FC0-U71 Security Practice Test 4 — 15 Questions

Question 1

An organization implements a security policy where users must provide a password and a one-time code generated by a mobile app to log in. Which type of authentication is being used?

Accepted Answer

Two-factor authentication. Two-factor authentication (2FA) requires two different categories of authentication factors: something you know (the password) and something you have (the one-time code generated by the mobile app). Because the password and the OTP come from separate factor classes, this satisfies the definition of 2FA rather than single-factor or a single-category method. The mobile app acts as a soft token, but the overall scheme is still classified as two-factor authentication.

Answer

Biometric authentication

Answer

Token-based authentication

Answer

Single-factor authentication

Question 2

Which of the following is a characteristic of a strong password?

Accepted Answer

Contains a combination of uppercase, lowercase, numbers, and symbols. A strong password uses a mix of character types — uppercase, lowercase, numbers, and symbols — to increase entropy and resist brute-force and dictionary attacks. This complexity requirement is a widely accepted characteristic of strong passwords. Length also matters, but among the options, the combination of character classes is the defining characteristic.

Answer

Is exactly 8 characters long

Answer

Uses only lowercase letters

Answer

Is the same as the username

Question 3

A company requires all employees to use a smart card and a PIN to access the building. This is an example of which concept?

Accepted Answer

Multi-factor authentication. Multi-factor authentication combines something you have (smart card) and something you know (PIN).

Answer

Authorization

Answer

Biometrics

Answer

Single sign-on

Question 4

A security analyst discovers that a file on a server has been modified without authorization. Which element of the CIA triad has been compromised?

Accepted Answer

Integrity. Integrity ensures that data has not been altered or tampered with in an unauthorized manner. Since the file was modified without authorization, the integrity of the data has been compromised, which is the definition of an integrity violation in the CIA triad.

Answer

Non-repudiation

Answer

Availability

Answer

Confidentiality

Question 5

Which type of malware is designed to replicate itself and spread to other computers without needing to attach to a host file?

Accepted Answer

Worm. Worms are self-replicating and spread independently, unlike viruses which attach to files.

Answer

Trojan

Answer

Virus

Answer

Ransomware

Question 6

Which of the following is the best practice for backing up data according to the 3-2-1 rule?

Accepted Answer

Three copies on two different media types, with one copy stored offsite. The 3-2-1 rule means at least three copies of data, on two different types of storage media, with one copy stored offsite.

Answer

Three copies on three different external hard drives stored in the same building

Answer

Two copies on the same server, one on a different server

Answer

One copy on the same drive, one on an external drive, one in the cloud

Question 7

An attacker gains physical access to a secure area by following an authorized employee through a door that requires a badge. This social engineering technique is known as:

Accepted Answer

Tailgating. Tailgating (or piggybacking) is when an unauthorized person follows an authorized person into a restricted area without proper authentication.

Answer

Pretexting

Answer

Phishing

Answer

Baiting

Question 8

A user reports that their computer has been displaying unwanted pop-up advertisements frequently. Which type of malware is most likely responsible?

Accepted Answer

Adware. Adware displays unwanted advertisements, often in pop-ups or banners.

Answer

Ransomware

Answer

Spyware

Answer

Rootkit

Question 9

Which of the following is an example of a physical security control?

Accepted Answer

Biometric door lock. Physical security controls include measures like locks, guards, and biometric scanners to protect physical assets.

Answer

Password policy

Answer

Antivirus software

Answer

Firewall

Question 10

A company wants to implement the principle of least privilege for its employees. Which TWO of the following actions align with this principle? (Choose TWO.)

Accepted Answer

Providing access only to the applications needed for each employee's role. Option A is correct because least privilege means granting each user only the minimum access required to perform their job, so providing access only to the applications needed for each employee's role directly enforces that restriction. Option D is correct because least privilege requires continuously right-sizing permissions; revoking access when an employee changes roles prevents privilege accumulation and removes rights no longer needed for the new position. Option B is not correct because sharing passwords destroys individual accountability and grants access beyond what any single user should have. Option C is not correct because granting administrative rights by default massively exceeds the minimum necessary privileges. Option E is not correct because giving everyone full access to financial data violates least privilege by exposing sensitive data to users who do not need it.

Answer

Allowing employees to share passwords for convenience

Answer

Granting all employees administrative rights by default

Answer

Giving all employees full access to the company's financial data

Question 11

Which TWO of the following are examples of multi-factor authentication? (Choose TWO.)

Accepted Answer

Smart card and a PIN. Option C (Smart card and a PIN) is correct because it combines two different authentication factor categories: a smart card is something you have (a physical token holding a certificate or key), while a PIN is something you know, satisfying multi-factor authentication. Option E (Password and a fingerprint scan) is correct because it pairs something you know (the password) with something you are (a biometric fingerprint), which are distinct factor types. Options A, B, and D are not multi-factor: A uses two things you know (password and security question), B is a single factor (something you know), and D is also two instances of the same knowledge factor, so none combine different factor categories.

Answer

Password and a security question

Answer

Username and password

Answer

Two different passwords

Question 12

Which element of the CIA triad is primarily concerned with ensuring that data is not accessed by unauthorized individuals?

Accepted Answer

Confidentiality. Confidentiality is the CIA triad element that ensures data is only accessible to authorized individuals, typically enforced through encryption, access controls, and authentication mechanisms. It directly addresses the concern of preventing unauthorized access or disclosure. Integrity concerns data accuracy, and availability concerns uptime — neither addresses unauthorized access.

Answer

Authentication

Answer

Availability

Answer

Integrity

Question 13

A user receives an email that appears to be from their bank, asking them to click a link and verify their account details. The user notices the sender's email address is slightly misspelled. Which type of threat is this?

Accepted Answer

Phishing. Phishing is a social engineering attack where attackers send fraudulent emails to steal sensitive information.

Answer

Rootkit

Answer

Tailgating

Answer

Ransomware

Question 14

An organization requires employees to use a password and a one-time code sent to their mobile phone when logging into the network. Which security principle is being implemented?

Accepted Answer

Multi-factor authentication. Multi-factor authentication (MFA) requires two or more factors: something you know (password) and something you have (phone).

Answer

Least privilege

Answer

Biometrics

Answer

Single sign-on

Question 15

Which of the following is the best practice for creating a strong password?

Accepted Answer

Using a 14-character phrase with numbers and symbols. A strong password is at least 12 characters with a mix of uppercase, lowercase, numbers, and symbols.

Answer

Using your pet's name

Answer

Using the same password for multiple accounts

Answer

Using a sequence of 8 characters with letters only