Free GIAC Information Security Professional GISP Practice Questions

Correct answer: A, B, D. It is immune to electromagnetic interference (EMI); It can transmit undistorted signals over great distances; It uses light pulses for signal transmission.

Fiber optic cable transmits data using light pulses, making it immune to electromagnetic interference. It can transmit undistorted signals over long distances due to the nature of light transmission. These are key advantages of fiber optic technology compared to copper-based cables.

Why the other options are wrong

• C. Fiber optic cables use glass or plastic strands, not twisted wire pairs; twisted pairs are a characteristic of copper UTP cables.

Correct answer: B, D. It forwards broadcast packets; It filters traffic based on MAC addresses.

A bridge operates at Layer 2 (Data Link Layer) and filters traffic based on MAC addresses, learning which devices are on each port. Bridges forward broadcast packets because broadcasts are necessary for network communication and are not filtered by MAC address. Bridges do not filter by IP addresses or assign network addresses.

Why the other options are wrong

• A. Bridges operate at Layer 2 and filter by MAC address, not IP addresses; IP filtering is a Layer 3 function.
• C. Bridges do not assign network addresses; they forward frames based on MAC addresses learned from incoming traffic.

Correct answer: B. Security

Browser security settings, such as security zones, control how the browser handles content from web sites, including file downloads, scripts and ActiveX controls. Changing these settings is how Sam controls what the browser receives and downloads.

Why the other options are wrong

• A. A proxy server setting only routes browser traffic through another server and does not control how content is downloaded.
• C. Cookie settings control whether sites can store small data files, not how content is downloaded.
• D. Certificates verify the identity of sites and do not control downloads.

Correct answer: A, D. Water; Soda acid

Water and soda acid are both effective extinguishing agents for Class A fires, which involve ordinary combustibles like paper and wood. Water cools the fire and removes heat, while soda acid (sodium bicarbonate-based) smothers flames and interrupts combustion. Kerosene is a flammable liquid that would fuel such fires, and CO2 is primarily effective for electrical fires and flammable liquid fires, not wood or paper fires.

Why the other options are wrong

• B. Kerosene is a fuel and would intensify paper or wood fires.
• C. CO2 is effective for Class B and C fires, not Class A fires involving paper or wood.

Correct answer: A, B, C, D. Use slot locks with cable to connect the laptop to a stationary object; Keep inventory of all laptops including serial numbers; Harden the operating system; Encrypt all sensitive data.

All four options represent valid protective measures for laptops and their data. Physical locks prevent theft, inventory tracking aids in recovery and accountability, OS hardening reduces vulnerabilities to attacks, and data encryption protects information if the device is stolen or compromised. Each addresses different aspects of comprehensive laptop security.

Correct answer: B. DDoS attack

A Distributed Denial of Service (DDoS) attack uses multiple compromised systems (botnets) to simultaneously attack a single target, overwhelming it with traffic and making it unavailable. This distinguishes it from other attack types that use single systems or different methods.

Why the other options are wrong

• A. A brute force attack systematically tries password combinations using a single system, not multiple systems.
• C. A dictionary attack tests known words and common passwords, typically from a single system.
• D. A replay attack captures and retransmits valid data packets, not involving multiple systems attacking a target.

Correct answer: B, C. It is the boundary between the Internet and a private network; It contains company resources that are available on the Internet, such as Web servers and FTP servers.

A firewall is the security boundary between the Internet and a private network, controlling traffic flow. Additionally, firewalls typically contain company resources that are publicly accessible, such as web servers and FTP servers, in a DMZ (demilitarized zone). Firewalls operate at multiple layers and use rules and policies, but ACLs are primarily associated with routers and switches, not firewalls specifically.

Why the other options are wrong

• A. Anti-virus software scans for malware; this is not a firewall function.
• D. While firewalls use rules and policies, ACLs are more commonly associated with routers and switches than firewalls.

Correct answer: D. ARP poisoning

ARP poisoning is a technique that directly attacks Ethernet networks by sending falsified ARP (Address Resolution Protocol) messages to associate the attacker's MAC address with legitimate IP addresses, enabling man-in-the-middle attacks or network disruption. DNS poisoning targets DNS infrastructure rather than the network layer itself, keystroke logging targets individual systems to capture user input, and mail bombing is an application-level attack involving mass email transmission.

Why the other options are wrong

• A. DNS poisoning attacks DNS servers and name resolution, not the Ethernet network layer.
• B. Keystroke logging is a host-based attack that captures individual keystrokes, not a network attack.
• C. Mail bombing is an application-level attack involving excessive email transmission, not an Ethernet network attack.

Correct answer: D. Ciphertext

Ciphertext is the result of encrypting plaintext through a cryptographic algorithm, producing unreadable encrypted data. Plaintext is the opposite, unencrypted readable text. Cookies are small data files stored on clients for session management and tracking. Hypertext is markup language content used for web pages.

Why the other options are wrong

• A. Plaintext is unencrypted, readable text, not encrypted text.
• B. Cookies are session management tokens, not encrypted text.
• C. Hypertext is markup language used for web pages, not encrypted data.

Correct answer: A, C. It helps identify which information is the most sensitive or vital to an organization; It helps identify which protections apply to which information.

Information classification enables organizations to identify which data is most sensitive and critical (option A), and determines which security controls and protections should apply to different categories of information (option C). Option B describes data integrity controls rather than classification benefits. Option D relates to cost reduction through operational efficiency rather than being a direct benefit of classification itself.

Why the other options are wrong

• B. Ensuring unauthorized modifications are prevented is a function of access controls and integrity mechanisms, not classification.
• D. While classification may indirectly impact costs, reducing TCO is not a primary benefit of the classification process itself.

Correct answer: B. Circumstantial

Circumstantial evidence is a collection of facts that, when considered together, can be used to infer a conclusion about malicious activity or a person's involvement, rather than directly proving the activity.

Why the other options are wrong

• A. Corroborating evidence supports other evidence but is not defined as a collection of facts used for inference.
• C. Direct evidence directly proves a fact without requiring inference or interpretation.
• D. Incontrovertible evidence is proof that cannot be disputed, which is stronger than circumstantial evidence requiring inference.

Correct answer: C. Hardening

Hardening is the process of securing a system or device by reducing its attack surface through removing unnecessary services, closing ports, applying patches, and implementing security configurations. It strengthens defenses against potential attacks.

Why the other options are wrong

• A. Sanitization refers to securely removing or destroying data from storage media.
• B. Cryptography involves encrypting data to protect confidentiality but is not the term for securing a system overall.
• D. Authentication verifies identity but does not describe the broader process of securing a system.

Correct answer: A, C, D. Secure Hypertext Transfer Protocol (S-HTTP); Post Office Protocol version 3 (POP3); Trivial File Transfer Protocol (TFTP)

S-HTTP (Secure Hypertext Transfer Protocol) operates at Layer 7 (Application), POP3 (Post Office Protocol version 3) operates at Layer 7 (Application), and TFTP (Trivial File Transfer Protocol) operates at Layer 7 (Application). These are all application-layer protocols used for specific communication purposes. ARP operates at Layer 2 (Data Link) and Layer 3 (Network), making it the only option that does not function exclusively at Layer 7.

Why the other options are wrong

• B. ARP is a Layer 2/3 protocol used for address resolution, not a Layer 7 application protocol.

Correct answer: D. Polymorphic shell code attack

Polymorphic shell code attack involves malware that continuously changes its code signature or structure to avoid detection by IDS systems. Since the virus modifies its signature with each instance, the IDS cannot match it against the signature database, allowing the attack to evade detection.

Why the other options are wrong

• A. Session splicing attack involves fragmenting attack traffic across multiple sessions to evade detection, but does not specifically involve changing virus signatures.
• B. Evasion attack is a generic term that encompasses various techniques but is not specific to the signature-changing behavior described in the scenario.
• C. Insertion attack involves injecting data to confuse the IDS, but does not describe the continuous signature modification technique used in this scenario.

Correct answer: B, C. It is used to dynamically assign IP addresses to computers; It reduces the complexity of managing network client IP address configuration.

DHCP (Dynamic Host Configuration Protocol) dynamically assigns IP addresses to computers on a network, which directly reduces the complexity of managing client IP address configurations manually. Option B is correct because DHCP's primary function is dynamic IP assignment. Option C is correct because by automating IP address distribution, DHCP eliminates the need for manual configuration of each client, significantly reducing administrative complexity. Option A describes DNS, not DHCP. Option D is incorrect because DHCP does not inherently reduce DoS attack risk; in fact, DHCP servers can themselves be targets of attacks.

Why the other options are wrong

• A. This describes DNS (Domain Name System), which provides hostname-to-IP-address resolution, not DHCP.
• D. DHCP does not reduce DoS attack risk; DHCP servers can be targets of attacks themselves.

Correct answer: D. SMTP

SMTP (Simple Mail Transfer Protocol) is the standard protocol used for sending email messages between mail servers. It operates on port 25 and handles the transmission of email from client to server and between servers across the internet.

Why the other options are wrong

• A. IGMP (Internet Group Management Protocol) is used for managing multicast group memberships, not email transmission.
• B. SNMP (Simple Network Management Protocol) is used for network device management and monitoring, not email delivery.
• C. ICMP (Internet Control Message Protocol) is used for diagnostic purposes like ping and traceroute, not email transmission.

Correct answer: D. DNS entry is not available for the host name.

The inability to access a site by hostname (www.example.com) while the IP address (66.111.64.227) works correctly indicates a DNS resolution failure. The DNS server cannot resolve the hostname to its corresponding IP address, preventing the browser from connecting using the domain name. The IP address access works because it bypasses DNS resolution entirely.

Why the other options are wrong

• A. Heavy traffic on the web server would affect both IP address and hostname access equally.
• B. If the web server were offline, accessing the IP address directly would also fail, but it succeeds in this scenario.
• C. WINS is a NetBIOS name service; this issue involves web access through domain names, which relies on DNS, not WINS.

Correct answer: C, D. Ticket-granting service; Authentication service

Kerberos, the primary authentication protocol in many enterprise networks, consists of two main services: the Authentication Service (AS) and the Ticket-Granting Service (TGS). The AS authenticates users and issues initial tickets, while the TGS issues service tickets that allow authenticated users to access network resources. Option C and D correctly identify these core Kerberos components. Options A and B do not represent standard Kerberos service components.

Why the other options are wrong

• A. Data service is not a recognized component of the Kerberos authentication framework.
• B. Account service is not a standard Kerberos component; Kerberos uses AS and TGS instead.

Correct answer: D. Extranet

An Extranet is a network that allows controlled access to company resources by external users, such as suppliers, partners, or customers, while maintaining security boundaries separate from the public Internet. Since the website is for suppliers only, it requires restricted external access beyond the company's internal network, making an Extranet the correct choice. Intranet is limited to internal employees only. Internet describes publicly accessible resources. Internet and Intranet together do not provide the selective external access needed for supplier-only content.

Why the other options are wrong

• A. An Intranet is restricted to internal employees, not external suppliers.
• B. This combination does not properly describe selective external access for suppliers.
• C. The Internet is publicly accessible to anyone, but the site must be restricted to suppliers only.

Correct answer: A, C, D. It has a connection to the Internet through an external firewall and a connection to an internal network through an interior firewall; It is also known as a demilitarized zone or DMZ; It prevents access to the internal corporate network for outside users.

A demilitarized zone (DMZ) is a network segment positioned between internal and external networks with firewalls on both sides. It has a connection to the Internet through an external firewall and a connection to the internal network through an interior firewall, creating a buffer zone. It is also known as a DMZ and prevents unauthorized outside users from directly accessing the internal corporate network while allowing controlled access to public-facing services.

Why the other options are wrong

• B. A DMZ connects to the Internet through an external firewall, not a private network; the external connection is what makes it a demilitarized zone.

Correct answer: A, B. Storms; Floods

Storms and floods are natural environmental threats that organizations must protect against through physical security measures and business continuity planning. Strikes are labor-related actions by employees, which are human threats rather than natural environmental threats. Accidents, while they can occur naturally, are typically classified as human-caused incidents rather than natural environmental threats in security frameworks.

Why the other options are wrong

• C. Strikes are labor disputes and human actions, not natural environmental threats.
• D. Accidents are typically classified as human-caused rather than natural environmental threats.

Correct answer: B. It hides internal hosts from the public network.

Network Address Translation (NAT) operates by translating private IP addresses on an internal network into public IP addresses when those packets traverse to the public network. This process effectively hides internal hosts and their private addressing scheme from the public network, making internal network topology and device details invisible to external hosts. The internal network remains aware of the public network through the NAT device, but external entities cannot directly see or communicate with individual internal hosts, they only see the NAT device's public interface.

Why the other options are wrong

• A. NAT does not hide the public network from internal hosts; internal hosts can still access and communicate with public network resources through the NAT device.
• C. NAT does not use public IP addresses on an internal network; it uses private IP addresses internally and only translates them to public addresses at the border.
• D. NAT translates IP addresses into other IP addresses, not into user-friendly names; DNS performs name-to-address translation.

Correct answer: D. Land attack

A Land attack sends a spoofed TCP SYN packet where the target's IP address is used in both the source and destination fields, causing the target to send replies to itself and potentially crash. Jolt, Ping of Death, and Teardrop are other DoS attacks but do not involve this specific spoofing technique of duplicating the target IP in both fields.

Why the other options are wrong

• A. Jolt DoS attack sends fragmented ICMP echo requests, not spoofed TCP SYN packets with identical source and destination.
• B. Ping of Death attack sends oversized ICMP packets, not the specific spoofed SYN technique described.
• C. Teardrop attack sends overlapping fragmented IP packets, not spoofed TCP SYN packets with identical source and destination fields.

Correct answer: A, D. Highest possible encryption for traffic between the offices; Mutual authentication between the two servers

L2TP combined with IPSec provides the highest possible encryption for traffic between offices through dual-layer security, and IPSec includes mutual authentication mechanisms that verify the identity of both servers before the tunnel is established. Encryption protects data in transit but does not encrypt files stored locally on servers, and this configuration does not increase available bandwidth on the Internet connection.

Why the other options are wrong

• B. IPSec and L2TP encrypt data in transit but do not encrypt files stored locally on the servers.
• C. VPN configuration does not increase available Internet bandwidth; it only secures existing connections.

Correct answer: D. Orange Book

The Orange Book, formally known as the Department of Defense Trusted Computer System Evaluation Criteria (TCSEC), addresses confidentiality and is the primary security evaluation standard dealing with data confidentiality protection. The Brown, Red, and Purple Books are part of the Rainbow Series but have different focuses unrelated to confidentiality.

Why the other options are wrong

• A. The Brown Book addresses security labels and labeling mechanisms, not confidentiality principles.
• B. The Red Book covers network security and trusted network interpretation, not confidentiality principles.
• C. The Purple Book addresses security guidelines for specific systems but is not the primary confidentiality reference.

Correct answer: A, B, C. Running regular backups and routinely testing the validity of the backup data; Performing data restoration from the backups when necessary; Controlling access, adding and removing privileges for individual users

A data custodian implements and maintains the security controls for classified information as directed by the data owner. This includes performing regular backups and testing their validity (A), performing data restoration when needed (B), and managing user access by controlling privileges through addition and removal (C). Determining classification levels is the responsibility of the data owner or data classifier, not the custodian.

Why the other options are wrong

• D. Classification determination is the data owner's responsibility, not the custodian's role.

Correct answer: A, B. MS-CHAP v2; EAP-TLS

MS-CHAP v2 and EAP-TLS both support mutual authentication, where both the client and server authenticate each other. MS-CHAP v2 provides bidirectional authentication in the Challenge-Handshake Authentication Protocol, and EAP-TLS uses certificate-based authentication for both parties.

Why the other options are wrong

• C. EAP-MD5 only authenticates the client to the server, not bidirectionally, so it does not support mutual authentication.
• D. NTLM supports mutual authentication in some contexts, but it is not considered as robust for mutual authentication as MS-CHAP v2 and EAP-TLS; however, the standard answer prioritizes the two strongest implementations.

Correct answer: C, D. Security policy; Security awareness training

Administrative controls are management-driven measures such as policies, procedures and training that direct how people behave. A security policy sets the organisation's rules, and security awareness training teaches staff to follow them, so both are classic administrative controls.

Why the other options are wrong

• A. Data backup is a technical or operational control that protects data availability, not a management directive.
• B. Auditing, in the sense of audit trails and logging, is a detective technical control rather than an administrative one.

Correct answer: C. Bounce attack scanning

Bounce attack scanning exploits FTP servers configured to allow proxy connections. The scanner connects to an FTP server and requests it to initiate a data transfer to a third-party target system, allowing the scanner to remain anonymous while probing the target. This technique bounces the scan traffic through an intermediary server. Xmas Tree and TCP FIN scans are specific TCP flag-based techniques, and TCP SYN scanning uses the three-way handshake for probing.

Why the other options are wrong

• A. Xmas Tree scanning sets multiple TCP flags and does not involve FTP servers.
• B. TCP SYN scanning uses the three-way handshake, not FTP server proxying.
• D. TCP FIN scanning uses the FIN flag to probe ports, not FTP server intermediaries.

Correct answer: D. Web server

Server-side programs and scripts execute on the web server. When a user requests a web page that contains server-side code (such as scripts written in PHP, ASP, or JSP), the web server processes that code and sends the result to the client's browser. The client never executes the server-side program directly; it only receives the HTML output. This separation ensures that sensitive business logic and databases remain protected on the server.

Why the other options are wrong

• A. Routers do not execute web server programs.
• B. Only the server executes the program; the client receives the processed output.
• C. The client receives the result of server execution, but does not execute the program itself.

Correct answer: B. Unicast transmission

Unicast transmission occurs when a packet is sent from a single source computer to a single destination computer. This is point-to-point communication where the data travels along a specific path to reach one intended recipient.

Why the other options are wrong

• A. Broadcast transmission sends a packet from one source to all devices on a network segment.
• C. Multicast transmission sends a packet from one source to multiple specific destinations (a group), not just one.
• D. Baseband transmission is a method of signal transmission on a medium, not a classification of packet transmission types.

Correct answer: A, C. It is a block cipher in which plain text and cipher text are integers between 0 and n-1; It is an asymmetric algorithm.

RSA is a block cipher where plaintext and ciphertext are integers between 0 and n-1, where n is the product of two large primes. RSA is also an asymmetric algorithm, using a public key for encryption and a private key for decryption. These two properties define RSA's fundamental operation.

Why the other options are wrong

• B. RSA is not a stream cipher; it is a block cipher that processes data in fixed-size blocks.
• D. RSA is not symmetric; it uses different keys for encryption and decryption, making it asymmetric.

Correct answer: B. Ping flood attack

A ping flood attack involves sending a large number of ICMP ECHO request packets to a target computer to consume its bandwidth and processing resources, causing denial of service. This is exactly what Samantha is doing in the scenario.

Why the other options are wrong

• A. A land attack sends spoofed packets with the same source and destination IP address, which is a different technique.
• C. A smurf attack uses ICMP ECHO requests sent to broadcast addresses with spoofed source addresses to amplify traffic.
• D. A teardrop attack exploits fragmentation handling by sending overlapping packet fragments, not ICMP ECHO packets.

Correct answer: B, D. Password sniffing; IP spoofing

Password sniffing and IP spoofing are network-based attacks that require specific security protections to defend against. Password sniffing captures credentials transmitted over networks, necessitating encryption and secure protocols, while IP spoofing falsifies source addresses and requires authentication mechanisms and packet filtering. DoS attacks and broadcast storms are symptom categories rather than attack vectors requiring distinct protective solutions.

Why the other options are wrong

• A. DoS attacks are a broad category of network disruption rather than a specific threat requiring unique protection mechanisms.
• C. Broadcast storms are network congestion events, not security attacks that constitute independent protection requirements.

Correct answer: D. 22

SSH (Secure Shell) protocol uses port 22 by default for secure remote connections. This is the standard IANA-assigned port for SSH and is what systems expect when establishing SSH connections unless explicitly configured otherwise. Port 22 is the universally recognized default across all operating systems and network devices for SSH communication.

Why the other options are wrong

• A. Port 21 is the default port for FTP (File Transfer Protocol), not SSH.
• B. Port 443 is the default port for HTTPS (HTTP Secure), not SSH.
• C. Port 80 is the default port for HTTP (unencrypted web traffic), not SSH.

Correct answer: D. Nimda virus

The Snort rule detects WEB-IIS cmd.exe access attempts with established flow connections targeting HTTP ports. This signature is specifically designed to identify the Nimda worm, which exploited IIS vulnerabilities to execute cmd.exe commands remotely. Nimda was known for spreading through IIS web servers and attempting command execution via HTTP requests. The rule's focus on cmd.exe execution through IIS and HTTP traffic directly matches Nimda's attack methodology. The Chernobyl, I LOVE YOU, and Melissa viruses used different propagation methods (file systems, email attachments) and did not specifically target IIS with cmd.exe execution over HTTP.

Why the other options are wrong

• A. Chernobyl virus primarily targeted system files and the BIOS, not web application attacks or IIS cmd.exe execution.
• B. I LOVE YOU virus spread via email attachments and script execution, not through HTTP-based IIS cmd.exe exploitation.
• C. Melissa virus propagated through email and Outlook, not through web server command execution attacks.

Correct answer: B. System hardening

System hardening is the process of securing an operating system from attack by reducing vulnerabilities, disabling unnecessary services, applying patches, and implementing security controls. System hacking is malicious activity, system mirroring is data replication, and system indexing is a data organization technique, none relate to securing systems against attacks.

Why the other options are wrong

• A. System hacking is malicious exploitation, not a defensive security process.
• C. System mirroring is a data redundancy and backup technique, not security hardening.
• D. System indexing is a database or file organization method, not a security hardening practice.

Correct answer: A, B, D. Blowfish; DES; RC5

Blowfish, DES, and RC5 are all symmetric encryption algorithms that use the same key for both encryption and decryption. Blowfish is a 64-bit block cipher designed by Bruce Schneier, DES (Data Encryption Standard) is a 56-bit symmetric cipher, and RC5 is a variable block-size symmetric cipher. Diffie-Hellman is an asymmetric key exchange algorithm used to establish shared secrets over insecure channels, not a symmetric encryption method.

Why the other options are wrong

• C. Diffie-Hellman is an asymmetric key exchange protocol, not a symmetric encryption algorithm.

Correct answer: A, B, C, D. ASCII; MPEG; TIFF; JPEG

ASCII, MPEG, TIFF, and JPEG are all standardized file formats. ASCII is a character encoding standard; MPEG is a video and audio compression standard; TIFF is an image format standard; and JPEG is a compressed image format standard. All are recognized international or industry standards.

Correct answer: C. Differential backup

A differential backup backs up all changes made since the last full or normal backup. It captures every file that has changed since the last full backup, making it faster than a full backup but potentially larger than an incremental backup.

Why the other options are wrong

• A. Half backup is not a standard backup method terminology.
• B. An incremental backup backs up only changes since the last backup of any type (full or incremental), not since the last full backup.
• D. A full backup backs up all data, not just changes since the last full backup.

Correct answer: A. B-rated system

The Orange Book (TCSEC) B-rated systems have mandatory protection of the Trusted Computing Base (TCB). B-rated systems implement mandatory access control and labeled security. A-rated systems provide even higher assurance with verified design, while C and D rated systems have lesser protection requirements for the TCB.

Why the other options are wrong

• B. A-rated systems have the highest assurance level, exceeding mandatory TCB protection requirements.
• C. D-rated systems have minimal or no verified protection of the TCB.
• D. C-rated systems have discretionary access control but not mandatory TCB protection.

Correct answer: D. Session

SQL (Structured Query Language) operates at Layer 5 (Session) of the OSI model. SQL is an application-level query language used to manage database sessions and transactions. While databases themselves often function at higher layers, SQL specifically manages session-level operations including connection establishment, maintenance, and termination of communication sessions.

Why the other options are wrong

• A. The Physical layer deals with hardware transmission media and signals, not database queries.
• B. The Network layer handles routing and IP addressing, not database language operations.
• C. The Transport layer manages end-to-end communication reliability, not database queries.

Correct answer: A. Patent

A patent is a set of exclusive rights granted by a state to an inventor or assignee for a fixed period in exchange for disclosure of an invention. Patents protect novel inventions and provide legal monopoly rights over the technology. Copyright protects creative works, a utility model is a lesser form of protection in some jurisdictions, and snooping is not an intellectual property concept.

Why the other options are wrong

• B. Snooping refers to unauthorized access to information and is not an intellectual property protection mechanism.
• C. Copyright protects creative works and artistic expression, not inventions.
• D. A utility model is a weaker form of intellectual property protection available in some countries but is not the primary mechanism described.

Correct answer: A, C, D. Use on-screen keyboards and speech-to-text conversion software which can also be useful agains keyloggers, as there are no typing or mouse movements involved; Use commercially available anti-keyloggers such as PrivacyKeyboard; Monitor the programs running on the server to see whether any new process is running on the server or not.

Using on-screen keyboards and speech-to-text eliminates keystroke capture vectors, commercially available anti-keylogger software actively detects and prevents keyloggers, and monitoring running processes helps identify unauthorized keylogger processes. SNMP agent removal is unrelated to keylogger defense and addresses network management vulnerabilities instead.

Why the other options are wrong

• B. Removing or disabling SNMP protects against SNMP-based attacks but does not counter keylogger threats.

Correct answer: D. IP Security (IPSec)

L2TP is a tunneling protocol that operates at Layer 2 and provides the tunnel itself, but does not provide encryption. IPSec (IP Security) is the standard protocol used with L2TP to provide encryption for data transmitted across public networks. The combination L2TP/IPSec is the industry standard for secure remote access VPN connections, where IPSec handles the encryption while L2TP manages the tunneling.

Why the other options are wrong

• A. MPPE is a Microsoft-specific encryption protocol primarily used with PPTP, not the standard choice for L2TP encryption.
• B. PGP is an email encryption standard and is not used for VPN tunnel encryption in L2TP implementations.
• C. DES is a symmetric cipher that can be used for encryption but is not the protocol layer used to secure L2TP tunnels; IPSec is the proper security protocol.

Correct answer: B. UDP port 67

DHCP (Dynamic Host Configuration Protocol) operates on UDP port 67 on the server side. The DHCP server listens on UDP port 67 to receive discovery and request messages from DHCP clients, which send from UDP port 68. UDP is the correct transport protocol because DHCP requires a connectionless, low-overhead method for IP address assignment during the bootstrap process.

Why the other options are wrong

• A. UDP port 389 is used by LDAP (Lightweight Directory Access Protocol), not DHCP.
• C. TCP port 80 is used by HTTP (Hypertext Transfer Protocol) for web servers, not DHCP.
• D. TCP port 110 is used by POP3 (Post Office Protocol 3) for retrieving email, not DHCP.

Correct answer: A. Dumpster diving

Dumpster diving is the practice of searching through discarded materials, typically trash and recycling, to find confidential or useful information that can be exploited for social engineering or other malicious purposes. Hacking involves unauthorized computer access, phishing uses deceptive emails to obtain information, and spoofing involves impersonating trusted sources.

Why the other options are wrong

• B. Hacking refers to unauthorized computer system access, not searching through trash.
• C. Phishing is sending deceptive emails to obtain information, not searching through physical trash.
• D. Spoofing is impersonating a trusted entity digitally, not searching through discarded materials.

Correct answer: A, B, D. Dig; NSLookup; Host

Dig, NSLookup, and Host are legitimate command-line DNS query tools that can be used to perform DNS zone transfers when misconfigured DNS servers allow them. These tools can request AXFR (zone transfer) records from DNS servers, allowing attackers to enumerate the entire zone file. DSniff is a network sniffing tool used for capturing network traffic and does not perform DNS zone transfers.

Why the other options are wrong

• C. DSniff is a packet sniffing tool for capturing network traffic and credentials; it does not perform DNS zone transfer enumeration.

Correct answer: A. Fibre optic cable

Fiber optic cable provides maximum security against electronic eavesdropping because it transmits data as light pulses through glass or plastic strands rather than electrical signals. This makes it virtually impossible to intercept signals without breaking the cable, which is immediately detectable. Copper-based cables (UTP, STP) transmit electrical signals that can be intercepted electromagnetically. NTP is not a cable type.

Why the other options are wrong

• B. NTP (Network Time Protocol) is not a cable type; it is a protocol for time synchronization.
• C. STP (Shielded Twisted Pair) cable has shielding but can still be vulnerable to sophisticated eavesdropping compared to fiber optic.
• D. UTP (Unshielded Twisted Pair) cable lacks shielding and is highly vulnerable to electromagnetic eavesdropping.

Correct answer: D. Insertion attack

An insertion attack is an IDS evasion technique where an attacker sends a data packet that the IDS accepts and processes as part of the attack payload, but the target host rejects or ignores. This causes a divergence between what the IDS sees and what the actual system processes, allowing the attacker to bypass IDS detection. Fragmentation overlap and fragmentation overwrite attacks involve overlapping packet fragments, while evasion attack is a general category rather than a specific technique.

Why the other options are wrong

• A. Fragmentation overlap attacks involve overlapping fragments that different systems interpret differently, not specifically packets accepted by IDS but rejected by hosts.
• B. Evasion attack is a general category of attacks that avoid detection rather than a specific IDS evasion technique.
• C. Fragmentation overwrite attacks use overlapping fragments to overwrite portions of data but are distinct from insertion attacks.

Correct answer: D. CCTV

CCTV (Closed-Circuit Television) is an intrusion detection device that monitors and records activity to detect unauthorized access or suspicious behavior. Fingerprint readers, smart card readers, and retinal scanners are all authentication or identification devices used to verify identity, not to detect intrusions. These biometric and access control devices prevent unauthorized access but do not detect or alert to intrusion attempts like surveillance systems do.

Why the other options are wrong

• A. Fingerprint readers are authentication devices for identity verification, not intrusion detection.
• B. Smart card readers are authentication devices for access control, not intrusion detection.
• C. Retinal scanners are biometric authentication devices for identity verification, not intrusion detection.

Correct answer: D. Wiretapping

Wiretapping is a lawful interception technique generally practiced by police and governmental authorities with proper legal authorization and warrants. It is an established investigative tool in law enforcement and is conducted under legal oversight and framework.

Why the other options are wrong

• A. SMB signing is a security feature for network authentication, not a law enforcement practice.
• B. Phishing is a malicious attack technique, not a practice of governmental authorities.
• C. Spoofing is a malicious deception technique, not a recognized governmental law enforcement practice.

Correct answer: B. IDLE

IDLE scanning is a stealth scanning technique that uses a zombie host (third-party IP address) to send packets to the target, masking the attacker's true IP address. This allows John to perform reconnaissance while remaining undetected by using another system's IP as the source, making it ideal for stealth testing against www.we-are-secure.com.

Why the other options are wrong

• A. RPC (Remote Procedure Call) is an application protocol used for inter-process communication, not a scanning technique.
• C. UDP is a transport protocol but not specifically designed for stealth scanning using a third party's IP address.
• D. TCP SYCK (likely TCP SYN) is a standard scan type that does not inherently provide stealth through third-party IP spoofing.

Correct answer: D. 2Mosaic

2Mosaic is a specialized tool designed for breaking or removing digital watermarks from multimedia content. TRACERT is a network diagnostic utility for tracing routes, Trin00 is a distributed denial-of-service attack tool, and Fpipe is a port redirector utility, none of these are used for watermark removal.

Why the other options are wrong

• A. TRACERT is a network routing diagnostic tool, not related to watermark breaking.
• B. Trin00 is a DDoS attack tool, not used for watermark removal.
• C. Fpipe is a port forwarding utility, not related to digital watermarks.

Correct answer: A, B. 10.0.0.3; 192.168.15.2

Private IP addresses are reserved ranges defined in RFC 1918: 10.0.0.0/8 (10.0.0.0–10.255.255.255), 172.16.0.0/12 (172.16.0.0–172.31.255.255), and 192.168.0.0/16 (192.168.0.0–192.168.255.255). Option A (10.0.0.3) falls within the first private range, and option B (192.168.15.2) falls within the third private range. Options C and D are public addresses outside these reserved ranges.

Why the other options are wrong

• C. 192.166.54.32 is a public IP address, not in any private range.
• D. 19.3.22.17 is a public IP address, not in any private range.

Correct answer: C. A sensor scans some physical characteristics of a user and sends that information to the authentication server.

Biometric authentication involves a sensor scanning physical characteristics (such as fingerprints, iris patterns, or facial features) of a user and sending that information to an authentication server for verification. This is the defining characteristic of biometric authentication systems. Username/password is knowledge-based authentication, smart cards are token-based authentication, and generic device issuance without specifying biometric characteristics does not define biometric authentication.

Why the other options are wrong

• A. Username and password represent knowledge-based authentication, not biometric authentication.
• B. Smart cards are token-based authentication, not biometric authentication.
• D. A device for authentication is too vague and could refer to tokens or other non-biometric methods.

Correct answer: A. Grant the employees minimum permissions that are needed to perform the required tasks.

The principle of least privilege dictates granting employees only the minimum permissions necessary to perform their job functions, which prevents unauthorized activities by restricting access to only what is needed. Limiting file opens is an arbitrary restriction unrelated to security policy. Granting maximum permissions increases risk substantially. NTFS partitions provide file-level security but are not a strategy to prevent unauthorized activities without proper permission assignment.

Why the other options are wrong

• B. Limiting the number of open files is an arbitrary technical restriction not related to preventing unauthorized activities.
• C. Granting maximum permissions increases the risk of unauthorized activities rather than preventing them.
• D. NTFS partitions provide security features but do not prevent unauthorized activities without proper permission configuration.

Correct answer: A. It is used to track user accounts for file and object access, logon attempts, etc.

Audit logging is a security mechanism designed to record and track user activities, including file and object access, logon attempts, privilege escalation, and other significant security events. These logs create an accountability trail that enables administrators to monitor who accessed what resources, when they accessed them, and what actions they performed. This tracking capability is essential for detecting unauthorized activities, investigating security incidents, and maintaining compliance with regulatory requirements.

Why the other options are wrong

• B. While audit logging can support access control policies, its primary function is tracking and recording activities rather than preventing unauthorized access, that is the role of authentication and authorization mechanisms.
• C. Audit logging does not protect against virus attacks; antivirus software, firewalls, and endpoint protection systems are used for that purpose.
• D. Though audit logging contributes to overall network security by enabling detection and investigation, it is not a general security mechanism for protecting networks, it is specifically a tracking and accountability tool.

Correct answer: B. PGP

PGP (Pretty Good Privacy) is used for encrypting and digitally signing email and other communications. It provides end-to-end encryption and authentication for private communications, making it suitable for securing messages sent via email and instant messaging.

Why the other options are wrong

• A. IPSec operates at the network layer and is used for securing IP traffic, not specifically for email and messaging encryption.
• C. PPTP is a tunneling protocol for creating VPN connections, not a standard for encrypting email and messages.
• D. NTFS is a file system standard used by Windows, unrelated to communication encryption.

Correct answer: A. Broadband transmission

Broadband transmission handles a relatively wide range of frequencies that may be divided into channels or frequency bins. This is the defining characteristic of broadband systems, which use multiple frequency bands simultaneously to transmit data, unlike baseband which uses a single channel.

Why the other options are wrong

• B. Multicast transmission refers to sending data to multiple specific recipients, not a frequency handling method.
• C. Baseband transmission uses a single frequency band without division into multiple channels.
• D. Unicast transmission refers to one-to-one communication, not a frequency handling approach.

Correct answer: A, B, C. L2TP does not provide any kind of security; PPTP connections use Microsoft Point-to-Point Encryption (MPPE), whereas L2TP uses Data Encryption Standard (DES); L2TP may be used with IPSec, while PPTP stands alone.

L2TP does not provide encryption on its own (A), relying instead on IPSec or other methods for security. PPTP uses Microsoft Point-to-Point Encryption (MPPE) while L2TP uses DES or other encryption standards when paired with IPSec (B). L2TP is designed to work with IPSec for security, whereas PPTP functions independently (C). Option D is incorrect because PPTP is not proprietary to Microsoft and L2TP is an industry standard, not a Microsoft proprietary protocol.

Why the other options are wrong

• D. L2TP is an industry-standard protocol developed jointly, not a Microsoft proprietary standard, and PPTP is more widely supported but not exclusively by Microsoft.

Correct answer: A, C. He should upgrade his anti-virus program; He should observe the process viewer (Task Manager) to see whether any new process is running on the computer or not. If any new malicious process is running, he should kill that process.

When Kernel32.exe shows errors, it may indicate malware infection. John should upgrade his anti-virus program (A) to detect and remove threats, and monitor the Task Manager to identify and terminate malicious processes (C). Downloading patches (B) addresses vulnerabilities but not active malware, and restoring settings (D) does not directly address malware threats or kernel compromise.

Why the other options are wrong

• B. Patches fix vulnerabilities but do not remove active malware already present on the system.
• D. Restoring Windows settings alone does not address malware infections or kernel compromise.

Correct answer: C. Packet filtering

Packet filtering is the firewall technique that examines packets and allows or denies them based on predefined rules such as source/destination IP addresses, ports, and protocols. This is the fundamental firewall function for controlling which traffic crosses the firewall boundary.

Why the other options are wrong

• A. Web caching improves performance by storing web content; it does not filter packets at the firewall.
• B. Hacking is unauthorized access, not a firewall protection mechanism.
• D. Spoofing is an attack technique that forges source addresses; it is not a firewall filtering method.

Correct answer: A, B, D. DC; OU; CN

DC (Domain Component), OU (Organizational Unit), and CN (Common Name) are LDAP notation components used to identify and reference Active Directory elements. DC represents domain components, OU represents organizational units, and CN represents the common name of an object. FN is not a standard Active Directory naming component.

Why the other options are wrong

• C. FN is not a recognized Active Directory naming convention component.

Correct answer: A. Packet sniffing

Packet sniffing is the process of monitoring and capturing data packets that travel across a network. It intercepts network traffic to analyze or monitor data flow. Authentication verifies identity, network binding establishes connections, and encryption protects data, none of these are processes for monitoring packets.

Why the other options are wrong

• B. Authentication is a verification process, not packet monitoring.
• C. Network binding refers to connecting network adapters or establishing network connections, not monitoring packets.
• D. Encryption protects data confidentiality, not a monitoring technique.

Correct answer: B. CGI

CGI (Common Gateway Interface) is the standard interface that defines the communication link between a web server and web applications. It specifies how web servers execute external programs and return their output to clients. PGP is an encryption standard for email, IETF is an internet standards organization, and a firewall is a network security device, none of which define the web server-to-application communication protocol.

Why the other options are wrong

• A. PGP is an encryption and authentication protocol for email, not a web server communication interface.
• C. IETF is an internet standards organization, not a communication link protocol.
• D. A firewall is a network security device that filters traffic, not a communication interface between servers and applications.

Correct answer: A, B. ToneLoc; THC-Scan

ToneLoc and THC-Scan are both recognized war dialing tools used to scan large ranges of telephone numbers to identify vulnerable modems and other devices that may grant unauthorized access. These tools systematically probe phone numbers and attempt to detect systems with weak security configurations.

Why the other options are wrong

• C. Wingate is a proxy and firewall software, not a war dialing tool for scanning telephone numbers.
• D. NetStumbler is a tool for detecting wireless networks (WiFi), not a war dialing tool for telephone scanning.

Correct answer: B, C, D. Preserve the log files for a forensics expert; Prevent the company employees from entering the server room; Detach the network cable from the database server.

Preserving log files for forensic analysis (option B) maintains critical evidence of the intrusion. Detaching the network cable (option D) isolates the server and stops the attacker's access while preserving the current system state and memory. Preventing employees from entering the server room (option C) protects the crime scene from evidence contamination and maintains chain of custody. Preventing forensics experts from entering the server room (option A) is counterproductive to evidence preservation.

Why the other options are wrong

• A. Preventing forensics experts from accessing the server room obstructs evidence collection and analysis.

Correct answer: B, D. Bluesnarfing; Bluebug attack

Bluesnarfing and Bluebug attacks are both application-level security violations that exploit Bluetooth vulnerabilities to unauthorized access and data theft. Bluesnarfing involves unauthorized access to data on Bluetooth devices, while Bluebug allows attackers to control certain functions. Social engineering, SQL injection, and cross-site scripting are technique-based attacks but are not classified as application-level violations in the same sense as Bluetooth-specific exploits.

Why the other options are wrong

• A. Social engineering is a human-based attack technique rather than an application-level security violation.
• C. SQL injection is a web application attack, not typically classified as an application-level security violation in this context.
• E. Cross-site scripting is a web application vulnerability rather than an application-level security violation in the sense being asked.

Correct answer: A, C. Perl; JavaScript

JavaScript and Perl are both scripting languages that can execute on client computers. JavaScript runs in web browsers natively, while Perl can be executed on client systems for various tasks. Both provide scripting capabilities directly on the client side.

Why the other options are wrong

• B. DHTML is not a programming language but a combination of HTML, CSS, and JavaScript; it is not executable on its own.
• D. HTML is a markup language used for structure and presentation, not a scripting language that runs on clients.

Correct answer: D. Use SET.

SET (Secure Electronic Transaction) is the standard protocol specifically designed for secure credit card transactions over the internet. It provides encryption and authentication mechanisms to protect credit card numbers and payment information during online purchases, ensuring both cardholder and merchant security.

Why the other options are wrong

• A. PGP (Pretty Good Privacy) is a general-purpose encryption tool for email and files, not specifically designed for e-commerce payment processing.
• B. HTTP is the standard web protocol without encryption; HTTPS uses SSL/TLS but SET is the dedicated e-commerce payment standard.
• C. MIME is a standard for encoding email and file attachments, not a secure payment protocol.

Correct answer: A. WEP

WEP (Wired Equivalent Privacy) is a security protocol specifically designed to provide security for wireless local area networks. It encrypts data transmitted over WLANs to protect against unauthorized access. Although WEP has known vulnerabilities and is now considered obsolete, it was the original protocol developed for WLAN security.

Why the other options are wrong

• B. EAP (Extensible Authentication Protocol) is an authentication framework used in conjunction with wireless security but is not itself a WLAN security protocol.
• C. NAT (Network Address Translation) is a network function for address translation and has no direct role in WLAN security.
• D. TLS (Transport Layer Security) operates at the transport layer and is used for securing communications channels, not specifically for WLAN security.

Correct answer: B. Bastion host

A bastion host is a hardened computer system positioned at the network perimeter to accept connections from untrusted networks like the Internet while being extremely vulnerable to attack. It is deliberately designed to be accessible externally yet secured with additional protections. LMHOSTS is a static name resolution file, a firewall is a network security device, and a gateway is a network access point, none specifically describe an Internet-facing secure computer.

Why the other options are wrong

• A. LMHOSTS is a static NetBIOS name resolution file, not a type of secure computer.
• C. A firewall is a network security device, not a computer that must be secure due to Internet accessibility.
• D. A gateway is a network device for connecting different networks, not a computer hardened against Internet attacks.

Correct answer: A. ICMP

ICMP (Internet Control Message Protocol) provides maintenance and error reporting functions for IP networks. It is used for diagnostics such as ping and traceroute commands to test connectivity and report network errors. IGMP handles multicast group management. PPP is a data link layer protocol for establishing direct connections. UDP is a transport layer protocol for connectionless data transmission.

Why the other options are wrong

• B. IGMP manages multicast group membership, not general error reporting.
• C. PPP is a data link protocol for point-to-point connections, not for error reporting.
• D. UDP is a transport protocol for data transmission, not for network maintenance and error reporting.

Correct answer: D. Keystroke logger

A keystroke logger is a tool that records everything a person types using the keyboard. It captures all keyboard input and is commonly used in security breaches to steal passwords and sensitive information.

Why the other options are wrong

• A. A line conditioner protects against power supply problems and voltage fluctuations.
• B. A firewall filters network traffic and controls access between networks.
• C. A port scanner identifies open ports on a system for network reconnaissance.

Correct answer: B. Type I

A Type I error is a false rejection, where a biometric system wrongly denies access to a legitimate user. Its rate is the False Rejection Rate.

Why the other options are wrong

• A. A Type II error is a false acceptance, where an impostor is wrongly granted access.
• C. Type III is not a recognised biometric error type.
• D. Type IV is not a recognised biometric error type.

Correct answer: D. SSH

SSH (Secure Shell) is the protocol specifically designed to establish secure sessions over TCP/IP, replacing the insecure TELNET protocol. SSH provides encryption and authentication for remote command-line access and file transfer. While SSL provides encryption for web traffic, PGP is for email encryption, and IPsec secures IP layer communications, SSH is the direct secure replacement for TELNET.

Why the other options are wrong

• A. SSL secures HTTP traffic for web browsing, not TELNET sessions.
• B. PGP is primarily used for encrypting and signing email messages, not remote terminal access.
• C. IPsec operates at the network layer and secures IP communications generally, not specifically TELNET sessions.

Correct answer: A. Biometrics

Biometrics is the most secure method of authentication because it relies on unique physiological characteristics (fingerprints, iris scans, facial recognition) that cannot be easily duplicated, forgotten, or stolen, making it inherently more secure than knowledge-based or possession-based methods.

Why the other options are wrong

• B. Smart cards can be lost, stolen, or compromised, making them less secure than biometric authentication.
• C. Anonymous authentication provides no identification verification and is the least secure option.
• D. Username and password authentication is vulnerable to guessing, phishing, and credential theft attacks.

Correct answer: B. IEEE 802.11b

IEEE 802.11b is the wireless local area network standard that operates in the 2.4 GHz frequency band and supports data rates up to 11 Mbps. It is part of the 802.11 family of standards specifically designed for WLANs.

Why the other options are wrong

• A. IEEE 802.4 is the Token Bus standard for local area networks, not wireless networks.
• C. IEEE 802.5 is the Token Ring standard for local area networks, not wireless networks.
• D. IEEE 802.3 is the Ethernet standard for wired local area networks, not wireless networks.

Correct answer: A, C. Rename the Administrator account; Disable the Guest account.

Renaming the Administrator account prevents attackers from targeting a known account name with brute force attacks, and disabling the Guest account removes an unnecessary default account that could be exploited. These are both fundamental hardening practices for Windows 2000 Server security. Removing the Administrator account entirely would prevent legitimate administration, and enabling the Guest account introduces security vulnerabilities rather than hardening the system.

Why the other options are wrong

• B. The Administrator account cannot be completely removed as it is essential for server administration and management.
• D. Enabling the Guest account increases security risk by providing an unnecessary entry point for potential attackers.

Correct answer: B. Category 3

Category 3 UTP cable has a maximum data transfer rate of 155 Mbps, making it suitable for older networking standards. Category 5 supports up to 100 Mbps, Category 6 supports up to 10 Gbps, and Category 7 supports up to 100 Gbps, all exceeding the 155 Mbps specification in the question.

Why the other options are wrong

• A. Category 5 cable supports maximum speeds of 100 Mbps, not 155 Mbps.
• C. Category 7 cable supports up to 100 Gbps, far exceeding 155 Mbps.
• D. Category 6 cable supports up to 10 Gbps, significantly higher than 155 Mbps.

Correct answer: C. Network address translation (NAT)

Network Address Translation (NAT) operates at the network layer and translates private IP addresses on a local area network to a public IP address for external communication. This process effectively hides the internal LAN's IP addressing scheme and topology from external networks.

Why the other options are wrong

• A. A hub is a physical layer device that simply repeats signals and does not translate or hide addresses.
• B. MAC addresses operate at the data link layer and are used for local network communication, not for hiding LAN topology.
• D. A network interface card is a hardware component that connects a device to a network but does not perform address translation or topology hiding.

Correct answer: A, D. It enhances network security; It uses a single registered IP address for multiple connections to the Internet.

DHCP enhances network security by centralizing address management and reducing configuration errors, and it enables Network Address Translation (NAT) to use a single registered IP address for multiple internal client connections to the Internet. DHCP also reduces administrative overhead and improves network efficiency. Dial-up charges are unrelated to DHCP functionality in modern networks, and while DHCP automates IP assignment, it does not specifically cut dial-up costs.

Why the other options are wrong

• B. DHCP does not reduce dial-up charges; dial-up is a connection type unrelated to DHCP address assignment.
• C. While DHCP does assign IP addresses automatically, this is not a complete independent solution; it requires DHCP infrastructure.

Correct answer: B. Secure Shell (SSH)

Secure Shell (SSH) is an application-layer protocol that uses TCP port 22 by default and provides secure remote access to systems with encryption and authentication. SSH operates at the application layer (Layer 7) of the OSI model and is widely used for secure command-line access and file transfer. SSL/TLS also provides security but operates on port 443 and is used for different purposes. POP3 uses port 110 and is for email retrieval. TFTP uses UDP port 69 and is not secure.

Why the other options are wrong

• A. SSL uses TCP port 443, not port 22, and is primarily used for securing web traffic and other services.
• C. POP3 (Post Office Protocol version 3) uses TCP port 110, not port 22, and is used for email retrieval.
• D. TFTP (Trivial File Transfer Protocol) uses UDP port 69, not TCP port 22, and lacks encryption and authentication.

Correct answer: B, C, D. IPchains; Anonymizer; Proxy server

IPchains (firewall rules), Anonymizer (anonymization services), and Proxy servers (traffic routing through intermediaries) can all be used to hide a user's identity online. War dialer is used to find phone numbers and modems, and rootkits provide unauthorized system access but don't inherently hide user identity from the network.

Why the other options are wrong

• A. A war dialer is a tool that automatically dials phone numbers to find modems and vulnerable systems, not for hiding identity.
• E. A rootkit is malware that provides unauthorized system access and control, not primarily designed for hiding user identity on the network.

Correct answer: A, C, D. Integrity; Confidentiality; Availability

The three fundamental principles of information security are the CIA Triad: Confidentiality (ensuring data is only accessible to authorized parties), Integrity (ensuring data is accurate and unmodified), and Availability (ensuring data and systems are accessible when needed). These three pillars form the foundation of all information security frameworks and policies.

Why the other options are wrong

• B. Privacy is related to but distinct from the CIA Triad; it focuses on personal data protection rather than being a foundational security principle like the CIA elements.

Correct answer: A, C. It is used to securely store public and private keys for log on , e-mail signing and encryption, and file encryption; It is a device that contains a microprocessor and permanent memory.

A smart card is a device that is used to securely store public and private keys for log on, e-mail signing and encryption, and file encryption (option A). It is also a device that contains a microprocessor and permanent memory (option C), which enables its security capabilities and key storage functionality. These two characteristics define what a smart card is and how it operates.

Why the other options are wrong

• B. A router is a device that routes data packets between networks, not a smart card; this describes networking equipment, not security hardware.
• D. A network interface card or adapter is a device that works as an interface between a computer and a network, not a smart card.

Correct answer: A. PPP

PPP (Point-to-Point Protocol) is a data link layer protocol specifically designed for establishing direct connections over serial lines, such as dial-up modems. It was the standard protocol for remote access and dial-up networking before broadband adoption. SLIP (Serial Line Internet Protocol) was an earlier alternative, but PPP became the industry standard due to superior features including error detection, compression, and authentication support. PPP operates at Layer 2 and provides the framing and control mechanisms necessary for serial communication.

Why the other options are wrong

• B. SNMP is a network management protocol operating at Layer 7; it is not a link layer protocol for serial connections.
• C. UDP is a transport layer protocol operating at Layer 4; it has no role in establishing or managing serial link connections.
• D. SLIP is an older serial protocol that was superseded by PPP due to PPP's superior functionality and widespread industry adoption.

Correct answer: C. TrueCrypt

TrueCrypt is the encryption tool matching all specifications described: it creates virtual encrypted disks within files, supports AES-256, Serpent, and Twofish encryption algorithms with XTS mode of operation, encrypts system partitions and OS drives, and provides dual levels of plausible deniability through hidden volumes and hidden operating systems. CryptoHeaven, Stunnel, and Magic Lantern do not match this comprehensive feature set.

Why the other options are wrong

• A. CryptoHeaven is an encrypted communication and file storage application, not a disk encryption tool with the described features.
• B. Stunnel is a proxy for adding SSL/TLS encryption to services, not a disk encryption utility.
• D. Magic Lantern is malware associated with the FBI, not a legitimate disk encryption tool.

Correct answer: A, B. Unauthorized modifications are not made by authorized users; Data modifications are not made by an unauthorized user or process.

Integrity ensures that data cannot be modified without authorization. This is ensured by preventing unauthorized modifications by any party (whether inside or outside the organization) and protecting against both intentional and unintentional unauthorized changes. Confidentiality prevents disclosure, and availability ensures system uptime, these are separate security principles.

Why the other options are wrong

• C. Preventing unauthorized disclosure is confidentiality, not integrity.
• D. Ensuring systems are available when needed is availability, not integrity.

Correct answer: B, D. Trust; Identification

Trust and Identification are fundamental security requirements in e-commerce systems. Trust ensures customers feel confident in transactions, while Identification verifies the authenticity of parties involved. Credit is a payment method rather than a security provision, and Transparency, while important for business practices, is not a core security requirement that an e-commerce system must provide.

Why the other options are wrong

• A. Credit is a payment option, not a security requirement of the system itself.
• C. Transparency is a business practice principle, not a core security requirement.

Correct answer: A. PAP

PAP (Password Authentication Protocol) transmits passwords in clear text without any encryption, making it completely unencrypted. CHAP and MS-CHAP variants use challenge-response mechanisms with hashing to protect credentials, providing encryption or at minimum cryptographic protection rather than clear-text transmission.

Why the other options are wrong

• B. MS-CHAP uses encrypted challenge-response authentication, not unencrypted passwords.
• C. CHAP uses challenge-response hashing, not unencrypted passwords.
• D. MS-CHAP v2 uses improved encrypted challenge-response mechanisms, not unencrypted passwords.

Correct answer: A. IEEE 802.1X using EAP-TLS

IEEE 802.1X using EAP-TLS is the strongest authentication method for enterprise wireless networks in an Active Directory environment. EAP-TLS provides mutual authentication and certificate-based security, making it ideal for securing laptop access to company networks. Pre-shared keys lack the scalability and individual authentication needed for enterprise deployments. PEAP-MS-CHAP is acceptable but EAP-TLS provides superior security. Open system provides no authentication.

Why the other options are wrong

• B. Pre-shared keys are not suitable for enterprise environments with many users needing individual authentication.
• C. While PEAP-MS-CHAP is acceptable, EAP-TLS provides stronger mutual authentication with certificates.
• D. Open system provides no security or authentication whatsoever.

Correct answer: D. War driving

War driving is the most common method used to identify wireless networks by driving around with wireless-enabled devices to scan for and map available wireless networks and their characteristics.

Why the other options are wrong

• A. A back door is a hidden entry point for access, not a method for identifying networks.
• B. Packet filtering is a firewall technique for controlling traffic flow, not for identifying wireless networks.
• C. Packet sniffing captures network traffic but is not the primary method for discovering wireless network presence.

Correct answer: B. Strong authentication method

Strong authentication methods provide the most effective defense against man-in-the-middle (MITM) attacks by verifying the identity of communicating parties. Mutual authentication and certificate-based verification ensure that attackers cannot impersonate legitimate endpoints. While encryption protects data confidentiality during transit, it does not prevent MITM attacks if an attacker can establish sessions with both parties. Firewalls and antivirus programs do not specifically prevent MITM attacks.

Why the other options are wrong

• A. Encryption protects data from eavesdropping but does not prevent a man-in-the-middle from intercepting and relaying communications.
• C. Firewalls control network traffic but cannot prevent man-in-the-middle attacks occurring within trusted network segments.
• D. Antivirus programs detect malicious code but do not address the fundamental authentication and verification issues that enable MITM attacks.

Correct answer: A. UDP port 137

The NetBIOS name service uses UDP port 137 as its default port for name registration, resolution, and release operations. NetBIOS name service queries and responses are transmitted over UDP rather than TCP, making UDP port 137 the correct answer for the NetBIOS name service specifically.

Why the other options are wrong

• B. TCP port 110 is the default port for POP3 (Post Office Protocol), not NetBIOS.
• C. UDP port 138 is used for NetBIOS datagram service, not the name service.
• D. TCP port 119 is the default port for NNTP (Network News Transfer Protocol), not NetBIOS.

Correct answer: A. Social engineering attack

Social engineering attacks can bypass both physical and logical security mechanisms by manipulating human psychology. Attackers exploit trust, authority, or urgency to trick people into revealing credentials or granting access, circumventing even the strongest technical controls.

Why the other options are wrong

• B. Password guessing attacks target credentials directly and can be defeated by strong security mechanisms like account lockouts and complexity requirements.
• C. Mail bombing is a denial-of-service attack on email systems, not a method to gain system access.
• D. Cross-site scripting is a web application vulnerability that targets specific systems, not a bypass of general physical and logical security.

Correct answer: A. RAID-1

RAID-1 implements disk mirroring by maintaining identical copies of data on two separate disks. When one disk fails, the mirrored copy ensures data availability and fault tolerance, making it the standard choice for disk mirroring implementations.

Why the other options are wrong

• B. RAID-10 combines striping and mirroring but is more complex and typically used for higher performance requirements than simple disk mirroring.
• C. RAID-0 uses striping without redundancy and provides no fault tolerance; a single disk failure causes total data loss.
• D. RAID-5 uses striping with parity across multiple disks and is more complex than the disk mirroring solution requested.

Correct answer: D. The original document

In legal and forensic contexts, the original document is considered the best evidence under the Best Evidence Rule. Original documents are preferred because they are authentic, unaltered, and provide the most reliable information. Copies may introduce errors or raise questions about authenticity, witness testimony can be subject to perception and memory errors, and computer-generated records may be questioned regarding their source and integrity. The original document provides the highest level of certainty and evidentiary weight.

Why the other options are wrong

• A. Copies of original documents are considered secondary evidence and are less reliable than the original.
• B. Computer-generated records lack the direct authenticity and verifiability of an original document.
• C. Witness testimony based on sensory information is subject to human error, bias, and memory limitations, making it weaker evidence than a physical original document.

Correct answer: C. Dictionary attack

A dictionary attack is specifically designed for cracking passwords by testing each word in a predetermined list (dictionary) of common passwords and variations against a target account. This method exploits the tendency of users to choose common, guessable passwords.

Why the other options are wrong

• A. DoS (Denial of Service) attacks aim to disrupt service availability, not crack passwords.
• B. PING attacks are used for network reconnaissance and do not target password cracking.
• D. Vulnerability attacks exploit system weaknesses but are not specifically designed for password cracking.

Correct answer: C. Web ripping

Web ripping is the technique of copying an entire website's structure and files to a local system for analysis. This is a common reconnaissance technique in ethical hacking and security testing that allows offline analysis of the target site. TCP FTP proxy scanning relates to port scanning, eavesdropping is passive listening, and fingerprinting identifies system characteristics.

Why the other options are wrong

• A. TCP FTP proxy scanning is a network scanning technique, not website content copying.
• B. Eavesdropping is passive network traffic interception, not active website downloading.
• D. Fingerprinting identifies system characteristics and versions, not website structure copying.

Correct answer: C. It identifies the level of confidentiality of information.

A classification policy identifies the level of confidentiality of information by categorizing data into sensitivity levels such as public, internal, confidential, or restricted. This allows organizations to apply appropriate security controls based on how sensitive the information is.

Why the other options are wrong

• A. Providing information about new viruses describes threat intelligence or antivirus updates, not a classification policy.
• B. Authentication methods verify user identity through credentials, not related to information classification.
• D. Securing database servers is a technical control implementation, not the purpose of a classification policy.

Correct answer: A. It is an ICMP attack that involves spoofing and flooding.

A Smurf attack is a distributed denial of service attack that uses ICMP Echo Request packets (ping). The attacker spoofs the source IP address to be that of the victim and sends the ping request to a broadcast address, causing multiple machines on that network segment to respond to the victim with Echo Reply packets, effectively flooding the target with traffic. This combination of ICMP protocol usage with IP spoofing and flooding traffic is the defining characteristic of the Smurf attack.

Why the other options are wrong

• B. While Smurf-like attacks can be performed with UDP, the classic and most well-known Smurf attack specifically uses ICMP Echo Request and Reply packets, not UDP.
• C. A Smurf attack is a DoS attack, but it does not involve leaving TCP ports open; it floods the target with ICMP responses, not TCP traffic.
• D. Smurf attacks do not involve fragmented IP packets or reassembly issues; they use standard ICMP Echo Request/Reply packets sent to broadcast addresses.

Correct answer: A. Retention policy

A retention policy is a network administration rule that specifies how long users must keep emails, documents, and other data before deletion or archival. This policy is commonly used for compliance, legal holds, and storage management. Password policies control password requirements, audit policies track user actions, and backup policies govern data backup procedures, none of which specifically address how long to retain communications and documents.

Why the other options are wrong

• B. Password policy governs password complexity and change requirements, not data retention periods.
• C. Audit policy enables logging and monitoring of security events, not retention of user files.
• D. Backup policy defines how and when data is backed up, not the retention period for emails and documents.

Correct answer: A. Chain of custody

Chain of custody is the documented procedure that forensics experts follow to maintain the integrity and proper handling of evidence from collection through analysis and court presentation. It establishes accountability for evidence at each stage and is critical for legal admissibility.

Why the other options are wrong

• B. Evidence access policy governs who can view evidence but is not the specific documentation of handling guidelines.
• C. Chain of evidence is not standard forensics terminology; chain of custody is the correct term.
• D. Incident response policy addresses how to respond to security incidents but not specifically how to handle physical or digital evidence.

Correct answer: A. IPSec

IPSec (Internet Protocol Security) is a network layer protocol that provides encryption and authentication to protect confidential information from unauthorized access. It operates at Layer 3 of the OSI model and uses cryptographic algorithms to secure data in transit across networks.

Why the other options are wrong

• B. NAT (Network Address Translation) translates IP addresses but does not encrypt data.
• C. Firewalls filter traffic based on rules but do not inherently provide encryption.
• D. MAC addresses identify devices on a local network and provide no encryption capability.

Correct answer: D. Steganography

Steganography is the technique of hiding secret information within another file (in this case, hiding data in an image file). By embedding the secret information within an image file of Jennifer Lopez, John is using steganography to bypass email filters that scan for suspicious content. Email spoofing involves forging sender information, social engineering involves manipulation of people, and web ripping involves copying website content.

Why the other options are wrong

• A. Email spoofing involves forging the sender's address, which is not what John is doing with the image file technique.
• B. Social engineering involves manipulating people through psychological tactics, not technical data hiding methods.
• C. Web ripping is the unauthorized copying of content from websites, not the hiding of data within files.

Correct answer: D. Snort

Snort is the most widely used open-source network intrusion detection system (NIDS). It performs real-time traffic analysis and packet logging on IP networks, detecting various attack patterns and suspicious behavior. Sourcefire is a commercial IDS, NETSH is a Windows network configuration tool, and Macof is a MAC flooding tool.

Why the other options are wrong

• A. Sourcefire is a commercial intrusion detection and prevention platform, not open-source.
• B. NETSH is a Windows command-line network configuration utility, not an intrusion detection system.
• C. Macof is a MAC flooding attack tool used for network reconnaissance, not an intrusion detection system.

Correct answer: A, B. It allows the computers in a private network to share a global, ISP assigned address to connect to the Internet; It reduces the need for globally unique IP addresses.

Network Address Translation (NAT) allows multiple computers in a private network to share a single global ISP-assigned address to communicate with the Internet, and it reduces the need for numerous globally unique IP addresses by enabling address reuse within private networks.

Why the other options are wrong

• C. NAT actually restricts external network clients from accessing internal services; external requests cannot directly reach internal systems behind the NAT translation.
• D. NAT itself does not provide security through the Bastion Host; security policies are implemented through firewalls and ACLs, not NAT translation.

Correct answer: A, D. Biba; Clark-Wilson

The Biba model focuses exclusively on integrity by preventing unauthorized modifications and ensuring data cannot flow from lower to higher integrity levels. The Clark-Wilson model is also an integrity-focused security model designed to prevent unauthorized modifications and ensure data consistency. Bell-LaPadula is a confidentiality model focused on preventing unauthorized information disclosure, and Biba-Wilson is not a recognized standard security model.

Why the other options are wrong

• B. Bell-LaPadula is a confidentiality-focused model concerned with preventing information disclosure, not integrity.
• C. Biba-Wilson is not a recognized standard security model in the literature.

Correct answer: B, C, D. RC5; Twofish; Rijndael

RC5, Twofish, and Rijndael are all block cipher algorithms. RC5 operates on 64-bit or 128-bit blocks, Twofish uses 128-bit blocks, and Rijndael (the basis for AES) operates on 128-bit blocks with variable key sizes. RC4 is a stream cipher, not a block cipher, making it the incorrect option.

Why the other options are wrong

• A. RC4 is a stream cipher algorithm, not a block cipher.

Correct answer: B, C, D. File and object access; Network logons and logoffs; Printer access

File and object access, network logons/logoffs, and printer access are all auditable security activities that organizations track to maintain security logs and detect unauthorized access. Data downloading from the Internet is not typically audited as a standard security control in most organizational audit frameworks.

Why the other options are wrong

• A. Data downloading from the Internet is not commonly included in standard security auditing activities.

Correct answer: C. SSL

SSL (Secure Sockets Layer) is the protocol built into web servers and browsers to encrypt data traveling over the Internet, establishing secure HTTPS connections. UDP is a transport protocol without encryption capability, HTTP is the unencrypted web protocol, and IPSec is a network-layer security protocol not inherently built into web browsers and servers for web traffic encryption.

Why the other options are wrong

• A. UDP is a transport protocol that does not provide encryption.
• B. HTTP is the standard unencrypted web protocol and does not encrypt data by default.
• D. IPSec is a network-layer protocol not built into web servers and browsers as a standard web encryption method.

Correct answer: D. Firewall

A firewall is the primary security mechanism for protecting a network against unauthorized remote access. Firewalls control inbound and outbound traffic, enforcing security policies that determine which remote connections are permitted. This is essential when employees connect via Remote Access Service (RAS) to ensure only authorized users can access the network.

Why the other options are wrong

• A. A bridge operates at Layer 2 and simply forwards frames between network segments; it provides no access control or security filtering.
• B. Anti-virus software protects against malware but doesn't control network access or prevent unauthorized remote connections.
• C. A gateway can facilitate network connections but doesn't inherently provide the access control needed to prevent unauthorized remote access.

Correct answer: C. Session hijacking

Session hijacking is the exploitation of a valid computer session to gain unauthorized access to information or services. An attacker intercepts or steals an established session token or credentials to impersonate a legitimate user without needing to authenticate properly. This directly matches the question's definition of exploiting a valid session for unauthorized access.

Why the other options are wrong

• A. Piggybacking refers to gaining unauthorized access by following an authorized person through a secured entrance, not exploiting computer sessions.
• B. Hacking is a broad term for unauthorized computer access but doesn't specifically refer to exploiting valid sessions.
• D. Keystroke logging captures keystrokes but is not the exploitation of an existing valid session.

Correct answer: B, C, D, E. Civil disobedience; Riot; Terrorist attacks; Vandalism

Civil disobedience, riots, terrorist attacks, and vandalism are all politically motivated threats that can affect an organization's security and operations. These represent deliberate human actions driven by political, social, or ideological motivations. Power distribution outages, while they can disrupt operations, are typically caused by equipment failure, weather, or maintenance issues rather than political motivation, making them environmental or infrastructure failures rather than politically motivated threats.

Why the other options are wrong

• A. Power distribution outages result from infrastructure issues or accidents, not political motivation.

Correct answer: A, B, D. It displays the duration of a task; It is easier to plan than PERT; The impact of slippage is easily determined.

A Gantt chart is a horizontal bar chart that visually displays task duration along a timeline, making it straightforward to plan project schedules compared to PERT charts. The impact of task slippage is easily determined because delays are immediately visible on the chart. However, Gantt charts do not effectively show dependencies between activities; network diagrams like PERT are better suited for displaying task relationships and sequential dependencies.

Why the other options are wrong

• C. Gantt charts show duration and sequence but do not clearly display task dependencies; PERT and network diagrams are designed for this purpose.

Correct answer: A, B. Routing Information Protocol (RIP); Internet Group Management Protocol (IGMP)

RIP (Routing Information Protocol) and IGMP (Internet Group Management Protocol) both operate at Layer 3 (Network) of the OSI model. RIP is a distance-vector routing protocol used for dynamic routing, and IGMP is used for managing multicast group memberships. SNMP operates at Layer 7 (Application) for network management, and FTP operates at Layer 7 (Application) for file transfer.

Why the other options are wrong

• C. SNMP is an application-layer protocol used for network management, not a network layer protocol.
• D. FTP is an application-layer protocol used for file transfer, not a network layer protocol.

Correct answer: A. VPN

A VPN (Virtual Private Network) is the primary technology used to provide secure, encrypted communication over the Internet by creating a private tunnel through the public network. VPN encrypts data end-to-end and allows remote users or networks to securely connect over the Internet. ATM is a switching technology for local networks, not for Internet security. SSL is a protocol used for securing individual connections (typically web traffic), not for comprehensive Internet communication protection. SET was a payment protocol with limited adoption and is not used for general Internet security.

Why the other options are wrong

• B. ATM (Asynchronous Transfer Mode) is a network switching technology used in LANs, not for Internet security.
• C. SSL secures individual connections like HTTPS but is not the primary technology for secure communication over the Internet as a whole.
• D. SET (Secure Electronic Transaction) is a payment protocol that never gained widespread adoption and is not used for general Internet communication.

Correct answer: C. Nondiscretionary access control

Nondiscretionary access control, also called role-based access control (RBAC), determines access rights based on assigned roles rather than individual discretion. Users are granted permissions based on their role in the organization. Discretionary access control allows owners to set permissions, mandatory access control uses classifications and clearances, and roaming access control is not a standard model.

Why the other options are wrong

• A. Discretionary access control grants permission at the owner's discretion, not based on roles.
• B. Roaming access control is not a recognized standard access control model.
• D. Mandatory access control uses security labels and clearance levels, not role-based methods.

Correct answer: A, B. TACACS+; RADIUS

TACACS+ (Terminal Access Controller Access-Control System Plus) and RADIUS (Remote Authentication Dial-In User Service) are both centralized authentication and authorization protocols that manage network access from a central server. Media Access Control (MAC) is a data link layer addressing scheme used locally on networks, and Peer-to-Peer is a decentralized network architecture where nodes communicate directly without central administration, making neither suitable for centralized administration.

Why the other options are wrong

• C. Media Access Control is a local network addressing mechanism, not a centralized administration technology.
• D. Peer-to-Peer is a decentralized architecture that explicitly avoids central administration.

Correct answer: D. Screened host

A screened host is a router or gateway that filters and inspects traffic before it reaches the firewall, serving as an outer defense perimeter. A honey pot is a decoy system designed to attract attackers, a bastion host is a hardened server exposed to untrusted networks, and a demilitarized zone (DMZ) is a network segment between an internal network and external networks. Only the screened host specifically describes a router filtering traffic before the firewall.

Why the other options are wrong

• A. A honey pot is a decoy system designed to attract and analyze attackers, not a traffic filter before the firewall.
• B. A bastion host is a hardened server in a demilitarized zone, not a router that filters traffic before the firewall.
• C. A demilitarized zone is a network segment that sits between internal and external networks, not a router filtering traffic before the firewall.

Correct answer: A, B, D. MAC address filtering; SSID spoofing; Closed network

MAC address filtering restricts network access to approved devices by their hardware addresses. SSID spoofing refers to hiding the network's identifier, forcing users to manually enter it, which adds obscurity. A closed network (not broadcasting the SSID) prevents casual discovery. IP spoofing is an attack technique where attackers forge source IP addresses to deceive systems; it is not a defensive technique for securing wireless networks.

Why the other options are wrong

• C. IP spoofing is an attack method used by hackers to impersonate legitimate systems, not a technique to secure wireless networks.

Correct answer: D. DoS attack

A Denial of Service (DoS) attack is specifically designed to overload a server with requests, consuming its resources and preventing legitimate users from accessing the service. The attack floods the target with traffic or requests until the server can no longer respond, slowing it down or bringing it offline entirely.

Why the other options are wrong

• A. Vulnerability attacks exploit specific weaknesses in software or systems but do not necessarily involve overloading with requests.
• B. Impersonation attacks involve pretending to be someone else to gain unauthorized access, not overwhelming server resources.
• C. Network attacks is too broad a category and does not specifically describe resource exhaustion through request flooding.

Correct answer: D. NetBIOS

UDP port 137 is the default port for NetBIOS Name Service, a legacy Windows networking protocol used for name resolution and computer browsing on local networks. HTTPS uses port 443, HTTP uses port 80, and TELNET uses port 23, none of which match UDP port 137.

Why the other options are wrong

• A. HTTPS operates on TCP port 443, not UDP 137.
• B. HTTP operates on TCP port 80, not UDP 137.
• C. TELNET operates on TCP port 23, not UDP 137.

Correct answer: A, C. Support for file and folder level permissions; Support for Encrypting File System (EFS).

NTFS provides support for file and folder level permissions through access control lists, enabling granular security management. NTFS also includes support for the Encrypting File System (EFS), which provides transparent encryption for sensitive files and folders. Dual-booting capability is a system configuration feature unrelated to NTFS, and NTFS itself is a file system that handles all file types including audio, but audio file support is not a specific feature of NTFS.

Why the other options are wrong

• B. Dual-booting is a system configuration capability not specific to NTFS functionality.
• D. NTFS can store audio files but does not provide file type-specific support for audio as a distinguishing feature.

Correct answer: A. EAP

EAP (Extensible Authentication Protocol) is a flexible authentication framework designed to support a wide variety of authentication methods including smart cards, certificates, biometrics, and token-based systems. It provides a standardized interface for implementing diverse authentication mechanisms. CHAP and MS-CHAP v2 are challenge-response protocols limited to password-based authentication, and PAP is a basic plaintext authentication method.

Why the other options are wrong

• B. CHAP uses challenge-response with hashed passwords and does not support certificate or smart card authentication.
• C. MS-CHAP v2 is a Microsoft proprietary protocol limited to password authentication without support for certificates or smart cards.
• D. PAP sends passwords in plaintext and does not support advanced authentication methods like certificates or smart cards.

Correct answer: A. Honey pot

A honeypot is a decoy system or network resource designed to attract potential intruders and malicious attackers. It serves as a trap to monitor attack patterns and divert attackers from real systems.

Why the other options are wrong

• B. A bastion host is a hardened, secure server that controls access to protected resources, not a decoy.
• C. Data pot is not a recognized security term or concept.
• D. Files pot is not a recognized security term or concept.

Correct answer: D. IGMP

IGMP (Internet Group Management Protocol) is the protocol responsible for managing multicast group membership and enabling hosts to join and leave IP multicast groups. IGMP allows devices to communicate their multicast group memberships to routers, which then forward multicast messages to all group members. ARP handles IP-to-MAC address resolution, TCP is a unicast transport protocol, and ICMP is used for network diagnostics and error reporting.

Why the other options are wrong

• A. ARP resolves IP addresses to MAC addresses and does not manage multicast group communication.
• B. TCP is a connection-oriented unicast protocol that does not support multicast messaging.
• C. ICMP is used for network diagnostics and error messages, not for multicast group management.

Correct answer: A, C, D. Frauds; Employee errors; Theft

Man-made threats are security risks created by human actions or decisions. Frauds involve deliberate deception for financial or personal gain, employee errors result from human mistakes in following procedures or handling data, and theft involves deliberately taking organizational assets. Strikes, while they may be human actions, are labor disputes or work stoppages that represent a different category of organizational threat rather than traditional security threats to information or assets.

Why the other options are wrong

• B. Strikes are labor actions and organizational disruptions but are not classified as man-made security threats in the traditional threat assessment model.

Correct answer: A. Employees

Employees represent the most statistically significant source of asset loss through inappropriate computer use, including unauthorized access, data theft, personal use of company resources, and malware introduction. While external threats from hackers exist, employees have legitimate system access and are therefore the most common source of internal computer misuse and asset loss.

Why the other options are wrong

• B. Hackers are external threats and less likely to have legitimate access than employees.
• C. Visitors typically have limited or no unattended system access.
• D. Customers generally do not have direct access to internal company computer systems.

Correct answer: B. Mandatory Access Control

Mandatory Access Control uses a predefined set of access privileges for each object, based on security labels assigned by the system or administrator. Access is granted only when a subject's clearance matches the object's classification, and users cannot change these rules.

Why the other options are wrong

• A. Policy Access Control is not a standard access control model.
• C. Role-Based Access Control assigns permissions to job roles, not a predefined set of privileges attached to each object.
• D. Discretionary Access Control lets the object owner grant and change access at will, so privileges are not predefined.

Correct answer: B, D. It uses both a public key and a private key; It was developed in 1976.

Diffie-Hellman is a key exchange algorithm developed in 1976 that uses both a public key and a private key in an asymmetric cryptographic system. It authenticates parties through the exchange mechanism itself, allowing two parties to establish a shared secret over an insecure channel. The algorithm relies on the computational difficulty of the discrete logarithm problem.

Why the other options are wrong

• A. Diffie-Hellman uses both public and private keys, not just a private key alone.
• C. Diffie-Hellman does authenticate the parties involved through the key exchange process.

Correct answer: D. Drive wiping

Drive wiping is the process of overwriting all addressable locations on a disk to ensure data cannot be recovered. This is the standard term for secure disk sanitization that overwrites every sector. Sanitization is a broader term encompassing multiple methods, while drive wiping specifically refers to the overwriting process.

Why the other options are wrong

• A. Sanitization is a broader category that includes multiple techniques; drive wiping is the specific method of overwriting.
• B. Authentication is the process of verifying identity, not related to disk data destruction.
• C. Spoofing is impersonating another entity, unrelated to disk wiping.

Correct answer: C, D. It is used for securing an operating system; It can be achieved by installing service packs and security updates on a regular basis.

Installing service packs and security updates on a regular basis (Option D) is a direct method of securing an operating system by patching vulnerabilities. Securing an operating system (Option C) refers to the practice of hardening the OS through patches, configuration, and updates. Locking the computer room provides physical security for hardware, not OS security. OS security is specifically about software-level protections, not hardware protection.

Why the other options are wrong

• A. Securing computer hardware refers to physical security measures, not operating system security.
• B. Locking the computer room is a physical security measure for hardware, not a method of securing the operating system itself.

Correct answer: D. Removing the content from the media so that it is difficult to restore.

Sanitization is the process of removing or obscuring data from media so that it cannot be recovered or restored, even with specialized tools. This is the standard security practice for decommissioning storage devices before reuse or disposal. It sits between the extremes of physical destruction and risk assessment, providing a practical middle ground that allows media to be safely reused or recycled while ensuring data confidentiality.

Why the other options are wrong

• A. Physical destruction is a more extreme measure called degaussing or incineration, not sanitization.
• B. Risk assessment is the evaluation process that may lead to a decision about sanitization, but is not sanitization itself.
• C. Verifying identity describes authentication, which is unrelated to data removal from media.

Correct answer: B. NetStumbler

NetStumbler is a Windows-based wireless network detection tool used for identifying IEEE 802.11a, 802.11b, and 802.11g networks. It displays signal strength, MAC addresses, SSIDs, channel details, and is used for war driving, detecting rogue access points, and troubleshooting wireless interference.

Why the other options are wrong

• A. Kismet is a wireless network detector, but it is primarily Linux-based, not Windows-based.
• C. Absinthe is used for database security testing and SQL injection, not wireless network detection.
• D. THC-Scan is not a recognized wireless network detection tool matching this description.

Correct answer: A, C. Firewalls; Routers

Firewalls operate at Layer 3 (Network) and Layer 7 (Application), making decisions based on IP addresses, ports, and protocols. Routers operate at Layer 3 (Network), using routing tables to forward packets based on IP addresses. Both are network devices that function at the network layer or above. Hubs operate at Layer 1 (Physical) and simply repeat signals without intelligence. MAC addresses are data link layer identifiers used at Layer 2, not devices themselves.

Why the other options are wrong

• B. Hubs operate at Layer 1 (Physical) only, not Layer 3 or above.
• D. MAC addresses are Layer 2 addressing schemes, not Layer 3 or above devices or mechanisms.

Correct answer: A, C. Halon; CO2

Halon (A) and CO2 (C) are both approved fire suppression agents for electrical and computer fires because they extinguish flames through chemical reaction or oxygen displacement without leaving water damage or conductive residue. Soda acid is used for ordinary fires, and water conducts electricity and damages electronic equipment, making them unsuitable for electrical fires.

Why the other options are wrong

• B. Soda acid is designed for ordinary fires, not suitable for electrical equipment.
• D. Water conducts electricity and causes damage to electronic systems.

Correct answer: A, C. It is a protocol used in the Universal Resource Locater (URL) address line to connect to a secure site; It uses TCP port 443 as the default port.

HTTPS (Hypertext Transfer Protocol Secure) is the secure version of HTTP used in URL address lines to establish encrypted connections to secure websites. It uses TCP port 443 as its default port for secure communication. HTTP, by contrast, uses port 80 and lacks encryption.

Why the other options are wrong

• B. TCP port 80 is the default port for unencrypted HTTP, not HTTPS.
• D. HTTPS is not specifically designed for securing database servers in internal networks; it is a web protocol.

Correct answer: C. Steganography

Steganography is the practice of concealing data within another medium, such as hiding a message inside an image, audio file, or document. Unlike encryption, which makes data unreadable, steganography makes data undetectable by embedding it invisibly within carrier media. This technique is commonly used in security and covert communications.

Why the other options are wrong

• A. Spoofing is the act of impersonating or falsifying identity (such as IP spoofing or email spoofing), not hiding data within media.
• B. Cryptanalysis is the science of analyzing and breaking cryptographic systems, not a method of hiding data within other media types.
• D. Packet sniffing is a network attack technique that captures and analyzes network traffic, not a method of concealing data within media.

Correct answer: B, D. SSL; TLS

SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are both cryptographic protocols that provide secure communication channels between clients and servers over the Internet. SSL is the predecessor to TLS and both establish encrypted connections for secure data transmission. HTTP is an unencrypted protocol without security features, and SNMP is a network management protocol not designed for securing client-server communication.

Why the other options are wrong

• A. HTTP is an unencrypted protocol without built-in security for client-server communication.
• C. SNMP is a network management protocol, not a secure communication protocol for general client-server interactions.

Correct answer: A, B, C. User; Owner; Custodian

The common roles in information classification programs are Owner (accountable for data and classification decisions), Custodian (responsible for protecting data according to classifications), and User (handles data according to classification level). Security auditors verify compliance but are not typically classified as a standard data role in classification programs, and Editors are users with specific functions rather than distinct classification roles.

Why the other options are wrong

• D. Security auditors verify and monitor compliance with classification policies but are not considered a primary data role in classification programs.
• E. Editors are users with specific permissions rather than distinct roles in the data classification framework.

Correct answer: A, B. Implement NAT; Upgrade your class C network to a class B network.

To support 300 hosts on a private Class C network while enabling Internet access through a single connection, NAT (Network Address Translation) is essential to map private addresses to public addresses for outbound traffic. Additionally, implementing NAT requires moving to a larger address space conceptually, though practically a Class C network with NAT can support more than 254 devices since NAT translates them. However, to properly accommodate the growth from 200 to 300 hosts, upgrading the addressing scheme is necessary, which aligns with transitioning the network architecture. A router is needed for NAT implementation, making it implicit in option A.

Why the other options are wrong

• C. A router is required for NAT but is not the primary solution; NAT on an existing router is sufficient.
• D. A bridge operates at Layer 2 and does not facilitate Internet access or address expansion.
• E. Applying for more public IP addresses defeats the purpose of using private addressing and NAT.

Correct answer: B. DDoS attack

A distributed denial-of-service (DDoS) attack uses multiple compromised computers (botnet) to simultaneously send traffic to overwhelm a target. The scenario describes multiple machines sending FIN packets with spoofed addresses, which is characteristic of a DDoS flood attack.

Why the other options are wrong

• A. A dictionary attack is used to crack passwords by trying common words, not to flood web servers.
• C. An insertion attack involves injecting malicious data into a data stream, not a volumetric flood attack.
• D. An evasion attack attempts to bypass security controls like firewalls, not to overwhelm them with traffic.

Correct answer: C. ACH

ACH (Automated Clearing House) provides secure electronic payment services used for online transactions, including credit card processing and fund transfers. It is the network that processes electronic payments between bank accounts.

Why the other options are wrong

• A. CA (Certificate Authority) issues digital certificates for authentication, not payment services.
• B. IEEE is a standards organization for technology, not a payment service provider.
• D. ICSA is an information security certification organization, not a payment service.

Correct answer: A. B-rated

According to the Orange Book (TCSEC) classification scheme, B-rated systems have mandatory protection of the Trusted Computing Base (TCB) through mandatory access control policies. B-rated systems enforce security labels and access control rules at the TCB level, providing stronger assurance than lower ratings.

Why the other options are wrong

• B. A-rated systems provide verified design assurance beyond mandatory TCB protection.
• C. D-rated systems represent minimal security with no guaranteed TCB protection.
• D. C-rated systems provide discretionary access control, not mandatory TCB protection.

Correct answer: C. ACL

An Access Control List (ACL) is the standard mechanism used to implement procedures that control both inbound and outbound network traffic by defining permit and deny rules based on source addresses, destination addresses, protocols, and ports.

Why the other options are wrong

• A. Sam Spade is a DNS lookup utility tool, not a traffic control mechanism.
• B. NIDS (Network Intrusion Detection System) monitors and alerts on malicious traffic but does not control it.
• D. Cookies are HTTP objects stored on client browsers for session management, not network traffic control.

Correct answer: B. Replay attack

In a replay attack, the attacker captures valid authentication traffic, such as a logon exchange or session token, and retransmits it later. The target accepts the replayed data as genuine, giving the attacker an authenticated connection without knowing the actual credentials.

Why the other options are wrong

• A. A denial-of-service attack aims to make a service unavailable, not to gain an authenticated connection.
• C. A man-in-the-middle attack intercepts and relays traffic between two parties rather than replaying credentials to obtain its own authenticated session.
• D. A back door is a hidden entry point that bypasses authentication altogether rather than obtaining an authenticated connection.

Correct answer: C. NSLOOKUP

NSLOOKUP is a command-line utility that queries DNS servers to verify that zone database records are correct. It allows administrators to perform DNS lookups, retrieve resource records, and troubleshoot DNS configuration issues.

Why the other options are wrong

• A. IPCONFIG displays IP configuration settings on a local machine, not DNS zone information.
• B. TELNET is a remote connection protocol used to access remote systems, not for DNS queries.
• D. NETSTAT displays active network connections and statistics, not DNS zone database information.

Correct answer: C. Firewall

A firewall is a network security device that filters incoming and outgoing traffic based on predetermined security rules. It acts as a barrier between an internal network and external networks (like the Internet), preventing unauthorized access from external sources.

Why the other options are wrong

• A. HTTP is an application protocol for web communication, not a security mechanism for protecting against unauthorized access.
• B. FTP is a file transfer protocol and does not provide protection against external network attacks.
• D. Gopher is an obsolete information retrieval protocol and has no role in network security or access protection.

Correct answer: D. The transport layer

The transport layer (Layer 4) provides end-to-end service by managing reliable delivery of data between source and destination hosts. It handles connection establishment, data segmentation, and error checking across the entire communication path.

Why the other options are wrong

• A. The physical layer deals with physical media and signal transmission, not end-to-end service delivery.
• B. The application layer provides user services but does not manage end-to-end communication reliability.
• C. The session layer manages sessions between applications but does not provide the end-to-end data delivery service.

Correct answer: B. The Network layer

Both ICMP and IGMP operate at Layer 3 (the Network layer) of the OSI model. ICMP is used for error reporting and diagnostics (such as ping and traceroute), while IGMP is used for managing multicast group memberships. Both work with IP addresses and routing logic characteristic of the Network layer.

Why the other options are wrong

• A. The Physical layer deals with transmission media and electrical signals, not protocols like ICMP or IGMP.
• C. The Data-Link layer handles MAC addresses and frame delivery between adjacent network nodes, not IP-based protocols.
• D. The Presentation layer handles data encryption, compression, and format translation, not network-level diagnostic protocols.

Correct answer: A, B, D. Delegating the responsibility of the data protection duties to a custodian; Determining what level of classification the information requires; Reviewing the classification assignments at regular time intervals and making changes as the business needs change.

Data owners are responsible for delegating protection duties to custodians, determining classification levels, and regularly reviewing and updating classifications based on business needs. Running regular backups and testing backup validity is a custodian responsibility, not an owner responsibility. Custodians handle the technical implementation of data protection, while owners define policy and make business-level decisions.

Why the other options are wrong

• C. Running backups and testing backup validity are custodian responsibilities, not owner responsibilities.

Correct answer: B, C. Access rights and permissions; File and data ownership

Access rights and permissions define what actions users can perform on resources, while file and data ownership establishes who owns and controls resources within an access control model. Together they form the core of defining and enforcing access controls in systems.

Why the other options are wrong

• A. User's group is derived from ownership and permissions but is not itself a primary component of the access control model.
• D. Smart card is a hardware authentication device used for identity verification but not a component of the access control model itself.

Correct answer: D. 40-bit and 128-bit.

SSL/TLS session keys are available in 40-bit and 128-bit lengths. The 40-bit key length was historically used in export-grade cryptography due to U.S. export restrictions, while 128-bit provides stronger security. These are the standard key lengths for session keys in SSL/TLS protocols.

Why the other options are wrong

• A. While 128-bit is correct, 64-bit is not a standard SSL/TLS session key length.
• B. While 40-bit is correct, 64-bit is not a standard SSL/TLS session key length.
• C. 128-bit is correct but 1,024-bit is used for asymmetric keys (like RSA), not for symmetric session keys.

Correct answer: B. RG-59

RG-59 is the standard coaxial cable used for cable television (CATV) and cable modem applications. It provides the appropriate impedance and shielding characteristics for broadband video and data transmission over short to medium distances typical in residential cable networks.

Why the other options are wrong

• A. RG-62 is used for ARCnet and older computer networks, not cable TV.
• C. RG-8 is a thick coaxial cable primarily used for long-distance trunk lines and antenna applications, not consumer cable TV.
• D. RG-58 is thin coaxial cable used for short-distance computer networking like Ethernet 10BASE2, not cable TV.

Correct answer: C, D. ARP; PPP

ARP (Address Resolution Protocol) and PPP (Point-to-Point Protocol) both operate at the data-link layer (Layer 2). ARP maps IP addresses to MAC addresses, and PPP is used for dial-up and serial connections. NFS operates at the application layer, and SSL operates at the transport/session layer.

Why the other options are wrong

• A. NFS (Network File System) operates at the application layer (Layer 7), not the data-link layer.
• B. SSL (Secure Sockets Layer) operates at the transport/session layer, not the data-link layer.

Correct answer: D. Cookie

Cookies are small data files stored on a user's browser that websites use to maintain user preferences, login information, and other customization data for providing personalized services. ActiveX controls are executable components, keywords are search terms, and protocols are communication standards, none of which serve this storage and personalization function.

Why the other options are wrong

• A. ActiveX controls are executable components used for interactive web content, not for storing user preferences.
• B. Keywords are search terms used in web searches, not a storage mechanism for user information.
• C. Protocols are communication standards and rules, not storage mechanisms for customization data.

Correct answer: A. TCP SYN

TCP SYN scanning is a half-open scanning technique that sends SYN packets to target ports without completing the full three-way TCP handshake. This allows the scanner to identify open ports while avoiding full connection establishment, making it faster and less likely to trigger logging systems.

Why the other options are wrong

• B. TCP SYCK is not a valid or recognized scanning technique.
• C. TCP FIN scanning uses FIN packets to probe ports and is a different technique, less reliable than SYN scanning.
• D. Xmas tree scanning sends packets with multiple flags set and is less common than SYN scanning for port discovery.

Correct answer: D. Perform OS fingerprinting on the We-are-secure network.

After completing information gathering, network range determination, active system identification, and open port/application discovery, the next logical step in the preattack phase is OS fingerprinting. This determines the operating systems running on identified hosts, which is essential before attempting any exploitation or service-level testing. OS fingerprinting comes before service fingerprinting as it provides foundational system knowledge.

Why the other options are wrong

• A. Installing backdoors is part of post-exploitation, not the preattack phase, and would be unauthorized without explicit permission.
• B. Network mapping is performed earlier in the process, during the initial information gathering and active system identification phases.
• C. Service fingerprinting (identifying specific services and versions) typically follows OS fingerprinting, as OS knowledge informs service discovery.

Correct answer: C. Enable DNS reverse lookup on the e-mail server.

Enabling DNS reverse lookup on the e-mail server allows verification that incoming mail servers actually exist in DNS and belong to legitimate domains. This prevents spoofing and filtering of malicious e-mails from non-existent domains by validating the reverse DNS records of mail servers attempting to deliver messages.

Why the other options are wrong

• A. Disabling recursive queries would affect legitimate DNS lookups but does not specifically prevent mail from non-existent domains.
• B. Enabling recursive queries allows DNS servers to query other servers but does not validate the legitimacy of mail senders.
• D. Disabling reverse lookup would remove the ability to verify mail server legitimacy, making it less effective against spoofing.

Correct answer: C, D. It cannot detect events scattered over the network; It can handle encrypted and unencrypted traffic equally.

The question describes network monitoring capabilities. Network monitoring tools cannot detect events scattered across the entire network in real-time (they work at specific collection points), and they can handle both encrypted and unencrypted traffic equally well since they operate at the packet level regardless of encryption status.

Why the other options are wrong

• A. Monitoring tools are limited to their collection points and cannot detect all events scattered network-wide.
• B. This describes IP address sharing/load balancing, not network monitoring.

Correct answer: A, B, C. Switches; Bridges; MAC addresses

Switches, bridges, and MAC addresses are all essential components of data-link layer (Layer 2) networking. Switches and bridges use MAC addresses to forward frames between network segments. Hubs, however, operate at the physical layer (Layer 1), not the data-link layer.

Why the other options are wrong

• D. Hubs operate at Layer 1 (physical layer) and do not use MAC addresses for forwarding decisions like data-link layer devices.