling logging to reduce storage costs
  3. Sharing one VPN account among all remote staff
  4. Enforcing least-privilege access policies and session monitoring for remote users Correct answer.

Explanation

Least-privilege profiles and monitoring constrain what a compromised account can reach and reveal anomalous behavior quickly. Shared accounts destroy accountability, disabled logging removes detection, and unrestricted split tunneling widens exposure.

Question 49Network Security Fundamentals

An IDS signature matches a known exploit pattern, but the traffic is encrypted with TLS. What is the most accurate statement about the IDS's ability to detect the exploit?

  1. It can match the signature because TLS preserves plaintext headers for inspection
  2. It can detect the exploit because encryption does not cover application data
  3. It cannot inspect the encrypted payload unless it has access to decrypted traffic or TLS inspection Correct answer.
  4. It can detect the exploit by reading the TCP sequence numbers

Explanation

TLS encrypts application payloads, so a signature that inspects payload content cannot match unless the sensor terminates or receives decrypted traffic. Metadata such as addresses and ports may still be visible, but that is insufficient for content signatures.

Question 50Network Security Fundamentals

Which measure most directly reduces the risk of credential theft through phishing on a corporate network?

  1. Increasing the minimum password length to 8 characters
  2. Disabling account lockout thresholds
  3. Deploying phishing-resistant authentication such as FIDO2 security keys Correct answer.
  4. Publishing the password policy to all staff

Explanation

Phishing-resistant authenticators bind the credential to the legitimate origin, so a captured response cannot be replayed against a fake site. Longer passwords help against guessing but not against a user voluntarily submitting credentials to a phishing page.