FC0-U71 Security Practice Test 2 — 15 Questions

Question 1

A security analyst is reviewing authentication logs and notices that an attacker tried many common passwords against a single user account in a short period. The account was not locked out, and the attacker eventually guessed the correct password. Which of the following should the analyst recommend to BEST prevent this type of attack in the future?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement account lockout after a set number of failed attempts. The attack described is a brute-force or dictionary attack against a single account, made possible by unlimited login attempts. Account lockout stops this by disabling the account after a few failures. While MFA and password policies add security, they do not directly prevent the repeated guessing that led to the compromise. Lockout is the most targeted and effective mitigation for this specific behavior.

Answer

Require users to change passwords every 30 days

Answer

Enable multifactor authentication for all users

Answer

Enforce a password complexity policy

Question 2

Which of the following best describes the principle of confidentiality in the CIA triad?

Accepted Answer

Preventing unauthorized access to information. Confidentiality in the CIA triad means ensuring information is not disclosed to unauthorized individuals, entities, or processes — i.e., preventing unauthorized access to information. It is enforced through encryption, access controls, and authentication. The scenario's phrasing 'preventing unauthorized access to information' is the textbook definition of confidentiality.

Answer

Data is not altered unexpectedly

Answer

Systems are accessible when needed

Answer

Ensuring data is backed up regularly

Question 3

A company implements a policy requiring employees to use a password and a one-time code sent to their mobile phone when logging into the corporate network. Which security concept is being employed?

Accepted Answer

Multi-factor authentication. Multi-factor authentication (MFA) requires two or more verification factors to gain access, such as a password (something you know) and a one-time code sent to a mobile phone (something you have). This combination enhances security by adding a layer beyond just a password.

Answer

Role-based access control

Answer

Single sign-on

Answer

Biometrics

Question 4

A user receives an email that appears to be from their bank, asking them to click a link and verify their account details. The email contains urgent language and threats of account closure. What type of attack is this?

Accepted Answer

Phishing. Phishing is a social engineering attack where attackers impersonate a legitimate entity to steal sensitive information.

Answer

Spear phishing

Answer

Smishing

Answer

Vishing

Question 5

Which of the following is the strongest password?

Accepted Answer

MyD0g!sF1d0. MyD0g!sF1d0 is the strongest because it is the longest option (11 characters) and combines uppercase, lowercase, digits, and special characters in a non-dictionary phrase. Length is the primary driver of password strength, and this password avoids common words or predictable substitutions like 'P@ssw0rd'. It would take significantly longer to crack via brute force or dictionary attacks than the other options.

Answer

12345678

Answer

P@ssw0rd

Answer

password

Question 6

A security analyst discovers that a file on a server has been modified without authorization. However, the system logs show that the modification was made by an authenticated user who had legitimate access to the file. Which aspect of the CIA triad has been violated?

Accepted Answer

Integrity. Integrity ensures that data is not modified or altered without authorization. Even though the user was authenticated and had legitimate access, the modification was unauthorized, which violates the integrity of the file. The CIA triad's integrity aspect is about protecting data from unauthorized changes.

Answer

Non-repudiation

Answer

Availability

Answer

Confidentiality

Question 7

Which of the following malware types is characterized by self-replication without needing to attach to a host file?

Accepted Answer

Worm. A worm is a standalone malware program that self-replicates and spreads across networks without requiring a host file or user intervention. It exploits vulnerabilities or uses social engineering to move between systems, often consuming bandwidth and system resources. Unlike viruses, worms do not need to attach themselves to legitimate files to propagate.

Answer

Virus

Answer

Trojan

Answer

Ransomware

Question 8

A company wants to ensure that sensitive documents are not readable if a laptop is stolen. Which of the following provides the best protection?

Accepted Answer

Full disk encryption. Full disk encryption (FDE) encrypts the entire storage drive, so if a laptop is stolen, the data remains unreadable without the decryption key. It protects data at rest even if the attacker removes the drive or boots from external media. This directly addresses the risk of physical theft.

Answer

Antivirus software

Answer

Firewall

Answer

Strong password on user account

Question 9

What is the primary purpose of a password manager?

Accepted Answer

To generate and store strong, unique passwords. A password manager's core function is to create high-entropy, unique passwords for every account and store them in an encrypted vault, eliminating password reuse and weak credentials. It uses a master password and strong encryption (e.g., AES-256) to protect the vault, and can auto-fill credentials, reducing human error. While some managers offer cloud sync or sharing, those are secondary features, not the primary purpose.

Answer

To store passwords in the cloud for easy access

Answer

To encrypt all network traffic

Answer

To share passwords securely with team members

Question 10

An attacker gains physical access to a building by following an employee through a secured door without using a badge. This is an example of which social engineering technique?

Accepted Answer

Tailgating. Tailgating (also called piggybacking) is the social engineering technique where an attacker follows an authorized employee through a secured door without using their own credentials. It exploits politeness or inattention rather than technical vulnerabilities, and it is a physical social engineering attack.

Answer

Phishing

Answer

Baiting

Answer

Pretexting

Question 11

A user downloads a free game from an untrusted website. After installation, the user's computer begins displaying pop-up advertisements frequently. Which type of malware is most likely installed?

Accepted Answer

Adware. Adware is malware that automatically displays or downloads unwanted advertisements, often bundled with free software from untrusted sources. The symptom described—frequent pop-up ads after installing a free game—matches adware's defining behavior. Unlike spyware, adware's primary goal is forced advertising rather than covert data collection.

Answer

Ransomware

Answer

Rootkit

Answer

Spyware

Question 12

An organization uses a security model where users are granted the minimum permissions necessary to perform their job functions. This model is known as:

Accepted Answer

Principle of least privilege. The principle of least privilege (PoLP) states that users, processes, and systems should be granted only the minimum access rights required to perform their legitimate functions, and only for the duration needed. The scenario's wording — 'minimum permissions necessary to perform their job functions' — is the textbook definition of PoLP. It is a foundational security principle (codified in NIST SP 800-53 AC-6) rather than an access control model per se, though it is often implemented through RBAC.

Answer

Role-based access control

Answer

Mandatory access control

Answer

Discretionary access control

Question 13

Which TWO of the following are effective measures to protect against ransomware attacks? (Select two.)

Accepted Answer

Installing the latest software updates and patches. Option B is correct because installing the latest software updates and patches closes known vulnerabilities (e.g., SMBv1/EternalBlue, RDP flaws) that ransomware such as WannaCry and NotPetya exploit to gain initial access and propagate laterally. Option D is correct because regularly backing up important files—ideally following the 3-2-1 rule with offline or immutable copies—allows restoration of data without paying a ransom, neutralizing the extortion leverage even if encryption occurs. Option A is wrong because reusing the same password across accounts enables credential-stuffing and lateral movement, dramatically increasing ransomware blast radius rather than protecting against it. Option C is wrong because disabling the firewall removes network traffic filtering and exposes hosts and services to scanning, exploitation, and command-and-control communication. Option E is wrong because opening attachments from unknown senders is a primary ransomware delivery vector via malicious macros, executables, or exploit-laden documents.

Answer

Using the same password for all accounts

Answer

Disabling the firewall

Answer

Opening email attachments from unknown senders

Question 14

Which THREE of the following are examples of multi-factor authentication? (Select three.)

Accepted Answer

A smart card and a PIN. Multi-factor authentication (MFA) requires combining factors from different categories: something you know (password, PIN), something you have (smart card, phone, token), and something you are (biometrics such as fingerprint or retina scan). Option A is correct because a smart card (something you have) plus a PIN (something you know) combines two distinct factor types. Option B is correct because a password (something you know) plus a fingerprint scan (something you are) also mixes two different factor categories. Option E is correct because a one-time code sent to a phone (something you have) plus a password (something you know) likewise draws on two separate factor types. Option C does not qualify because a retina scan and a fingerprint scan are both biometrics, i.e., two instances of the same 'something you are' factor. Option D does not qualify because a username and password are both 'something you know' and represent a single authentication factor.

Answer

A retina scan and a fingerprint scan

Answer

A username and password

Question 15

Which TWO of the following are recommended practices for physical security in an office environment? (Select two.)

Accepted Answer

Locking computer screens when leaving the desk. Option A is correct because locking the screen when leaving a desk prevents unauthorized individuals from accessing the system and data in the user's absence, which is a fundamental physical-access control in an office. Option D is correct because shredding documents containing sensitive information before disposal prevents dumpster-diving attacks and unauthorized recovery of confidential data, aligning with secure media disposal practices. Option B is not recommended because writing passwords on sticky notes exposes credentials to anyone who can physically see the monitor, defeating authentication controls. Option C is not recommended because sharing access badges breaks individual accountability and allows unauthorized entry under someone else's identity. Option E is not recommended because propping doors open bypasses physical access controls and enables tailgating or unauthorized entry into restricted areas.

Answer

Writing passwords on sticky notes and attaching them to monitors

Answer

Sharing access badges with colleagues

Answer

Leaving doors propped open for convenience