100 Free SSCP Practice Questions and Answers
100 questions for the SSCP exam, each answer explained. Watch it here, try the questions yourself, or read the transcript.
Questions in this video
Tap an answer to see why it is right or wrong. Tap it again to reset.
Question 1 Play from 00:00
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Omits ICMP, which is a fundamental part of the Internet protocol suite.
Right, B is the answer.
Why B is right
The Internet protocol suite consists of TCP (Transmission Control Protocol), UDP (User Datagram Protocol), ICMP (Internet Control Message Protocol), and IP (Internet Protocol). Option B correctly lists all four core protocols, while option C omits UDP and ICMP, and options A and D are incomplete or incorrect groupings.
Not this one. Try another answer.
Why C is wrong
TCP/IP is a shorthand notation but incomplete; UDP and ICMP are also essential Internet protocols.
Not this one. Try another answer.
Why D is wrong
These are application layer protocols (email), not the core Internet protocol suite.
Question 2 Play from 01:48
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Caesar cipher is the general category; ROT13 is the specific name for the 13-shift variant.
Not this one. Try another answer.
Why B is wrong
Polyalphabetic ciphers use multiple substitution alphabets, not a simple fixed rotation.
Right, C is the answer.
Why C is right
ROT13 is a substitution cipher that rotates each letter in the alphabet by exactly 13 places. It is a special case of the Caesar cipher (which can shift by any amount), making ROT13 a specific implementation with a fixed shift of 13. The name ROT13 directly describes this 13-place rotation. ROT13 is notable because applying it twice returns the original text, making it symmetric.
Not this one. Try another answer.
Why D is wrong
Transposition ciphers rearrange letter positions; ROT13 substitutes letters, not transposes them.
Question 3 Play from 03:25
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
In the concentric layers of physical security (perimeter barriers, exterior barriers, interior barriers, and people), people represent the final line of defense. While automated systems and physical barriers provide layers of protection, ultimately human personnel, whether guards, staff, or authorized occupants, serve as the last defense against threats that penetrate all other security measures. People can make judgments, respond adaptively, and take decisive action that mechanical systems cannot.
Not this one. Try another answer.
Why B is wrong
Interior barriers are an earlier line of defense, protecting specific areas within a facility.
Not this one. Try another answer.
Why C is wrong
Exterior barriers are an earlier layer, typically surrounding buildings or facilities.
Not this one. Try another answer.
Why D is wrong
Perimeter barriers are the outermost layer and the first line of defense, not the last.
Question 4 Play from 05:04
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Power conditioners regulate and stabilize voltage but do not supply power during outages.
Right, B is the answer.
Why B is right
An uninterruptible power supply (UPS) is the device that supplies power when commercial utility power fails. A UPS uses battery backup to maintain system operation during power outages, allowing time for proper shutdown or continued operation.
Not this one. Try another answer.
Why C is wrong
Power filters remove electrical noise and interference but do not supply backup power.
Not this one. Try another answer.
Why D is wrong
Power dividers distribute power to multiple devices but do not provide backup during failures.
Question 5 Play from 06:30
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Backup and recovery is a people-executed operational control.
Right, B is the answer.
Why B is right
Operational controls are security measures carried out mainly by people, such as backup and recovery, contingency planning and operations procedures. Auditing through audit trails is classified as a technical control because it is implemented and enforced by the system itself.
Not this one. Try another answer.
Why C is wrong
Contingency planning is listed as an operational control in standard control families.
Not this one. Try another answer.
Why D is wrong
Operations procedures are the day-to-day processes that define operational controls.
Question 6 Play from 07:48
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Authentication in biometrics is a one-to-one verification process where the system compares a presented biometric sample against one specific stored template to verify that the person's claimed identity is valid. This is the verification of an identity claim rather than discovery of identity.
Not this one. Try another answer.
Why B is wrong
Identification is one-to-many searching to determine identity, not one-to-one verification of a claimed identity.
Not this one. Try another answer.
Why C is wrong
Auditing is logging and monitoring activities, not the biometric verification process.
Not this one. Try another answer.
Why D is wrong
Authorization is determining what access rights an authenticated user has, not the verification of identity.
Question 7 Play from 09:14
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Allowing access to files is a consequence of authentication, not the primary purpose of the password itself.
Not this one. Try another answer.
Why B is wrong
Identification is the process of claiming who you are; authentication is proving the claim, making authentication primary.
Right, C is the answer.
Why C is right
The primary use of a password is to authenticate the user, to verify that the person claiming to be a specific user actually is that person. Authentication is the verification of identity. While passwords can facilitate file access and user segregation as secondary effects, their fundamental security purpose is authentication. Identification (option B) is the process of claiming an identity, whereas authentication is proving that claim.
Not this one. Try another answer.
Why D is wrong
Segregating user accesses is a policy implementation that follows authentication, not its primary purpose.
Question 8 Play from 10:57
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Maintenance is an outcome or benefit, not the primary objective of configuration management.
Right, B is the answer.
Why B is right
The major objective of system configuration management is to maintain system stability by controlling changes and maintaining accurate records of system components and their states. Configuration management prevents unauthorized or uncontrolled modifications that could destabilize the system, ensuring consistency and reliability across the IT environment.
Not this one. Try another answer.
Why C is wrong
Operations are enabled by configuration management but not the primary objective.
Not this one. Try another answer.
Why D is wrong
Tracking is a component of configuration management but not its major objective.
Question 9 Play from 12:27
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Validation confirms the system meets user needs and requirements, not specifically about testing security compliance.
Not this one. Try another answer.
Why B is wrong
Verification checks that something was built correctly according to specifications, not the specific act of security testing and evaluation.
Right, C is the answer.
Why C is right
Assessment is the formal process of performing tests and evaluations to determine a system's security level and compliance with design specifications and security requirements. This involves systematic examination and measurement against defined criteria, which is the definition of assessment in security contexts.
Not this one. Try another answer.
Why D is wrong
Accuracy refers to precision of measurements or data, not the process of security testing and evaluation.
Question 10 Play from 14:00
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The Network Access layer corresponds to the OSI Data Link and Physical layers, not the Network layer.
Not this one. Try another answer.
Why B is wrong
The Application layer corresponds to the OSI Application, Presentation, and Session layers, not the Network layer.
Not this one. Try another answer.
Why C is wrong
The Host-to-Host Transport layer corresponds to the OSI Transport layer, not the Network layer.
Right, D is the answer.
Why D is right
The Internet layer of the TCP/IP model corresponds to the Network layer (Layer 3) of the OSI model. Both layers handle logical addressing (IP addresses in TCP/IP), routing, and path determination. The Internet layer contains protocols like IP, ICMP, and IGMP.
Show all 100 questionsShow fewer questions
Question 11 Play from 15:37
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Abstraction is a technical concept unrelated to data integrity.
Right, B is the answer.
Why B is right
Integrity in information security means ensuring data has not been altered or modified. Alteration is the direct opposite of integrity, while integrity protects against changes, alteration represents the act of making unauthorized changes to data. This is the fundamental opposing concept.
Not this one. Try another answer.
Why C is wrong
Accreditation is a certification process, not opposite to integrity.
Not this one. Try another answer.
Why D is wrong
Application refers to software programs, not an opposite of integrity.
Question 12 Play from 16:56
When using PKI, I digitally sign a message using my ______ key. The recipient verifies my signature using my ______ key.
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
In PKI, digital signatures use the sender's private key to sign a message (which encrypts the hash), and the recipient uses the sender's public key to verify the signature (which decrypts the hash). This proves both authenticity and non-repudiation. The private key is kept secret for signing, and the public key is distributed for verification.
Not this one. Try another answer.
Why B is wrong
This is reversed; you cannot sign with a public key or verify with a private key in PKI.
Not this one. Try another answer.
Why C is wrong
Symmetric and asymmetric are categories, not the specific key types used in digital signatures.
Not this one. Try another answer.
Why D is wrong
Digital signatures do not use symmetric keys; they use asymmetric private/public key pairs.
Question 13 Play from 18:29
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Key collision refers to two keys being identical or producing identical outputs through hashing, which is different from two different keys producing the same ciphertext.
Right, B is the answer.
Why B is right
Key clustering is the phenomenon where two different keys produce the same ciphertext when encrypting the same plaintext. This is a theoretical weakness in some cipher designs where the encryption transformation is not perfectly injective across all key-plaintext pairs, meaning multiple keys can map the same plaintext to identical ciphertext.
Not this one. Try another answer.
Why C is wrong
Hashing is a one-way cryptographic function that produces digests; it is not related to two keys producing the same ciphertext.
Not this one. Try another answer.
Why D is wrong
Ciphertext collision refers to two different plaintexts producing the same ciphertext, not two different keys encrypting the same plaintext to the same ciphertext.
Question 14 Play from 20:15
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
3' to 4' high fencing is too low and can be easily climbed or jumped over by intruders.
Right, B is the answer.
Why B is right
A 6' to 7' high fence represents the optimal balance for maximum security design in terms of both effectiveness and cost-effectiveness. This height is difficult for an intruder to climb quickly without equipment, yet remains economical to install and maintain across large perimeters. While 8' fencing with barbed wire and double fencing provide greater security, they are significantly more expensive. The 3' to 4' height is insufficient as it can be easily overcome.
Not this one. Try another answer.
Why C is wrong
8' high fencing with barbed wire provides excellent security but is cost-prohibitive for most facilities.
Not this one. Try another answer.
Why D is wrong
Double fencing provides superior security but is the most expensive option and overkill for most applications.
Question 15 Play from 22:04
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
While Kerberos is named after the mythological creature, the question asks what Kerberos is in IT security context.
Right, B is the answer.
Why B is right
Kerberos is a trusted third-party authentication protocol that provides secure authentication services in network environments. It was developed at MIT and is named after the mythological three-headed dog, but the protocol itself is specifically a third-party authentication mechanism that uses a Key Distribution Center (KDC) as a trusted intermediary.
Not this one. Try another answer.
Why C is wrong
Kerberos is a protocol, not a security model.
Not this one. Try another answer.
Why D is wrong
RADIUS (Remote Authentication Dial-In User Service) is a different authentication protocol from Kerberos.
Question 16 Play from 23:37
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Industry best practices and most security standards require disaster recovery drills and tests to be performed at least once per quarter (four times per year). This frequency ensures that recovery procedures remain current, staff remain trained, and potential issues are identified and addressed promptly. Annual testing is insufficient for maintaining operational readiness.
Not this one. Try another answer.
Why B is wrong
Every six months is less frequent than the recommended quarterly minimum.
Not this one. Try another answer.
Why C is wrong
Annual testing is insufficient; quarterly testing is the industry standard minimum.
Not this one. Try another answer.
Why D is wrong
Testing every two years is far too infrequent to ensure readiness and compliance.
Question 17 Play from 25:08
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Stream ciphers are more suitable for hardware implementation due to their simpler, more parallel-friendly nature and lower memory requirements. Stream ciphers process data bit- by-bit or byte-by-byte sequentially, making them efficient in hardware. Block ciphers, cipher block chaining, and electronic codebook are modes or algorithm types that typically require more complex hardware implementations or state management.
Not this one. Try another answer.
Why B is wrong
Block ciphers require more complex hardware implementations with larger state management.
Not this one. Try another answer.
Why C is wrong
Cipher block chaining mode requires sequential processing due to data dependencies, making it less suitable for hardware.
Not this one. Try another answer.
Why D is wrong
Electronic codebook is a block cipher mode that is less efficient for hardware implementation than stream ciphers.
Question 18 Play from 26:41
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
System development activity cannot be undertaken while computer incident handling is ongoing because development could alter systems, introduce changes, compromise evidence integrity, or interfere with incident investigation. Help-desk functions, system imaging, and risk management can all continue during incident handling as they don't compromise the investigation.
Not this one. Try another answer.
Why B is wrong
Help-desk functions can continue during incident handling, though with awareness of the incident scope.
Not this one. Try another answer.
Why C is wrong
System imaging is actually a critical activity during incident handling for evidence preservation.
Not this one. Try another answer.
Why D is wrong
Risk management processes can and should continue during incident handling to inform response strategies.
Question 19 Play from 28:14
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
TCP uses protocol number 6 in the IP header, not 17.
Not this one. Try another answer.
Why B is wrong
ICMP uses protocol number 1 in the IP header, not 17.
Right, C is the answer.
Why C is right
The IP protocol field value of 17 designates UDP (User Datagram Protocol). This is a standardized IANA protocol number. TCP uses protocol number 6, ICMP uses protocol number 1, and IGMP uses protocol number 2. Protocol 17 is definitively UDP in the IP header.
Not this one. Try another answer.
Why D is wrong
IGMP uses protocol number 2 in the IP header, not 17.
Question 20 Play from 29:41
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Continuity of support plan is not a standard contingency planning document type.
Not this one. Try another answer.
Why B is wrong
A business continuity plan addresses overall business function continuity, not specific cyber attack response procedures.
Right, C is the answer.
Why C is right
An incident response plan specifically addresses how an organization will respond to and manage security incidents, including cyber attacks against IT systems. It provides procedures for detection, containment, eradication, and recovery from security breaches and attacks.
Not this one. Try another answer.
Why D is wrong
A continuity of operations plan addresses operational continuity broadly, not specifically cyber attack response mechanisms.
Question 21 Play from 31:12
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Access Rules describe how access decisions are made, but do not establish the actual mapping of subjects to objects and permissions.
Right, B is the answer.
Why B is right
An Access Matrix is the fundamental mechanism used to control access by subjects (active entities like users or processes) to objects (passive entities like files or resources). The access matrix specifies which subjects have what permissions on which objects, forming the basis for implementing access control decisions.
Not this one. Try another answer.
Why C is wrong
Identification controls verify who a user is, but do not control what resources they can access.
Not this one. Try another answer.
Why D is wrong
An access terminal is a physical device for user interaction, not a mechanism for controlling subject-to-object access.
Question 22 Play from 32:57
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Host-based IDS (HIDS) monitors system and event logs on individual hosts, analyzing logged activities and system calls to detect attack attempts and determine success by examining actual system state changes and log entries that reflect what occurred on the host.
Not this one. Try another answer.
Why B is wrong
Firewall-based IDS operates at network perimeter, not on individual hosts, and does not review host system logs.
Not this one. Try another answer.
Why C is wrong
Bastion-based IDS is not a standard IDS terminology; bastion hosts are hardened hosts but do not define the detection method.
Not this one. Try another answer.
Why D is wrong
Server-based IDS is not standard terminology; detection of host attacks requires host-based IDS specifically.
Question 23 Play from 34:35
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Race condition errors involve timing issues with concurrent access, not input validation failures.
Not this one. Try another answer.
Why B is wrong
Access validation errors relate to authorization checks, not buffer or boundary issues from malformed input.
Not this one. Try another answer.
Why C is wrong
Exceptional condition handling is broader than input validation; input errors are a specific category within it.
Right, D is the answer.
Why D is right
Buffer overflow and boundary condition errors are both subsets of input validation errors. These occur when an application fails to properly validate and sanitize input data before processing it, allowing attackers to exceed buffer boundaries or trigger exceptional conditions.
Question 24 Play from 36:06
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Sensitivity labels are a preventive security control because they are applied to information before it can be mishandled, preventing unauthorized disclosure or misuse. By classifying data with sensitivity labels, organizations establish a preventive framework that guides how information should be protected, accessed, and handled. This labeling mechanism works to prevent security violations from occurring in the first place rather than detecting or correcting them after they happen.
Not this one. Try another answer.
Why B is wrong
Sensitivity labels are not detective controls; they don't identify violations after the fact.
Not this one. Try another answer.
Why C is wrong
They are not compensating controls; they are standard preventive controls.
Not this one. Try another answer.
Why D is wrong
Sensitivity labels are security controls, not specifically accuracy controls.
Question 25 Play from 37:43
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Authentication is the verification that a user's claimed identity is valid, confirming that the person is who they profess to be. This typically occurs through mechanisms like passwords, biometrics, or multi-factor authentication at log-on time. Authentication proves the claimed identity is genuine.
Not this one. Try another answer.
Why B is wrong
Identification is merely claiming an identity; authentication is verifying that claim.
Not this one. Try another answer.
Why C is wrong
Integrity is a security principle ensuring data has not been altered, unrelated to verifying identity.
Not this one. Try another answer.
Why D is wrong
Confidentiality is a security principle ensuring information remains private, unrelated to identity verification.
Question 26 Play from 39:20
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Address Resolution Protocol (ARP) uses broadcast frames to interrogate a network. When a device needs to find the MAC address corresponding to an IP address, it sends an ARP request as a broadcast to all devices on the local network segment. This allows the target device to respond with its MAC address.
Not this one. Try another answer.
Why B is wrong
Multicast is a one-to-many transmission to a specific group, not used by ARP which needs to reach all devices.
Not this one. Try another answer.
Why C is wrong
Unicast is a one-to-one transmission, but ARP needs to query multiple devices to find a match.
Not this one. Try another answer.
Why D is wrong
Semicast is not a valid network transmission type.
Question 27 Play from 40:47
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
IDS is not preventive; it does not stop intrusions from occurring, only detects them.
Right, B is the answer.
Why B is right
An Intrusion Detection System is fundamentally a detective control because it monitors, identifies, and alerts on security incidents and suspicious activity after they occur. IDS does not prevent intrusions from happening; it detects them in progress or after the fact. This distinguishes it from preventive controls like firewalls that block attacks before they penetrate, recovery controls that restore systems after compromise, or directive controls that prescribe behavior.
Not this one. Try another answer.
Why C is wrong
IDS is not a recovery control; it doesn't restore systems or data after an incident.
Not this one. Try another answer.
Why D is wrong
IDS is not a directive control; it doesn't establish rules or guide behavior through policies.
Question 28 Play from 42:29
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A known plaintext attack is a cryptanalytic scenario where the attacker has access to both the plaintext and its corresponding ciphertext. With this information, the attacker can analyze the encryption algorithm's behavior and work to discover the encryption key or algorithm weaknesses. This is distinct from other attack types that have different information availability.
Not this one. Try another answer.
Why B is wrong
Brute force attacks involve trying all possible keys, not having plaintext-ciphertext pairs.
Not this one. Try another answer.
Why C is wrong
Ciphertext-only attacks occur when the attacker has only the ciphertext, not the plaintext.
Not this one. Try another answer.
Why D is wrong
Chosen plaintext attacks occur when the attacker can select which plaintexts to encrypt, a more powerful position than merely having known plaintext-ciphertext pairs.
Question 29 Play from 44:05
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The Full Interruption test is the most comprehensive and rigorous disaster recovery plan test type. It simulates an actual disaster by shutting down primary systems and fully activating the alternate site with real data processing. This test should only be performed after successfully completing less disruptive tests like Parallel tests, as it carries the highest risk and requires the most preparation and confidence in the plan.
Not this one. Try another answer.
Why B is wrong
Checklist tests are the least rigorous, involving only review of procedures without actual activation.
Not this one. Try another answer.
Why C is wrong
Simulation tests are less comprehensive than Full Interruption tests, as they don't involve actual system shutdown.
Not this one. Try another answer.
Why D is wrong
Structured walk-through tests involve discussing procedures in detail but not activating systems.
Question 30 Play from 45:47
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
DR should be treated as a committed expense, not something to be deferred or eliminated.
Right, B is the answer.
Why B is right
Organizations should view disaster recovery as a committed, necessary expense, not a discretionary one. DR is essential for business continuity, regulatory compliance, and risk management. It often addresses legal requirements and regulatory mandates that cannot be waived. Treating DR as discretionary spending is incorrect because it can be cut during budget constraints, leaving the organization vulnerable. Proper DR requires sustained, committed investment regardless of other budget pressures.
Not this one. Try another answer.
Why C is wrong
Many industries have legal statutes requiring disaster recovery capabilities, making this a valid view.
Not this one. Try another answer.
Why D is wrong
Compliance with regulations is a legitimate and important driver for DR investment.
Question 31 Play from 47:27
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
golf001 is a simple, dictionary-based password with predictable numbering.
Not this one. Try another answer.
Why B is wrong
Elizabeth is a common proper name lacking numbers and special characters.
Right, C is the answer.
Why C is right
T1me4g0lF is the strongest password because it combines multiple character types: uppercase letters (T, F), lowercase letters (i, m, e, g, o, l), numbers (1, 4, 0), creating a complex password with good length. The other options are weak: golf001 is simple and predictable, Elizabeth is a common name with no numbers or special characters, and password is one of the most commonly used and easily guessed passwords.
Not this one. Try another answer.
Why D is wrong
password is one of the weakest possible passwords and among the most commonly used.
Question 32 Play from 49:13
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
El Gamal encryption is based on the discrete logarithm problem.
Not this one. Try another answer.
Why B is wrong
Diffie-Hellman key exchange is fundamentally built on discrete logarithms.
Right, C is the answer.
Why C is right
RSA is based on the computational difficulty of factoring large numbers into their prime factors, not on discrete logarithms. El Gamal, Diffie-Hellman, and Elliptic Curve cryptography all rely on the discrete logarithm problem (or variants thereof) as their underlying mathematical foundation for security.
Not this one. Try another answer.
Why D is wrong
Elliptic Curve cryptography uses the elliptic curve discrete logarithm problem.
Question 33 Play from 50:28
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Something you have and something you know combines possession and knowledge factors, creating true two-factor authentication.
Not this one. Try another answer.
Why B is wrong
Something you do (biometric behavior) and a password combines inherence and knowledge factors, creating true two-factor authentication.
Not this one. Try another answer.
Why C is wrong
A smartcard (possession) and something you are (inherence/biometric) combines two different factor categories, creating true two-factor authentication.
Right, D is the answer.
Why D is right
Two-factor authentication requires two distinct factors from different categories: something you know (knowledge), something you have (possession), or something you are (inherence). Option D uses two items from the same category, both passwords are knowledge factors, so it does not constitute true two-factor authentication. The other options each combine two different authentication factor categories.
Question 34 Play from 52:18
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A trusted front-end is the standard retrofit approach for adding multilevel security to existing database management systems. It acts as an intermediary between users and the DBMS, enforcing security policies and filtering data based on clearance levels without requiring modifications to the underlying database engine itself.
Not this one. Try another answer.
Why B is wrong
Trusted back-end would modify the database engine itself, which is more invasive and less commonly used for retrofitting.
Not this one. Try another answer.
Why C is wrong
A controller is a generic term and not the specific architectural pattern for retrofitting multilevel security to DBMSs.
Not this one. Try another answer.
Why D is wrong
A kernel is the core OS component; it's not a retrofit mechanism for database-level security controls.
Question 35 Play from 53:51
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Administrative controls include policies, procedures, and training rather than physical barriers.
Not this one. Try another answer.
Why B is wrong
Technical controls use technology such as firewalls and encryption, not physical barriers.
Right, C is the answer.
Why C is right
Locks, gates, and guards are examples of physical controls. Physical controls are tangible, real-world security measures that physically restrict or prevent access to assets, facilities, or areas. These three examples all involve concrete physical mechanisms or personnel that provide direct physical security.
Not this one. Try another answer.
Why D is wrong
Logical controls are technology-based access restrictions such as passwords and encryption, not physical barriers.
Question 36 Play from 55:26
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Auditability is an important security principle but is not part of the foundational CIA triad.
Not this one. Try another answer.
Why B is wrong
Accountability relates to traceability and responsibility but is not represented by 'A' in the CIA triad.
Right, C is the answer.
Why C is right
In the CIA triad, the letter 'A' stands for Availability, representing the assurance that information and systems are accessible and usable upon demand by authorized users. The three pillars are Confidentiality (preventing unauthorized access), Integrity (ensuring accuracy and completeness), and Availability (ensuring timely access).
Not this one. Try another answer.
Why D is wrong
Authentication is a security mechanism but does not represent the 'A' in the CIA triad.
Question 37 Play from 56:57
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
RSA is an asymmetric encryption algorithm using public and private keys.
Not this one. Try another answer.
Why B is wrong
Elliptic Curve cryptography is an asymmetric algorithm that does not use a single shared key.
Right, C is the answer.
Why C is right
RC5 is a symmetric block cipher algorithm that uses the same key for both encryption and decryption. In contrast, RSA (option A) and El Gamal (option D) are asymmetric algorithms that use public and private key pairs, and Elliptic Curve (option B) algorithms are also asymmetric. Symmetric algorithms are characterized by shared secret keys and are faster than their asymmetric counterparts.
Not this one. Try another answer.
Why D is wrong
El Gamal is an asymmetric encryption algorithm relying on public key infrastructure.
Question 38 Play from 58:28
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Clustering is a data analysis and machine learning technique unrelated to message concealment.
Right, B is the answer.
Why B is right
Steganography is the practice of hiding the existence of a message itself, not just its content. While cryptography makes messages unreadable, steganography conceals that a message exists at all by embedding it within innocuous carriers like images or audio files. This distinguishes it from cryptology (which focuses on encryption/decryption), clustering (a data analysis technique), and the Vernam cipher (a specific encryption method).
Not this one. Try another answer.
Why C is wrong
Cryptology is the study of encryption and decryption; it makes messages unreadable but doesn't hide their existence.
Not this one. Try another answer.
Why D is wrong
The Vernam cipher is an encryption algorithm that obscures message content but doesn't hide that a message exists.
Question 39 Play from 1:00:11
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
TCP (Transmission Control Protocol) and UDP (User Datagram Protocol) are both transport layer protocols operating at Layer 4 of the OSI model. They provide end-to-end communication services and are responsible for managing data delivery between applications on different systems.
Not this one. Try another answer.
Why B is wrong
Network layer (Layer 3) handles routing and IP addressing, not TCP/UDP protocols.
Not this one. Try another answer.
Why C is wrong
Presentation layer (Layer 6) handles data translation and encryption, not transport protocols.
Not this one. Try another answer.
Why D is wrong
Application layer (Layer 7) uses TCP/UDP but does not provide them; TCP/UDP support application layer protocols.
Question 40 Play from 1:01:45
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Closure has no meaningful relationship to confidentiality in information security contexts.
Right, B is the answer.
Why B is right
Disclosure is the opposite of confidentiality. Confidentiality aims to prevent unauthorized disclosure of information, while disclosure means revealing or making information known. If confidentiality is breached, information is disclosed to unauthorized parties. These concepts are directly opposite in meaning.
Not this one. Try another answer.
Why C is wrong
Disposal refers to proper destruction or handling of data at end-of-life, not the opposite of confidentiality.
Not this one. Try another answer.
Why D is wrong
Disaster is an unrelated concept referring to system failures or emergencies, not opposing confidentiality.
Question 41 Play from 1:03:13
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Each data packet contains the IP address of the sender (source) and the IP address of the recipient (destination). These are fundamental fields in the IP header that enable routing and delivery of packets across networks to their intended endpoints.
Not this one. Try another answer.
Why B is wrong
While the recipient is a host, the term 'host' is less precise than 'recipient' for what IP packets are addressed to.
Not this one. Try another answer.
Why C is wrong
Packets contain destination IP addresses, not node identifiers; nodes are identified by their IP addresses.
Not this one. Try another answer.
Why D is wrong
Packets contain the destination host's IP address, not a network address alone, though network addresses are derived from IP addresses.
Question 42 Play from 1:04:39
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Direct evidence proves a fact without inference and includes testimony based on firsthand observation, not copies or descriptions.
Not this one. Try another answer.
Why B is wrong
Circumstantial evidence proves a fact indirectly through inference, but the question specifically addresses copies or descriptions.
Not this one. Try another answer.
Why C is wrong
Hearsay evidence is an out-of-court statement offered to prove the truth of the matter; while unreliable, it is categorized differently than secondary evidence.
Right, D is the answer.
Why D is right
Secondary Evidence is a copy of evidence or an oral description of its contents that is not as reliable as the original best evidence. Examples include photocopies, photographs, or testimony about what a document said. Secondary evidence is admissible when the original cannot be produced, but it is inherently less reliable than the primary source.
Question 43 Play from 1:06:21
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Potential risks are hypothetical and not yet evaluated; contingency plans focus on those formally identified.
Not this one. Try another answer.
Why B is wrong
Residual risks remain after controls are implemented; contingency planning addresses the identified risks that triggered control implementation.
Right, C is the answer.
Why C is right
A contingency plan specifically addresses identified risks, those that have been formally recognized through risk assessment and analysis. The plan is developed in response to risks that have been discovered and documented, not theoretical or residual risks, as these require concrete planning mechanisms and resource allocation.
Not this one. Try another answer.
Why D is wrong
Not all answers are correct because contingency planning specifically targets identified risks through documented risk assessment processes.
Question 44 Play from 1:07:56
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Standards are mandatory but provide requirements rather than detailed action steps.
Not this one. Try another answer.
Why B is wrong
Guidelines are advisory recommendations, not mandatory detailed actions.
Right, C is the answer.
Why C is right
Procedures are the most detailed and prescriptive security policy documents, containing step-by-step instructions that personnel must follow. They describe the exact actions required in specific situations. Standards are mandatory requirements but less detailed; guidelines are recommendations; baselines are minimum security configurations. Procedures are the actionable, detailed level of policy implementation.
Not this one. Try another answer.
Why D is wrong
Baselines establish minimum security levels, not detailed procedural steps.
Question 45 Play from 1:09:25
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Encapsulating Security Payload (ESP) is primarily designed to provide confidentiality through encryption of packet contents. While ESP can also provide authentication and integrity services (overlapping with AH), its main distinguishing feature and primary purpose is to encrypt the payload to protect data confidentiality. This is the key difference between ESP and AH.
Not this one. Try another answer.
Why B is wrong
Cryptography is the mechanism used, but confidentiality is the primary service provided.
Not this one. Try another answer.
Why C is wrong
Digital signatures are provided by AH, not primarily by ESP.
Not this one. Try another answer.
Why D is wrong
Access control is a separate security service; ESP focuses on confidentiality.
Question 46 Play from 1:11:04
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
While TFTP has simpler negotiation, this is a consequence of its design rather than the primary difference.
Right, B is the answer.
Why B is right
The primary difference between FTP and TFTP is that FTP provides authentication mechanisms (username/password) while TFTP does not. FTP requires user authentication before file transfer, whereas TFTP is a simple, unauthenticated protocol. While TFTP is faster and used for configuration files, and FTP can be automated, authentication is the most fundamental and primary distinguishing feature between these two protocols.
Not this one. Try another answer.
Why C is wrong
FTP can be automated with scripts, and this is not the primary distinguishing characteristic.
Not this one. Try another answer.
Why D is wrong
While TFTP is indeed used for network equipment configuration, this describes a use case rather than the fundamental protocol difference.
Question 47 Play from 1:12:49
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Virus detection is typically a separate security function, not the primary feature of a proxy server.
Not this one. Try another answer.
Why B is wrong
URL blocking is a subset of content filtering but not the primary or broadest security feature.
Not this one. Try another answer.
Why C is wrong
Route blocking is not a proxy server function; it applies to network routing, not proxy operations.
Right, D is the answer.
Why D is right
The primary security feature of a proxy server is content filtering, which examines and controls the content of traffic passing through it, blocking malicious or policy-violating content. While proxy servers may support URL blocking and some may integrate virus detection, content filtering is their core security function, it allows organizations to inspect and filter HTTP/HTTPS traffic, block access to inappropriate sites, and protect against content-based threats.
Question 48 Play from 1:14:32
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Preventive/physical controls prevent violations through barriers and locks, not detection.
Right, B is the answer.
Why B is right
Detective controls using software and hardware technologies such as intrusion detection systems, logging mechanisms, and monitoring tools are designed to identify and reveal security policy violations after they occur. This represents the detective/technical pairing that uses technology to discover breaches.
Not this one. Try another answer.
Why C is wrong
Detective/physical controls identify violations through physical means like guard patrols, not software and hardware systems.
Not this one. Try another answer.
Why D is wrong
Detective/administrative controls reveal violations through procedures and audits, not through software and hardware technology.
Question 49 Play from 1:16:09
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Cold sites have no other organizations' resources, eliminating contention.
Right, B is the answer.
Why B is right
Cold sites are unequipped backup facilities with no preinstalled equipment, systems, or data. They require significant setup time after activation, making quick recovery impossible. Options A, C, and D are actual benefits: no contention, secondary location availability, and low cost due to minimal infrastructure.
Not this one. Try another answer.
Why C is wrong
Cold sites provide a physical location to rebuild the environment.
Not this one. Try another answer.
Why D is wrong
Cold sites are the lowest-cost recovery option due to minimal preparation and equipment.
Question 50 Play from 1:17:38
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
People are widely recognized as the weakest link in security systems because human behavior, error, and social engineering are difficult to control technically. Even robust software, hardware, and communication systems can be compromised through user negligence, password sharing, social engineering, or failure to follow security procedures. Technical controls can be perfected, but human factors remain unpredictable.
Not this one. Try another answer.
Why B is wrong
Software can be patched, updated, and hardened against vulnerabilities
Not this one. Try another answer.
Why C is wrong
Communications security can be strengthened through encryption and protocols
Not this one. Try another answer.
Why D is wrong
Hardware security can be physically controlled and monitored
Question 51 Play from 1:19:04
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A Subordinate CA is lower in the hierarchy, not the highest CA.
Right, B is the answer.
Why B is right
In a hierarchical PKI, the highest certification authority is referred to as the 'Top Level CA' (also called Root CA). This is the most trusted anchor at the apex of the certificate chain. The term 'Top Level' correctly describes its position at the top of the hierarchy.
Not this one. Try another answer.
Why C is wrong
'Big CA' is not a standard PKI terminology.
Not this one. Try another answer.
Why D is wrong
'Master CA' is not the standard term; 'Root CA' and 'Top Level CA' are the accepted terms.
Question 52 Play from 1:20:33
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Non-mobile hot sites are expensive to maintain and relatively easy to test regularly.
Not this one. Try another answer.
Why B is wrong
Mobile hot sites are moderately expensive and easier to test than cold sites due to pre-positioned equipment.
Not this one. Try another answer.
Why C is wrong
Warm sites have intermediate cost and reasonable testing feasibility compared to cold sites.
Right, D is the answer.
Why D is right
A cold site is the least expensive recovery option because it requires minimal infrastructure investment, typically just a physical space with basic utilities. However, it is the most difficult to test because it lacks pre-installed equipment, data, and configurations, making realistic testing exercises time-consuming and impractical. In contrast, hot and warm sites have equipment ready and are easier to test, while hot sites are expensive, and mobile sites offer moderate cost with reasonable testing capability.
Question 53 Play from 1:22:08
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A capacity table is not a standard access control term.
Not this one. Try another answer.
Why B is wrong
An ACL is organized by object only, not a full matrix of subjects and objects.
Right, C is the answer.
Why C is right
An Access Control Matrix is a table with subjects as rows and objects as columns (or vice versa), showing what actions each subject can perform on each object. It provides a complete representation of all access relationships in a system.
Not this one. Try another answer.
Why D is wrong
A capability table shows subjects to objects but is not typically called a matrix.
Question 54 Play from 1:23:32
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Domain Name Service (DNS) is a distributed database system whose primary function is to map domain names (like www.example.com) to their corresponding IP addresses. This allows users to access resources using human-readable domain names rather than numerical IP addresses.
Not this one. Try another answer.
Why B is wrong
DNS does not map MAC addresses to domain names; that function is performed by reverse DNS or other protocols.
Not this one. Try another answer.
Why C is wrong
DNS does not map MAC addresses to IP addresses; that function is performed by ARP (Address Resolution Protocol).
Not this one. Try another answer.
Why D is wrong
DNS does not map IP addresses to MAC addresses; ARP performs the inverse function of mapping IP addresses to MAC addresses on local networks.
Question 55 Play from 1:25:16
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
In a stateful inspection firewall, the inspection engine operates at the Network or Transport Layer (Layers 3-4 of the OSI model). Stateful inspection examines packet headers and connection states at these layers, tracking the state of network connections and making filtering decisions based on the context of the connection rather than just individual packets.
Not this one. Try another answer.
Why B is wrong
Application layer inspection is characteristic of proxy firewalls, not the primary operating level of stateful inspection firewalls.
Not this one. Try another answer.
Why C is wrong
Inspection layer is not an OSI layer; this is not a valid OSI reference.
Not this one. Try another answer.
Why D is wrong
The Data Link Layer (Layer 2) is too low for stateful inspection; stateful inspection requires knowledge of network and transport layer information.
Question 56 Play from 1:26:56
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Installing a firewall is a network-level measure that assumes you already know what to protect.
Not this one. Try another answer.
Why B is wrong
Implementing encryption without identifying sensitive data wastes resources on non- critical information.
Right, C is the answer.
Why C is right
Before implementing any technical controls, you must first identify which information is sensitive and requires protection. This discovery and classification phase is foundational, you cannot effectively apply encryption, firewalls, or access controls without knowing what data needs protection and why. Starting with technical measures without understanding your sensitive data is inefficient and may leave critical information unprotected.
Not this one. Try another answer.
Why D is wrong
Reviewing access rights is appropriate only after identifying which data requires confidentiality protection.
Question 57 Play from 1:28:38
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
VDSL (Very High Speed Digital Subscriber Line) can deliver up to 52 Mbps downstream over a single copper twisted pair under favorable conditions. This represents a significant improvement over ADSL technology. SDSL is symmetric and maxes out lower, HDSL is older technology with lower speeds, and ADSL typically delivers 8-24 Mbps downstream.
Not this one. Try another answer.
Why B is wrong
SDSL provides symmetric speeds of approximately 2.3 Mbps and is not designed for the high downstream speeds mentioned.
Not this one. Try another answer.
Why C is wrong
HDSL is older technology from the 1990s with maximum speeds around 2 Mbps, well below 52 Mbps.
Not this one. Try another answer.
Why D is wrong
ADSL typically delivers 8-24 Mbps downstream, which is below the 52 Mbps specification stated.
Question 58 Play from 1:30:22
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
In the IP header's protocol field, the value 6 corresponds to TCP (Transmission Control Protocol). This standardized protocol number identifies the type of transport layer protocol contained in the IP datagram payload. ICMP is 1, UDP is 17, and IGMP is 2.
Not this one. Try another answer.
Why B is wrong
ICMP is protocol number 1, not 6.
Not this one. Try another answer.
Why C is wrong
UDP is protocol number 17, not 6.
Not this one. Try another answer.
Why D is wrong
IGMP is protocol number 2, not 6.
Question 59 Play from 1:31:41
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Being between routers or firewalls describes a bastion host or gateway, not a multi-homed host specifically.
Not this one. Try another answer.
Why B is wrong
While multi-homed hosts can enable IP routing, allowing routing is not their defining characteristic.
Right, C is the answer.
Why C is right
A multi-homed host is defined by having multiple network interfaces (NICs), each connected to separate networks, allowing it to communicate on multiple network segments simultaneously. This is the core characteristic that distinguishes multi-homed hosts from standard hosts.
Not this one. Try another answer.
Why D is wrong
Operating at multiple layers is not the main characteristic; the defining feature is the multiple network interfaces.
Question 60 Play from 1:33:19
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Incremental backups require a full backup plus all subsequent incrementals to restore, making them unsuitable as standalone archives.
Not this one. Try another answer.
Why B is wrong
Off-site backup method is not a recognized backup classification or method.
Right, C is the answer.
Why C is right
Full backup method is most appropriate for off-site archiving because it creates a complete, standalone copy of all data that does not depend on other backups to restore. This independence is critical for archival purposes where incremental or differential backups would require maintaining a chain of previous backups, making archival management complex and error-prone.
Not this one. Try another answer.
Why D is wrong
Differential backups still depend on a reference full backup for complete restoration, lacking the independence needed for archival.
Question 61 Play from 1:34:56
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Timestamping is a core PKI service for non-repudiation and audit trails.
Not this one. Try another answer.
Why B is wrong
Repository is essential to PKI for storing and distributing certificates.
Not this one. Try another answer.
Why C is wrong
Certificate revocation is a critical PKI function for invalidating compromised certificates.
Right, D is the answer.
Why D is right
Internet Key Exchange (IKE) is a protocol used for establishing security associations in IPSec, not a component of Public Key Infrastructure. PKI elements include timestamping services (for non-repudiation), repositories (for storing certificates), and certificate revocation mechanisms (CRLs or OCSP). IKE is an IPSec-specific protocol that operates outside the PKI framework.
Question 62 Play from 1:36:41
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Tokens themselves do not inherently prevent replay; they must include time-based validation.
Not this one. Try another answer.
Why B is wrong
Passwords are used for initial authentication but do not directly protect against ticket replay.
Not this one. Try another answer.
Why C is wrong
While cryptography is used throughout Kerberos, it is timestamps specifically that prevent replays.
Right, D is the answer.
Why D is right
Kerberos uses timestamps embedded in tickets to protect against replay attacks. Each ticket includes a timestamp that indicates when it was issued, and the system validates that the timestamp falls within an acceptable time window. This prevents an attacker from capturing and reusing old tickets because they will be rejected if presented outside the valid time range. The combination of timestamps with ticket expiration times is the primary mechanism Kerberos uses to defeat replay attacks.
Question 63 Play from 1:38:17
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The Application layer uses TCP/UDP services but does not implement them.
Not this one. Try another answer.
Why B is wrong
The Presentation layer handles data formatting and encryption, not protocol implementation.
Not this one. Try another answer.
Why C is wrong
The Session layer manages dialogue control, not TCP/UDP implementation.
Right, D is the answer.
Why D is right
TCP (Transmission Control Protocol) and UDP (User Datagram Protocol) are both implemented at Layer 4, the Transport layer, of the OSI model. They manage end-to-end communication, reliability, and port-based service delivery.
Question 64 Play from 1:39:42
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Rotation of duties is a preventive control that reduces the opportunity for fraud or errors before they occur. Detective controls identify issues after they happen. Required vacations, separation of duties, and security reviews/audits all function as detective controls by revealing unauthorized activities, conflicts, or compliance violations through monitoring and analysis.
Not this one. Try another answer.
Why B is wrong
Required vacations are detective controls that may reveal fraudulent activities when the employee is absent.
Not this one. Try another answer.
Why C is wrong
Separation of duties is explicitly a detective control that identifies conflicts of interest and unauthorized transactions.
Not this one. Try another answer.
Why D is wrong
Security reviews and audits are quintessential detective controls designed to identify issues after occurrence.
Question 65 Play from 1:41:19
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
S-WAP is not a recognized wireless security standard.
Right, B is the answer.
Why B is right
WTLS (Wireless Transport Layer Security) is a security protocol designed specifically to provide encryption and authentication for wireless communications. It is part of the WAP (Wireless Application Protocol) suite and is the wireless equivalent of TLS/SSL. WTLS protects data transmission in wireless networks by providing confidentiality and integrity. The other options are different components of WAP: WSP is a session protocol, WDP is a datagram protocol, and S-WAP is not a standard security protocol.
Not this one. Try another answer.
Why C is wrong
WSP (Wireless Session Protocol) handles sessions but does not provide the security encryption that WTLS does.
Not this one. Try another answer.
Why D is wrong
WDP (Wireless Datagram Protocol) is a transport layer protocol but does not provide security features.
Question 66 Play from 1:43:11
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Retina scan biometrics has the lowest user acceptance level among common biometric methods. This is because retina scanning requires close proximity to the scanner, direct eye contact, and can feel invasive to users. Additionally, there are concerns about eye- related health issues and discomfort. In contrast, fingerprint scans, hand geometry, and signature recognition are less intrusive and more user-friendly.
Not this one. Try another answer.
Why B is wrong
Fingerprint scans have higher user acceptance than retina scans.
Not this one. Try another answer.
Why C is wrong
Hand geometry has higher user acceptance than retina scans.
Not this one. Try another answer.
Why D is wrong
Signature recognition has higher user acceptance than retina scans.
Question 67 Play from 1:44:36
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Both self-audits and independent audits may use similar tools; tools are not the essential difference.
Not this one. Try another answer.
Why B is wrong
Both audit types aim to produce reliable results; the difference is in independence, not inherent result quality.
Right, C is the answer.
Why C is right
The essential difference between a self-audit and an independent audit is objectivity. A self-audit is conducted by internal personnel assessing their own work, creating inherent bias and conflicts of interest. An independent audit is performed by external parties without vested interests, allowing for objective, unbiased evaluation. This objectivity is the critical distinction that determines the credibility and reliability of audit findings.
Not this one. Try another answer.
Why D is wrong
Both can be conducted by competent professionals; competence exists independently of audit independence.
Question 68 Play from 1:46:13
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A fail-safe system defaults to a safe state when a failure is detected, but does not necessarily correct the fault or operate around it.
Not this one. Try another answer.
Why B is wrong
A fail-soft system gracefully degrades functionality, but this is not the same as detecting and correcting faults or operating around them.
Right, C is the answer.
Why C is right
A fault-tolerant system is specifically designed to detect faults when they occur and either correct them automatically or continue operating around them without service interruption. This is the standard definition used in computer science and security engineering.
Not this one. Try another answer.
Why D is wrong
A failover system switches to a backup system, which is related to availability but not the same as fault tolerance with automatic correction.
Question 69 Play from 1:47:52
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
HTTP (HyperText Transport Protocol) operates at Layer 7 (Application Layer), not Layer 3 (Network Layer). The other three protocols are all Network Layer protocols: OSPF (Open Shortest Path First) and RIP (Routing Information Protocol) are routing protocols, and IP (Internet Protocol) is the fundamental Network Layer protocol. HTTP is an application-level protocol.
Not this one. Try another answer.
Why B is wrong
OSPF is a Network Layer routing protocol.
Not this one. Try another answer.
Why C is wrong
Internet Protocol (IP) is the core Network Layer protocol.
Not this one. Try another answer.
Why D is wrong
RIP (Routing Information Protocol) is a Network Layer routing protocol.
Question 70 Play from 1:49:26
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Network-based IDS (NIDS) provides real-time information by passively monitoring network traffic without requiring installation on individual hosts or consuming significant host resources. It analyzes packets at the network perimeter, making it efficient and non- intrusive compared to host-based approaches that consume CPU and memory on each monitored system.
Not this one. Try another answer.
Why B is wrong
Host-based IDS consumes significant host resources including CPU, memory, and disk I/O on the monitored system.
Not this one. Try another answer.
Why C is wrong
Application-based IDS requires integration with specific applications and consumes application resources.
Not this one. Try another answer.
Why D is wrong
Firewall-based IDS is less common and still requires processing resources to analyze traffic rules.
Question 71 Play from 1:51:10
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Current level firewall is not a recognized firewall classification or variation.
Not this one. Try another answer.
Why B is wrong
Cache level firewall is not a standard firewall terminology or variation.
Not this one. Try another answer.
Why C is wrong
Session level firewall is not the correct term; circuit level firewall is the recognized variation.
Right, D is the answer.
Why D is right
A circuit level firewall (also called a circuit level proxy) is a variation of the application layer firewall. It operates at a lower OSI layer and establishes circuits or connections between clients and servers, forwarding data packets without deeply inspecting the application-level content, making it faster but less thorough than full application proxies.
Question 72 Play from 1:52:38
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
SOCKS servers operate at the session layer (layer 5) of the OSI model. SOCKS is a protocol that facilitates proxy communication and session establishment between clients and servers, making it fundamentally a session-layer mechanism. While it works with transport-layer protocols, its primary function is establishing and managing sessions, not transport itself.
Not this one. Try another answer.
Why B is wrong
The transport layer handles protocols like TCP and UDP, not SOCKS session management.
Not this one. Try another answer.
Why C is wrong
The network layer handles routing and IP addressing, which is below SOCKS functionality.
Not this one. Try another answer.
Why D is wrong
The data link layer handles physical hardware addressing and framing, not application-level session proxying.
Question 73 Play from 1:54:14
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
There is no 'Pre Initialization Phase' in the IKE protocol structure.
Right, B is the answer.
Why B is right
In the Internet Key Exchange (IKE) protocol, Phase 1 is responsible for peer authentication and the establishment of a secure channel between the two peers. Phase 2 follows and handles the negotiation of IPsec security associations.
Not this one. Try another answer.
Why C is wrong
Phase 2 is focused on IPsec security association negotiation, not peer authentication.
Not this one. Try another answer.
Why D is wrong
Peer authentication is definitively performed during IKE Phase 1.
Question 74 Play from 1:55:38
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Executives are important but not critical infrastructure components needed to restore operations.
Not this one. Try another answer.
Why B is wrong
Least critical components should be restored last, not first, as they have minimal impact on recovery.
Not this one. Try another answer.
Why C is wrong
IT support staff, while helpful, are not components that need to be physically moved back and are secondary to infrastructure recovery.
Right, D is the answer.
Why D is right
When recovering from a disaster, the most critical components should be moved back to the original site first to restore business operations as quickly as possible. This prioritization minimizes downtime and business impact. Critical components are those essential to core business functions, which take precedence over personnel or less critical systems.
Question 75 Play from 1:57:17
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The Internet layer handles routing and logical addressing, not error correction or sequencing.
Not this one. Try another answer.
Why B is wrong
The Network Access layer handles physical transmission and MAC functions, not end-to-end reliability.
Right, C is the answer.
Why C is right
The Host-to-Host (Transport) layer of the DoD TCP/IP model ensures error-free delivery and packet sequencing. This layer contains protocols like TCP (Transmission Control Protocol) which provides reliable, ordered delivery of data through sequence numbers and acknowledgments, and UDP which provides unreliable delivery.
Not this one. Try another answer.
Why D is wrong
The Application layer provides user services and applications, not the underlying transport reliability mechanisms.
Question 76 Play from 1:58:46
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Memory segmentation is a memory management technique but not the primary mechanism preventing inter-process data access.
Right, B is the answer.
Why B is right
Process isolation is the primary mechanism that prevents one process from accessing another process's data. It creates a logical separation at the OS level, ensuring that each process operates within its own protected memory space and cannot directly access or modify the memory or resources of other processes.
Not this one. Try another answer.
Why C is wrong
The reference monitor enforces access control policies but operates as part of process isolation, not instead of it.
Not this one. Try another answer.
Why D is wrong
Data hiding is an application-level concept, not a system-level mechanism for preventing process-to-process data access.
Question 77 Play from 2:00:22
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Secondary evidence is a copy or substitute for original evidence, not evidence derived through inference.
Not this one. Try another answer.
Why B is wrong
Conclusive evidence is evidence that is incontrovertible and requires no further proof or inference.
Not this one. Try another answer.
Why C is wrong
Hearsay evidence is testimony regarding out-of-court statements, not evidence derived through logical inference from facts.
Right, D is the answer.
Why D is right
Circumstantial evidence is defined as inference of information from other, intermediate, relevant facts rather than direct observation. It requires the fact-finder to make a logical deduction or inference from the facts presented to reach a conclusion about the matter in question.
Question 78 Play from 2:01:57
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Code is not a generic term for encryption; that would be 'cipher' or 'encryption algorithm'.
Not this one. Try another answer.
Why B is wrong
Codes are not specific to substitution ciphers; they are a separate cryptographic concept operating at a different level.
Right, C is the answer.
Why C is right
In cryptography, a code specifically operates on linguistic units such as words or phrases, converting them to other words or phrases. This contrasts with ciphers, which operate on individual characters or bits. Codes deal with meaning at the semantic level, while ciphers manipulate individual symbols mathematically.
Not this one. Try another answer.
Why D is wrong
Codes are not specific to transposition ciphers; they operate independently of cipher types.
Question 79 Play from 2:03:27
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The Digital Signature Standard (DSS) does NOT provide encryption. DSS is specifically designed for creating and verifying digital signatures, which provide authentication, non- repudiation, and integrity verification. Encryption requires additional algorithms; DSS only ensures that messages are authenticated, have not been altered, and that the sender cannot deny having signed the message.
Not this one. Try another answer.
Why B is wrong
DSS provides integrity assurance through the digital signature mechanism, which detects any tampering with signed data.
Not this one. Try another answer.
Why C is wrong
Creating digital signatures is the primary purpose of the Digital Signature Standard.
Not this one. Try another answer.
Why D is wrong
DSS provides authentication by allowing the signer to be verified through signature validation and key association.
Question 80 Play from 2:04:59
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
The reference monitor is an abstract machine that mediates access, not a domain of trust with shared policy.
Right, B is the answer.
Why B is right
A security domain is defined as a domain of trust that shares a single security policy and single management authority. It represents a logical grouping where all subjects operate under the same security policy and are managed cohesively.
Not this one. Try another answer.
Why C is wrong
The security kernel is the core of a trusted computing base, not a domain sharing a single policy.
Not this one. Try another answer.
Why D is wrong
The security perimeter is the boundary of a secure system, not specifically a domain with shared policy management.
Question 81 Play from 2:06:27
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Monthly reviews are excessive and create unnecessary administrative burden without proportional benefit.
Not this one. Try another answer.
Why B is wrong
Semi-annual reviews, while more frequent than necessary, are not the standard recommended interval in most frameworks.
Right, C is the answer.
Why C is right
Industry best practice and most IT certification standards require Business Continuity Plans to be reviewed at least annually. This frequency ensures the plan remains current with organizational changes, technology updates, and lessons learned, while not being so frequent as to create unnecessary overhead. Annual reviews allow sufficient time to identify meaningful changes and implement updates systematically.
Not this one. Try another answer.
Why D is wrong
Quarterly reviews are overly frequent for routine updates and only appropriate for high-risk environments or post-incident reassessment.
Question 82 Play from 2:08:04
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
Disgruntled employees pose the greatest threat because they have legitimate internal access to systems, deep knowledge of organizational infrastructure and security controls, motivation stemming from grievances, and the ability to cause significant damage before detection. While criminal hackers and corporate spies are dangerous, insiders have the advantage of trusted access and detailed system knowledge that external attackers must work to obtain.
Not this one. Try another answer.
Why B is wrong
Student hackers typically lack the motivation, resources, and access to pose threats as severe as other categories.
Not this one. Try another answer.
Why C is wrong
Criminal hackers operate from outside and must overcome external security controls, giving them less advantage than insiders.
Not this one. Try another answer.
Why D is wrong
Corporate spies are a threat, but disgruntled employees have superior access and knowledge as trusted insiders.
Question 83 Play from 2:09:44
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Certification is the technical assessment, not management's formal acceptance.
Not this one. Try another answer.
Why B is wrong
Acceptance is too informal; accreditation is the formal management recognition.
Right, C is the answer.
Why C is right
Accreditation is the formal, official acceptance by management of the adequacy of a system's overall security posture. It represents management's authorization and acknowledgment that security is acceptable for operational use. Certification is the technical assessment process; acceptance is informal agreement; evaluation is the assessment activity. Accreditation is the formal management decision following technical certification.
Not this one. Try another answer.
Why D is wrong
Evaluation is the assessment process, not the formal management acceptance decision.
Question 84 Play from 2:11:18
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Lighting is a physical control that deters intruders and aids surveillance.
Not this one. Try another answer.
Why B is wrong
Fences are physical barriers that control and restrict facility access.
Right, C is the answer.
Why C is right
Physical security controls are tangible measures that protect facilities and assets through physical means. Lighting, fences, and facility construction materials are all physical controls. Training is an administrative or procedural control, it educates people on security practices but does not physically prevent access or protect against attacks.
Not this one. Try another answer.
Why D is wrong
Facility construction materials provide physical protection against damage and intrusion.
Question 85 Play from 2:12:38
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A breach is an actual incident, not a component of risk definition; risk is about potential, not realized events.
Right, B is the answer.
Why B is right
Risk is best defined as the combination of threat and vulnerability. A threat is a potential source of harm, and a vulnerability is a weakness that can be exploited. Risk exists when a threat can exploit a vulnerability; without both elements, risk is not present.
Not this one. Try another answer.
Why C is wrong
An attack is a realized action, not a definition component; risk involves potential threats and vulnerabilities.
Not this one. Try another answer.
Why D is wrong
A breach of security is an incident outcome, not part of the foundational definition of risk itself.
Question 86 Play from 2:14:13
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
This represents only the number of clerks, not accounting for the monthly frequency or annualization.
Not this one. Try another answer.
Why B is wrong
This figure would represent only 10 months of occurrences, not the full 12-month annualized rate.
Not this one. Try another answer.
Why C is wrong
This would suggest only one error per year across all clerks, which dramatically underestimates the actual frequency.
Right, D is the answer.
Why D is right
ARO represents how many times a threat is expected to occur in one year. With 100 data entry clerks each making one input error per month, that equals 100 errors per month. Over 12 months, this totals 100 × 12 = 1,200 occurrences annually. ARO is therefore 1200.
Question 87 Play from 2:15:51
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Local security specialists implement and maintain controls but lack the independence needed for objective effectiveness measurement.
Not this one. Try another answer.
Why B is wrong
Business managers are concerned with business objectives and risk acceptance, not technical control measurement.
Right, C is the answer.
Why C is right
A systems auditor is the independent party responsible for measuring and evaluating the effectiveness of security controls. Auditors provide objective assessment of whether controls are functioning as designed and achieving their intended security objectives. While security managers and business managers play roles in security, the auditor's independence and expertise in control evaluation make them the appropriate choice for measuring effectiveness.
Not this one. Try another answer.
Why D is wrong
Central security managers oversee the security program but should not audit their own controls due to lack of independence.
Question 88 Play from 2:17:36
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
VDSL provides higher speeds but shorter distance range and is less suitable for home/small office deployment.
Not this one. Try another answer.
Why B is wrong
SDSL provides symmetric speeds, not asymmetric, and is intended for business applications.
Right, C is the answer.
Why C is right
ADSL (Asymmetric Digital Subscriber Line) is designed for home and small office use with asymmetric speeds where downstream bandwidth is significantly higher than upstream bandwidth. ADSL operates over longer distances than other xDSL variants and is optimized for typical internet usage patterns where users download more than they upload.
Not this one. Try another answer.
Why D is wrong
HDSL provides symmetric speeds and is designed for T1/E1 replacement, not home/small office asymmetric use.
Question 89 Play from 2:19:12
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Non-repudiation ensures a user cannot deny their actions; while Kerberos provides authentication, it is not its primary service.
Not this one. Try another answer.
Why B is wrong
Confidentiality is supported through encryption in Kerberos, but authentication is the primary service it provides.
Right, C is the answer.
Why C is right
Kerberos is primarily an authentication service within a network environment. It provides mutual authentication between clients and servers using tickets and a trusted third party (the Key Distribution Center), ensuring that both parties can verify each other's identity within a networked system.
Not this one. Try another answer.
Why D is wrong
Authorization (access control) is handled by separate systems; Kerberos focuses on authentication, not authorization decisions.
Question 90 Play from 2:20:39
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Tech support provides operational security but not ultimate organizational responsibility.
Not this one. Try another answer.
Why B is wrong
Operations teams execute security procedures but are not ultimately accountable.
Right, C is the answer.
Why C is right
Ultimate responsibility for information system security within an organization rests with senior management. While technical teams implement and maintain security controls, management is accountable for establishing security policy, allocating resources, defining acceptable risk levels, and ensuring compliance. This responsibility cannot be delegated away; it remains with organizational leadership.
Not this one. Try another answer.
Why D is wrong
Training teams support security awareness but do not bear ultimate responsibility.
Question 91 Play from 2:22:21
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A baseline within the CBK context defines the minimum acceptable level of security that must be implemented in an environment. It provides a floor below which security posture should not fall. Standards (B) are mandatory requirements but not minimum levels. Procedures (C) are step-by-step instructions. Guidelines (D) are recommendations, not minimum requirements.
Not this one. Try another answer.
Why B is wrong
Standards are mandatory specifications but don't specifically define a minimum acceptable level.
Not this one. Try another answer.
Why C is wrong
Procedures are detailed instructions for executing tasks, not baseline security levels.
Not this one. Try another answer.
Why D is wrong
Guidelines are recommendations and best practices, not minimum requirements or baselines.
Question 92 Play from 2:23:58
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Port 81 is not the standard HTTP port; it is sometimes used as an alternative but is not the official standard.
Right, B is the answer.
Why B is right
Port 80 is the well-known and standard port number for HTTP (Hypertext Transfer Protocol) traffic. This is the default port that web browsers use to communicate with web servers unless otherwise specified.
Not this one. Try another answer.
Why C is wrong
Port 8080 is commonly used as an alternative HTTP port for proxies and development servers, not the standard port.
Not this one. Try another answer.
Why D is wrong
Port 8180 is not a standard HTTP port and is not commonly associated with HTTP services.
Question 93 Play from 2:25:24
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Development/acquisition focuses on building or procuring systems according to established requirements, not establishing foundational policy.
Not this one. Try another answer.
Why B is wrong
Implementation is about deploying the system, not establishing initial security policy foundations.
Right, C is the answer.
Why C is right
The Initiation phase is where foundational planning occurs, including establishing security policies, requirements, and organizational context that will guide all subsequent design and implementation decisions. This phase sets the security baseline before any acquisition or development work begins.
Not this one. Try another answer.
Why D is wrong
Maintenance occurs after system deployment and focuses on ongoing operations, not establishing initial policies.
Question 94 Play from 2:26:59
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
Voice alone is incomplete; it ignores data and multimedia transmission needs.
Not this one. Try another answer.
Why B is wrong
Voice and multimedia omit data, which is a critical component of network communications.
Not this one. Try another answer.
Why C is wrong
Data and multimedia omit voice communications, which is increasingly transmitted over networks.
Right, D is the answer.
Why D is right
Communications and network security encompasses the transmission and protection of all types of information across networks. This includes voice communications (VoIP), data (text, files, databases), and multimedia (video, audio streams). A comprehensive communications security program must address all three categories to ensure complete protection of organizational information in transit.
Question 95 Play from 2:28:39
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
7 layers is the count for the OSI/ISO model, not the DoD TCP/IP model.
Not this one. Try another answer.
Why B is wrong
5 layers is not a standard count for either the DoD model or OSI model.
Right, C is the answer.
Why C is right
The DoD TCP/IP Model defines 4 layers: Application layer, Host-to-Host (Transport) layer, Internet layer, and Network Access (Link) layer. This is distinct from the OSI model which has 7 layers. The DoD model is a simpler, more practical model used for TCP/IP networking.
Not this one. Try another answer.
Why D is wrong
3 layers is too few; the DoD model has one more layer than this.
Question 96 Play from 2:30:00
Tap an answer. The reason for that answer shows here.
Not this one. Try another answer.
Why A is wrong
A digital signature is a cryptographic construct that uses both hashing and asymmetric encryption; it is not the direct result of applying a hash algorithm alone.
Not this one. Try another answer.
Why B is wrong
Ciphertext is the encrypted output from an encryption algorithm, not the output of a hash algorithm.
Right, C is the answer.
Why C is right
When a hash algorithm is applied to a message, the result is a message digest, a fixed- size, unique digital fingerprint of the original message. The message digest is deterministic, meaning the same input always produces the same output, and it is one- way, making it impossible to reverse-engineer the original message from the digest.
Not this one. Try another answer.
Why D is wrong
Plaintext is the original unencrypted message, not the result of applying a hash algorithm to that message.
Question 97 Play from 2:31:33
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
An IP address is the logical identifier assigned to each host on an IP network for identification and routing purposes. MAC addresses are physical layer identifiers, TCP addresses do not exist as a standard term, and datagrams are data units, not host identifiers.
Not this one. Try another answer.
Why B is wrong
MAC addresses are hardware addresses used at the data link layer, not logical IDs for IP networks.
Not this one. Try another answer.
Why C is wrong
TCP is a transport layer protocol; there is no standard TCP address identifier.
Not this one. Try another answer.
Why D is wrong
Datagrams are packets of data, not logical identifiers for hosts.
Question 98 Play from 2:32:58
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
The Logical Link Control (LLC) sublayer is part of the ISO/OSI Data Link layer (Layer 2). The Data Link layer is subdivided into the LLC sublayer and the Media Access Control (MAC) sublayer. The Reference monitor is a security concept, the Transport layer is a different OSI layer where the LLC sublayer does not reside, and option D is malformed and nonsensical.
Not this one. Try another answer.
Why B is wrong
The Reference monitor is a security principle, not a layer that contains LLC.
Not this one. Try another answer.
Why C is wrong
The Transport layer is OSI Layer 4, while LLC is part of Layer 2 (Data Link).
Not this one. Try another answer.
Why D is wrong
This option is malformed and does not represent a valid OSI model component.
Question 99 Play from 2:34:44
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
To be admissible in court, computer evidence must be relevant, meaning it must have a direct bearing on the case and tend to prove or disprove a fact of consequence. Relevance is the fundamental requirement under evidence rules. Decryption, editing, and whether evidence is incriminating are separate considerations that don't determine basic admissibility.
Not this one. Try another answer.
Why B is wrong
Evidence does not need to be decrypted to be admissible; encrypted data can be admitted with proper authentication and explanation.
Not this one. Try another answer.
Why C is wrong
Evidence must not be edited; editing would actually render it inadmissible as it compromises integrity.
Not this one. Try another answer.
Why D is wrong
Evidence need not be incriminating to be admissible; exculpatory evidence is equally admissible.
Question 100 Play from 2:36:16
Tap an answer. The reason for that answer shows here.
Right, A is the answer.
Why A is right
A passphrase is a sequence of characters (usually words or a sentence) that is typically longer than a standard password. Passphrases provide increased security through length while often being easier for users to remember than random character passwords. They exceed the typical character limits imposed on passwords.
Not this one. Try another answer.
Why B is wrong
Cognitive phrase is not a standard security term and does not refer to longer character sequences.
Not this one. Try another answer.
Why C is wrong
Anticipated phrase is not a recognized authentication credential type.
Not this one. Try another answer.
Why D is wrong
Real phrase is not a recognized authentication credential type in security terminology.
Transcript
Play from 00:00 Question 1. Which of the following protocols suite does the Internet use? Here are the options. Option A. IP/UDP/TCP. Option B. IP/UDP/ICMP/TCP. Option C. TCP/IP. Option D. IMAP/SMTP/POP3. Pause the video now if you want time to think about the answer.
The correct answer is B. IP/UDP/ICMP/TCP. The Internet protocol suite consists of TCP (Transmission Control Protocol), UDP (User Datagram Protocol), ICMP (Internet Control Message Protocol), and IP (Internet Protocol). Option B correctly lists all four core protocols, while option C omits UDP and ICMP, and options A and D are incomplete or incorrect groupings. Now, why are the other options incorrect? Option A is incorrect. Omits ICMP, which is a fundamental part of the Internet protocol suite. Option C is incorrect. TCP/IP is a shorthand notation but incomplete; UDP and ICMP are also essential Internet protocols. Option D is incorrect. These are application layer protocols (email), not the core Internet protocol suite. Therefore, B, IP/UDP/ICMP/TCP, is the correct answer.
Play from 01:48 Question 2. What is the name for a substitution cipher that shifts the alphabet by 13 places? Here are the options. Option A. Caesar cipher. Option B. Polyalphabetic cipher. Option C. ROT13 cipher. Option D. Transposition cipher. Pause the video now if you want time to think about the answer.
The correct answer is C. ROT13 cipher. ROT13 is a substitution cipher that rotates each letter in the alphabet by exactly 13 places. It is a special case of the Caesar cipher (which can shift by any amount), making ROT13 a specific implementation with a fixed shift of 13. The name ROT13 directly describes this 13-place rotation. ROT13 is notable because applying it twice returns the original text, making it symmetric. Now, why are the other options incorrect? Option A is incorrect. Caesar cipher is the general category; ROT13 is the specific name for the 13-shift variant. Option B is incorrect. Polyalphabetic ciphers use multiple substitution alphabets, not a simple fixed rotation. Option D is incorrect. Transposition ciphers rearrange letter positions; ROT13 substitutes letters, not transposes them. Therefore, C, ROT13 cipher, is the correct answer.
Play from 03:25 Question 3. Which is the last line of defense in a physical security sense? Here are the options. Option A. people. Option B. interior barriers. Option C. exterior barriers. Option D. perimeter barriers. Pause the video now if you want time to think about the answer.
The correct answer is A. people. In the concentric layers of physical security (perimeter barriers, exterior barriers, interior barriers, and people), people represent the final line of defense. While automated systems and physical barriers provide layers of protection, ultimately human personnel, whether guards, staff, or authorized occupants, serve as the last defense against threats that penetrate all other security measures. People can make judgments, respond adaptively, and take decisive action that mechanical systems cannot. Now, why are the other options incorrect? Option B is incorrect. Interior barriers are an earlier line of defense, protecting specific areas within a facility. Option C is incorrect. Exterior barriers are an earlier layer, typically surrounding buildings or facilities. Option D is incorrect. Perimeter barriers are the outermost layer and the first line of defense, not the last. Therefore, A, people, is the correct answer.
Show full transcriptShow less
Play from 05:04 Question 4. Devices that supply power when the commercial utility power system fails are called which of the following? Here are the options. Option A. power conditioners. Option B. uninterruptible power supplies. Option C. power filters. Option D. power dividers. Pause the video now if you want time to think about the answer.
The correct answer is B. uninterruptible power supplies. An uninterruptible power supply (UPS) is the device that supplies power when commercial utility power fails. A UPS uses battery backup to maintain system operation during power outages, allowing time for proper shutdown or continued operation. Now, why are the other options incorrect? Option A is incorrect. Power conditioners regulate and stabilize voltage but do not supply power during outages. Option C is incorrect. Power filters remove electrical noise and interference but do not supply backup power. Option D is incorrect. Power dividers distribute power to multiple devices but do not provide backup during failures. Therefore, B, uninterruptible power supplies, is the correct answer.
Play from 06:30 Question 5. Which of the following is NOT an example of an operational control? Here are the options. Option A. backup and recovery. Option B. Auditing. Option C. contingency planning. Option D. operations procedures. Pause the video now if you want time to think about the answer.
The correct answer is B. Auditing. Operational controls are security measures carried out mainly by people, such as backup and recovery, contingency planning and operations procedures. Auditing through audit trails is classified as a technical control because it is implemented and enforced by the system itself. Now, why are the other options incorrect? Option A is incorrect. Backup and recovery is a people-executed operational control. Option C is incorrect. Contingency planning is listed as an operational control in standard control families. Option D is incorrect. Operations procedures are the day-to-day processes that define operational controls. Therefore, B, Auditing, is the correct answer.
Play from 07:48 Question 6. In biometrics, the "one-to-one" search used to verify claim to an identity made by a person is considered: Here are the options. Option A. Authentication. Option B. Identification. Option C. Auditing. Option D. Authorization. Pause the video now if you want time to think about the answer.
The correct answer is A. Authentication. Authentication in biometrics is a one-to-one verification process where the system compares a presented biometric sample against one specific stored template to verify that the person's claimed identity is valid. This is the verification of an identity claim rather than discovery of identity. Now, why are the other options incorrect? Option B is incorrect. Identification is one-to-many searching to determine identity, not one-to-one verification of a claimed identity. Option C is incorrect. Auditing is logging and monitoring activities, not the biometric verification process. Option D is incorrect. Authorization is determining what access rights an authenticated user has, not the verification of identity. Therefore, A, Authentication, is the correct answer.
Play from 09:14 Question 7. What is the PRIMARY use of a password? Here are the options. Option A. Allow access to files. Option B. Identify the user. Option C. Authenticate the user. Option D. Segregate various user's accesses. Pause the video now if you want time to think about the answer.
The correct answer is C. Authenticate the user. The primary use of a password is to authenticate the user, to verify that the person claiming to be a specific user actually is that person. Authentication is the verification of identity. While passwords can facilitate file access and user segregation as secondary effects, their fundamental security purpose is authentication. Identification (option B) is the process of claiming an identity, whereas authentication is proving that claim. Now, why are the other options incorrect? Option A is incorrect. Allowing access to files is a consequence of authentication, not the primary purpose of the password itself. Option B is incorrect. Identification is the process of claiming who you are; authentication is proving the claim, making authentication primary. Option D is incorrect. Segregating user accesses is a policy implementation that follows authentication, not its primary purpose. Therefore, C, Authenticate the user, is the correct answer.
Play from 10:57 Question 8. The major objective of system configuration management is which of the following? Here are the options. Option A. system maintenance. Option B. system stability. Option C. system operations. Option D. system tracking. Pause the video now if you want time to think about the answer.
The correct answer is B. system stability. The major objective of system configuration management is to maintain system stability by controlling changes and maintaining accurate records of system components and their states. Configuration management prevents unauthorized or uncontrolled modifications that could destabilize the system, ensuring consistency and reliability across the IT environment. Now, why are the other options incorrect? Option A is incorrect. Maintenance is an outcome or benefit, not the primary objective of configuration management. Option C is incorrect. Operations are enabled by configuration management but not the primary objective. Option D is incorrect. Tracking is a component of configuration management but not its major objective. Therefore, B, system stability, is the correct answer.
Play from 12:27 Question 9. Which of the following is the act of performing tests and evaluations to test a system's security level to see if it complies with the design specifications and security requirements? Here are the options. Option A. Validation. Option B. Verification. Option C. Assessment. Option D. Accuracy. Pause the video now if you want time to think about the answer.
The correct answer is C. Assessment. Assessment is the formal process of performing tests and evaluations to determine a system's security level and compliance with design specifications and security requirements. This involves systematic examination and measurement against defined criteria, which is the definition of assessment in security contexts. Now, why are the other options incorrect? Option A is incorrect. Validation confirms the system meets user needs and requirements, not specifically about testing security compliance. Option B is incorrect. Verification checks that something was built correctly according to specifications, not the specific act of security testing and evaluation. Option D is incorrect. Accuracy refers to precision of measurements or data, not the process of security testing and evaluation. Therefore, C, Assessment, is the correct answer.
Play from 14:00 Question 10. Which layer of the TCP/IP protocol model would best correspond to the OSI/ISO model's network layer? Here are the options. Option A. Network access layer. Option B. Application layer. Option C. Host-to-host transport layer. Option D. Internet layer. Pause the video now if you want time to think about the answer.
The correct answer is D. Internet layer. The Internet layer of the TCP/IP model corresponds to the Network layer (Layer 3) of the OSI model. Both layers handle logical addressing (IP addresses in TCP/IP), routing, and path determination. The Internet layer contains protocols like IP, ICMP, and IGMP. Now, why are the other options incorrect? Option A is incorrect. The Network Access layer corresponds to the OSI Data Link and Physical layers, not the Network layer. Option B is incorrect. The Application layer corresponds to the OSI Application, Presentation, and Session layers, not the Network layer. Option C is incorrect. The Host-to-Host Transport layer corresponds to the OSI Transport layer, not the Network layer. Therefore, D, Internet layer, is the correct answer.
Play from 15:37 Question 11. Related to information security, integrity is the opposite of which of the following? Here are the options. Option A. abstraction. Option B. alteration. Option C. accreditation. Option D. application. Pause the video now if you want time to think about the answer.
The correct answer is B. alteration. Integrity in information security means ensuring data has not been altered or modified. Alteration is the direct opposite of integrity, while integrity protects against changes, alteration represents the act of making unauthorized changes to data. This is the fundamental opposing concept. Now, why are the other options incorrect? Option A is incorrect. Abstraction is a technical concept unrelated to data integrity. Option C is incorrect. Accreditation is a certification process, not opposite to integrity. Option D is incorrect. Application refers to software programs, not an opposite of integrity. Therefore, B, alteration, is the correct answer.
Play from 16:56 Question 12. Complete the blanks. When using PKI, I digitally sign a message using my ______ key. The recipient verifies my signature using my ______ key. Here are the options. Option A. Private / Public. Option B. Public / Private. Option C. Symmetric / Asymmetric. Option D. Private / Symmetric. Pause the video now if you want time to think about the answer.
The correct answer is A. Private / Public. In PKI, digital signatures use the sender's private key to sign a message (which encrypts the hash), and the recipient uses the sender's public key to verify the signature (which decrypts the hash). This proves both authenticity and non-repudiation. The private key is kept secret for signing, and the public key is distributed for verification. Now, why are the other options incorrect? Option B is incorrect. This is reversed; you cannot sign with a public key or verify with a private key in PKI. Option C is incorrect. Symmetric and asymmetric are categories, not the specific key types used in digital signatures. Option D is incorrect. Digital signatures do not use symmetric keys; they use asymmetric private/public key pairs. Therefore, A, Private / Public, is the correct answer.
Play from 18:29 Question 13. What can be defined as an instance of two different keys generating the same ciphertext from the same plaintext? Here are the options. Option A. Key collision. Option B. Key clustering. Option C. Hashing. Option D. Ciphertext collision. Pause the video now if you want time to think about the answer.
The correct answer is B. Key clustering. Key clustering is the phenomenon where two different keys produce the same ciphertext when encrypting the same plaintext. This is a theoretical weakness in some cipher designs where the encryption transformation is not perfectly injective across all key-plaintext pairs, meaning multiple keys can map the same plaintext to identical ciphertext. Now, why are the other options incorrect? Option A is incorrect. Key collision refers to two keys being identical or producing identical outputs through hashing, which is different from two different keys producing the same ciphertext. Option C is incorrect. Hashing is a one-way cryptographic function that produces digests; it is not related to two keys producing the same ciphertext. Option D is incorrect. Ciphertext collision refers to two different plaintexts producing the same ciphertext, not two different keys encrypting the same plaintext to the same ciphertext. Therefore, B, Key clustering, is the correct answer.
Play from 20:15 Question 14. For maximum security design, what type of fence is most effective and cost-effective method (Foot are being used as measurement unit below)? Here are the options. Option A. 3' to 4' high. Option B. 6' to 7' high. Option C. 8' high and above with strands of barbed wire. Option D. Double fencing. Pause the video now if you want time to think about the answer.
The correct answer is B. 6' to 7' high. A 6' to 7' high fence represents the optimal balance for maximum security design in terms of both effectiveness and cost-effectiveness. This height is difficult for an intruder to climb quickly without equipment, yet remains economical to install and maintain across large perimeters. While 8' fencing with barbed wire and double fencing provide greater security, they are significantly more expensive. The 3' to 4' height is insufficient as it can be easily overcome. Now, why are the other options incorrect? Option A is incorrect. 3' to 4' high fencing is too low and can be easily climbed or jumped over by intruders. Option C is incorrect. 8' high fencing with barbed wire provides excellent security but is cost-prohibitive for most facilities. Option D is incorrect. Double fencing provides superior security but is the most expensive option and overkill for most applications. Therefore, B, 6' to 7' high, is the correct answer.
Play from 22:04 Question 15. What is Kerberos? Here are the options. Option A. A three-headed dog from the egyptian mythology. Option B. A trusted third-party authentication protocol. Option C. A security model. Option D. A remote authentication dial in user server. Pause the video now if you want time to think about the answer.
The correct answer is B. A trusted third-party authentication protocol. Kerberos is a trusted third-party authentication protocol that provides secure authentication services in network environments. It was developed at MIT and is named after the mythological three-headed dog, but the protocol itself is specifically a third-party authentication mechanism that uses a Key Distribution Center (KDC) as a trusted intermediary. Now, why are the other options incorrect? Option A is incorrect. While Kerberos is named after the mythological creature, the question asks what Kerberos is in IT security context. Option C is incorrect. Kerberos is a protocol, not a security model. Option D is incorrect. RADIUS (Remote Authentication Dial-In User Service) is a different authentication protocol from Kerberos. Therefore, B, A trusted third-party authentication protocol, is the correct answer.
Play from 23:37 Question 16. How often should tests and disaster recovery drills be performed? Here are the options. Option A. At least once a quarter. Option B. At least once every 6 months. Option C. At least once a year. Option D. At least once every 2 years. Pause the video now if you want time to think about the answer.
The correct answer is A. At least once a quarter. Industry best practices and most security standards require disaster recovery drills and tests to be performed at least once per quarter (four times per year). This frequency ensures that recovery procedures remain current, staff remain trained, and potential issues are identified and addressed promptly. Annual testing is insufficient for maintaining operational readiness. Now, why are the other options incorrect? Option B is incorrect. Every six months is less frequent than the recommended quarterly minimum. Option C is incorrect. Annual testing is insufficient; quarterly testing is the industry standard minimum. Option D is incorrect. Testing every two years is far too infrequent to ensure readiness and compliance. Therefore, A, At least once a quarter, is the correct answer.
Play from 25:08 Question 17. Which of the following is more suitable for a hardware implementation? Here are the options. Option A. Stream ciphers. Option B. Block ciphers. Option C. Cipher block chaining. Option D. Electronic code book. Pause the video now if you want time to think about the answer.
The correct answer is A. Stream ciphers. Stream ciphers are more suitable for hardware implementation due to their simpler, more parallel-friendly nature and lower memory requirements. Stream ciphers process data bit- by-bit or byte-by-byte sequentially, making them efficient in hardware. Block ciphers, cipher block chaining, and electronic codebook are modes or algorithm types that typically require more complex hardware implementations or state management. Now, why are the other options incorrect? Option B is incorrect. Block ciphers require more complex hardware implementations with larger state management. Option C is incorrect. Cipher block chaining mode requires sequential processing due to data dependencies, making it less suitable for hardware. Option D is incorrect. Electronic codebook is a block cipher mode that is less efficient for hardware implementation than stream ciphers. Therefore, A, Stream ciphers, is the correct answer.
Play from 26:41 Question 18. Which of the following cannot be undertaken in conjunction or while computer incident handling is ongoing? Here are the options. Option A. System development activity. Option B. Help-desk function. Option C. System Imaging. Option D. Risk management process. Pause the video now if you want time to think about the answer.
The correct answer is A. System development activity. System development activity cannot be undertaken while computer incident handling is ongoing because development could alter systems, introduce changes, compromise evidence integrity, or interfere with incident investigation. Help-desk functions, system imaging, and risk management can all continue during incident handling as they don't compromise the investigation. Now, why are the other options incorrect? Option B is incorrect. Help-desk functions can continue during incident handling, though with awareness of the incident scope. Option C is incorrect. System imaging is actually a critical activity during incident handling for evidence preservation. Option D is incorrect. Risk management processes can and should continue during incident handling to inform response strategies. Therefore, A, System development activity, is the correct answer.
Play from 28:14 Question 19. The IP header contains a protocol field. If this field contains the value of 17, what type of data is contained within the ip datagram? Here are the options. Option A. TCP. Option B. ICMP. Option C. UDP. Option D. IGMP. Pause the video now if you want time to think about the answer.
The correct answer is C. UDP. The IP protocol field value of 17 designates UDP (User Datagram Protocol). This is a standardized IANA protocol number. TCP uses protocol number 6, ICMP uses protocol number 1, and IGMP uses protocol number 2. Protocol 17 is definitively UDP in the IP header. Now, why are the other options incorrect? Option A is incorrect. TCP uses protocol number 6 in the IP header, not 17. Option B is incorrect. ICMP uses protocol number 1 in the IP header, not 17. Option D is incorrect. IGMP uses protocol number 2 in the IP header, not 17. Therefore, C, UDP, is the correct answer.
Play from 29:41 Question 20. Which of the following specifically addresses cyber attacks against an organization's IT systems? Here are the options. Option A. Continuity of support plan. Option B. Business continuity plan. Option C. Incident response plan. Option D. Continuity of operations plan. Pause the video now if you want time to think about the answer.
The correct answer is C. Incident response plan. An incident response plan specifically addresses how an organization will respond to and manage security incidents, including cyber attacks against IT systems. It provides procedures for detection, containment, eradication, and recovery from security breaches and attacks. Now, why are the other options incorrect? Option A is incorrect. Continuity of support plan is not a standard contingency planning document type. Option B is incorrect. A business continuity plan addresses overall business function continuity, not specific cyber attack response procedures. Option D is incorrect. A continuity of operations plan addresses operational continuity broadly, not specifically cyber attack response mechanisms. Therefore, C, Incident response plan, is the correct answer.
Play from 31:12 Question 21. To control access by a subject (an active entity such as individual or process) to an object (a passive entity such as a file) involves setting up: Here are the options. Option A. Access Rules. Option B. Access Matrix. Option C. Identification controls. Option D. Access terminal. Pause the video now if you want time to think about the answer.
The correct answer is B. Access Matrix. An Access Matrix is the fundamental mechanism used to control access by subjects (active entities like users or processes) to objects (passive entities like files or resources). The access matrix specifies which subjects have what permissions on which objects, forming the basis for implementing access control decisions. Now, why are the other options incorrect? Option A is incorrect. Access Rules describe how access decisions are made, but do not establish the actual mapping of subjects to objects and permissions. Option C is incorrect. Identification controls verify who a user is, but do not control what resources they can access. Option D is incorrect. An access terminal is a physical device for user interaction, not a mechanism for controlling subject-to-object access. Therefore, B, Access Matrix, is the correct answer.
Play from 32:57 Question 22. Which of the following reviews system and event logs to detect attacks on the host and determine if the attack was successful? Here are the options. Option A. host-based IDS. Option B. firewall-based IDS. Option C. bastion-based IDS. Option D. server-based IDS. Pause the video now if you want time to think about the answer.
The correct answer is A. host-based IDS. Host-based IDS (HIDS) monitors system and event logs on individual hosts, analyzing logged activities and system calls to detect attack attempts and determine success by examining actual system state changes and log entries that reflect what occurred on the host. Now, why are the other options incorrect? Option B is incorrect. Firewall-based IDS operates at network perimeter, not on individual hosts, and does not review host system logs. Option C is incorrect. Bastion-based IDS is not a standard IDS terminology; bastion hosts are hardened hosts but do not define the detection method. Option D is incorrect. Server-based IDS is not standard terminology; detection of host attacks requires host-based IDS specifically. Therefore, A, host-based IDS, is the correct answer.
Play from 34:35 Question 23. Buffer overflow and boundary condition errors are subsets of which of the following? Here are the options. Option A. Race condition errors. Option B. Access validation errors. Option C. Exceptional condition handling errors. Option D. Input validation errors. Pause the video now if you want time to think about the answer.
The correct answer is D. Input validation errors. Buffer overflow and boundary condition errors are both subsets of input validation errors. These occur when an application fails to properly validate and sanitize input data before processing it, allowing attackers to exceed buffer boundaries or trigger exceptional conditions. Now, why are the other options incorrect? Option A is incorrect. Race condition errors involve timing issues with concurrent access, not input validation failures. Option B is incorrect. Access validation errors relate to authorization checks, not buffer or boundary issues from malformed input. Option C is incorrect. Exceptional condition handling is broader than input validation; input errors are a specific category within it. Therefore, D, Input validation errors, is the correct answer.
Play from 36:06 Question 24. Sensitivity labels are an example of what application control type? Here are the options. Option A. Preventive security controls. Option B. Detective security controls. Option C. Compensating administrative controls. Option D. Preventive accuracy controls. Pause the video now if you want time to think about the answer.
The correct answer is A. Preventive security controls. Sensitivity labels are a preventive security control because they are applied to information before it can be mishandled, preventing unauthorized disclosure or misuse. By classifying data with sensitivity labels, organizations establish a preventive framework that guides how information should be protected, accessed, and handled. This labeling mechanism works to prevent security violations from occurring in the first place rather than detecting or correcting them after they happen. Now, why are the other options incorrect? Option B is incorrect. Sensitivity labels are not detective controls; they don't identify violations after the fact. Option C is incorrect. They are not compensating controls; they are standard preventive controls. Option D is incorrect. Sensitivity labels are security controls, not specifically accuracy controls. Therefore, A, Preventive security controls, is the correct answer.
Play from 37:43 Question 25. What is called the verification that the user's claimed identity is valid and is usually implemented through a user password at log-on time? Here are the options. Option A. Authentication. Option B. Identification. Option C. Integrity. Option D. Confidentiality. Pause the video now if you want time to think about the answer.
The correct answer is A. Authentication. Authentication is the verification that a user's claimed identity is valid, confirming that the person is who they profess to be. This typically occurs through mechanisms like passwords, biometrics, or multi-factor authentication at log-on time. Authentication proves the claimed identity is genuine. Now, why are the other options incorrect? Option B is incorrect. Identification is merely claiming an identity; authentication is verifying that claim. Option C is incorrect. Integrity is a security principle ensuring data has not been altered, unrelated to verifying identity. Option D is incorrect. Confidentiality is a security principle ensuring information remains private, unrelated to identity verification. Therefore, A, Authentication, is the correct answer.
Play from 39:20 Question 26. Address Resolution Protocol (ARP) interrogates the network by sending out a? Here are the options. Option A. broadcast. Option B. multicast. Option C. unicast. Option D. semicast. Pause the video now if you want time to think about the answer.
The correct answer is A. broadcast. Address Resolution Protocol (ARP) uses broadcast frames to interrogate a network. When a device needs to find the MAC address corresponding to an IP address, it sends an ARP request as a broadcast to all devices on the local network segment. This allows the target device to respond with its MAC address. Now, why are the other options incorrect? Option B is incorrect. Multicast is a one-to-many transmission to a specific group, not used by ARP which needs to reach all devices. Option C is incorrect. Unicast is a one-to-one transmission, but ARP needs to query multiple devices to find a match. Option D is incorrect. Semicast is not a valid network transmission type. Therefore, A, broadcast, is the correct answer.
Play from 40:47 Question 27. An Intrusion Detection System (IDS) is what type of control? Here are the options. Option A. A preventive control. Option B. A detective control. Option C. A recovery control. Option D. A directive control. Pause the video now if you want time to think about the answer.
The correct answer is B. A detective control. An Intrusion Detection System is fundamentally a detective control because it monitors, identifies, and alerts on security incidents and suspicious activity after they occur. IDS does not prevent intrusions from happening; it detects them in progress or after the fact. This distinguishes it from preventive controls like firewalls that block attacks before they penetrate, recovery controls that restore systems after compromise, or directive controls that prescribe behavior. Now, why are the other options incorrect? Option A is incorrect. IDS is not preventive; it does not stop intrusions from occurring, only detects them. Option C is incorrect. IDS is not a recovery control; it doesn't restore systems or data after an incident. Option D is incorrect. IDS is not a directive control; it doesn't establish rules or guide behavior through policies. Therefore, B, A detective control, is the correct answer.
Play from 42:29 Question 28. Which of the following cryptographic attacks describes when the attacker has a copy of the plaintext and the corresponding ciphertext? Here are the options. Option A. known plaintext. Option B. brute force. Option C. ciphertext only. Option D. chosen plaintext. Pause the video now if you want time to think about the answer.
The correct answer is A. known plaintext. A known plaintext attack is a cryptanalytic scenario where the attacker has access to both the plaintext and its corresponding ciphertext. With this information, the attacker can analyze the encryption algorithm's behavior and work to discover the encryption key or algorithm weaknesses. This is distinct from other attack types that have different information availability. Now, why are the other options incorrect? Option B is incorrect. Brute force attacks involve trying all possible keys, not having plaintext-ciphertext pairs. Option C is incorrect. Ciphertext-only attacks occur when the attacker has only the ciphertext, not the plaintext. Option D is incorrect. Chosen plaintext attacks occur when the attacker can select which plaintexts to encrypt, a more powerful position than merely having known plaintext-ciphertext pairs. Therefore, A, known plaintext, is the correct answer.
Play from 44:05 Question 29. Which of the following is the most complete disaster recovery plan test type, to be performed after successfully completing the Parallel test? Here are the options. Option A. Full Interruption test. Option B. Checklist test. Option C. Simulation test. Option D. Structured walk-through test. Pause the video now if you want time to think about the answer.
The correct answer is A. Full Interruption test. The Full Interruption test is the most comprehensive and rigorous disaster recovery plan test type. It simulates an actual disaster by shutting down primary systems and fully activating the alternate site with real data processing. This test should only be performed after successfully completing less disruptive tests like Parallel tests, as it carries the highest risk and requires the most preparation and confidence in the plan. Now, why are the other options incorrect? Option B is incorrect. Checklist tests are the least rigorous, involving only review of procedures without actual activation. Option C is incorrect. Simulation tests are less comprehensive than Full Interruption tests, as they don't involve actual system shutdown. Option D is incorrect. Structured walk-through tests involve discussing procedures in detail but not activating systems. Therefore, A, Full Interruption test, is the correct answer.
Play from 45:47 Question 30. Organizations should not view disaster recovery as which of the following? Here are the options. Option A. Committed expense. Option B. Discretionary expense. Option C. Enforcement of legal statutes. Option D. Compliance with regulations. Pause the video now if you want time to think about the answer.
The correct answer is B. Discretionary expense. Organizations should view disaster recovery as a committed, necessary expense, not a discretionary one. DR is essential for business continuity, regulatory compliance, and risk management. It often addresses legal requirements and regulatory mandates that cannot be waived. Treating DR as discretionary spending is incorrect because it can be cut during budget constraints, leaving the organization vulnerable. Proper DR requires sustained, committed investment regardless of other budget pressures. Now, why are the other options incorrect? Option A is incorrect. DR should be treated as a committed expense, not something to be deferred or eliminated. Option C is incorrect. Many industries have legal statutes requiring disaster recovery capabilities, making this a valid view. Option D is incorrect. Compliance with regulations is a legitimate and important driver for DR investment. Therefore, B, Discretionary expense, is the correct answer.
Play from 47:27 Question 31. Which of the following would be an example of the best password? Here are the options. Option A. golf001. Option B. Elizabeth. Option C. T1me4g0lF. Option D. password. Pause the video now if you want time to think about the answer.
The correct answer is C. T1me4g0lF. T1me4g0lF is the strongest password because it combines multiple character types: uppercase letters (T, F), lowercase letters (i, m, e, g, o, l), numbers (1, 4, 0), creating a complex password with good length. The other options are weak: golf001 is simple and predictable, Elizabeth is a common name with no numbers or special characters, and password is one of the most commonly used and easily guessed passwords. Now, why are the other options incorrect? Option A is incorrect. golf001 is a simple, dictionary-based password with predictable numbering. Option B is incorrect. Elizabeth is a common proper name lacking numbers and special characters. Option D is incorrect. password is one of the weakest possible passwords and among the most commonly used. Therefore, C, T1me4g0lF, is the correct answer.
Play from 49:13 Question 32. Which of the following encryption algorithms does not deal with discrete logarithms? Here are the options. Option A. El Gamal. Option B. Diffie-Hellman. Option C. RSA. Option D. Elliptic Curve. Pause the video now if you want time to think about the answer.
The correct answer is C. RSA. RSA is based on the computational difficulty of factoring large numbers into their prime factors, not on discrete logarithms. El Gamal, Diffie-Hellman, and Elliptic Curve cryptography all rely on the discrete logarithm problem (or variants thereof) as their underlying mathematical foundation for security. Now, why are the other options incorrect? Option A is incorrect. El Gamal encryption is based on the discrete logarithm problem. Option B is incorrect. Diffie-Hellman key exchange is fundamentally built on discrete logarithms. Option D is incorrect. Elliptic Curve cryptography uses the elliptic curve discrete logarithm problem. Therefore, C, RSA, is the correct answer.
Play from 50:28 Question 33. Which of the following is not a two-factor authentication mechanism? Here are the options. Option A. Something you have and something you know. Option B. Something you do and a password. Option C. A smartcard and something you are. Option D. Something you know and a password. Pause the video now if you want time to think about the answer.
The correct answer is D. Something you know and a password. Two-factor authentication requires two distinct factors from different categories: something you know (knowledge), something you have (possession), or something you are (inherence). Option D uses two items from the same category, both passwords are knowledge factors, so it does not constitute true two-factor authentication. The other options each combine two different authentication factor categories. Now, why are the other options incorrect? Option A is incorrect. Something you have and something you know combines possession and knowledge factors, creating true two-factor authentication. Option B is incorrect. Something you do (biometric behavior) and a password combines inherence and knowledge factors, creating true two-factor authentication. Option C is incorrect. A smartcard (possession) and something you are (inherence/biometric) combines two different factor categories, creating true two-factor authentication. Therefore, D, Something you know and a password, is the correct answer.
Play from 52:18 Question 34. Which of the following is commonly used for retrofitting multilevel security to a database management system? Here are the options. Option A. trusted front-end. Option B. trusted back-end. Option C. controller. Option D. kernel. Pause the video now if you want time to think about the answer.
The correct answer is A. trusted front-end. A trusted front-end is the standard retrofit approach for adding multilevel security to existing database management systems. It acts as an intermediary between users and the DBMS, enforcing security policies and filtering data based on clearance levels without requiring modifications to the underlying database engine itself. Now, why are the other options incorrect? Option B is incorrect. Trusted back-end would modify the database engine itself, which is more invasive and less commonly used for retrofitting. Option C is incorrect. A controller is a generic term and not the specific architectural pattern for retrofitting multilevel security to DBMSs. Option D is incorrect. A kernel is the core OS component; it's not a retrofit mechanism for database-level security controls. Therefore, A, trusted front-end, is the correct answer.
Play from 53:51 Question 35. In the context of access control, locks, gates, guards are examples of which of the following? Here are the options. Option A. Administrative controls. Option B. Technical controls. Option C. Physical controls. Option D. Logical controls. Pause the video now if you want time to think about the answer.
The correct answer is C. Physical controls. Locks, gates, and guards are examples of physical controls. Physical controls are tangible, real-world security measures that physically restrict or prevent access to assets, facilities, or areas. These three examples all involve concrete physical mechanisms or personnel that provide direct physical security. Now, why are the other options incorrect? Option A is incorrect. Administrative controls include policies, procedures, and training rather than physical barriers. Option B is incorrect. Technical controls use technology such as firewalls and encryption, not physical barriers. Option D is incorrect. Logical controls are technology-based access restrictions such as passwords and encryption, not physical barriers. Therefore, C, Physical controls, is the correct answer.
Play from 55:26 Question 36. In the CIA triad, what does the letter A stand for? Here are the options. Option A. Auditability. Option B. Accountability. Option C. Availability. Option D. Authentication. Pause the video now if you want time to think about the answer.
The correct answer is C. Availability. In the CIA triad, the letter 'A' stands for Availability, representing the assurance that information and systems are accessible and usable upon demand by authorized users. The three pillars are Confidentiality (preventing unauthorized access), Integrity (ensuring accuracy and completeness), and Availability (ensuring timely access). Now, why are the other options incorrect? Option A is incorrect. Auditability is an important security principle but is not part of the foundational CIA triad. Option B is incorrect. Accountability relates to traceability and responsibility but is not represented by 'A' in the CIA triad. Option D is incorrect. Authentication is a security mechanism but does not represent the 'A' in the CIA triad. Therefore, C, Availability, is the correct answer.
Play from 56:57 Question 37. Which of the following is a symmetric encryption algorithm? Here are the options. Option A. RSA. Option B. Elliptic Curve. Option C. RC5. Option D. El Gamal. Pause the video now if you want time to think about the answer.
The correct answer is C. RC5. RC5 is a symmetric block cipher algorithm that uses the same key for both encryption and decryption. In contrast, RSA (option A) and El Gamal (option D) are asymmetric algorithms that use public and private key pairs, and Elliptic Curve (option B) algorithms are also asymmetric. Symmetric algorithms are characterized by shared secret keys and are faster than their asymmetric counterparts. Now, why are the other options incorrect? Option A is incorrect. RSA is an asymmetric encryption algorithm using public and private keys. Option B is incorrect. Elliptic Curve cryptography is an asymmetric algorithm that does not use a single shared key. Option D is incorrect. El Gamal is an asymmetric encryption algorithm relying on public key infrastructure. Therefore, C, RC5, is the correct answer.
Play from 58:28 Question 38. What can be defined as secret communications where the very existence of the message is hidden? Here are the options. Option A. Clustering. Option B. Steganography. Option C. Cryptology. Option D. Vernam cipher. Pause the video now if you want time to think about the answer.
The correct answer is B. Steganography. Steganography is the practice of hiding the existence of a message itself, not just its content. While cryptography makes messages unreadable, steganography conceals that a message exists at all by embedding it within innocuous carriers like images or audio files. This distinguishes it from cryptology (which focuses on encryption/decryption), clustering (a data analysis technique), and the Vernam cipher (a specific encryption method). Now, why are the other options incorrect? Option A is incorrect. Clustering is a data analysis and machine learning technique unrelated to message concealment. Option C is incorrect. Cryptology is the study of encryption and decryption; it makes messages unreadable but doesn't hide their existence. Option D is incorrect. The Vernam cipher is an encryption algorithm that obscures message content but doesn't hide that a message exists. Therefore, B, Steganography, is the correct answer.
Play from 1:00:11 Question 39. In the Open Systems Interconnect (OSI) Reference Model, at what level are TCP and UDP provided? Here are the options. Option A. Transport. Option B. Network. Option C. Presentation. Option D. Application. Pause the video now if you want time to think about the answer.
The correct answer is A. Transport. TCP (Transmission Control Protocol) and UDP (User Datagram Protocol) are both transport layer protocols operating at Layer 4 of the OSI model. They provide end-to-end communication services and are responsible for managing data delivery between applications on different systems. Now, why are the other options incorrect? Option B is incorrect. Network layer (Layer 3) handles routing and IP addressing, not TCP/UDP protocols. Option C is incorrect. Presentation layer (Layer 6) handles data translation and encryption, not transport protocols. Option D is incorrect. Application layer (Layer 7) uses TCP/UDP but does not provide them; TCP/UDP support application layer protocols. Therefore, A, Transport, is the correct answer.
Play from 1:01:45 Question 40. Related to information security, confidentiality is the opposite of which of the following? Here are the options. Option A. closure. Option B. disclosure. Option C. disposal. Option D. disaster. Pause the video now if you want time to think about the answer.
The correct answer is B. disclosure. Disclosure is the opposite of confidentiality. Confidentiality aims to prevent unauthorized disclosure of information, while disclosure means revealing or making information known. If confidentiality is breached, information is disclosed to unauthorized parties. These concepts are directly opposite in meaning. Now, why are the other options incorrect? Option A is incorrect. Closure has no meaningful relationship to confidentiality in information security contexts. Option C is incorrect. Disposal refers to proper destruction or handling of data at end-of-life, not the opposite of confidentiality. Option D is incorrect. Disaster is an unrelated concept referring to system failures or emergencies, not opposing confidentiality. Therefore, B, disclosure, is the correct answer.
Play from 1:03:13 Question 41. Each data packet is assigned the IP address of the sender and the IP address of the: Here are the options. Option A. recipient. Option B. host. Option C. node. Option D. network. Pause the video now if you want time to think about the answer.
The correct answer is A. recipient. Each data packet contains the IP address of the sender (source) and the IP address of the recipient (destination). These are fundamental fields in the IP header that enable routing and delivery of packets across networks to their intended endpoints. Now, why are the other options incorrect? Option B is incorrect. While the recipient is a host, the term 'host' is less precise than 'recipient' for what IP packets are addressed to. Option C is incorrect. Packets contain destination IP addresses, not node identifiers; nodes are identified by their IP addresses. Option D is incorrect. Packets contain the destination host's IP address, not a network address alone, though network addresses are derived from IP addresses. Therefore, A, recipient, is the correct answer.
Play from 1:04:39 Question 42. A copy of evidence or oral description of its contents; which is not as reliable as best evidence is what type of evidence? Here are the options. Option A. Direct evidence. Option B. Circumstantial evidence. Option C. Hearsay evidence. Option D. Secondary evidence. Pause the video now if you want time to think about the answer.
The correct answer is D. Secondary evidence. Secondary Evidence is a copy of evidence or an oral description of its contents that is not as reliable as the original best evidence. Examples include photocopies, photographs, or testimony about what a document said. Secondary evidence is admissible when the original cannot be produced, but it is inherently less reliable than the primary source. Now, why are the other options incorrect? Option A is incorrect. Direct evidence proves a fact without inference and includes testimony based on firsthand observation, not copies or descriptions. Option B is incorrect. Circumstantial evidence proves a fact indirectly through inference, but the question specifically addresses copies or descriptions. Option C is incorrect. Hearsay evidence is an out-of-court statement offered to prove the truth of the matter; while unreliable, it is categorized differently than secondary evidence. Therefore, D, Secondary evidence, is the correct answer.
Play from 1:06:21 Question 43. A contingency plan should address: Here are the options. Option A. Potential risks. Option B. Residual risks. Option C. Identified risks. Option D. All answers are correct. Pause the video now if you want time to think about the answer.
The correct answer is C. Identified risks. A contingency plan specifically addresses identified risks, those that have been formally recognized through risk assessment and analysis. The plan is developed in response to risks that have been discovered and documented, not theoretical or residual risks, as these require concrete planning mechanisms and resource allocation. Now, why are the other options incorrect? Option A is incorrect. Potential risks are hypothetical and not yet evaluated; contingency plans focus on those formally identified. Option B is incorrect. Residual risks remain after controls are implemented; contingency planning addresses the identified risks that triggered control implementation. Option D is incorrect. Not all answers are correct because contingency planning specifically targets identified risks through documented risk assessment processes. Therefore, C, Identified risks, is the correct answer.
Play from 1:07:56 Question 44. Which of the following embodies all the detailed actions that personnel are required to follow? Here are the options. Option A. Standards. Option B. Guidelines. Option C. Procedures. Option D. Baselines. Pause the video now if you want time to think about the answer.
The correct answer is C. Procedures. Procedures are the most detailed and prescriptive security policy documents, containing step-by-step instructions that personnel must follow. They describe the exact actions required in specific situations. Standards are mandatory requirements but less detailed; guidelines are recommendations; baselines are minimum security configurations. Procedures are the actionable, detailed level of policy implementation. Now, why are the other options incorrect? Option A is incorrect. Standards are mandatory but provide requirements rather than detailed action steps. Option B is incorrect. Guidelines are advisory recommendations, not mandatory detailed actions. Option D is incorrect. Baselines establish minimum security levels, not detailed procedural steps. Therefore, C, Procedures, is the correct answer.
Play from 1:09:25 Question 45. Encapsulating Security Payload (ESP) provides some of the services of Authentication Headers (AH), but it is primarily designed to provide: Here are the options. Option A. Confidentiality. Option B. Cryptography. Option C. Digital signatures. Option D. Access Control. Pause the video now if you want time to think about the answer.
The correct answer is A. Confidentiality. Encapsulating Security Payload (ESP) is primarily designed to provide confidentiality through encryption of packet contents. While ESP can also provide authentication and integrity services (overlapping with AH), its main distinguishing feature and primary purpose is to encrypt the payload to protect data confidentiality. This is the key difference between ESP and AH. Now, why are the other options incorrect? Option B is incorrect. Cryptography is the mechanism used, but confidentiality is the primary service provided. Option C is incorrect. Digital signatures are provided by AH, not primarily by ESP. Option D is incorrect. Access control is a separate security service; ESP focuses on confidentiality. Therefore, A, Confidentiality, is the correct answer.
Play from 1:11:04 Question 46. What is the primary difference between FTP and TFTP? Here are the options. Option A. Speed of negotiation. Option B. Authentication. Option C. Ability to automate. Option D. TFTP is used to transfer configuration files to and from network equipment. Pause the video now if you want time to think about the answer.
The correct answer is B. Authentication. The primary difference between FTP and TFTP is that FTP provides authentication mechanisms (username/password) while TFTP does not. FTP requires user authentication before file transfer, whereas TFTP is a simple, unauthenticated protocol. While TFTP is faster and used for configuration files, and FTP can be automated, authentication is the most fundamental and primary distinguishing feature between these two protocols. Now, why are the other options incorrect? Option A is incorrect. While TFTP has simpler negotiation, this is a consequence of its design rather than the primary difference. Option C is incorrect. FTP can be automated with scripts, and this is not the primary distinguishing characteristic. Option D is incorrect. While TFTP is indeed used for network equipment configuration, this describes a use case rather than the fundamental protocol difference. Therefore, B, Authentication, is the correct answer.
Play from 1:12:49 Question 47. Which of the following is the primary security feature of a proxy server? Here are the options. Option A. Virus Detection. Option B. URL blocking. Option C. Route blocking. Option D. Content filtering. Pause the video now if you want time to think about the answer.
The correct answer is D. Content filtering. The primary security feature of a proxy server is content filtering, which examines and controls the content of traffic passing through it, blocking malicious or policy-violating content. While proxy servers may support URL blocking and some may integrate virus detection, content filtering is their core security function, it allows organizations to inspect and filter HTTP/HTTPS traffic, block access to inappropriate sites, and protect against content-based threats. Now, why are the other options incorrect? Option A is incorrect. Virus detection is typically a separate security function, not the primary feature of a proxy server. Option B is incorrect. URL blocking is a subset of content filtering but not the primary or broadest security feature. Option C is incorrect. Route blocking is not a proxy server function; it applies to network routing, not proxy operations. Therefore, D, Content filtering, is the correct answer.
Play from 1:14:32 Question 48. The control measures that are intended to reveal the violations of security policy using software and hardware are associated with: Here are the options. Option A. Preventive/physical. Option B. Detective/technical. Option C. Detective/physical. Option D. Detective/administrative. Pause the video now if you want time to think about the answer.
The correct answer is B. Detective/technical. Detective controls using software and hardware technologies such as intrusion detection systems, logging mechanisms, and monitoring tools are designed to identify and reveal security policy violations after they occur. This represents the detective/technical pairing that uses technology to discover breaches. Now, why are the other options incorrect? Option A is incorrect. Preventive/physical controls prevent violations through barriers and locks, not detection. Option C is incorrect. Detective/physical controls identify violations through physical means like guard patrols, not software and hardware systems. Option D is incorrect. Detective/administrative controls reveal violations through procedures and audits, not through software and hardware technology. Therefore, B, Detective/technical, is the correct answer.
Play from 1:16:09 Question 49. Which of the following items is NOT a benefit of cold sites? Here are the options. Option A. No resource contention with other organisation. Option B. Quick Recovery. Option C. A secondary location is available to reconstruct the environment. Option D. Low Cost. Pause the video now if you want time to think about the answer.
The correct answer is B. Quick Recovery. Cold sites are unequipped backup facilities with no preinstalled equipment, systems, or data. They require significant setup time after activation, making quick recovery impossible. Options A, C, and D are actual benefits: no contention, secondary location availability, and low cost due to minimal infrastructure. Now, why are the other options incorrect? Option A is incorrect. Cold sites have no other organizations' resources, eliminating contention. Option C is incorrect. Cold sites provide a physical location to rebuild the environment. Option D is incorrect. Cold sites are the lowest-cost recovery option due to minimal preparation and equipment. Therefore, B, Quick Recovery, is the correct answer.
Play from 1:17:38 Question 50. Which of the following is considered the weakest link in a security system? Here are the options. Option A. People. Option B. Software. Option C. Communications. Option D. Hardware. Pause the video now if you want time to think about the answer.
The correct answer is A. People. People are widely recognized as the weakest link in security systems because human behavior, error, and social engineering are difficult to control technically. Even robust software, hardware, and communication systems can be compromised through user negligence, password sharing, social engineering, or failure to follow security procedures. Technical controls can be perfected, but human factors remain unpredictable. Now, why are the other options incorrect? Option B is incorrect. Software can be patched, updated, and hardened against vulnerabilities Option C is incorrect. Communications security can be strengthened through encryption and protocols Option D is incorrect. Hardware security can be physically controlled and monitored Therefore, A, People, is the correct answer.
Play from 1:19:04 Question 51. In a hierarchical PKI the highest CA is regularly called Root CA, it is also referred to by which one of the following term? Here are the options. Option A. Subordinate CA. Option B. Top Level CA. Option C. Big CA. Option D. Master CA B. Pause the video now if you want time to think about the answer.
The correct answer is B. Top Level CA. In a hierarchical PKI, the highest certification authority is referred to as the 'Top Level CA' (also called Root CA). This is the most trusted anchor at the apex of the certificate chain. The term 'Top Level' correctly describes its position at the top of the hierarchy. Now, why are the other options incorrect? Option A is incorrect. A Subordinate CA is lower in the hierarchy, not the highest CA. Option C is incorrect. 'Big CA' is not a standard PKI terminology. Option D is incorrect. 'Master CA' is not the standard term; 'Root CA' and 'Top Level CA' are the accepted terms. Therefore, B, Top Level CA, is the correct answer.
Play from 1:20:33 Question 52. Which of the following computer recovery sites is the least expensive and the most difficult to test? Here are the options. Option A. non-mobile hot site. Option B. mobile hot site. Option C. warm site. Option D. cold site. Pause the video now if you want time to think about the answer.
The correct answer is D. cold site. A cold site is the least expensive recovery option because it requires minimal infrastructure investment, typically just a physical space with basic utilities. However, it is the most difficult to test because it lacks pre-installed equipment, data, and configurations, making realistic testing exercises time-consuming and impractical. In contrast, hot and warm sites have equipment ready and are easier to test, while hot sites are expensive, and mobile sites offer moderate cost with reasonable testing capability. Now, why are the other options incorrect? Option A is incorrect. Non-mobile hot sites are expensive to maintain and relatively easy to test regularly. Option B is incorrect. Mobile hot sites are moderately expensive and easier to test than cold sites due to pre-positioned equipment. Option C is incorrect. Warm sites have intermediate cost and reasonable testing feasibility compared to cold sites. Therefore, D, cold site, is the correct answer.
Play from 1:22:08 Question 53. What can be defined as a table of subjects and objects indicating what actions individual subjects can take upon individual objects? Here are the options. Option A. A capacity table. Option B. An access control list. Option C. An access control matrix. Option D. A capability table. Pause the video now if you want time to think about the answer.
The correct answer is C. An access control matrix. An Access Control Matrix is a table with subjects as rows and objects as columns (or vice versa), showing what actions each subject can perform on each object. It provides a complete representation of all access relationships in a system. Now, why are the other options incorrect? Option A is incorrect. A capacity table is not a standard access control term. Option B is incorrect. An ACL is organized by object only, not a full matrix of subjects and objects. Option D is incorrect. A capability table shows subjects to objects but is not typically called a matrix. Therefore, C, An access control matrix, is the correct answer.
Play from 1:23:32 Question 54. Domain Name Service is a distributed database system that is used to map: Here are the options. Option A. Domain Name to IP addresses. Option B. MAC addresses to domain names. Option C. MAC Address to IP addresses. Option D. IP addresses to MAC Addresses. Pause the video now if you want time to think about the answer.
The correct answer is A. Domain Name to IP addresses. Domain Name Service (DNS) is a distributed database system whose primary function is to map domain names (like www.example.com) to their corresponding IP addresses. This allows users to access resources using human-readable domain names rather than numerical IP addresses. Now, why are the other options incorrect? Option B is incorrect. DNS does not map MAC addresses to domain names; that function is performed by reverse DNS or other protocols. Option C is incorrect. DNS does not map MAC addresses to IP addresses; that function is performed by ARP (Address Resolution Protocol). Option D is incorrect. DNS does not map IP addresses to MAC addresses; ARP performs the inverse function of mapping IP addresses to MAC addresses on local networks. Therefore, A, Domain Name to IP addresses, is the correct answer.
Play from 1:25:16 Question 55. In a stateful inspection firewall, data packets are captured by an inspection engine that is operating at the: Here are the options. Option A. Network or Transport Layer. Option B. Application Layer. Option C. Inspection Layer. Option D. Data Link Layer. Pause the video now if you want time to think about the answer.
The correct answer is A. Network or Transport Layer. In a stateful inspection firewall, the inspection engine operates at the Network or Transport Layer (Layers 3-4 of the OSI model). Stateful inspection examines packet headers and connection states at these layers, tracking the state of network connections and making filtering decisions based on the context of the connection rather than just individual packets. Now, why are the other options incorrect? Option B is incorrect. Application layer inspection is characteristic of proxy firewalls, not the primary operating level of stateful inspection firewalls. Option C is incorrect. Inspection layer is not an OSI layer; this is not a valid OSI reference. Option D is incorrect. The Data Link Layer (Layer 2) is too low for stateful inspection; stateful inspection requires knowledge of network and transport layer information. Therefore, A, Network or Transport Layer, is the correct answer.
Play from 1:26:56 Question 56. Which of the following is the FIRST step in protecting data's confidentiality? Here are the options. Option A. Install a firewall. Option B. Implement encryption. Option C. Identify which information is sensitive. Option D. Review all user access rights. Pause the video now if you want time to think about the answer.
The correct answer is C. Identify which information is sensitive. Before implementing any technical controls, you must first identify which information is sensitive and requires protection. This discovery and classification phase is foundational, you cannot effectively apply encryption, firewalls, or access controls without knowing what data needs protection and why. Starting with technical measures without understanding your sensitive data is inefficient and may leave critical information unprotected. Now, why are the other options incorrect? Option A is incorrect. Installing a firewall is a network-level measure that assumes you already know what to protect. Option B is incorrect. Implementing encryption without identifying sensitive data wastes resources on non- critical information. Option D is incorrect. Reviewing access rights is appropriate only after identifying which data requires confidentiality protection. Therefore, C, Identify which information is sensitive, is the correct answer.
Play from 1:28:38 Question 57. Which xDSL flavour can deliver up to 52 Mbps downstream over a single copper twisted pair? Here are the options. Option A. VDSL. Option B. SDSL. Option C. HDSL. Option D. ADSL. Pause the video now if you want time to think about the answer.
The correct answer is A. VDSL. VDSL (Very High Speed Digital Subscriber Line) can deliver up to 52 Mbps downstream over a single copper twisted pair under favorable conditions. This represents a significant improvement over ADSL technology. SDSL is symmetric and maxes out lower, HDSL is older technology with lower speeds, and ADSL typically delivers 8-24 Mbps downstream. Now, why are the other options incorrect? Option B is incorrect. SDSL provides symmetric speeds of approximately 2.3 Mbps and is not designed for the high downstream speeds mentioned. Option C is incorrect. HDSL is older technology from the 1990s with maximum speeds around 2 Mbps, well below 52 Mbps. Option D is incorrect. ADSL typically delivers 8-24 Mbps downstream, which is below the 52 Mbps specification stated. Therefore, A, VDSL, is the correct answer.
Play from 1:30:22 Question 58. The IP header contains a protocol field. If this field contains the value of 6, what type of data is contained within the ip datagram? Here are the options. Option A. TCP. Option B. ICMP. Option C. UDP. Option D. IGMP. Pause the video now if you want time to think about the answer.
The correct answer is A. TCP. In the IP header's protocol field, the value 6 corresponds to TCP (Transmission Control Protocol). This standardized protocol number identifies the type of transport layer protocol contained in the IP datagram payload. ICMP is 1, UDP is 17, and IGMP is 2. Now, why are the other options incorrect? Option B is incorrect. ICMP is protocol number 1, not 6. Option C is incorrect. UDP is protocol number 17, not 6. Option D is incorrect. IGMP is protocol number 2, not 6. Therefore, A, TCP, is the correct answer.
Play from 1:31:41 Question 59. What is the main characteristic of a multi-homed host? Here are the options. Option A. It is placed between two routers or firewalls. Option B. It allows IP routing. Option C. It has multiple network interfaces, each connected to separate networks. Option D. It operates at multiple layers. Pause the video now if you want time to think about the answer.
The correct answer is C. It has multiple network interfaces, each connected to separate networks. A multi-homed host is defined by having multiple network interfaces (NICs), each connected to separate networks, allowing it to communicate on multiple network segments simultaneously. This is the core characteristic that distinguishes multi-homed hosts from standard hosts. Now, why are the other options incorrect? Option A is incorrect. Being between routers or firewalls describes a bastion host or gateway, not a multi-homed host specifically. Option B is incorrect. While multi-homed hosts can enable IP routing, allowing routing is not their defining characteristic. Option D is incorrect. Operating at multiple layers is not the main characteristic; the defining feature is the multiple network interfaces. Therefore, C, It has multiple network interfaces, each connected to separate networks, is the correct answer.
Play from 1:33:19 Question 60. Which of the following backup methods is most appropriate for off-site archiving? Here are the options. Option A. Incremental backup method. Option B. Off-site backup method. Option C. Full backup method. Option D. Differential backup method. Pause the video now if you want time to think about the answer.
The correct answer is C. Full backup method. Full backup method is most appropriate for off-site archiving because it creates a complete, standalone copy of all data that does not depend on other backups to restore. This independence is critical for archival purposes where incremental or differential backups would require maintaining a chain of previous backups, making archival management complex and error-prone. Now, why are the other options incorrect? Option A is incorrect. Incremental backups require a full backup plus all subsequent incrementals to restore, making them unsuitable as standalone archives. Option B is incorrect. Off-site backup method is not a recognized backup classification or method. Option D is incorrect. Differential backups still depend on a reference full backup for complete restoration, lacking the independence needed for archival. Therefore, C, Full backup method, is the correct answer.
Play from 1:34:56 Question 61. Which of the following elements is NOT included in a Public Key Infrastructure (PKI)? Here are the options. Option A. Timestamping. Option B. Repository. Option C. Certificate revocation. Option D. Internet Key Exchange (IKE). Pause the video now if you want time to think about the answer.
The correct answer is D. Internet Key Exchange (IKE). Internet Key Exchange (IKE) is a protocol used for establishing security associations in IPSec, not a component of Public Key Infrastructure. PKI elements include timestamping services (for non-repudiation), repositories (for storing certificates), and certificate revocation mechanisms (CRLs or OCSP). IKE is an IPSec-specific protocol that operates outside the PKI framework. Now, why are the other options incorrect? Option A is incorrect. Timestamping is a core PKI service for non-repudiation and audit trails. Option B is incorrect. Repository is essential to PKI for storing and distributing certificates. Option C is incorrect. Certificate revocation is a critical PKI function for invalidating compromised certificates. Therefore, D, Internet Key Exchange (IKE), is the correct answer.
Play from 1:36:41 Question 62. Which of the following protects Kerberos against replay attacks? Here are the options. Option A. Tokens. Option B. Passwords. Option C. Cryptography. Option D. Time stamps D. Pause the video now if you want time to think about the answer.
The correct answer is D. Time stamps D. Kerberos uses timestamps embedded in tickets to protect against replay attacks. Each ticket includes a timestamp that indicates when it was issued, and the system validates that the timestamp falls within an acceptable time window. This prevents an attacker from capturing and reusing old tickets because they will be rejected if presented outside the valid time range. The combination of timestamps with ticket expiration times is the primary mechanism Kerberos uses to defeat replay attacks. Now, why are the other options incorrect? Option A is incorrect. Tokens themselves do not inherently prevent replay; they must include time-based validation. Option B is incorrect. Passwords are used for initial authentication but do not directly protect against ticket replay. Option C is incorrect. While cryptography is used throughout Kerberos, it is timestamps specifically that prevent replays. Therefore, D, Time stamps D, is the correct answer.
Play from 1:38:17 Question 63. Which OSI/ISO layers are TCP and UDP implemented at? Here are the options. Option A. Application layer. Option B. Presentation layer. Option C. Session layer. Option D. Transport layer. Pause the video now if you want time to think about the answer.
The correct answer is D. Transport layer. TCP (Transmission Control Protocol) and UDP (User Datagram Protocol) are both implemented at Layer 4, the Transport layer, of the OSI model. They manage end-to-end communication, reliability, and port-based service delivery. Now, why are the other options incorrect? Option A is incorrect. The Application layer uses TCP/UDP services but does not implement them. Option B is incorrect. The Presentation layer handles data formatting and encryption, not protocol implementation. Option C is incorrect. The Session layer manages dialogue control, not TCP/UDP implementation. Therefore, D, Transport layer, is the correct answer.
Play from 1:39:42 Question 64. Which of the following is NOT a form of detective administrative control? Here are the options. Option A. Rotation of duties. Option B. Required vacations. Option C. Separation of duties. Option D. Security reviews and audits. Pause the video now if you want time to think about the answer.
The correct answer is A. Rotation of duties. Rotation of duties is a preventive control that reduces the opportunity for fraud or errors before they occur. Detective controls identify issues after they happen. Required vacations, separation of duties, and security reviews/audits all function as detective controls by revealing unauthorized activities, conflicts, or compliance violations through monitoring and analysis. Now, why are the other options incorrect? Option B is incorrect. Required vacations are detective controls that may reveal fraudulent activities when the employee is absent. Option C is incorrect. Separation of duties is explicitly a detective control that identifies conflicts of interest and unauthorized transactions. Option D is incorrect. Security reviews and audits are quintessential detective controls designed to identify issues after occurrence. Therefore, A, Rotation of duties, is the correct answer.
Play from 1:41:19 Question 65. Which of the following offers security to wireless communications? Here are the options. Option A. S-WAP. Option B. WTLS. Option C. WSP. Option D. WDP. Pause the video now if you want time to think about the answer.
The correct answer is B. WTLS. WTLS (Wireless Transport Layer Security) is a security protocol designed specifically to provide encryption and authentication for wireless communications. It is part of the WAP (Wireless Application Protocol) suite and is the wireless equivalent of TLS/SSL. WTLS protects data transmission in wireless networks by providing confidentiality and integrity. The other options are different components of WAP: WSP is a session protocol, WDP is a datagram protocol, and S-WAP is not a standard security protocol. Now, why are the other options incorrect? Option A is incorrect. S-WAP is not a recognized wireless security standard. Option C is incorrect. WSP (Wireless Session Protocol) handles sessions but does not provide the security encryption that WTLS does. Option D is incorrect. WDP (Wireless Datagram Protocol) is a transport layer protocol but does not provide security features. Therefore, B, WTLS, is the correct answer.
Play from 1:43:11 Question 66. Which of the following biometric devices has the lowest user acceptance level? Here are the options. Option A. Retina Scan. Option B. Fingerprint scan. Option C. Hand geometry. Option D. Signature recognition. Pause the video now if you want time to think about the answer.
The correct answer is A. Retina Scan. Retina scan biometrics has the lowest user acceptance level among common biometric methods. This is because retina scanning requires close proximity to the scanner, direct eye contact, and can feel invasive to users. Additionally, there are concerns about eye- related health issues and discomfort. In contrast, fingerprint scans, hand geometry, and signature recognition are less intrusive and more user-friendly. Now, why are the other options incorrect? Option B is incorrect. Fingerprint scans have higher user acceptance than retina scans. Option C is incorrect. Hand geometry has higher user acceptance than retina scans. Option D is incorrect. Signature recognition has higher user acceptance than retina scans. Therefore, A, Retina Scan, is the correct answer.
Play from 1:44:36 Question 67. What is the essential difference between a self-audit and an independent audit? Here are the options. Option A. Tools used. Option B. Results. Option C. Objectivity. Option D. Competence. Pause the video now if you want time to think about the answer.
The correct answer is C. Objectivity. The essential difference between a self-audit and an independent audit is objectivity. A self-audit is conducted by internal personnel assessing their own work, creating inherent bias and conflicts of interest. An independent audit is performed by external parties without vested interests, allowing for objective, unbiased evaluation. This objectivity is the critical distinction that determines the credibility and reliability of audit findings. Now, why are the other options incorrect? Option A is incorrect. Both self-audits and independent audits may use similar tools; tools are not the essential difference. Option B is incorrect. Both audit types aim to produce reliable results; the difference is in independence, not inherent result quality. Option D is incorrect. Both can be conducted by competent professionals; competence exists independently of audit independence. Therefore, C, Objectivity, is the correct answer.
Play from 1:46:13 Question 68. What is called a system that is capable of detecting that a fault has occurred and has the ability to correct the fault or operate around it? Here are the options. Option A. A fail safe system. Option B. A fail soft system. Option C. A fault-tolerant system. Option D. A failover system. Pause the video now if you want time to think about the answer.
The correct answer is C. A fault-tolerant system. A fault-tolerant system is specifically designed to detect faults when they occur and either correct them automatically or continue operating around them without service interruption. This is the standard definition used in computer science and security engineering. Now, why are the other options incorrect? Option A is incorrect. A fail-safe system defaults to a safe state when a failure is detected, but does not necessarily correct the fault or operate around it. Option B is incorrect. A fail-soft system gracefully degrades functionality, but this is not the same as detecting and correcting faults or operating around them. Option D is incorrect. A failover system switches to a backup system, which is related to availability but not the same as fault tolerance with automatic correction. Therefore, C, A fault-tolerant system, is the correct answer.
Play from 1:47:52 Question 69. Which protocol is NOT implemented in the Network layer of the OSI Protocol Stack? Here are the options. Option A. hyper text transport protocol. Option B. Open Shortest Path First. Option C. Internet Protocol. Option D. Routing Information Protocol. Pause the video now if you want time to think about the answer.
The correct answer is A. hyper text transport protocol. HTTP (HyperText Transport Protocol) operates at Layer 7 (Application Layer), not Layer 3 (Network Layer). The other three protocols are all Network Layer protocols: OSPF (Open Shortest Path First) and RIP (Routing Information Protocol) are routing protocols, and IP (Internet Protocol) is the fundamental Network Layer protocol. HTTP is an application-level protocol. Now, why are the other options incorrect? Option B is incorrect. OSPF is a Network Layer routing protocol. Option C is incorrect. Internet Protocol (IP) is the core Network Layer protocol. Option D is incorrect. RIP (Routing Information Protocol) is a Network Layer routing protocol. Therefore, A, hyper text transport protocol, is the correct answer.
Play from 1:49:26 Question 70. Which of the following usually provides reliable, real-time information without consuming network or host resources? Here are the options. Option A. network-based IDS. Option B. host-based IDS. Option C. application-based IDS. Option D. firewall-based IDS. Pause the video now if you want time to think about the answer.
The correct answer is A. network-based IDS. Network-based IDS (NIDS) provides real-time information by passively monitoring network traffic without requiring installation on individual hosts or consuming significant host resources. It analyzes packets at the network perimeter, making it efficient and non- intrusive compared to host-based approaches that consume CPU and memory on each monitored system. Now, why are the other options incorrect? Option B is incorrect. Host-based IDS consumes significant host resources including CPU, memory, and disk I/O on the monitored system. Option C is incorrect. Application-based IDS requires integration with specific applications and consumes application resources. Option D is incorrect. Firewall-based IDS is less common and still requires processing resources to analyze traffic rules. Therefore, A, network-based IDS, is the correct answer.
Play from 1:51:10 Question 71. A variation of the application layer firewall is called a: Here are the options. Option A. Current Level Firewall. Option B. Cache Level Firewall. Option C. Session Level Firewall. Option D. Circuit Level Firewall. Pause the video now if you want time to think about the answer.
The correct answer is D. Circuit Level Firewall. A circuit level firewall (also called a circuit level proxy) is a variation of the application layer firewall. It operates at a lower OSI layer and establishes circuits or connections between clients and servers, forwarding data packets without deeply inspecting the application-level content, making it faster but less thorough than full application proxies. Now, why are the other options incorrect? Option A is incorrect. Current level firewall is not a recognized firewall classification or variation. Option B is incorrect. Cache level firewall is not a standard firewall terminology or variation. Option C is incorrect. Session level firewall is not the correct term; circuit level firewall is the recognized variation. Therefore, D, Circuit Level Firewall, is the correct answer.
Play from 1:52:38 Question 72. Which OSI/ISO layer does a SOCKS server operate at? Here are the options. Option A. Session layer. Option B. Transport layer. Option C. Network layer. Option D. Data link layer. Pause the video now if you want time to think about the answer.
The correct answer is A. Session layer. SOCKS servers operate at the session layer (layer 5) of the OSI model. SOCKS is a protocol that facilitates proxy communication and session establishment between clients and servers, making it fundamentally a session-layer mechanism. While it works with transport-layer protocols, its primary function is establishing and managing sessions, not transport itself. Now, why are the other options incorrect? Option B is incorrect. The transport layer handles protocols like TCP and UDP, not SOCKS session management. Option C is incorrect. The network layer handles routing and IP addressing, which is below SOCKS functionality. Option D is incorrect. The data link layer handles physical hardware addressing and framing, not application-level session proxying. Therefore, A, Session layer, is the correct answer.
Play from 1:54:14 Question 73. In which phase of Internet Key Exchange (IKE) protocol is peer authentication performed? Here are the options. Option A. Pre Initialization Phase. Option B. Phase 1. Option C. Phase 2. Option D. No peer authentication is performed. Pause the video now if you want time to think about the answer.
The correct answer is B. Phase 1. In the Internet Key Exchange (IKE) protocol, Phase 1 is responsible for peer authentication and the establishment of a secure channel between the two peers. Phase 2 follows and handles the negotiation of IPsec security associations. Now, why are the other options incorrect? Option A is incorrect. There is no 'Pre Initialization Phase' in the IKE protocol structure. Option C is incorrect. Phase 2 is focused on IPsec security association negotiation, not peer authentication. Option D is incorrect. Peer authentication is definitively performed during IKE Phase 1. Therefore, B, Phase 1, is the correct answer.
Play from 1:55:38 Question 74. After a company is out of an emergency state, what should be moved back to the original site first? Here are the options. Option A. Executives. Option B. Least critical components. Option C. IT support staff. Option D. Most critical components. Pause the video now if you want time to think about the answer.
The correct answer is D. Most critical components. When recovering from a disaster, the most critical components should be moved back to the original site first to restore business operations as quickly as possible. This prioritization minimizes downtime and business impact. Critical components are those essential to core business functions, which take precedence over personnel or less critical systems. Now, why are the other options incorrect? Option A is incorrect. Executives are important but not critical infrastructure components needed to restore operations. Option B is incorrect. Least critical components should be restored last, not first, as they have minimal impact on recovery. Option C is incorrect. IT support staff, while helpful, are not components that need to be physically moved back and are secondary to infrastructure recovery. Therefore, D, Most critical components, is the correct answer.
Play from 1:57:17 Question 75. Which layer of the DoD TCP/IP Model ensures error-free delivery and packet sequencing? Here are the options. Option A. Internet layer. Option B. Network access layer. Option C. Host-to-host. Option D. Application layer. Pause the video now if you want time to think about the answer.
The correct answer is C. Host-to-host. The Host-to-Host (Transport) layer of the DoD TCP/IP model ensures error-free delivery and packet sequencing. This layer contains protocols like TCP (Transmission Control Protocol) which provides reliable, ordered delivery of data through sequence numbers and acknowledgments, and UDP which provides unreliable delivery. Now, why are the other options incorrect? Option A is incorrect. The Internet layer handles routing and logical addressing, not error correction or sequencing. Option B is incorrect. The Network Access layer handles physical transmission and MAC functions, not end-to-end reliability. Option D is incorrect. The Application layer provides user services and applications, not the underlying transport reliability mechanisms. Therefore, C, Host-to-host, is the correct answer.
Play from 1:58:46 Question 76. What prevents a process from accessing another process' data? Here are the options. Option A. Memory segmentation. Option B. Process isolation. Option C. The reference monitor. Option D. Data hiding. Pause the video now if you want time to think about the answer.
The correct answer is B. Process isolation. Process isolation is the primary mechanism that prevents one process from accessing another process's data. It creates a logical separation at the OS level, ensuring that each process operates within its own protected memory space and cannot directly access or modify the memory or resources of other processes. Now, why are the other options incorrect? Option A is incorrect. Memory segmentation is a memory management technique but not the primary mechanism preventing inter-process data access. Option C is incorrect. The reference monitor enforces access control policies but operates as part of process isolation, not instead of it. Option D is incorrect. Data hiding is an application-level concept, not a system-level mechanism for preventing process-to-process data access. Therefore, B, Process isolation, is the correct answer.
Play from 2:00:22 Question 77. What is defined as inference of information from other, intermediate, relevant facts? Here are the options. Option A. Secondary evidence. Option B. Conclusive evidence. Option C. Hearsay evidence. Option D. Circumstantial evidence. Pause the video now if you want time to think about the answer.
The correct answer is D. Circumstantial evidence. Circumstantial evidence is defined as inference of information from other, intermediate, relevant facts rather than direct observation. It requires the fact-finder to make a logical deduction or inference from the facts presented to reach a conclusion about the matter in question. Now, why are the other options incorrect? Option A is incorrect. Secondary evidence is a copy or substitute for original evidence, not evidence derived through inference. Option B is incorrect. Conclusive evidence is evidence that is incontrovertible and requires no further proof or inference. Option C is incorrect. Hearsay evidence is testimony regarding out-of-court statements, not evidence derived through logical inference from facts. Therefore, D, Circumstantial evidence, is the correct answer.
Play from 2:01:57 Question 78. A code, as is pertains to cryptography: Here are the options. Option A. Is a generic term for encryption. Option B. Is specific to substitution ciphers. Option C. Deals with linguistic units. Option D. Is specific to transposition ciphers. Pause the video now if you want time to think about the answer.
The correct answer is C. Deals with linguistic units. In cryptography, a code specifically operates on linguistic units such as words or phrases, converting them to other words or phrases. This contrasts with ciphers, which operate on individual characters or bits. Codes deal with meaning at the semantic level, while ciphers manipulate individual symbols mathematically. Now, why are the other options incorrect? Option A is incorrect. Code is not a generic term for encryption; that would be 'cipher' or 'encryption algorithm'. Option B is incorrect. Codes are not specific to substitution ciphers; they are a separate cryptographic concept operating at a different level. Option D is incorrect. Codes are not specific to transposition ciphers; they operate independently of cipher types. Therefore, C, Deals with linguistic units, is the correct answer.
Play from 2:03:27 Question 79. Which of the following services is NOT provided by the digital signature standard (DSS)? Here are the options. Option A. Encryption. Option B. Integrity. Option C. Digital signature. Option D. Authentication. Pause the video now if you want time to think about the answer.
The correct answer is A. Encryption. The Digital Signature Standard (DSS) does NOT provide encryption. DSS is specifically designed for creating and verifying digital signatures, which provide authentication, non- repudiation, and integrity verification. Encryption requires additional algorithms; DSS only ensures that messages are authenticated, have not been altered, and that the sender cannot deny having signed the message. Now, why are the other options incorrect? Option B is incorrect. DSS provides integrity assurance through the digital signature mechanism, which detects any tampering with signed data. Option C is incorrect. Creating digital signatures is the primary purpose of the Digital Signature Standard. Option D is incorrect. DSS provides authentication by allowing the signer to be verified through signature validation and key association. Therefore, A, Encryption, is the correct answer.
Play from 2:04:59 Question 80. What can best be described as a domain of trust that shares a single security policy and single management? Here are the options. Option A. The reference monitor. Option B. A security domain. Option C. The security kernel. Option D. The security perimeter. Pause the video now if you want time to think about the answer.
The correct answer is B. A security domain. A security domain is defined as a domain of trust that shares a single security policy and single management authority. It represents a logical grouping where all subjects operate under the same security policy and are managed cohesively. Now, why are the other options incorrect? Option A is incorrect. The reference monitor is an abstract machine that mediates access, not a domain of trust with shared policy. Option C is incorrect. The security kernel is the core of a trusted computing base, not a domain sharing a single policy. Option D is incorrect. The security perimeter is the boundary of a secure system, not specifically a domain with shared policy management. Therefore, B, A security domain, is the correct answer.
Play from 2:06:27 Question 81. How often should a Business Continuity Plan be reviewed? Here are the options. Option A. At least once a month. Option B. At least every six months. Option C. At least once a year. Option D. At least Quarterly. Pause the video now if you want time to think about the answer.
The correct answer is C. At least once a year. Industry best practice and most IT certification standards require Business Continuity Plans to be reviewed at least annually. This frequency ensures the plan remains current with organizational changes, technology updates, and lessons learned, while not being so frequent as to create unnecessary overhead. Annual reviews allow sufficient time to identify meaningful changes and implement updates systematically. Now, why are the other options incorrect? Option A is incorrect. Monthly reviews are excessive and create unnecessary administrative burden without proportional benefit. Option B is incorrect. Semi-annual reviews, while more frequent than necessary, are not the standard recommended interval in most frameworks. Option D is incorrect. Quarterly reviews are overly frequent for routine updates and only appropriate for high-risk environments or post-incident reassessment. Therefore, C, At least once a year, is the correct answer.
Play from 2:08:04 Question 82. Which of the following categories of hackers poses the greatest threat? Here are the options. Option A. Disgruntled employees. Option B. Student hackers. Option C. Criminal hackers. Option D. Corporate spies. Pause the video now if you want time to think about the answer.
The correct answer is A. Disgruntled employees. Disgruntled employees pose the greatest threat because they have legitimate internal access to systems, deep knowledge of organizational infrastructure and security controls, motivation stemming from grievances, and the ability to cause significant damage before detection. While criminal hackers and corporate spies are dangerous, insiders have the advantage of trusted access and detailed system knowledge that external attackers must work to obtain. Now, why are the other options incorrect? Option B is incorrect. Student hackers typically lack the motivation, resources, and access to pose threats as severe as other categories. Option C is incorrect. Criminal hackers operate from outside and must overcome external security controls, giving them less advantage than insiders. Option D is incorrect. Corporate spies are a threat, but disgruntled employees have superior access and knowledge as trusted insiders. Therefore, A, Disgruntled employees, is the correct answer.
Play from 2:09:44 Question 83. What is called the formal acceptance of the adequacy of a system's overall security by the management? Here are the options. Option A. Certification. Option B. Acceptance. Option C. Accreditation. Option D. Evaluation. Pause the video now if you want time to think about the answer.
The correct answer is C. Accreditation. Accreditation is the formal, official acceptance by management of the adequacy of a system's overall security posture. It represents management's authorization and acknowledgment that security is acceptable for operational use. Certification is the technical assessment process; acceptance is informal agreement; evaluation is the assessment activity. Accreditation is the formal management decision following technical certification. Now, why are the other options incorrect? Option A is incorrect. Certification is the technical assessment, not management's formal acceptance. Option B is incorrect. Acceptance is too informal; accreditation is the formal management recognition. Option D is incorrect. Evaluation is the assessment process, not the formal management acceptance decision. Therefore, C, Accreditation, is the correct answer.
Play from 2:11:18 Question 84. Which of the following is not a physical control for physical security? Here are the options. Option A. lighting. Option B. fences. Option C. training. Option D. facility construction materials. Pause the video now if you want time to think about the answer.
The correct answer is C. training. Physical security controls are tangible measures that protect facilities and assets through physical means. Lighting, fences, and facility construction materials are all physical controls. Training is an administrative or procedural control, it educates people on security practices but does not physically prevent access or protect against attacks. Now, why are the other options incorrect? Option A is incorrect. Lighting is a physical control that deters intruders and aids surveillance. Option B is incorrect. Fences are physical barriers that control and restrict facility access. Option D is incorrect. Facility construction materials provide physical protection against damage and intrusion. Therefore, C, training, is the correct answer.
Play from 2:12:38 Question 85. Within the realm of IT security, which of the following combinations best defines risk? Here are the options. Option A. Threat coupled with a breach. Option B. Threat coupled with a vulnerability. Option C. Vulnerability coupled with an attack. Option D. Threat coupled with a breach of security. Pause the video now if you want time to think about the answer.
The correct answer is B. Threat coupled with a vulnerability. Risk is best defined as the combination of threat and vulnerability. A threat is a potential source of harm, and a vulnerability is a weakness that can be exploited. Risk exists when a threat can exploit a vulnerability; without both elements, risk is not present. Now, why are the other options incorrect? Option A is incorrect. A breach is an actual incident, not a component of risk definition; risk is about potential, not realized events. Option C is incorrect. An attack is a realized action, not a definition component; risk involves potential threats and vulnerabilities. Option D is incorrect. A breach of security is an incident outcome, not part of the foundational definition of risk itself. Therefore, B, Threat coupled with a vulnerability, is the correct answer.
Play from 2:14:13 Question 86. What would be the Annualized Rate of Occurrence (ARO) of the threat "user input error", in the case where a company employs 100 data entry clerks and every one of them makes one input error each month? Here are the options. Option A. 100. Option B. 120. Option C. 1. Option D. 1200. Pause the video now if you want time to think about the answer.
The correct answer is D. 1200. ARO represents how many times a threat is expected to occur in one year. With 100 data entry clerks each making one input error per month, that equals 100 errors per month. Over 12 months, this totals 100 × 12 = 1,200 occurrences annually. ARO is therefore 1200. Now, why are the other options incorrect? Option A is incorrect. This represents only the number of clerks, not accounting for the monthly frequency or annualization. Option B is incorrect. This figure would represent only 10 months of occurrences, not the full 12-month annualized rate. Option C is incorrect. This would suggest only one error per year across all clerks, which dramatically underestimates the actual frequency. Therefore, D, 1200, is the correct answer.
Play from 2:15:51 Question 87. Who should measure the effectiveness of Information System security related controls in an organization? Here are the options. Option A. The local security specialist. Option B. The business manager. Option C. The systems auditor. Option D. The central security manager. Pause the video now if you want time to think about the answer.
The correct answer is C. The systems auditor. A systems auditor is the independent party responsible for measuring and evaluating the effectiveness of security controls. Auditors provide objective assessment of whether controls are functioning as designed and achieving their intended security objectives. While security managers and business managers play roles in security, the auditor's independence and expertise in control evaluation make them the appropriate choice for measuring effectiveness. Now, why are the other options incorrect? Option A is incorrect. Local security specialists implement and maintain controls but lack the independence needed for objective effectiveness measurement. Option B is incorrect. Business managers are concerned with business objectives and risk acceptance, not technical control measurement. Option D is incorrect. Central security managers oversee the security program but should not audit their own controls due to lack of independence. Therefore, C, The systems auditor, is the correct answer.
Play from 2:17:36 Question 88. Which xDSL flavour, appropriate for home or small offices, delivers more bandwidth downstream than upstream and over longer distance? Here are the options. Option A. VDSL. Option B. SDSL. Option C. ADSL. Option D. HDSL. Pause the video now if you want time to think about the answer.
The correct answer is C. ADSL. ADSL (Asymmetric Digital Subscriber Line) is designed for home and small office use with asymmetric speeds where downstream bandwidth is significantly higher than upstream bandwidth. ADSL operates over longer distances than other xDSL variants and is optimized for typical internet usage patterns where users download more than they upload. Now, why are the other options incorrect? Option A is incorrect. VDSL provides higher speeds but shorter distance range and is less suitable for home/small office deployment. Option B is incorrect. SDSL provides symmetric speeds, not asymmetric, and is intended for business applications. Option D is incorrect. HDSL provides symmetric speeds and is designed for T1/E1 replacement, not home/small office asymmetric use. Therefore, C, ADSL, is the correct answer.
Play from 2:19:12 Question 89. The primary service provided by Kerberos is which of the following? Here are the options. Option A. non-repudiation. Option B. confidentiality. Option C. authentication. Option D. authorization. Pause the video now if you want time to think about the answer.
The correct answer is C. authentication. Kerberos is primarily an authentication service within a network environment. It provides mutual authentication between clients and servers using tickets and a trusted third party (the Key Distribution Center), ensuring that both parties can verify each other's identity within a networked system. Now, why are the other options incorrect? Option A is incorrect. Non-repudiation ensures a user cannot deny their actions; while Kerberos provides authentication, it is not its primary service. Option B is incorrect. Confidentiality is supported through encryption in Kerberos, but authentication is the primary service it provides. Option D is incorrect. Authorization (access control) is handled by separate systems; Kerberos focuses on authentication, not authorization decisions. Therefore, C, authentication, is the correct answer.
Play from 2:20:39 Question 90. Who is ultimately responsible for the security of computer based information systems within an organization? Here are the options. Option A. The tech support team. Option B. The Operation Team. Option C. The management team. Option D. The training team. Pause the video now if you want time to think about the answer.
The correct answer is C. The management team. Ultimate responsibility for information system security within an organization rests with senior management. While technical teams implement and maintain security controls, management is accountable for establishing security policy, allocating resources, defining acceptable risk levels, and ensuring compliance. This responsibility cannot be delegated away; it remains with organizational leadership. Now, why are the other options incorrect? Option A is incorrect. Tech support provides operational security but not ultimate organizational responsibility. Option B is incorrect. Operations teams execute security procedures but are not ultimately accountable. Option D is incorrect. Training teams support security awareness but do not bear ultimate responsibility. Therefore, C, The management team, is the correct answer.
Play from 2:22:21 Question 91. Within the context of the CBK, which of the following provides a MINIMUM level of security ACCEPTABLE for an environment ? Here are the options. Option A. A baseline. Option B. A standard. Option C. A procedure. Option D. A guideline. Pause the video now if you want time to think about the answer.
The correct answer is A. A baseline. A baseline within the CBK context defines the minimum acceptable level of security that must be implemented in an environment. It provides a floor below which security posture should not fall. Standards (B) are mandatory requirements but not minimum levels. Procedures (C) are step-by-step instructions. Guidelines (D) are recommendations, not minimum requirements. Now, why are the other options incorrect? Option B is incorrect. Standards are mandatory specifications but don't specifically define a minimum acceptable level. Option C is incorrect. Procedures are detailed instructions for executing tasks, not baseline security levels. Option D is incorrect. Guidelines are recommendations and best practices, not minimum requirements or baselines. Therefore, A, A baseline, is the correct answer.
Play from 2:23:58 Question 92. The standard server port number for HTTP is which of the following? Here are the options. Option A. 81. Option B. 80. Option C. 8080. Option D. 8180. Pause the video now if you want time to think about the answer.
The correct answer is B. 80. Port 80 is the well-known and standard port number for HTTP (Hypertext Transfer Protocol) traffic. This is the default port that web browsers use to communicate with web servers unless otherwise specified. Now, why are the other options incorrect? Option A is incorrect. Port 81 is not the standard HTTP port; it is sometimes used as an alternative but is not the official standard. Option C is incorrect. Port 8080 is commonly used as an alternative HTTP port for proxies and development servers, not the standard port. Option D is incorrect. Port 8180 is not a standard HTTP port and is not commonly associated with HTTP services. Therefore, B, 80, is the correct answer.
Play from 2:25:24 Question 93. Which of the following phases of a system development life-cycle is most concerned with establishing a good security policy as the foundation for design? Here are the options. Option A. Development/acquisition. Option B. Implementation. Option C. Initiation. Option D. Maintenance. Pause the video now if you want time to think about the answer.
The correct answer is C. Initiation. The Initiation phase is where foundational planning occurs, including establishing security policies, requirements, and organizational context that will guide all subsequent design and implementation decisions. This phase sets the security baseline before any acquisition or development work begins. Now, why are the other options incorrect? Option A is incorrect. Development/acquisition focuses on building or procuring systems according to established requirements, not establishing foundational policy. Option B is incorrect. Implementation is about deploying the system, not establishing initial security policy foundations. Option D is incorrect. Maintenance occurs after system deployment and focuses on ongoing operations, not establishing initial policies. Therefore, C, Initiation, is the correct answer.
Play from 2:26:59 Question 94. Communications and network security relates to transmission of which of the following? Here are the options. Option A. voice. Option B. voice and multimedia. Option C. data and multimedia. Option D. voice, data and multimedia. Pause the video now if you want time to think about the answer.
The correct answer is D. voice, data and multimedia. Communications and network security encompasses the transmission and protection of all types of information across networks. This includes voice communications (VoIP), data (text, files, databases), and multimedia (video, audio streams). A comprehensive communications security program must address all three categories to ensure complete protection of organizational information in transit. Now, why are the other options incorrect? Option A is incorrect. Voice alone is incomplete; it ignores data and multimedia transmission needs. Option B is incorrect. Voice and multimedia omit data, which is a critical component of network communications. Option C is incorrect. Data and multimedia omit voice communications, which is increasingly transmitted over networks. Therefore, D, voice, data and multimedia, is the correct answer.
Play from 2:28:39 Question 95. How many layers are defined within the US Department of Defense (DoD) TCP/IP Model? Here are the options. Option A. 7. Option B. 5. Option C. 4. Option D. 3. Pause the video now if you want time to think about the answer.
The correct answer is C. 4. The DoD TCP/IP Model defines 4 layers: Application layer, Host-to-Host (Transport) layer, Internet layer, and Network Access (Link) layer. This is distinct from the OSI model which has 7 layers. The DoD model is a simpler, more practical model used for TCP/IP networking. Now, why are the other options incorrect? Option A is incorrect. 7 layers is the count for the OSI/ISO model, not the DoD TCP/IP model. Option B is incorrect. 5 layers is not a standard count for either the DoD model or OSI model. Option D is incorrect. 3 layers is too few; the DoD model has one more layer than this. Therefore, C, 4, is the correct answer.
Play from 2:30:00 Question 96. What is the RESULT of a hash algorithm being applied to a message ? Here are the options. Option A. A digital signature. Option B. A ciphertext. Option C. A message digest. Option D. A plaintext. Pause the video now if you want time to think about the answer.
The correct answer is C. A message digest. When a hash algorithm is applied to a message, the result is a message digest, a fixed- size, unique digital fingerprint of the original message. The message digest is deterministic, meaning the same input always produces the same output, and it is one- way, making it impossible to reverse-engineer the original message from the digest. Now, why are the other options incorrect? Option A is incorrect. A digital signature is a cryptographic construct that uses both hashing and asymmetric encryption; it is not the direct result of applying a hash algorithm alone. Option B is incorrect. Ciphertext is the encrypted output from an encryption algorithm, not the output of a hash algorithm. Option D is incorrect. Plaintext is the original unencrypted message, not the result of applying a hash algorithm to that message. Therefore, C, A message digest, is the correct answer.
Play from 2:31:33 Question 97. All hosts on an IP network have a logical ID called a(n): Here are the options. Option A. IP address. Option B. MAC address. Option C. TCP address. Option D. Datagram address. Pause the video now if you want time to think about the answer.
The correct answer is A. IP address. An IP address is the logical identifier assigned to each host on an IP network for identification and routing purposes. MAC addresses are physical layer identifiers, TCP addresses do not exist as a standard term, and datagrams are data units, not host identifiers. Now, why are the other options incorrect? Option B is incorrect. MAC addresses are hardware addresses used at the data link layer, not logical IDs for IP networks. Option C is incorrect. TCP is a transport layer protocol; there is no standard TCP address identifier. Option D is incorrect. Datagrams are packets of data, not logical identifiers for hosts. Therefore, A, IP address, is the correct answer.
Play from 2:32:58 Question 98. The Logical Link Control sub-layer is a part of which of the following? Here are the options. Option A. The ISO/OSI Data Link layer. Option B. The Reference monitor. Option C. The Transport layer of the TCP/IP stack model. Option D. Change management control A. Pause the video now if you want time to think about the answer.
The correct answer is A. The ISO/OSI Data Link layer. The Logical Link Control (LLC) sublayer is part of the ISO/OSI Data Link layer (Layer 2). The Data Link layer is subdivided into the LLC sublayer and the Media Access Control (MAC) sublayer. The Reference monitor is a security concept, the Transport layer is a different OSI layer where the LLC sublayer does not reside, and option D is malformed and nonsensical. Now, why are the other options incorrect? Option B is incorrect. The Reference monitor is a security principle, not a layer that contains LLC. Option C is incorrect. The Transport layer is OSI Layer 4, while LLC is part of Layer 2 (Data Link). Option D is incorrect. This option is malformed and does not represent a valid OSI model component. Therefore, A, The ISO/OSI Data Link layer, is the correct answer.
Play from 2:34:44 Question 99. To be admissible in court, computer evidence must be which of the following? Here are the options. Option A. Relevant. Option B. Decrypted. Option C. Edited. Option D. Incriminating. Pause the video now if you want time to think about the answer.
The correct answer is A. Relevant. To be admissible in court, computer evidence must be relevant, meaning it must have a direct bearing on the case and tend to prove or disprove a fact of consequence. Relevance is the fundamental requirement under evidence rules. Decryption, editing, and whether evidence is incriminating are separate considerations that don't determine basic admissibility. Now, why are the other options incorrect? Option B is incorrect. Evidence does not need to be decrypted to be admissible; encrypted data can be admitted with proper authentication and explanation. Option C is incorrect. Evidence must not be edited; editing would actually render it inadmissible as it compromises integrity. Option D is incorrect. Evidence need not be incriminating to be admissible; exculpatory evidence is equally admissible. Therefore, A, Relevant, is the correct answer.
Play from 2:36:16 Question 100. What is called a sequence of characters that is usually longer than the allotted number for a password? Here are the options. Option A. passphrase. Option B. cognitive phrase. Option C. anticipated phrase. Option D. Real phrase. Pause the video now if you want time to think about the answer.
The correct answer is A. passphrase. A passphrase is a sequence of characters (usually words or a sentence) that is typically longer than a standard password. Passphrases provide increased security through length while often being easier for users to remember than random character passwords. They exceed the typical character limits imposed on passwords. Now, why are the other options incorrect? Option B is incorrect. Cognitive phrase is not a standard security term and does not refer to longer character sequences. Option C is incorrect. Anticipated phrase is not a recognized authentication credential type. Option D is incorrect. Real phrase is not a recognized authentication credential type in security terminology. Therefore, A, passphrase, is the correct answer.
