FC0-U71 Security Practice Test 2 — 15 Questions

Question 1

Which TWO of the following are recommended practices for physical security in an office environment? (Select two.)

Accepted Answer

Locking computer screens when leaving the desk. Locking screens when away prevents unauthorized access; shredding documents ensures sensitive information is not readable.

Answer

Writing passwords on sticky notes and attaching them to monitors

Answer

Sharing access badges with colleagues

Answer

Leaving doors propped open for convenience

Question 2

Which of the following best describes the principle of least privilege?

Accepted Answer

Users should have the minimum permissions needed to do their job. The principle of least privilege states that users should be granted only the minimum permissions necessary to perform their job functions, reducing potential damage from accidents or attacks.

Answer

Users should have all permissions by default

Answer

Users should use multi-factor authentication

Answer

Users should change passwords every 30 days

Question 3

A user receives an email that appears to be from their bank, asking them to click a link and verify their account details. The user notices the email address is slightly misspelled (e.g., 'support@bankk.com' instead of 'support@bank.com'). Which type of attack is this?

Accepted Answer

Phishing. Phishing is a social engineering attack where attackers send fraudulent emails pretending to be from legitimate sources to steal sensitive information.

Answer

Smishing

Answer

Spear phishing

Answer

Vishing

Question 4

An organization implements a security control that requires users to swipe a smart card and then enter a PIN to access a secure facility. Which combination of authentication factors does this represent?

Accepted Answer

Something you have and something you know. Smart card is 'something you have' and PIN is 'something you know', making it two-factor authentication using different factor types.

Answer

Something you are and something you have

Answer

Something you know and something you do

Answer

Something you know and something you are

Question 5

Which of the following is a characteristic of a worm in the context of malware?

Accepted Answer

It self-replicates without needing a host file. A worm is a standalone malware that replicates itself to spread to other computers without needing to attach to a host file, often exploiting network vulnerabilities.

Answer

It disguises itself as legitimate software

Answer

It encrypts files and demands a ransom

Answer

It requires a host file to spread

Question 6

A company wants to protect its network from unauthorized external access. Which of the following devices should be configured to filter traffic based on port and protocol?

Accepted Answer

Network firewall. A network firewall examines incoming and outgoing traffic and can block or allow based on rules involving ports and protocols, providing a barrier between internal and external networks.

Answer

Host-based firewall

Answer

VPN concentrator

Answer

Antivirus software

Question 7

An employee is tailgated into a secure office building by someone without a badge. Which type of security threat does this represent?

Accepted Answer

Tailgating. Tailgating (or piggybacking) is a physical social engineering attack where an unauthorized person follows an authorized person into a restricted area.

Answer

Phishing

Answer

Baiting

Answer

Pretexting

Question 8

An organization adopts the 3-2-1 backup rule. Which of the following practices aligns with this rule?

Accepted Answer

Three copies of data on two different media types, with one offsite. The 3-2-1 rule means having three copies of data on two different media types with one copy offsite. Storing backups on external drives and cloud meets this requirement.

Answer

Four backups all stored on tape

Answer

One backup stored in the same location as the original

Answer

Two copies of data on the same hard drive

Question 9

A security analyst is explaining the CIA triad to new employees. Which scenario best illustrates a breach of integrity?

Accepted Answer

An attacker modifies financial records in a database without authorization. Integrity means data is not altered without authorization. An unauthorized modification breaches integrity, even if the system remains available and confidential.

Answer

An employee accidentally deletes a critical file

Answer

An attacker steals customer credit card numbers from a database

Answer

A denial-of-service attack makes a website unavailable

Question 10

Which of the following is a best practice for creating a strong password?

Accepted Answer

Using a long passphrase that includes symbols and numbers. Strong passwords should be at least 12 characters, include a mix of uppercase, lowercase, numbers, and symbols, and should not be reused across accounts.

Answer

Using a password with 8 characters including letters and numbers

Answer

Reusing the same password across multiple sites

Answer

Using your pet's name as a password

Question 11

A small business owner wants to protect customer data stored on laptops in case the devices are stolen. Which encryption method provides the best protection for the entire hard drive?

Accepted Answer

Full disk encryption. Full disk encryption (e.g., BitLocker or FileVault) encrypts the entire drive, making data unreadable without the decryption key even if the physical device is stolen.

Answer

HTTPS encryption for web traffic

Answer

File-level encryption on individual documents

Answer

A VPN when connecting to the internet

Question 12

Which of the following is a key difference between a vulnerability and a threat in cybersecurity?

Accepted Answer

A vulnerability is a weakness, while a threat is a potential danger. A vulnerability is a weakness that could be exploited, while a threat is a potential danger (e.g., a hacker or malware) that could exploit that vulnerability.

Answer

A vulnerability is a potential harm, while a threat is a weakness

Answer

A vulnerability is always present, while a threat is actively exploited

Answer

A vulnerability can be patched, but a threat cannot be mitigated

Question 13

A company implements a policy where employees must lock their computer screen when leaving their desk. Which security principle does this practice support?

Accepted Answer

Confidentiality. Locking the screen prevents unauthorized access when the user is away, supporting confidentiality by ensuring only authorized users can access the system.

Answer

Availability

Answer

Authentication

Answer

Integrity

Question 14

Which TWO of the following are examples of social engineering attacks? (Select TWO.)

Accepted Answer

Pretexting. Pretexting involves creating a fabricated scenario to gain information, and tailgating is following an authorized person into a restricted area. Both manipulate human behavior rather than technical systems.

Answer

Rootkit

Answer

Worm

Answer

Ransomware

Question 15

Which THREE of the following are effective methods to protect against malware infections? (Select THREE.)

Accepted Answer

Install and maintain antivirus software. Antivirus software detects and removes malware; keeping software updated patches vulnerabilities; using a firewall blocks malicious traffic. Disabling software updates would increase risk, and opening all email attachments is dangerous.

Answer

Open all email attachments regardless of sender

Answer

Disable automatic software updates to avoid changes