Security Concepts practice questions

An organization wants to classify data based on its sensitivity and impact if disclosed. Which security principle is being applied?

Trap 1: Defense in depth

Defense in depth uses multiple layers, not data labeling.

Trap 2: Least privilege

Least privilege restricts access rights, but classification is about labeling data.

Trap 3: Data loss prevention

DLP enforces policies, but classification is a precursor.

A
Defense in depth
Why wrong: Defense in depth uses multiple layers, not data labeling.
B
Confidentiality, integrity, and availability (CIA)
Data classification directly supports confidentiality and integrity by applying appropriate controls.
C
Least privilege
Why wrong: Least privilege restricts access rights, but classification is about labeling data.
D
Data loss prevention
Why wrong: DLP enforces policies, but classification is a precursor.

Question 2mediummultiple choice

A SOC analyst notices repeated failed login attempts from a single IP address against multiple user accounts. Which type of attack is most likely occurring?

Trap 1: Credential stuffing

Credential stuffing uses breached username/password pairs, not single IP.

Trap 2: Brute force attack

Brute force focuses on one account; here multiple accounts are targeted.

Trap 3: Man-in-the-middle attack

MITM intercepts communications, not login attempts.

A
Credential stuffing
Why wrong: Credential stuffing uses breached username/password pairs, not single IP.
B
Brute force attack
Why wrong: Brute force focuses on one account; here multiple accounts are targeted.
C
Password spraying
Password spraying tries a few common passwords across many accounts.
D
Man-in-the-middle attack
Why wrong: MITM intercepts communications, not login attempts.

Question 3hardmultiple choice

A security engineer is designing a network to prevent an attacker who gains access to a web server from easily pivoting to the internal database server. Which architecture best achieves this goal?

Trap 1: Place both servers on the internal network with host-based firewalls

Host firewalls can be bypassed if the attacker gains admin privileges.

Trap 2: Use a VPN between the web server and database server

VPN adds encryption but does not prevent pivoting if the web server is compromised.

Trap 3: Place both servers on the same VLAN with a firewall between them

Same VLAN reduces segmentation; firewall alone may not block all lateral movement.

A
Place both servers on the internal network with host-based firewalls
Why wrong: Host firewalls can be bypassed if the attacker gains admin privileges.
B
Place the web server in a DMZ and the database server on the internal network, with a firewall blocking outbound traffic from DMZ to internal
DMZ isolates web server; blocking outbound from DMZ prevents pivot.
C
Use a VPN between the web server and database server
Why wrong: VPN adds encryption but does not prevent pivoting if the web server is compromised.
D
Place both servers on the same VLAN with a firewall between them
Why wrong: Same VLAN reduces segmentation; firewall alone may not block all lateral movement.

Question 4mediummulti select

Which TWO security concepts are fundamental to the principle of least privilege? (Choose two.)

Trap 1: Mandatory access control (MAC)

MAC is system-enforced, not directly about limiting to minimum.

Trap 2: Separation of duties

Separation of duties prevents fraud, not directly least privilege.

Trap 3: Defense in depth

Defense in depth uses multiple layers, not directly about access minimization.

A
Role-based access control (RBAC)
RBAC implements least privilege by assigning permissions to roles.
B
Mandatory access control (MAC)
Why wrong: MAC is system-enforced, not directly about limiting to minimum.
C
Need-to-know
Need-to-know restricts access to data required for tasks.
D
Separation of duties
Why wrong: Separation of duties prevents fraud, not directly least privilege.
E
Defense in depth
Why wrong: Defense in depth uses multiple layers, not directly about access minimization.

Question 5hardmulti select

Which THREE are common indicators of a distributed denial-of-service (DDoS) attack? (Choose three.)

Trap 1: A single IP address generating excessive traffic

Single IP suggests a DoS, not distributed.

Trap 2: Encrypted traffic from a known malware C2 server

C2 traffic indicates compromise, not necessarily DDoS.

A
Slow network performance and service unavailability
Overwhelmed resources cause slowdowns.
B
A single IP address generating excessive traffic
Why wrong: Single IP suggests a DoS, not distributed.
C
High bandwidth consumption on the network link
DDoS floods the link with traffic.
D
Unusual traffic patterns from many different sources
Many sources indicate a distributed attack.
E
Encrypted traffic from a known malware C2 server
Why wrong: C2 traffic indicates compromise, not necessarily DDoS.

Question 6easymulti select

Which TWO are goals of a security operations center (SOC)? (Choose two.)

Trap 1: Managing user passwords

Password management is an IT admin task.

Trap 2: Developing software applications

Development is not a SOC function.

Trap 3: Performing penetration tests

Pen testing is typically done by separate red teams.

A
Continuous monitoring of security events
SOC monitors events 24/7.
B
Managing user passwords
Why wrong: Password management is an IT admin task.
C
Developing software applications
Why wrong: Development is not a SOC function.
D
Performing penetration tests
Why wrong: Pen testing is typically done by separate red teams.
E
Responding to security incidents
Incident response is a primary SOC role.

Question 7mediummultiple choice

Refer to the exhibit. A network analyst sees these firewall logs. What is the most likely interpretation?

Exhibit

Refer to the exhibit.
```
Mar  1 12:34:56.789: %ASA-5-111008: User 'admin' executed the 'configure terminal' command.
Mar  1 12:35:01.123: %ASA-4-106023: Deny tcp src outside:192.0.2.10/12345 dst inside:10.0.0.1/80 by access-group "OUTSIDE_IN" [0x0, 0x0]
Mar  1 12:35:05.456: %ASA-4-106023: Deny tcp src outside:192.0.2.10/12346 dst inside:10.0.0.2/443 by access-group "OUTSIDE_IN" [0x0, 0x0]
```

Trap 1: The firewall rule OUTSIDE_IN is misconfigured and blocking all…

Only specific denies are shown, not all traffic.

Trap 2: A malware is trying to phone home to an external C2 server

Traffic is inbound, not outbound.

Trap 3: A user is trying to access internal web servers legitimately but is…

Multiple ports to different destinations suggest scanning, not normal access.

A
An attacker is performing a port scan on internal hosts from the outside
Repeated denies from same source to different destinations on common ports indicate a scan.
B
The firewall rule OUTSIDE_IN is misconfigured and blocking all traffic
Why wrong: Only specific denies are shown, not all traffic.
C
A malware is trying to phone home to an external C2 server
Why wrong: Traffic is inbound, not outbound.
D
A user is trying to access internal web servers legitimately but is blocked by ACL
Why wrong: Multiple ports to different destinations suggest scanning, not normal access.

Study the full ACL explanation →

Question 8hardmultiple choice

Refer to the exhibit. A security analyst reviews this ACL on a firewall between a DMZ (10.0.1.0/24) and internal network (10.0.2.0/24). What is the effect of this ACL?

Exhibit

Refer to the exhibit.
```
! Access-list for DMZ to Inside
access-list DMZ_TO_INSIDE extended permit tcp 10.0.1.0 255.255.255.0 10.0.2.0 255.255.255.0 eq 3306
access-list DMZ_TO_INSIDE extended deny ip any any
```

Trap 1: It allows MySQL traffic from internal network to DMZ

The ACL is applied to traffic from DMZ to inside, not the reverse.

Trap 2: It blocks all traffic from DMZ to internal network

MySQL is permitted.

Trap 3: It allows any traffic from DMZ to internal network

The deny any any at the end blocks all other traffic.

A
It allows MySQL traffic from internal network to DMZ
Why wrong: The ACL is applied to traffic from DMZ to inside, not the reverse.
B
It allows MySQL traffic from DMZ to internal network and blocks all other traffic
The first line permits MySQL (port 3306), the second denies everything else.
C
It blocks all traffic from DMZ to internal network
Why wrong: MySQL is permitted.
D
It allows any traffic from DMZ to internal network
Why wrong: The deny any any at the end blocks all other traffic.

Question 9easymultiple choice

Refer to the exhibit. A Windows security log shows several events with Event ID 4625 (failed logon). What type of attack is indicated?

Exhibit

Refer to the exhibit.
```
Event Log:
Time: 10:00:01, Source: 192.168.1.100, Event ID: 4625, Account: Administrator
Time: 10:00:03, Source: 192.168.1.100, Event ID: 4625, Account: Admin
Time: 10:00:05, Source: 192.168.1.100, Event ID: 4625, Account: root
```

Trap 1: Pass-the-hash attack

Pass-the-hash uses NTLM hashes, not repeated logon attempts.

Trap 2: Kerberos golden ticket attack

Golden ticket forges Kerberos tickets, not logon failures.

Trap 3: Man-in-the-middle attack

MITM intercepts traffic, not logon events.

A
Brute force attack
Multiple failed logons from same source indicates password guessing.
B
Pass-the-hash attack
Why wrong: Pass-the-hash uses NTLM hashes, not repeated logon attempts.
C
Kerberos golden ticket attack
Why wrong: Golden ticket forges Kerberos tickets, not logon failures.
D
Man-in-the-middle attack
Why wrong: MITM intercepts traffic, not logon events.

Read the full wireless explanation →

Question 10hardmultiple choice

You are a security analyst at a financial institution. The network consists of three segments: internal corporate network (10.0.0.0/24), DMZ (192.168.1.0/24) hosting a web server and an email server, and a guest wireless network (172.16.0.0/24). The firewall is configured with the following rules: (1) permit inbound HTTP/HTTPS to the web server from any; (2) permit inbound SMTP to the email server from any; (3) deny all other inbound traffic; (4) permit all outbound traffic from internal network; (5) deny all outbound traffic from guest network to internal and DMZ, but permit to internet. Recently, an employee reported that sensitive files on an internal file server (10.0.0.10) were accessed without authorization. Logs show that the access originated from an IP address in the guest network (172.16.0.50) at 3:00 AM. The guest network is open (no authentication required). The internal file server is not directly accessible from the guest network per rule (5). However, the attacker used the web server as a pivot: they compromised the web server via an unpatched vulnerability, then from the web server they connected to the internal file server. Which of the following actions would BEST prevent this type of attack in the future?

Trap 1: Implement a firewall rule that denies all traffic from the DMZ to…

This would prevent legitimate DMZ services from reaching internal resources like databases.

Trap 2: Move the web server to the internal network and place a reverse…

Moving the web server inside exposes it to internal threats; a reverse proxy still presents an attack surface.

Trap 3: Apply a patch to the web server and require authentication on the…

Patching addresses the specific vulnerability but not future ones; guest authentication adds security but does not prevent pivoting from a compromised DMZ host.

A
Implement a firewall rule that denies all traffic from the DMZ to the internal network
Why wrong: This would prevent legitimate DMZ services from reaching internal resources like databases.
B
Move the web server to the internal network and place a reverse proxy in the DMZ
Why wrong: Moving the web server inside exposes it to internal threats; a reverse proxy still presents an attack surface.
C
Apply a patch to the web server and require authentication on the guest network
Why wrong: Patching addresses the specific vulnerability but not future ones; guest authentication adds security but does not prevent pivoting from a compromised DMZ host.
D
Add a firewall rule that permits only necessary traffic from the DMZ to specific internal servers, and deny all other DMZ-to-internal traffic
This limits lateral movement: even if the web server is compromised, it can only reach authorized internal systems.

Question 11mediummultiple choice

You are a SOC analyst monitoring traffic on a corporate network. The network uses a next-generation firewall (NGFW) with intrusion prevention system (IPS). You receive an alert that the IPS detected a SQL injection attempt against the internal web application server (10.0.1.10) from an external IP (203.0.113.5). The IPS action was set to "alert" only, not "drop". Further investigation shows that the web server logs indicate the SQL injection succeeded and data was exfiltrated to 203.0.113.5. The web application is a custom application developed in-house. The database server (10.0.1.20) contains customer PII. Which of the following is the BEST immediate action to contain the incident?

Trap 1: Apply a software patch to the web application to fix the SQL…

Patching is important but takes time; it does not stop ongoing exfiltration.

Trap 2: Restore the web server from a known good backup

Restoring may remove the attacker's foothold but does not block the current exfiltration path.

Trap 3: Shut down the database server to prevent further data loss

This may be too drastic and impacts business operations; also, data may already be exfiltrated.

A
Apply a software patch to the web application to fix the SQL injection vulnerability
Why wrong: Patching is important but takes time; it does not stop ongoing exfiltration.
B
Restore the web server from a known good backup
Why wrong: Restoring may remove the attacker's foothold but does not block the current exfiltration path.
C
Block the attacker's IP address at the firewall and implement a temporary rule to drop all traffic from 203.0.113.5
This immediately cuts off the attacker's access and stops exfiltration.
D
Shut down the database server to prevent further data loss
Why wrong: This may be too drastic and impacts business operations; also, data may already be exfiltrated.

Question 12mediummultiple choice

A security analyst is investigating a potential data exfiltration incident. The analyst notices that a large amount of data has been sent to an external IP address over port 443 during non-business hours. The company uses a proxy server that logs all outbound connections. Which action should the analyst take first to validate the suspicion?

Trap 1: Immediately block the external IP address at the firewall.

Blocking without investigation may disrupt legitimate traffic and does not provide evidence.

Trap 2: Run a packet capture on the internal server to analyze the payload.

Packet capture may not be feasible or might miss the traffic if it has already occurred.

Trap 3: Notify the security team lead and wait for further instructions.

Waiting may delay investigation and allow further data exfiltration.

A
Immediately block the external IP address at the firewall.
Why wrong: Blocking without investigation may disrupt legitimate traffic and does not provide evidence.
B
Run a packet capture on the internal server to analyze the payload.
Why wrong: Packet capture may not be feasible or might miss the traffic if it has already occurred.
C
Check the proxy logs to see the destination IP and user agent string.
Proxy logs provide details about the connection and can help identify if the traffic is suspicious.
D
Notify the security team lead and wait for further instructions.
Why wrong: Waiting may delay investigation and allow further data exfiltration.

Question 13hardmultiple choice

A network engineer is designing a segmented network to protect a sensitive database. The database must be accessible only from a specific application server. Which security concept best describes this design?

Trap 1: Defense in depth

Defense in depth involves multiple layers of security, not just restricting access to one server.

Trap 2: Separation of duties

Separation of duties is about dividing responsibilities among different people to prevent fraud.

Trap 3: Weakest link

Weakest link refers to the most vulnerable component in a system.

A
Defense in depth
Why wrong: Defense in depth involves multiple layers of security, not just restricting access to one server.
B
Separation of duties
Why wrong: Separation of duties is about dividing responsibilities among different people to prevent fraud.
C
Weakest link
Why wrong: Weakest link refers to the most vulnerable component in a system.
D
Least privilege
Least privilege ensures that entities have only the access necessary to perform their functions.

Question 14easymulti select

Which TWO of the following are common indicators of a denial-of-service (DoS) attack?

Trap 1: A low level of network utilization on the target server

DoS attacks increase utilization, not decrease.

Trap 2: A gradual increase in traffic from multiple geographic locations

This may be normal traffic growth or a marketing campaign.

Trap 3: A high number of DNS queries from diverse source IPs

This could be a DDoS, but the question asks for DoS (single source).

A
A low level of network utilization on the target server
Why wrong: DoS attacks increase utilization, not decrease.
B
A gradual increase in traffic from multiple geographic locations
Why wrong: This may be normal traffic growth or a marketing campaign.
C
A high number of DNS queries from diverse source IPs
Why wrong: This could be a DDoS, but the question asks for DoS (single source).
D
A sudden increase in traffic from a single source IP address
This indicates a potential DoS attack from that IP.
E
A large number of incomplete TCP connections (SYN packets without ACK)
This is characteristic of a SYN flood DoS attack.

Study the full ACL explanation →

Question 15mediummultiple choice

An analyst reviews the ACL applied to the outside interface of a router. The analyst notices that traffic from 192.168.1.0/24 to 10.10.10.10 on port 443 is permitted, but all other traffic is denied and logged. Which of the following is a potential security issue with this ACL?

Exhibit

Refer to the exhibit.

! Output from show access-list 101
! Extended IP access list 101
!    10 permit tcp 192.168.1.0 0.0.0.255 host 10.10.10.10 eq 443
!    20 deny ip any any log
!

Trap 1: The ACL is applied inbound on the outside interface, which could…

The exhibit does not indicate the direction; it just shows the ACL content.

Trap 2: The permit statement does not have logging enabled, so traffic is…

Logging on permit is optional; the issue is the deny log.

Trap 3: The ACL allows all traffic from 192.168.1.0/24 to 10.10.10.10 on…

It only permits port 443, not all ports.

A
The deny statement with logging may generate excessive logs, potentially masking attacks.
Excessive logging can bury important alerts in noise.
B
The ACL is applied inbound on the outside interface, which could allow external traffic.
Why wrong: The exhibit does not indicate the direction; it just shows the ACL content.
C
The permit statement does not have logging enabled, so traffic is not monitored.
Why wrong: Logging on permit is optional; the issue is the deny log.
D
The ACL allows all traffic from 192.168.1.0/24 to 10.10.10.10 on any port.
Why wrong: It only permits port 443, not all ports.

Review the full subnetting walkthrough →

Question 16hardmultiple choice

You are a security analyst for a mid-sized company with a flat network topology. The company uses a single firewall for internet access and has no internal segmentation. Recently, the IT team deployed a new file server running Windows Server 2019. The server was configured with default settings and placed in the same subnet as all user workstations. Two weeks later, the helpdesk receives multiple complaints about slow network performance. Upon investigation, you notice the file server's network interface is sending a high volume of broadcast traffic. Additionally, you find that the server's firewall is disabled and it is running an outdated SMBv1 protocol. The CEO is concerned about potential data loss and asks for immediate remediation. Which of the following is the most effective and immediate course of action to address the most critical security vulnerability?

Trap 1: Enable the Windows Firewall on the file server and create rules to…

Firewall helps but does not remove the SMBv1 vulnerability.

Trap 2: Configure the switch to block broadcast traffic on the file…

Broadcast traffic is normal; blocking it may break network functionality.

Trap 3: Create VLANs to segment the file server from user workstations.

Segmentation is a long-term solution; not immediate.

A
Enable the Windows Firewall on the file server and create rules to allow only essential traffic.
Why wrong: Firewall helps but does not remove the SMBv1 vulnerability.
B
Configure the switch to block broadcast traffic on the file server's port.
Why wrong: Broadcast traffic is normal; blocking it may break network functionality.
C
Create VLANs to segment the file server from user workstations.
Why wrong: Segmentation is a long-term solution; not immediate.
D
Disable SMBv1 on the file server using PowerShell or Registry.
This directly removes the critical vulnerability exploited by malware.

Question 17mediumdrag order

Review the full routing breakdown →

Drag and drop the steps to configure SSH access on a Cisco IOS switch into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 18mediumdrag order

Drag and drop the steps to perform a password recovery on a Cisco IOS router into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 19mediummatching

Match each security tool to its primary purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Network scanning and discovery

Packet capture and analysis

Intrusion detection and prevention

Exploitation framework for penetration testing

Security information and event management (SIEM)

Question 20mediummatching