FC0-U71 Security — Timed 25 Questions

Question 1

An organization is implementing a defense-in-depth strategy. Which THREE of the following are considered security controls that can be used? (Choose THREE.)

Accepted Answer

Firewall. Defense-in-depth uses multiple layers of security controls. Firewalls, antivirus, and encryption are different types of controls that provide overlapping protection.

Answer

Single sign-on

Answer

Acceptable use policy

Question 2

Which of the following best describes the principle of confidentiality in the CIA triad?

Accepted Answer

Preventing unauthorized access to information. Confidentiality ensures that information is not disclosed to unauthorized individuals, systems, or processes.

Answer

Data is not altered unexpectedly

Answer

Systems are accessible when needed

Answer

Ensuring data is backed up regularly

Question 3

A company implements a policy requiring employees to use a password and a one-time code sent to their mobile phone when logging into the corporate network. Which security concept is being employed?

Accepted Answer

Multi-factor authentication. Multi-factor authentication (MFA) requires two or more factors: something you know (password) and something you have (phone).

Answer

Role-based access control

Answer

Single sign-on

Answer

Biometrics

Question 4

A user receives an email that appears to be from their bank, asking them to click a link and verify their account details. The email contains urgent language and threats of account closure. What type of attack is this?

Accepted Answer

Phishing. Phishing is a social engineering attack where attackers impersonate a legitimate entity to steal sensitive information.

Answer

Spear phishing

Answer

Smishing

Answer

Vishing

Question 5

Which of the following is the strongest password?

Accepted Answer

MyD0g!sF1d0. A strong password is long and includes a mix of character types.

Answer

12345678

Answer

P@ssw0rd

Answer

password

Question 6

A security analyst discovers that a file on a server has been modified without authorization. However, the system logs show that the modification was made by an authenticated user who had legitimate access to the file. Which aspect of the CIA triad has been violated?

Accepted Answer

Integrity. Integrity ensures data is not altered by unauthorized parties. Even though the user was authenticated, the modification was unauthorized, violating integrity.

Answer

Non-repudiation

Answer

Availability

Answer

Confidentiality

Question 7

Which of the following malware types is characterized by self-replication without needing to attach to a host file?

Accepted Answer

Worm. A worm is standalone malware that replicates itself to spread to other computers, often using network connections.

Answer

Virus

Answer

Trojan

Answer

Ransomware

Question 8

A company wants to ensure that sensitive documents are not readable if a laptop is stolen. Which of the following provides the best protection?

Accepted Answer

Full disk encryption. Full disk encryption (FDE) encrypts the entire drive, making data unreadable without the decryption key.

Answer

Antivirus software

Answer

Firewall

Answer

Strong password on user account

Question 9

What is the primary purpose of a password manager?

Accepted Answer

To generate and store strong, unique passwords. Password managers generate and store complex, unique passwords for each account, reducing password reuse and improving security.

Answer

To store passwords in the cloud for easy access

Answer

To encrypt all network traffic

Answer

To share passwords securely with team members

Question 10

An attacker gains physical access to a building by following an employee through a secured door without using a badge. This is an example of which social engineering technique?

Accepted Answer

Tailgating. Tailgating (also called piggybacking) is when an unauthorized person follows an authorized person into a restricted area.

Answer

Phishing

Answer

Baiting

Answer

Pretexting

Question 11

Which of the following is the best practice for creating strong passwords?

Accepted Answer

Use a random combination of uppercase, lowercase, numbers, and symbols of at least 12 characters. A strong password should be at least 12 characters long and include a mix of character types.

Answer

Use your birthday and pet's name

Answer

Use a common phrase with numbers replacing letters

Answer

Use the same password for all accounts but change it monthly

Question 12

A user downloads a free game from an untrusted website. After installation, the user's computer begins displaying pop-up advertisements frequently. Which type of malware is most likely installed?

Accepted Answer

Adware. Adware displays unwanted advertisements, often bundled with free software.

Answer

Ransomware

Answer

Rootkit

Answer

Spyware

Question 13

An organization uses a security model where users are granted the minimum permissions necessary to perform their job functions. This model is known as:

Accepted Answer

Principle of least privilege. The principle of least privilege ensures users have only the access they need, reducing risk of misuse.

Answer

Role-based access control

Answer

Mandatory access control

Answer

Discretionary access control

Question 14

Which TWO of the following are effective measures to protect against ransomware attacks? (Select two.)

Accepted Answer

Installing the latest software updates and patches. Regular backups allow restoration without paying ransom; keeping systems patched closes vulnerabilities that ransomware exploits.

Answer

Using the same password for all accounts

Answer

Disabling the firewall

Answer

Opening email attachments from unknown senders

Question 15

Which THREE of the following are examples of multi-factor authentication? (Select three.)

Accepted Answer

A smart card and a PIN. MFA requires two or more different factors: something you know, something you have, and something you are. Each correct answer uses at least two distinct factors.

Answer

A retina scan and a fingerprint scan

Answer

A username and password

Question 16

Which TWO of the following are recommended practices for physical security in an office environment? (Select two.)

Accepted Answer

Locking computer screens when leaving the desk. Locking screens when away prevents unauthorized access; shredding documents ensures sensitive information is not readable.

Answer

Writing passwords on sticky notes and attaching them to monitors

Answer

Sharing access badges with colleagues

Answer

Leaving doors propped open for convenience

Question 17

Which of the following best describes the principle of least privilege?

Accepted Answer

Users should have the minimum permissions needed to do their job. The principle of least privilege states that users should be granted only the minimum permissions necessary to perform their job functions, reducing potential damage from accidents or attacks.

Answer

Users should have all permissions by default

Answer

Users should use multi-factor authentication

Answer

Users should change passwords every 30 days

Question 18

A user receives an email that appears to be from their bank, asking them to click a link and verify their account details. The user notices the email address is slightly misspelled (e.g., 'support@bankk.com' instead of 'support@bank.com'). Which type of attack is this?

Accepted Answer

Phishing. Phishing is a social engineering attack where attackers send fraudulent emails pretending to be from legitimate sources to steal sensitive information.

Answer

Smishing

Answer

Spear phishing

Answer

Vishing

Question 19

An organization implements a security control that requires users to swipe a smart card and then enter a PIN to access a secure facility. Which combination of authentication factors does this represent?

Accepted Answer

Something you have and something you know. Smart card is 'something you have' and PIN is 'something you know', making it two-factor authentication using different factor types.

Answer

Something you are and something you have

Answer

Something you know and something you do

Answer

Something you know and something you are

Question 20

Which of the following is a characteristic of a worm in the context of malware?

Accepted Answer

It self-replicates without needing a host file. A worm is a standalone malware that replicates itself to spread to other computers without needing to attach to a host file, often exploiting network vulnerabilities.

Answer

It disguises itself as legitimate software

Answer

It encrypts files and demands a ransom

Answer

It requires a host file to spread