FC0-U71 Practice Exam 4 — 20 Questions

Question 1

Which of the following is the primary purpose of hashing a password before storing it in a database?

Accepted Answer

To verify the password without storing it in plaintext. Hashing is a one-way function that converts a password into a fixed-length string. It is used to securely store passwords so that even if the database is breached, the actual passwords are not easily recoverable.

Answer

To make the password longer and more secure

Answer

To compress the password to save storage space

Answer

To encrypt the password so it can be decrypted later

Question 2

A user receives an email that appears to be from their bank, asking them to click a link and verify their account details. The user suspects it is a phishing attempt. Which type of phishing attack is this most likely to be?

Accepted Answer

Spear phishing. Spear phishing targets specific individuals or organizations, often using personalized information to appear legitimate.

Answer

Vishing

Answer

Whaling

Answer

Smishing

Question 3

A user receives an email that appears to be from their bank, asking them to click a link and verify their account. The email contains urgent language and a generic greeting. Which type of security threat is this?

Accepted Answer

Phishing. Phishing is a social engineering attack where attackers send deceptive emails to steal credentials. The generic greeting and urgent language are common signs.

Answer

Smishing

Answer

Spear phishing

Answer

Vishing

Question 4

Which type of malware is disguised as legitimate software but performs malicious actions?

Accepted Answer

Trojan. A Trojan horse appears useful but contains harmful code, unlike viruses or worms that self-replicate.

Answer

Virus

Answer

Ransomware

Answer

Worm

Question 5

A company wants to implement the principle of least privilege for its employees. Which TWO of the following actions align with this principle? (Choose TWO.)

Accepted Answer

Providing access only to the applications needed for each employee's role. Least privilege means giving users only the permissions necessary to perform their jobs. Granting access only to required applications and revoking old permissions enforce this.

Answer

Allowing employees to share passwords for convenience

Answer

Granting all employees administrative rights by default

Answer

Giving all employees full access to the company's financial data

Question 6

Which of the following is the best practice for backing up data according to the 3-2-1 rule?

Accepted Answer

Three copies on two different media types, with one copy stored offsite. The 3-2-1 rule means at least three copies of data, on two different types of storage media, with one copy stored offsite.

Answer

Three copies on three different external hard drives stored in the same building

Answer

Two copies on the same server, one on a different server

Answer

One copy on the same drive, one on an external drive, one in the cloud

Question 7

A security analyst is explaining the difference between a threat and a vulnerability. Which statement accurately describes this difference?

Accepted Answer

A threat is a potential cause of harm, and a vulnerability is a weakness that can be exploited.. A vulnerability is a weakness, while a threat is a potential danger that exploits that weakness.

Answer

A vulnerability is a risk, and a threat is a countermeasure.

Answer

A threat is a weakness in a system, and a vulnerability is an attack that exploits it.

Answer

A vulnerability is a potential harm, and a threat is likelihood times impact.

Question 8

Which of the following is the best practice for creating a strong password?

Accepted Answer

Using a 14-character phrase with numbers and symbols. A strong password is at least 12 characters with a mix of uppercase, lowercase, numbers, and symbols.

Answer

Using your pet's name

Answer

Using the same password for multiple accounts

Answer

Using a sequence of 8 characters with letters only

Question 9

Which of the following best describes the principle of least privilege?

Accepted Answer

Users should have the minimum access needed to perform their tasks.. The principle of least privilege grants users only the permissions necessary to perform their job functions, minimizing potential damage from accidents or attacks.

Answer

Access should be granted based on seniority within the organization.

Answer

All users should have the same level of access to ensure consistency.

Answer

Users should have full administrative access to their own devices.

Question 10

Which of the following is an example of a physical security control?

Accepted Answer

Biometric door lock. Physical security controls include measures like locks, guards, and biometric scanners to protect physical assets.

Answer

Password policy

Answer

Antivirus software

Answer

Firewall

Question 11

Which type of malware attaches to legitimate files and spreads when those files are executed?

Accepted Answer

Virus. A virus attaches itself to files or programs and replicates when the infected file is executed. Worms spread without a host file; trojans disguise as legitimate software.

Answer

Ransomware

Answer

Worm

Answer

Trojan

Question 12

Which TWO of the following are characteristics of a strong password? (Select TWO.)

Accepted Answer

Includes uppercase letters, numbers, and symbols. A strong password is at least 12 characters and includes a mix of character types. Using common words or personal information weakens the password.

Answer

Uses a common dictionary word

Answer

Based on your birth date

Answer

Contains only lowercase letters

Question 13

A company implements a policy where employees must swipe their ID card and then enter a PIN to access the server room. Which two authentication factors are being used?

Accepted Answer

Something you have and something you know. The ID card is 'something you have' (possession factor) and the PIN is 'something you know' (knowledge factor). This is multi-factor authentication.

Answer

Something you know and something you are

Answer

Something you have and something you are

Answer

Something you know and somewhere you are

Question 14

An employee receives an email that appears to be from the CEO, urgently requesting a wire transfer to an external vendor. The email address looks slightly off. Which type of social engineering attack is this?

Accepted Answer

Spear phishing. This is a phishing attack, specifically spear phishing because it targets a specific individual (the employee) and impersonates the CEO to steal money.

Answer

Pretexting

Answer

Phishing

Answer

Vishing

Question 15

Which TWO of the following are examples of multi-factor authentication? (Choose TWO.)

Accepted Answer

Smart card and a PIN. MFA requires two or more factors from different categories. A password plus a fingerprint combines knowledge (password) and inherence (fingerprint). A smart card plus a PIN combines possession (card) and knowledge (PIN).

Answer

Password and a security question

Answer

Username and password

Answer

Two different passwords

Question 16

A user receives an email that appears to be from their bank, asking them to click a link and verify their account details. The user notices the sender's email address is slightly misspelled. Which type of threat is this?

Accepted Answer

Phishing. Phishing is a social engineering attack where attackers send fraudulent emails to steal sensitive information.

Answer

Rootkit

Answer

Tailgating

Answer

Ransomware

Question 17

Which TWO of the following are types of malware? (Select TWO)

Accepted Answer

Ransomware. Ransomware and spyware are both types of malware. A firewall is a security tool, encryption is a protection method, and phishing is a social engineering attack.

Answer

Firewall

Answer

Encryption

Answer

Phishing

Question 18

A help desk technician receives a call from a user who says their computer is showing a message that files are encrypted and a ransom is demanded. Which TWO types of malware are most likely involved?

Accepted Answer

Trojan. Ransomware encrypts files for ransom. It is often delivered via a trojan (disguised as legitimate software) that the user inadvertently runs. The other options are incorrect: adware shows ads, spyware collects info, rootkit hides.

Answer

Spyware

Answer

Adware

Answer

Rootkit

Question 19

A company is implementing a backup strategy. Which of the following best adheres to the 3-2-1 backup rule?

Accepted Answer

Original data on a server, a backup on a NAS in the same building, and a backup in the cloud. The 3-2-1 rule means 3 copies of data, on 2 different media types, with 1 offsite. Option B meets this: 3 copies (original + 2 backups), 2 media (NAS + cloud), 1 offsite (cloud).

Answer

Two backups on tape drives, both stored in the server room

Answer

Original data on a laptop, a backup on a USB drive, and a backup on a second USB drive stored in a safe

Answer

One backup on an external drive stored in the same room as the server

Question 20

Which data structure is best for storing a collection of key-value pairs?

Accepted Answer

Dictionary. A dictionary (also known as a hash map or associative array) is specifically designed to store key-value pairs, allowing efficient insertion, deletion, and lookup based on a unique key. In computing, this structure uses a hash function to compute an index into an array of buckets, enabling average O(1) time complexity for operations, which is ideal for scenarios like caching or configuration settings.

Answer

Queue

Answer

Array

Answer

List