CSLB General Building (B) — All Questions

Which access control method assigns permissions to users based on their job function within an organization?

• a.Discretionary access control
• b.Mandatory access control
• c.Role-based access control✓
• d.Rule-based access control

Role-based access control (RBAC) grants permissions according to a user's role or job function, simplifying administration at scale. Users inherit access by being placed into roles rather than being assigned rights individually. This supports least-privilege principles.

A firewall rule set should end with which type of rule to enforce a secure default posture?

• a.An implicit or explicit deny-all✓
• b.A permit-all to any destination
• c.A rule allowing all ICMP
• d.A rule opening all high ports

A secure firewall enforces a default-deny posture, so any traffic not explicitly permitted is blocked by an implicit or explicit deny-all rule. This follows the principle of least privilege for network access. Permit-all rules undermine the firewall's purpose.

Which attack floods a switch's MAC address table to force it to broadcast frames out all ports?

• a.ARP spoofing
• b.DNS poisoning
• c.Smurf attack
• d.MAC flooding✓

MAC flooding overwhelms a switch's MAC address table, causing it to fail open and flood frames out all ports so an attacker can capture traffic. Port security limiting MAC addresses per port mitigates this. It exploits the finite size of the CAM table.

Which technology creates an encrypted tunnel over the public internet to securely connect a remote user to a corporate network?

• a.VLAN
• b.VPN✓
• c.NAT
• d.DMZ

A VPN establishes an encrypted tunnel across untrusted networks, allowing remote users to securely access internal resources. IPsec and SSL/TLS are common VPN technologies. The encryption protects confidentiality and integrity in transit.

Which network segment is designed to host public-facing servers while isolating them from the internal LAN?

• a.Screened subnet (DMZ)✓
• b.Native VLAN
• c.Loopback interface
• d.Broadcast domain

A screened subnet, commonly called a DMZ, hosts public-facing services like web and mail servers in an isolated zone between the internet and the internal network. If a DMZ host is compromised, the internal LAN remains protected. Firewalls control traffic in and out of the DMZ.

Which authentication framework provides port-based network access control, often used with RADIUS for wired and wireless clients?

• a.802.11ac
• b.802.3af
• c.802.1X✓
• d.802.1Q

IEEE 802.1X provides port-based network access control, requiring clients to authenticate, often against a RADIUS server, before gaining network access. It is widely used for both wired ports and wireless networks. This prevents unauthorized devices from connecting.

An attacker sends forged ARP replies to associate their MAC with the default gateway's IP. What is this attack called?

• a.Port scanning
• b.Session hijacking via cookies
• c.SYN flooding
• d.ARP poisoning✓

ARP poisoning sends forged ARP replies so victims map the gateway's IP to the attacker's MAC, enabling on-path interception. Dynamic ARP Inspection and static ARP entries mitigate it. It is a classic on-path (man-in-the-middle) technique.

Which principle dictates that users and processes should receive only the minimum access necessary to perform their tasks?

• a.Defense in depth
• b.Least privilege✓
• c.Separation of duties
• d.Zero trust

The principle of least privilege grants only the minimum access required, limiting the damage from compromised accounts or mistakes. It is a foundational security control. Regular access reviews help maintain it over time.

Which device inspects traffic and can actively block malicious activity inline, rather than only alerting on it?

• a.IPS✓
• b.IDS
• c.Proxy cache
• d.Syslog server

An Intrusion Prevention System (IPS) sits inline and can actively block or drop malicious traffic in real time. An IDS, by contrast, only detects and alerts without stopping the traffic. Inline placement is what enables prevention.

Which switch feature limits the number of MAC addresses learned on a port and can shut the port down if violated?

• a.DHCP snooping
• b.Dynamic ARP inspection
• c.Port security✓
• d.BPDU guard

Port security restricts how many MAC addresses a switch port learns and can take actions like shutting the port down on a violation. This mitigates MAC flooding and unauthorized device connections. Violation modes include protect, restrict, and shutdown.

Which authentication factor category does a hardware token or smartphone authenticator app represent?

• a.Something you are
• b.Something you know
• c.Somewhere you are
• d.Something you have✓

A hardware token or authenticator app is a 'something you have' factor, since it is a physical or possessed item. Passwords are 'something you know' and biometrics are 'something you are.' Combining factor categories creates multifactor authentication.

Which feature validates DHCP messages and blocks rogue DHCP servers on untrusted switch ports?

• a.Port mirroring
• b.DHCP snooping✓
• c.Link aggregation
• d.MAC filtering

DHCP snooping designates trusted and untrusted ports, dropping DHCP server responses on untrusted ports to block rogue DHCP servers. It also builds a binding table used by Dynamic ARP Inspection. This protects clients from receiving malicious configuration.

Which social engineering attack uses fraudulent emails that appear legitimate to trick users into revealing credentials?

• a.Phishing✓
• b.Tailgating
• c.Shoulder surfing
• d.Dumpster diving

Phishing uses deceptive emails impersonating trusted entities to lure users into disclosing credentials or clicking malicious links. Targeted variants include spear phishing and whaling. User awareness training is a primary defense.

Which security model assumes no implicit trust and verifies every request regardless of network location?

• a.Perimeter security
• b.Open access model
• c.Zero trust✓
• d.Flat network model

Zero trust assumes no user or device is inherently trusted, requiring continuous verification of every access request regardless of location. It shifts security away from a trusted internal perimeter. Microsegmentation and strong identity verification support the model.