FC0-U71 Security Practice Test 3 — 15 Questions

Question 1

Which of the following best describes the principle of least privilege?

Accepted Answer

Users should have the minimum permissions needed to do their job. The principle of least privilege (PoLP) states that a user, process, or system should be granted only the minimum access rights necessary to perform its legitimate function, and nothing more. Option B captures this exactly: minimum permissions needed to do the job. This limits the blast radius of compromised accounts, insider misuse, and accidental misconfiguration, and is a foundational control in frameworks like NIST SP 800-53 AC-6 and CIS Controls.

Answer

Users should have all permissions by default

Answer

Users should use multi-factor authentication

Answer

Users should change passwords every 30 days

Question 2

A user receives an email that appears to be from their bank, asking them to click a link and verify their account details. The user notices the email address is slightly misspelled (e.g., 'support@bankk.com' instead of 'support@bank.com'). Which type of attack is this?

Accepted Answer

Phishing. This is a phishing attack because it uses a fraudulent email impersonating a trusted institution (the bank) to trick the recipient into clicking a link and revealing account credentials. The misspelled domain is a classic phishing indicator designed to look legitimate at a glance. It is a broad, untargeted credential-harvesting attempt.

Answer

Smishing

Answer

Spear phishing

Answer

Vishing

Question 3

An organization implements a security control that requires users to swipe a smart card and then enter a PIN to access a secure facility. Which combination of authentication factors does this represent?

Accepted Answer

Something you have and something you know. A smart card is a physical token the user possesses, satisfying 'something you have,' while a PIN is a memorized secret, satisfying 'something you know.' Combining these two different factor categories constitutes multi-factor authentication (MFA), which is stronger than single-factor or same-category authentication. This is a classic two-factor physical access control scenario.

Answer

Something you are and something you have

Answer

Something you know and something you do

Answer

Something you know and something you are

Question 4

Which of the following is a characteristic of a worm in the context of malware?

Accepted Answer

It self-replicates without needing a host file. A worm is a standalone malware that replicates itself to spread to other computers without needing to attach to a host file, often exploiting network vulnerabilities.

Answer

It disguises itself as legitimate software

Answer

It encrypts files and demands a ransom

Answer

It requires a host file to spread

Question 5

A company wants to protect its network from unauthorized external access. Which of the following devices should be configured to filter traffic based on port and protocol?

Accepted Answer

Network firewall. A network firewall is specifically designed to inspect and filter traffic traversing the network perimeter based on rules that match port numbers, protocols (TCP/UDP/ICMP), and source/destination IP addresses. It sits between the internal network and external networks, making it the correct device to block unauthorized external access at the network boundary.

Answer

Host-based firewall

Answer

VPN concentrator

Answer

Antivirus software

Question 6

An employee is tailgated into a secure office building by someone without a badge. Which type of security threat does this represent?

Accepted Answer

Tailgating. Tailgating is the correct answer because it specifically describes an unauthorized person following an authorized employee through a secure door without presenting credentials. This is a physical security threat, not a social engineering attack conducted remotely. The scenario matches the definition exactly.

Answer

Phishing

Answer

Baiting

Answer

Pretexting

Question 7

An organization adopts the 3-2-1 backup rule. Which of the following practices aligns with this rule?

Accepted Answer

Three copies of data on two different media types, with one offsite. The 3-2-1 rule means three total copies of data (the original plus two backups), stored on two different media types, with at least one copy kept offsite. Option A matches this definition exactly.

Answer

Four backups all stored on tape

Answer

One backup stored in the same location as the original

Answer

Two copies of data on the same hard drive

Question 8

A security analyst is explaining the CIA triad to new employees. Which scenario best illustrates a breach of integrity?

Accepted Answer

An attacker modifies financial records in a database without authorization. Integrity in the CIA triad refers to protecting data from unauthorized modification. An attacker modifying financial records in a database without authorization directly violates integrity because the data is altered, potentially leading to incorrect decisions or fraud. This scenario best illustrates a breach of integrity.

Answer

An employee accidentally deletes a critical file

Answer

An attacker steals customer credit card numbers from a database

Answer

A denial-of-service attack makes a website unavailable

Question 9

Which of the following is a best practice for creating a strong password?

Accepted Answer

Using a long passphrase that includes symbols and numbers. A long passphrase that includes symbols and numbers is considered a best practice because it increases both length and complexity, making it significantly harder for attackers to crack using brute-force or dictionary attacks. Length is the most critical factor in password strength, and adding symbols and numbers further expands the search space. This approach aligns with guidance from NIST and other security organizations, which recommend passphrases over short, complex passwords.

Answer

Using a password with 8 characters including letters and numbers

Answer

Reusing the same password across multiple sites

Answer

Using your pet's name as a password

Question 10

A small business owner wants to protect customer data stored on laptops in case the devices are stolen. Which encryption method provides the best protection for the entire hard drive?

Accepted Answer

Full disk encryption. Full disk encryption (FDE) encrypts the entire storage volume — OS, applications, temp files, and user data — using a key protected by a TPM or pre-boot authentication, so a stolen laptop's drive is unreadable without the credential. Because it covers everything on the disk, it protects customer data regardless of which files or folders it lives in. This is the standard control for lost/stolen device scenarios.

Answer

HTTPS encryption for web traffic

Answer

File-level encryption on individual documents

Answer

A VPN when connecting to the internet

Question 11

Which of the following is a key difference between a vulnerability and a threat in cybersecurity?

Accepted Answer

A vulnerability is a weakness, while a threat is a potential danger. A vulnerability is a weakness or flaw in a system (e.g., unpatched software, misconfiguration) that could be exploited, while a threat is any potential danger or actor that could exploit that weakness (e.g., a hacker, malware, or natural disaster). Option C correctly captures this weakness-versus-danger distinction. Understanding the difference is essential for risk assessment, since risk = threat × vulnerability × impact.

Answer

A vulnerability is a potential harm, while a threat is a weakness

Answer

A vulnerability is always present, while a threat is actively exploited

Answer

A vulnerability can be patched, but a threat cannot be mitigated

Question 12

A company implements a policy where employees must lock their computer screen when leaving their desk. Which security principle does this practice support?

Accepted Answer

Confidentiality. Locking the computer screen when leaving a desk supports the confidentiality principle by preventing unauthorized individuals from viewing or accessing sensitive information on the screen or through the unlocked session. It ensures that only authorized users can access the data, aligning with confidentiality's goal of protecting information from unauthorized disclosure. This is a physical and operational control that directly reduces the risk of data exposure.

Answer

Availability

Answer

Authentication

Answer

Integrity

Question 13

Which TWO of the following are examples of social engineering attacks? (Select TWO.)

Accepted Answer

Pretexting. Pretexting (B) is a social engineering attack because it manipulates a person through a fabricated scenario or false identity to obtain information or access, exploiting human trust rather than technical vulnerabilities. Tailgating (D) is also a social engineering attack, as it relies on physically following an authorized person into a restricted area without proper credentials, exploiting human courtesy or inattention. The remaining options are technical malware or attack types rather than social engineering: a rootkit (A) is stealthy software that hides privileged access, a worm (C) is self-replicating malware that spreads across networks, and ransomware (E) is malware that encrypts data and demands payment.

Answer

Rootkit

Answer

Worm

Answer

Ransomware

Question 14

Which THREE of the following are effective methods to protect against malware infections? (Select THREE.)

Accepted Answer

Install and maintain antivirus software. Option B is correct because installing and maintaining antivirus software with current signature/definition databases enables detection, blocking, and removal of known malware before it can execute or spread. Option C is correct because a firewall filters inbound and outbound traffic against defined rules, blocking malicious connections, command-and-control callbacks, and unauthorized remote access that malware relies on. Option E is correct because keeping operating systems and applications patched closes known vulnerabilities (e.g., unpatched RCE flaws) that malware exploits to gain initial access or escalate privileges. Option A is wrong because opening all email attachments regardless of sender is a primary malware delivery vector, especially via phishing and malicious macros. Option D is wrong because disabling automatic software updates leaves systems exposed to publicly known exploits that vendors have already fixed.

Answer

Open all email attachments regardless of sender

Answer

Disable automatic software updates to avoid changes

Question 15

Which TWO of the following are characteristics of a strong password? (Select TWO.)

Accepted Answer

Includes uppercase letters, numbers, and symbols. Option A is correct because a strong password should combine uppercase letters, numbers, and symbols to increase its character-set complexity, making brute-force and dictionary attacks far less effective. Option C is correct because a minimum length of at least 12 characters significantly increases the number of possible combinations, which is a key factor in resisting cracking attempts. Options B, D, and E are not correct: a common dictionary word (B) is easily guessed via dictionary attacks, a birth date (D) is predictable personal information, and using only lowercase letters (E) severely limits the character set and thus the password's strength.

Answer

Uses a common dictionary word

Answer

Based on your birth date

Answer

Contains only lowercase letters