FC0-U71 Security Practice Test 6 — 15 Questions

Question 1

Which of the following best describes the 'Confidentiality' component of the CIA triad?

Accepted Answer

Data is accessible only to authorized users. Confidentiality ensures that data is not accessed by unauthorized individuals. Integrity protects data from unauthorized modification, and availability ensures data is accessible when needed.

Answer

Systems are operational when needed

Answer

Data is encrypted at rest

Answer

Data is not modified without authorization

Question 2

An employee receives an email that appears to be from the CEO, urgently requesting a wire transfer to an external vendor. The email address looks slightly off. Which type of social engineering attack is this?

Accepted Answer

Spear phishing. This is a phishing attack, specifically spear phishing because it targets a specific individual (the employee) and impersonates the CEO to steal money.

Answer

Pretexting

Answer

Phishing

Answer

Vishing

Question 3

A company is implementing a backup strategy. Which of the following best adheres to the 3-2-1 backup rule?

Accepted Answer

Original data on a server, a backup on a NAS in the same building, and a backup in the cloud. The 3-2-1 rule means 3 copies of data, on 2 different media types, with 1 offsite. Option B meets this: 3 copies (original + 2 backups), 2 media (NAS + cloud), 1 offsite (cloud).

Answer

Two backups on tape drives, both stored in the server room

Answer

Original data on a laptop, a backup on a USB drive, and a backup on a second USB drive stored in a safe

Answer

One backup on an external drive stored in the same room as the server

Question 4

Which of the following is an example of multi-factor authentication?

Accepted Answer

Using a PIN and a smart card. MFA requires two or more factors: something you know (PIN), something you have (smart card), something you are (biometric). Option A combines a PIN (know) and a smart card (have).

Answer

Using a password and answering a security question

Answer

Using a fingerprint scanner alone

Answer

Using a password and a one-time code sent via SMS

Question 5

Which of the following is a characteristic of a strong password?

Accepted Answer

A password that is at least 12 characters long with a mix of character types. A strong password should be at least 12 characters, include uppercase, lowercase, numbers, and symbols, and should not be reused or shared.

Answer

A short password with only letters

Answer

A password that is easy to remember, like a pet's name

Answer

A password that is the same across multiple accounts

Question 6

An organization wants to ensure that employees only have access to the data necessary to perform their job functions. Which principle should be applied?

Accepted Answer

Least privilege. The principle of least privilege grants users only the permissions they need to do their work, minimizing potential damage.

Answer

Defense in depth

Answer

Separation of duties

Answer

Mandatory access control

Question 7

A security analyst notices that a user's computer is running slowly and displaying many pop-up ads. Which type of malware is most likely causing this?

Accepted Answer

Adware. Adware displays unwanted advertisements and often causes performance issues. Spyware collects information, ransomware encrypts files, and a rootkit hides itself.

Answer

Spyware

Answer

Ransomware

Answer

Rootkit

Question 8

Which of the following is the primary purpose of hashing a password before storing it in a database?

Accepted Answer

To verify the password without storing it in plaintext. Hashing is a one-way function that converts a password into a fixed-length string. It is used to securely store passwords so that even if the database is breached, the actual passwords are not easily recoverable.

Answer

To make the password longer and more secure

Answer

To compress the password to save storage space

Answer

To encrypt the password so it can be decrypted later

Question 9

What is the difference between a threat and a vulnerability?

Accepted Answer

A threat is a potential harm, and a vulnerability is a weakness. A threat is a potential source of harm (e.g., a hacker), while a vulnerability is a weakness that can be exploited (e.g., unpatched software).

Answer

They are the same thing

Answer

A threat is a weakness, and a vulnerability is a danger

Answer

A threat is a type of malware, and a vulnerability is a type of attack

Question 10

An employee is working from a coffee shop and needs to access company files. Which of the following is the most secure method?

Accepted Answer

Use a VPN to encrypt all traffic between the laptop and the company. A VPN encrypts traffic between the device and the company network, protecting data on public Wi-Fi. HTTPS alone protects only web traffic, and disabling sharing is not sufficient.

Answer

Connect directly to the company's network over the public Wi-Fi

Answer

Disable file sharing on the laptop

Answer

Use HTTPS websites only

Question 11

Which of the following is a characteristic of a worm compared to a virus?

Accepted Answer

A worm can self-replicate without user intervention. A worm can spread automatically without needing to attach to a host file or require user action, while a virus typically requires a host file and user execution to spread.

Answer

A worm is always disguised as legitimate software

Answer

A worm is a type of ransomware

Answer

A worm requires a host file to replicate

Question 12

What is the primary purpose of a firewall?

Accepted Answer

To prevent unauthorized network access. A firewall controls incoming and outgoing network traffic based on predetermined security rules. It filters traffic by port, protocol, or IP address to block unauthorized access.

Answer

To encrypt data on the hard drive

Answer

To detect and remove viruses

Answer

To manage user passwords

Question 13

A help desk technician receives a call from a user who says their computer is showing a message that files are encrypted and a ransom is demanded. Which TWO types of malware are most likely involved?

Accepted Answer

Trojan. Ransomware encrypts files for ransom. It is often delivered via a trojan (disguised as legitimate software) that the user inadvertently runs. The other options are incorrect: adware shows ads, spyware collects info, rootkit hides.

Answer

Spyware

Answer

Adware

Answer

Rootkit

Question 14

A company is developing a security policy. Which THREE of the following are examples of physical security controls?

Accepted Answer

Employing security guards to monitor entrances. Physical security controls protect hardware and facilities. Badge readers, locks, and guards are physical. Firewalls and antivirus are logical/technical controls.

Answer

Requiring employees to use strong passwords

Answer

Using a firewall to filter network traffic

Question 15

Which TWO of the following are best practices for password security?

Accepted Answer

Enabling multi-factor authentication whenever possible. Using a password manager helps generate and store strong, unique passwords. Enabling MFA adds an extra layer of security. Sharing passwords and using simple patterns are insecure.

Answer

Using simple patterns like '123456' or 'password'

Answer

Using the same password for multiple accounts

Answer

Sharing passwords with coworkers for convenience