FC0-U71 Security Practice Test 7 — 15 Questions

Question 1

A company is developing a security policy. Which THREE of the following are examples of physical security controls?

Accepted Answer

Employing security guards to monitor entrances. Option A is correct because security guards monitoring entrances are a classic physical security control, providing deterrence and access control at the facility perimeter. Option D is correct because badge readers on doors are physical access control mechanisms that restrict entry to authorized personnel using credentials such as RFID or smart cards. Option E is correct because biometric locks on server rooms are physical controls that authenticate individuals via fingerprints, iris scans, or similar traits before granting access to sensitive areas. Option B is not a physical control; strong passwords are a logical/technical authentication control. Option C is not a physical control; firewalls are network security devices that filter traffic at the logical layer.

Answer

Requiring employees to use strong passwords

Answer

Using a firewall to filter network traffic

Question 2

Which TWO of the following are best practices for password security?

Accepted Answer

Enabling multi-factor authentication whenever possible. Option A is correct because enabling multi-factor authentication (MFA) adds a second verification factor (something you have, such as a TOTP code or hardware token, or something you are, such as a fingerprint) on top of the password, so a stolen or guessed password alone is no longer sufficient to compromise the account. Option E is correct because a password manager generates high-entropy, unique passwords for each account and stores them encrypted (typically with AES-256) behind a single strong master passphrase, which eliminates password reuse and makes credential stuffing attacks ineffective. The remaining options are poor practices: B uses trivially guessable patterns that appear at the top of every breach wordlist, C enables credential stuffing and lateral movement because one breach exposes all accounts, and D destroys individual accountability and non-repudiation while widening the attack surface to every person who knows the shared secret.

Answer

Using simple patterns like '123456' or 'password'

Answer

Using the same password for multiple accounts

Answer

Sharing passwords with coworkers for convenience

Question 3

A user receives an email from their bank asking them to click a link and verify their account information. The email contains spelling errors and the sender's address looks suspicious. Which type of social engineering attack is this?

Accepted Answer

Phishing. This is a phishing attack because it is a broad, untargeted email attempting to trick the recipient into clicking a link and providing account information. The presence of spelling errors and a suspicious sender address are classic indicators of phishing. Phishing typically targets many users indiscriminately, unlike spear phishing which is highly targeted.

Answer

Spear phishing

Answer

Pretexting

Answer

Vishing

Question 4

Which TWO of the following are examples of multi-factor authentication?

Accepted Answer

A smart card and a PIN. It combines two distinct authentication factors: something you have (the smart card) and something you know (the PIN), which is the definition of multi-factor authentication. Option C (a password and a fingerprint scan) is also correct because it pairs something you know (the password) with something you are (the fingerprint biometric), satisfying MFA's requirement for different factor categories. Option B (two different passwords) is not MFA because both are the same factor type—something you know—so it is merely multi-instance, not multi-factor. Option D (a username and a password) is not MFA because a username is an identifier, not an authentication factor, and the password alone represents a single factor. Option E (a password and a security question) is not MFA because both are knowledge-based factors (something you know), so they belong to the same factor category.

Answer

Two different passwords

Answer

A username and a password

Answer

A password and a security question

Question 5

Which TWO of the following are characteristics of ransomware?

Accepted Answer

It encrypts the victim's files.. Option C is correct because the defining behavior of ransomware is that it encrypts the victim's files (often using strong symmetric ciphers like AES with a per-file key, then wrapping that key with asymmetric encryption such as RSA), rendering the data inaccessible until a key is provided. Option D is correct because ransomware is a form of extortion: after encryption it presents a ransom note demanding payment, typically in cryptocurrency such as Bitcoin or Monero, in exchange for the decryption key or tool. Option A describes spyware, which covertly harvests user information rather than encrypting and holding data hostage. Option B describes a worm, which propagates across systems autonomously without user interaction, a spreading mechanism rather than the extortion characteristic of ransomware. Option E describes a Trojan, which masquerades as legitimate software to trick users into running it, and while ransomware is often delivered via Trojans, disguise is not its defining characteristic.

Answer

It collects user information without consent.

Answer

It self-replicates to other systems without user interaction.

Answer

It disguises itself as legitimate software.

Question 6

Which THREE of the following are best practices for password security?

Accepted Answer

Enabling two-factor authentication where possible. Option B is correct because enabling two-factor authentication (2FA) adds a second verification factor (e.g., TOTP, hardware token, or push notification) beyond the password, so a stolen or guessed password alone is insufficient to compromise the account. Option C is correct because a password manager generates high-entropy, unique credentials for each site and stores them encrypted (typically under AES-256 with a master passphrase), eliminating weak or reused passwords and reducing the risk of credential-stuffing attacks. Option E is correct because length and character diversity increase the search space, making brute-force and dictionary attacks computationally impractical; 12+ characters mixing uppercase, lowercase, digits, and symbols aligns with NIST and common policy guidance for strong passwords. Option A is wrong because sharing passwords destroys individual accountability and non-repudiation, and violates least-privilege and audit principles; use delegated accounts or role-based access instead. Option D is wrong because reusing one password across sites means a single breach exposes all accounts via credential stuffing, so every account should have a unique password.

Answer

Sharing passwords with trusted coworkers when necessary

Answer

Reusing the same password across multiple sites

Question 7

A security analyst is evaluating risks to the company's network. According to the risk formula (Risk = Likelihood × Impact), which THREE of the following are considered vulnerabilities?

Accepted Answer

Weak encryption used for data in transit. In the risk formula Risk = Likelihood × Impact, vulnerabilities are internal weaknesses or flaws that can be exploited or triggered by a threat. Option A (weak encryption for data in transit) is correct because using outdated or weak ciphers/protocols such as SSLv3, TLS 1.0, or RC4 is a configuration weakness that exposes data to interception. Option D (employees not trained to recognize phishing emails) is correct because lack of security awareness is a human vulnerability that enables social-engineering attacks like credential harvesting. Option E (unpatched software on the company's web server) is correct because missing security patches leave known CVEs exploitable, a classic technical vulnerability. Option B (a hacker attempting to guess passwords) is a threat actor/action, not a vulnerability, and Option C (a fire in the data center) is a physical threat or hazard, not a vulnerability.

Answer

A hacker attempting to guess passwords

Answer

A fire in the data center

Question 8

Which TWO of the following are examples of physical security controls?

Accepted Answer

A security guard at the entrance. A security guard at the entrance (A) is a physical security control because it involves a human presence that deters, detects, and responds to unauthorized physical access to a facility. A lock on a server room door (E) is also a physical security control, as it is a mechanical barrier that restricts physical access to the servers and other hardware inside. In contrast, a firewall (B) is a logical/network security control that filters traffic based on rules, not a physical barrier. Antivirus software (C) is a host-based logical control that detects and removes malicious code. An intrusion detection system (D) is a logical monitoring control that analyzes network or host activity for signs of attacks, so it is not a physical control either.

Answer

A firewall

Answer

Antivirus software

Answer

An intrusion detection system

Question 9

A user wants to protect their laptop in case it is stolen. Which TWO of the following measures would help protect the confidentiality of the data?

Accepted Answer

Full disk encryption. Full disk encryption (B) is correct because it encrypts the entire drive, so if the laptop is stolen the data remains unreadable without the decryption key, directly preserving confidentiality. A strong user account password (D) is correct because it prevents a thief from logging into the OS and accessing files under that account, adding an authentication barrier to the data. A BIOS password (A) only restricts firmware/startup access and can often be bypassed or reset, so it does not protect data confidentiality by itself. A VPN (C) protects data in transit on untrusted networks and does nothing for a stolen device. Screen lock with a password (E) only secures the current session and is trivially bypassed by removing the drive or booting another OS.

Answer

A strong password set in the BIOS

Answer

Using a VPN when connected to public Wi-Fi

Answer

Enabling the screen lock with a password

Question 10

A small accounting firm's wireless network currently uses WPA2-Personal with a shared passphrase that all 20 employees know. The office manager reports that a former contractor who was given the passphrase can still connect to the Wi-Fi from the parking lot. The firm wants each user to authenticate with their own unique credentials and wants to be able to revoke access for one person without disrupting everyone else. Which wireless security method should the firm implement?

Accepted Answer

WPA2-Enterprise with 802.1X authentication against a RADIUS server. The firm needs two things a shared passphrase cannot provide: distinct credentials per person and the ability to cut off one account without rekeying the whole office. WPA2-Enterprise pairs 802.1X with a RADIUS server so each login is validated individually against a directory, and disabling the contractor's account instantly blocks that person. Personal modes, MAC filtering, and WPS all rely on a network-wide secret or device identifiers rather than user identity.

Answer

MAC address filtering on the wireless access point

Answer

Wi-Fi Protected Setup (WPS) with push-button configuration for each employee

Answer

WPA3-Personal with Simultaneous Authentication of Equals (SAE)

Question 11

A small office wants to prevent unauthorized people from connecting to its wireless network while still allowing visitors to use Wi-Fi. The office manager enables WPA3-Personal on the access point. Which requirement does this configuration satisfy?

Accepted Answer

It requires a shared passphrase before a device can join the wireless network.. WPA3-Personal secures a wireless network by requiring a shared passphrase during association, so only devices with the correct passphrase can join. This prevents unauthorized users from connecting while allowing anyone who is given the passphrase, such as visitors, to use the Wi-Fi. The other choices describe unrelated functions such as local storage encryption, DHCP addressing, and DNS filtering.

Answer

It encrypts all files stored on the access point's internal memory.

Answer

It automatically assigns IP addresses to devices that join the network.

Answer

It blocks malicious websites by filtering DNS requests from connected clients.

Question 12

A technician is configuring a Windows workstation for a finance employee. The employee needs to read and update customer records but should not be able to change the folder's permissions or take ownership. Which NTFS permission should the technician assign?

Accepted Answer

Modify. Modify grants read, write, edit, and delete capabilities on files and subfolders without allowing the user to change permissions or take ownership. That matches the finance employee's need to read and update records while leaving the folder's security settings under administrative control. Full control would be excessive, while Read & execute and Write each fail to cover the required read-and-update combination.

Answer

Read & execute

Answer

Full control

Answer

Write

Question 13

A small accounting firm stores client tax records on a shared network folder. The owner wants to ensure that only the three staff members who prepare taxes can open those files, while other employees can still access the general office folder. Which security concept should the owner apply to the tax records folder?

Accepted Answer

Access control lists (ACLs) that grant permissions only to the tax preparers group. The requirement is an authorization decision about who may read specific files on a shared server. ACLs attached to the tax folder let the owner grant permissions to a tax preparers group and deny everyone else, while leaving the general office folder open to all staff. Encryption, firewalls, and antivirus address different risks and cannot enforce per-user file access.

Answer

Full disk encryption on each employee workstation

Answer

A firewall rule that blocks the file server's SMB port for non-tax staff

Answer

Antivirus software configured to scan the shared folder nightly

Question 14

A small business owner installs a wireless access point in a coffee shop for customers. The owner wants to prevent strangers outside the building from reading the wireless traffic of paying customers. Which security feature should be enabled on the access point?

Accepted Answer

WPA3 encryption with a shared passphrase. Wireless signals travel through walls and into public spaces, so the only reliable way to keep outsiders from reading customer traffic is strong over-the-air encryption. WPA3 with a shared passphrase encrypts every frame using SAE, preventing passive eavesdroppers from recovering data even if they capture the radio transmissions. Hiding the SSID, filtering MAC addresses, and lowering power are obscurity or access measures that leave traffic readable.

Answer

MAC address filtering on the access point

Answer

Disabling the SSID broadcast

Answer

Reducing the transmit power of the access point

Question 15

A user's web browser displays a warning that the connection to an online store is not private because the site's certificate cannot be validated. The user asks a technician what the warning means. Which explanation is MOST accurate?

Accepted Answer

The browser cannot verify the identity of the site or that the connection is securely encrypted.. A certificate warning means the browser could not validate the site's TLS certificate, so it cannot confirm the site's identity or guarantee an encrypted, trustworthy connection. Causes include expired certificates, hostname mismatches, self-signed certificates, or untrusted issuing authorities. Malware infection, a dropped connection, and outdated HTML do not produce this specific warning, so the accurate explanation is the one describing failed identity and encryption verification.

Answer

The online store is using an outdated version of HTML that the browser no longer supports.

Answer

The user's internet connection has been disconnected and the page is loading from the cache.

Answer

The store's website has been infected with malware that is stealing payment information.