Security practice questions

Use your birthday and pet's name

Why it fails: Birthdays and pet names are widely discoverable through social media and public records, so they fall to dictionary and targeted guessing attacks. It tempts because such details are memorable and need no manager, which suits low-risk throwaway accounts; strong passwords instead require length and unpredictability.

Use a common phrase with numbers replacing letters

Why it fails: Substituting digits for letters (for example, p4ssw0rd) follows a predictable pattern that cracking tools and rule-based dictionaries already encode, so entropy barely rises. It tempts because the result looks complex and stays memorable; genuinely strong passphrases avoid such systematic leetspeak substitutions.

Use the same password for all accounts but change it monthly

Why it fails: Reusing one password across accounts means a single breach exposes every account, and monthly rotation does nothing to contain that blast radius. It tempts because it reduces memorisation effort and rotation appears diligent; unique credentials per account with a password manager, plus MFA, is the actual practice.

Systems are accessible when needed

Why it fails: Accessibility when needed describes availability, not confidentiality. Confidentiality restricts data to authorised parties, preventing unauthorised disclosure; availability instead guarantees timely, reliable access to systems and data for legitimate users, which is the property this option actually names.

Ensuring data is backed up regularly

Why it fails: Backups support availability and recovery, not confidentiality. Confidentiality limits data access to authorised parties through controls such as encryption and access permissions; regular backups preserve data against loss or destruction, which is an availability concern rather than a disclosure concern.

Data is not altered unexpectedly

Why it fails: Data is not altered unexpectedly describes integrity, not confidentiality. Confidentiality concerns restricting access to information so only authorised parties can view it, typically enforced through encryption, access controls and permissions. Integrity controls such as hashing, checksums and versioning would be the correct answer when a question asks about preventing unauthorised modification of data.

Vishing

Why it fails: Vishing is voice phishing conducted over phone calls, where the attacker verbally impersonates an institution. This scenario describes an email containing a malicious link, which is email phishing. Vishing would be correct if the user received a phone call from a fake bank representative instead.

Whaling

Why it fails: Whaling targets senior executives such as CEOs or CFOs with highly tailored messages. This scenario involves an ordinary user receiving a generic bank email, which is standard phishing. Whaling would be correct only if the recipient held a high-ranking executive position.

Smishing

Why it fails: Smishing is phishing delivered via SMS text messages, typically containing malicious links sent to mobile phones. This scenario specifies an email, making it standard phishing. Smishing would be correct if the fraudulent bank message arrived as a text message on the user's phone.

Full disk encryption

Why it fails: Full disk encryption protects data at rest on a device's storage volume, so it does nothing for data crossing a public network. It is the right control when a stolen laptop's drive must remain unreadable, not for protecting traffic in transit.

File encryption

Why it fails: File encryption protects individual files at rest on disk, leaving network traffic unprotected. It is the correct choice when specific stored files need confidentiality, such as on shared storage, not when data is moving across the internet.

HTTPS

Why it fails: HTTPS encrypts web traffic in transit using TLS, but the question asks which encryption method protects data in transit generally; HTTPS is a protocol applying TLS to HTTP rather than the underlying encryption method, so it describes the transport rather than the cryptographic mechanism sought.

Single sign-on

Why it fails: Single sign-on (SSO) is an authentication convenience that reduces password fatigue, but it is not a security control in the context of defense-in-depth because it creates a single point of failure and does not add a layer of protection.

Acceptable use policy

Why it fails: AUP is an administrative policy, not a technical security control.

To store passwords in the cloud

Why it fails: Cloud storage is merely one deployment model; the primary purpose is generating and retaining unique credentials for each site so users need not memorise or reuse them. Storing in the cloud is a feature some managers offer, and would be the answer if the question asked where vaults synchronise.

To share passwords with others

Why it fails: Sharing credentials is a collaboration feature, not the core purpose of generating and retaining unique passwords per account. A manager's primary function is creating and filling strong, distinct credentials. Sharing would be the correct answer if the question asked how teams distribute a shared service account.

To bypass authentication

Why it fails: Password managers supply stored credentials to authentication prompts; they never circumvent the authentication process itself. Their purpose is generating and retaining unique passwords. Bypassing authentication describes exploitation techniques or single sign-on session reuse, not credential vaulting.

Enforcing strong passwords

Why it fails: Strong passwords are a logical/administrative access control governing authentication, not a barrier protecting facilities or hardware. It is tempting because passwords do restrict who reaches systems, but the question asks for controls over physical premises, such as locks, fences, badges or guards.

Using a firewall

Why it fails: A firewall is a logical network security control filtering traffic by rule, not a physical barrier over premises or equipment. It is tempting because firewalls guard the perimeter conceptually, but the question asks for controls protecting tangible assets, such as locks, bollards or surveillance cameras.

Installing antivirus software

Why it fails: Antivirus software is a logical host-based control detecting malicious code, not a physical measure restricting access to buildings or hardware. It is tempting because it defends endpoints, but the question asks for controls over tangible premises, such as fences, locks, lighting or guards.

Access should be granted based on seniority within the organization.

Why it fails: Seniority is unrelated to the minimum access needed to perform a job function, so it grants rights by rank rather than by task requirement. It is tempting because hierarchical models are common in organisations, and would be correct for approval workflows or delegation, not for determining which permissions a role requires.

All users should have the same level of access to ensure consistency.

Why it fails: Uniform access across all users violates least privilege by granting everyone the union of permissions, exceeding each person's job needs. It is tempting because consistency simplifies administration, and would be correct for standardised baseline settings such as desktop configuration, not for authorisation scope.

Users should have full administrative access to their own devices.

Why it fails: Full administrative access to one's own device exceeds the rights required for routine tasks, contradicting least privilege. It is tempting because local admin rights ease software installation and troubleshooting, and would be correct for IT administrators managing endpoints, not for general users performing everyday work.

To share passwords with other users securely

Why it fails: Secure credential sharing is a feature some password managers offer for team or family vaults, but it is not the primary purpose. The core function is generating and storing unique, complex credentials per account in an encrypted vault, removing the need to memorise or reuse passwords across sites.

To automatically log in to websites without typing a password

Why it fails: Autofill and automatic login are conveniences built on top of the vault, not its primary purpose. The tool exists to generate and retain strong, unique credentials for every account, so that a breach of one service cannot be leveraged against others through password reuse.

To recover forgotten passwords quickly

Why it fails: Recovery flows exist in most password managers, but recovery is a supporting capability rather than the primary purpose. The tool's core role is creating and storing unique, complex passwords in an encrypted vault, eliminating memorisation and the credential reuse that enables widespread account compromise.

Requiring strong passwords

Why it fails: Strong passwords are a logical or technical access control applied within systems; they do not restrict physical movement through a facility. It is tempting because passwords guard sensitive areas conceptually, but physical security measures such as locks, badges, fences or guards control bodily access to premises, which passwords cannot do.

Using encryption for sensitive files

Why it fails: Encryption protects data confidentiality in storage or transit through cryptographic algorithms; it does not restrict physical access to premises, equipment or media. It is tempting because encryption is a core security control, and it would be the right answer if the question asked about logical or data-at-rest protection rather than physical measures.

Installing a network firewall

Why it fails: A network firewall filters packets at OSI Layers 3 and 4 to control traffic entering or leaving a network; it governs logical connectivity, not physical access to a facility. It is tempting because firewalls are a foundational security control, and it would be correct if the question concerned network perimeter protection.

Pretexting

Why it fails: Pretexting invents a fabricated scenario to extract information, typically through prior rapport-building rather than a spoofed sender address demanding payment. It is tempting because the CEO impersonation is a fabricated pretext, and would be correct if the attacker had phoned or written inventing a story to obtain data.

Phishing

Why it fails: Phishing is a broad category covering many fraudulent messages; the stem's spoofed executive address demanding an urgent wire transfer describes the specific CEO-fraud variant, business email compromise. It is tempting because the email is fraudulent, and would be correct if the question asked for the general category rather than the precise subtype.

Vishing

Why it fails: Vishing is voice phishing conducted over telephone calls, whereas this attack arrives by email with a spoofed sender address. It is tempting because vishing also impersonates authority figures to pressure victims, and would be correct if the employee had received a phone call from someone claiming to be the CEO.

Using a password and answering a security question

Why it fails: A security question is knowledge-based, drawing on the same 'something you know' category as the password, so both factors share one authentication class. Security questions suit account recovery when a password is forgotten, not as a second factor.

Using a fingerprint scanner alone

Why it fails: A fingerprint scanner alone is 'something you are'—a single factor. Multi-factor authentication requires at least two different factor types.

Using a password and a one-time code sent via SMS

Why it fails: Although a one-time code is sent via SMS, it must be entered by the user, so it is considered 'something you know'—the same factor type as the password. Thus, this is not multi-factor authentication.

A short password with only letters

Why it fails: Length and character variety both drive resistance to brute-force and dictionary attacks, so a short all-letter password offers a tiny search space. Short alphabetic strings are acceptable only where a system enforces them and no sensitive data is involved, which is not the characteristic of a strong password.

A password that is easy to remember, like a pet's name

Why it fails: Pet names and similar personal details appear in wordlists and are often discoverable through social media, making them trivial to guess. Memorable passphrases are useful when they are long and random, but a single recognisable name supplies no entropy against credential-guessing attacks.

A password that is the same across multiple accounts

Why it fails: Reusing one password across accounts means a single breach exposes every linked service through credential stuffing. Unique passwords per account limit the blast radius of any one compromise; a shared password is only tolerable for disposable, non-sensitive accounts, never as a strength characteristic.

Spyware

Why it fails: Spyware covertly collects keystrokes, browsing habits and credentials; it does not encrypt files or display ransom demands. It would be the answer for a scenario describing silent data exfiltration, whereas this stem points to ransomware, with the second type being a dropper or trojan.

Adware

Why it fails: Adware displays unwanted advertisements or redirects browsing; it neither encrypts files nor demands payment. It fits a scenario about pop-ups and browser hijacking, whereas the encryption-plus-ransom message here indicates ransomware, paired with the malware that delivered or enabled it.

Rootkit

Why it fails: Ransomware encrypts files and demands payment; a rootkit instead hides malicious processes and grants persistent privileged access, so it does not produce the ransom note. Rootkits are tempting because they often accompany ransomware, but the scenario's encryption-and-extortion behaviour points to ransomware, not concealment.

Keeping one backup on the same external drive as the original

Why it fails: Keeping a backup on the same external drive as the original provides no separate copy, so a single failure destroys both. It is tempting because external drives feel like backups, but the rule requires three distinct copies across two media with one off-site.

Storing one backup in a cloud storage service

Why it fails: Incorrect: Only provides a single offsite backup; does not ensure three copies or two media types.

Using two different external hard drives for backups, both kept in the same building

Why it fails: Two drives in one building give two copies but no off-site copy, so a site-wide incident destroys both. It is tempting because using separate drives looks like redundancy, yet the 3-2-1 rule specifically requires one copy stored off-site.

Require users to change passwords every 30 days

Why it fails: Frequent password changes can limit the window of validity for a compromised password, but they do not prevent an attacker from guessing the current password through repeated attempts. The attack described happens in a short period, so a 30-day rotation would not stop it. The core problem is the lack of a mechanism to block repeated failed logins.

Enable multifactor authentication for all users

Why it fails: Multifactor authentication adds a second factor and would likely prevent the attacker from logging in even with the correct password. However, the scenario states the attacker guessed the password and the account was not locked out. While MFA is a strong control, the immediate issue is the unlimited guessing. Account lockout directly addresses the attack pattern observed and is the best first recommendation.

Enforce a password complexity policy

Why it fails: Password complexity requirements make passwords harder to guess, but they do not stop an attacker from making many attempts. If the attacker tries a large list of common passwords, a complex password might not be on that list, but the attack method itself remains viable. The immediate issue is the unlimited guessing, which complexity alone does not address.

Data is not altered unexpectedly

Why it fails: Unexpected alteration describes integrity, not confidentiality, which concerns restricting data access to authorised parties. It is tempting because integrity and confidentiality are both CIA triad pillars and are frequently confused, and this wording would be the right answer to a question asking which principle integrity represents.

Systems are accessible when needed

Why it fails: Accessibility when needed describes availability, not confidentiality, which concerns preventing unauthorised disclosure of data. It is tempting because availability is the third CIA triad pillar and the phrasing sounds protective, and it would correctly answer a question asking which principle availability represents.

Ensuring data is backed up regularly

Why it fails: Backups support availability and recovery, not confidentiality, which concerns restricting data access to authorised parties. It is tempting because backups are a recognised security control and sound protective, and regular backup would be the right answer to a question about resilience or availability rather than confidentiality.

Role-based access control

Why it fails: RBAC governs what an authenticated identity may do via role assignments; it does not verify identity. It is tempting because roles are often granted after login, but the password plus one-time code is multifactor authentication, and RBAC would be correct for authorising access to resources.

Single sign-on

Why it fails: Single sign-on lets one authentication event grant access to multiple systems; here each login demands a password and a phone code, with no federation between services. It is tempting because SSO often incorporates MFA, but SSO would be correct if users authenticated once and reached several applications.

Biometrics

Why it fails: Biometrics verifies identity through a physical characteristic such as a fingerprint or face scan; the scenario uses a password and a phone-delivered one-time code instead. It is tempting because biometrics is also a factor, but it would be correct where a fingerprint reader replaces the password rather than supplementing it.

Spear phishing

Why it fails: Spear phishing targets a specific, researched individual or small group, whereas this message is a generic mass lure sent to many recipients. It tempts because both use email and impersonate a trusted brand, and spear phishing would be correct if the attacker had personalised the message using reconnaissance.

Smishing

Why it fails: Smishing delivers the lure by SMS text message, not email, so the channel here is wrong. It tempts because the social-engineering tactic, brand impersonation with urgency, is identical; smishing would be correct if the victim received the fraudulent link on a mobile phone.

Vishing

Why it fails: Vishing is voice phishing conducted over telephone calls, whereas this attack arrives as an email containing a link. It tempts because the pretext, a bank demanding urgent verification, matches typical vishing scripts; vishing would be correct if a caller telephoned the user making the same demand.

12345678

Why it fails: Very weak, only numbers.

P@ssw0rd

Why it fails: Common pattern, short.

password

Why it fails: A single lowercase dictionary word is guessable within seconds and fails every complexity criterion. It is tempting because it is easy to remember and meets length minimums, and such a password would only be acceptable where a second authentication factor compensates, never as the strongest standalone choice.