FC0-U71 Security Practice Test 9 — 15 Questions

Question 1

A security administrator is reviewing authentication logs and notices hundreds of failed login attempts against many user accounts from a single external IP address within a few minutes. No accounts were successfully accessed. Which type of attack is occurring?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Brute-force attack. The log shows automated, high-volume login attempts against many accounts from one source with no successes, which is the classic fingerprint of a brute-force attack. Phishing requires user interaction and would not produce this server-side pattern. Man-in-the-middle and denial-of-service attacks have different goals and signatures, so brute force is the accurate classification.

Answer

Phishing campaign

Answer

Denial-of-service attack

Answer

Man-in-the-middle attack

Question 2

A user's workstation has become slow and shows unexpected pop-up windows even when no browser is open. A technician suspects malware and wants to reduce the risk of further compromise while investigating. Which TWO actions should the technician take FIRST? (Choose two.)

Accepted Answer

Document the observed symptoms and note the time they began.. Containment and evidence preservation come before remediation. Disconnecting the workstation stops active communication with external infrastructure and prevents lateral spread, while documenting symptoms and timestamps preserves information needed for analysis. Scanning, reimaging, or sharing credentials either allows the threat to continue operating or destroys evidence, so those actions belong later in the response process.

Answer

Run a full antivirus scan while leaving the machine connected.

Answer

Share the user's login credentials with the security team by email.

Answer

Immediately reinstall the operating system without further checks.

Question 3

A security analyst is reviewing access logs and notices that an employee in the marketing department was able to read files in the human resources shared folder. The employee's account should only have access to marketing resources. Which security principle was violated?

Accepted Answer

Least privilege. The principle of least privilege states that users should be granted only the access required for their role. The marketing employee reading HR files indicates excessive permissions. Separation of duties, defense in depth, and zero trust are related concepts but do not directly name the violation of over-provisioned access.

Answer

Zero trust

Answer

Separation of duties

Answer

Defense in depth

Question 4

A warehouse supervisor reports that an unknown person wearing a delivery uniform walked through the open loading dock, entered the server room, and left with a backup drive. The company wants to prevent unauthorized entry into the server room without rebuilding the entire facility. Which control should be implemented FIRST?

Accepted Answer

Install an electronic badge reader on the server room door that logs each entry attempt. The incident shows an outsider reaching a restricted area through an uncontrolled opening, so the first fix must prevent unauthorized entry at that boundary. A badge reader on the server room door authenticates individuals and logs attempts, directly addressing the gap. A SIEM, awareness training, and drive encryption are valuable but do not stop someone from walking in and carrying equipment out.

Answer

Deploy a security information and event management (SIEM) platform to correlate logs

Answer

Encrypt the backup drives stored in the server room

Answer

Provide security awareness training to all warehouse employees

Question 5

A user is creating an account on a shopping website and is asked to choose a password. Which of the following passwords BEST follows current security guidance for resisting brute-force and dictionary attacks?

Accepted Answer

correct-horse-battery-staple-42. Current guidance favors long, memorable passphrases over short strings with forced complexity. A multi-word passphrase of unrelated words reaches a length that makes brute-force attacks impractical and avoids the predictable patterns that dictionary attacks target. Short complex strings and common word-plus-year patterns remain vulnerable because attackers test those exact constructions first.

Answer

Jk7#pQ2!

Answer

P@ssw0rd123

Answer

Summer2024!

Question 6

An employee working from a coffee shop connects a laptop to an open wireless network to check webmail. The employee wants to prevent other patrons on that same network from capturing the login credentials in transit. Which technology BEST provides this protection?

Accepted Answer

A virtual private network (VPN) tunnel to the company network. On an open wireless network, frames are broadcast over a shared medium where any nearby device can capture them, so confidentiality must come from encryption applied to the traffic itself. A VPN creates an encrypted tunnel from the laptop to a trusted endpoint, hiding credentials and content from local eavesdroppers. Firewalls, screen filters, and disk encryption each defend different assets and none encrypts data in transit.

Answer

Full-disk encryption enabled on the laptop drive

Answer

A screen privacy filter placed over the laptop display

Answer

A host-based firewall enabled on the laptop

Question 7

A user is working from a coffee shop and needs to access the corporate file server. The user connects to the coffee shop's open Wi-Fi network and wants to ensure that the data transmitted between the laptop and the corporate network cannot be read by others on the same network. Which of the following should the user implement?

Accepted Answer

Use a VPN connection to the corporate network. When using an untrusted network such as open Wi-Fi, data in transit can be intercepted. A VPN encrypts the connection between the user's device and the corporate network, ensuring confidentiality. The other choices either do not encrypt traffic or address local sharing rather than protecting data as it travels, so they fail to meet the user's security need.

Answer

Change the Wi-Fi network password

Answer

Enable the laptop's host-based firewall

Answer

Disable file sharing on the laptop

Question 8

A user is setting up a new smartphone for work and wants to reduce the risk of unauthorized access if the device is lost. Which two measures should the user implement? (Choose two.)

Accepted Answer

Turn on remote wipe and locate services. Protecting a lost phone requires both a preventive control and a response capability. A strong screen lock, backed by a PIN or biometric, keeps a finder from opening the device and leverages the storage encryption tied to the lock credential. Remote wipe and locate services let the user erase work data after the loss is discovered. Disabling updates, rooting the device, and storing plain text passwords all increase exposure.

Answer

Disable automatic operating system updates

Answer

Store passwords in a plain text note on the device

Answer

Root or jailbreak the device to install security tools

Question 9

An organization's security policy requires that users prove their identity with something they know and something they have when accessing the payroll system from outside the office. A user enters a password and then a code generated by a mobile app. Which security concept does this scenario illustrate?

Accepted Answer

Multifactor authentication. Multifactor authentication combines evidence from different categories, such as knowledge, possession, and inherence. A password is something the user knows, and a code generated on an enrolled mobile app is tied to something the user has. Together they satisfy the policy requiring two distinct factor types and make stolen passwords alone insufficient to reach the payroll system.

Answer

Single sign-on

Answer

Role-based access control

Answer

Federation

Question 10

A user receives a text message claiming to be from a package delivery service, saying a package could not be delivered and asking the user to click a link to reschedule. The user is unsure if the message is legitimate. Which TWO of the following actions should the user take to verify the message and avoid becoming a victim? (Choose two.)

Accepted Answer

Contact the delivery service using a phone number from its official website to confirm whether the message is real.. The safest actions are to verify the message through an official channel and to report it as phishing. Clicking links, replying, or asking friends do not confirm legitimacy and may expose the user to risk. Reporting helps prevent others from falling victim.

Answer

Reply to the text message asking for more details about the package.

Answer

Forward the message to a friend to ask if they received a similar one.

Answer

Click the link to see if the website looks official before entering any information.

Question 11

A technician is helping a small office set up basic physical security for its server closet. Which TWO of the following are physical security controls that would protect the equipment in the closet? (Choose two.)

Accepted Answer

Mounting a security camera aimed at the closet entrance.. Physical security controls focus on the tangible environment and who can reach the equipment. A locked, keypad-controlled door and a monitoring camera both restrict or record physical access to the server closet. The other choices are logical or technical controls that protect data and accounts but do not prevent someone from physically touching, unplugging, or removing the servers.

Answer

Enabling full-disk encryption on the servers' storage drives.

Answer

Configuring a firewall rule to block inbound traffic to the servers.

Answer

Requiring complex passwords for the server administrator accounts.

Question 12

A finance team member must share a spreadsheet containing customer account numbers with an external auditor. The team member wants to ensure that only the intended recipient can read the file contents. Which action BEST accomplishes this?

Accepted Answer

Encrypt the file using the auditor's public key. Ensuring that only the intended recipient can read a file requires confidentiality that survives interception, which means cryptography tied to that recipient's identity. Encrypting with the auditor's public key ensures only the auditor's private key can decrypt the contents. Renaming, read-only attributes, and weak archive passwords all leave the data readable or easily recovered by anyone who obtains the file.

Answer

Compress the spreadsheet into a password-protected ZIP archive and email the password separately

Answer

Rename the file with a .txt extension before attaching it to the email

Answer

Apply a read-only permission to the file before sending it

Question 13

A user is browsing the web on a public Wi-Fi network at a coffee shop and needs to check a personal bank account. The bank's website address begins with https. Which statement BEST describes how the user's connection is protected?

Accepted Answer

HTTPS encrypts the connection between the browser and the bank's web server.. HTTPS wraps HTTP in TLS, which encrypts the session between the browser and the bank's server and verifies the server's identity through a certificate. That encryption persists regardless of how untrusted the local Wi-Fi network is, so an eavesdropper on the same network captures unreadable data. The other options either misattribute the protection to the network or describe local privacy features that do not secure the connection.

Answer

The bank's firewall prevents anyone on the same Wi-Fi network from viewing the user's traffic.

Answer

The public Wi-Fi network encrypts all traffic between the user and the bank automatically.

Answer

The browser's private browsing or incognito mode protects the session from interception.

Question 14

A user's web browser warns that the connection to an online store is not private because the site's certificate cannot be validated. The user ignores the warning and enters payment card details anyway. Which type of attack is the user MOST at risk of in this situation?

Accepted Answer

On-path attack intercepting the unverified connection.. When a browser cannot validate a site's certificate, the identity of the server is in doubt, which is the hallmark of an on-path attack redirecting traffic to an imposter endpoint. Entering payment details in that state can hand them directly to the attacker. The other listed attacks target availability or server-side application flaws and are not signaled by a certificate validation warning.

Answer

SQL injection against the store's product database.

Answer

Denial-of-service attack flooding the store's web server.

Answer

Cross-site scripting running in the store's checkout page.

Question 15

An administrator reviews a server's audit log and finds a long series of failed login attempts against many different usernames, all originating from a single external address within a few minutes. No attempt succeeded. Which term BEST describes this activity?

Accepted Answer

A password spraying attack. The distinguishing feature in the log is breadth: many different usernames targeted from one source in a short window. That pattern matches password spraying, where an attacker tests a few common passwords across a large user list to stay under per-account lockout thresholds. Brute force would hammer one account, a denial-of-service attack would aim at availability, and a man-in-the-middle attack would involve interception rather than direct login attempts.

Answer

A denial-of-service attack

Answer

A brute-force attack against one account

Answer

A man-in-the-middle attack