Hard Difficulty Questions

Availability

Why wrong: Availability ensures systems are operational and accessible when needed. While auditing can help detect availability issues, the policy's focus on identification and auditing is not primarily about availability.

Accountability

Why wrong: Accountability is not a principle of the CIA triad. Although the policy addresses accountability, the question specifically asks for a CIA triad principle. Therefore, Accountability is incorrect in this context.

Confidentiality

Why wrong: Confidentiality focuses on preventing unauthorized access to data. While identification and auditing can support confidentiality, the primary goal of the policy is to ensure traceability, which aligns more closely with integrity.

Hard drive failure

Why wrong: Hard drive failures typically generate disk I/O errors, not application crashes with kernel32.dll.

Incorrect user permissions

Why wrong: Permission errors would show access denied, not a faulting application with kernel32.dll.

Network connectivity loss

Why wrong: Network errors would show different source and description.

Reduction in the total amount of physical hardware needed

Why wrong: While it reduces the number of servers, the statement is true but not the primary benefit; utilization is key.

Increased performance for each application

Why wrong: Virtualization typically adds overhead, reducing peak performance.

Improved security by isolating applications

Why wrong: Security isolation is similar to physical separation; not the primary benefit.

Biometric authentication

Why wrong: Biometric uses physical characteristics like fingerprints, not a code.

Token-based authentication

Why wrong: Token-based can be part of MFA, but the combination described is specifically two-factor.

Single-factor authentication

Why wrong: Single-factor uses only one factor, such as a password.

Generator

Why wrong: Generators are for extended outages but not typically a standard recommendation for basic data loss prevention.

Power strip

Why wrong: Power strips provide no protection or backup.

Surge protector

Why wrong: Surge protectors guard against voltage spikes, not power loss.

Bluetooth

Why wrong: Bluetooth is a short-range wireless technology, not used for remote management.

NFC

Why wrong: NFC is used for contactless payments and data exchange, not remote management.

GPS

Why wrong: GPS provides location tracking but not remote wipe capability.

Louder operation

Why wrong: SSDs are silent; HDDs have noise from spinning disks.

Higher capacity per dollar

Why wrong: HDDs generally offer higher capacity per dollar.

Boolean

Why wrong: Boolean is for true/false values.

String

Why wrong: String is for text, not numbers.

Integer

Why wrong: Integer is for whole numbers, not decimals.

Ask the development team to work overtime to include it

Why wrong: Scrum discourages overtime; work is added to backlog not forced into current sprint.

Reject the request because the sprint is complete

Why wrong: The request can be considered for a future sprint; rejection is not required.

Add the feature to the current sprint immediately

Why wrong: Adding to the current sprint disrupts the sprint goal and is not allowed without renegotiation.

SATA HDD

Why wrong: Slower, not fast storage.

Bluetooth 4.0

Why wrong: Not for networking; short-range peripheral connection.

Simplify the database schema

Why wrong: Normalisation eliminates data redundancy and update anomalies by decomposing tables into smaller, related structures, which actually increases schema complexity rather than reducing it. The goal is to remove repeating groups through atomicity and dependency enforcement, not to simplify the schema. This option is tempting because simplifying a schema is a common database design objective, and it would be correct in a scenario where denormalisation is intentionally applied to improve read performance by reducing join operations.

Improve query performance

Why wrong: Normalization can sometimes decrease performance due to more joins.

The primary key of Professors is CourseID.

Why wrong: Primary key of Professors is ProfessorID, not CourseID.

The relationship between Professors and Courses is many-to-many.

Why wrong: It is one-to-many because one professor can teach many courses, but a course has one professor.

Virus

Why wrong: A virus requires user interaction (e.g., opening a file) to spread.

Ransomware

Why wrong: Ransomware encrypts files for ransom but usually requires user action to execute.

Trojan

Why wrong: A Trojan disguises itself as legitimate software but typically does not self-replicate.

Proxy server

Why wrong: Proxy servers can cache content and filter traffic but are not primarily for DNS resolution.

Web server

Why wrong: Web servers host websites; they do not perform DNS resolution.

DHCP server

Why wrong: DHCP assigns IP addresses to devices, but does not resolve domain names.

Circle

Why wrong: Not a standard topology.

Square

Why wrong: Not a standard topology.

Data is available only after replacing the disk

Why wrong: Data is available immediately.

The server will shut down

Why wrong: RAID 5 remains operational.

All data on the array is lost

Why wrong: RAID 5 can survive one disk failure.

A hacker attempting to guess passwords

Why wrong: This is a threat (potential harm), not a vulnerability.

A fire in the data center

Why wrong: This is a threat (physical event), not a vulnerability.

A vulnerability is a risk, and a threat is a countermeasure.

Why wrong: Risk is likelihood times impact; countermeasures reduce risk.

A threat is a weakness in a system, and a vulnerability is an attack that exploits it.

Why wrong: This reverses the definitions.

A vulnerability is a potential harm, and a threat is likelihood times impact.

Why wrong: That describes risk, not vulnerability and threat.

Something you know and something you are

Why wrong: Something you are would be a biometric like a fingerprint.

Something you have and something you are

Why wrong: No biometric is used.

Something you know and somewhere you are

Why wrong: Somewhere you are is a location factor, not used here.

Two backups on tape drives, both stored in the server room

Why wrong: Same media type and same location.

Original data on a laptop, a backup on a USB drive, and a backup on a second USB drive stored in a safe

Why wrong: Though three copies, both backups are USB drives (same media type) and both in the same building (not offsite).

One backup on an external drive stored in the same room as the server

Why wrong: Only one copy, same media type, no offsite.