CSLB General Building (B) — All Questions

What are the three core principles of the classic information security 'CIA triad'?

• a.Control, Isolation, Access
• b.Confidentiality, Integrity, Availability✓
• c.Cryptography, Identity, Authorization
• d.Compliance, Inspection, Auditing

The CIA triad stands for Confidentiality, Integrity, and Availability. Confidentiality keeps data private, integrity ensures data is accurate and unaltered, and availability ensures systems and data are accessible when needed. These principles guide most security decisions.

What does encryption accomplish?

• a.It converts readable data into an unreadable form that only authorized parties can decode✓
• b.It permanently deletes data
• c.It speeds up data transfer
• d.It compresses files to save space

Encryption transforms plaintext into ciphertext using an algorithm and a key, making it unreadable to anyone without the correct key. This protects data confidentiality both in transit and at rest. Only authorized parties with the key can decrypt and read the data.

In the AAA security framework, what do the three A's stand for?

• a.Access, Audit, Alert
• b.Assign, Approve, Archive
• c.Authentication, Authorization, Accounting✓
• d.Analyze, Act, Adapt

AAA stands for Authentication, Authorization, and Accounting. Authentication verifies identity, authorization determines what an authenticated user may do, and accounting tracks their activity. Together they provide a structured approach to controlling and auditing access.

What is multi-factor authentication (MFA)?

• a.Using the same password on multiple sites
• b.Encrypting a hard drive twice
• c.Logging in from multiple devices
• d.Requiring two or more independent forms of verification to prove identity✓

MFA requires two or more distinct factors to authenticate, such as something you know (password), something you have (a phone or token), or something you are (a fingerprint). This greatly increases security because a stolen password alone is not enough. MFA is a strong defense against account compromise.

What is the difference between symmetric and asymmetric encryption?

• a.Symmetric uses one shared key while asymmetric uses a public/private key pair✓
• b.Symmetric is always weaker than asymmetric
• c.Asymmetric does not use keys
• d.There is no difference

Symmetric encryption uses a single shared key for both encrypting and decrypting data, which is fast but requires securely sharing the key. Asymmetric encryption uses a mathematically linked public and private key pair, allowing secure exchange without sharing a secret key. Many systems combine both for efficiency and security.

What is 'phishing'?

• a.A method of encrypting emails
• b.A fraudulent attempt to trick people into revealing sensitive information✓
• c.A type of firewall
• d.A backup technique

Phishing is a social engineering attack where criminals impersonate a trustworthy source, often via email, to trick victims into revealing passwords, financial details, or other sensitive data. Warning signs include urgent language, suspicious links, and mismatched sender addresses. User awareness is a key defense.

What is the purpose of a firewall?

• a.To speed up the internet connection
• b.To store user passwords
• c.To monitor and control incoming and outgoing network traffic based on rules✓
• d.To defragment the hard drive

A firewall inspects network traffic and permits or blocks it according to a set of security rules. It acts as a barrier between trusted internal networks and untrusted external ones. Firewalls can be hardware appliances, software, or both.

Why is 'principle of least privilege' important in security?

• a.It makes systems boot faster
• b.It increases available bandwidth
• c.It eliminates the need for passwords
• d.It limits users and processes to only the access they need, reducing risk✓

The principle of least privilege means granting users and processes only the minimum access required to perform their tasks. This limits the potential damage from compromised accounts or mistakes. It is a foundational concept in reducing an organization's attack surface.

What is malware?

• a.Software designed to harm, exploit, or gain unauthorized access to systems✓
• b.A type of network cable
• c.A legitimate operating system update
• d.A hardware cooling device

Malware is malicious software created to damage systems, steal data, or gain unauthorized access. Categories include viruses, worms, trojans, ransomware, and spyware. Antivirus software, patching, and cautious user behavior help defend against it.

What does hashing provide that plain encryption does not necessarily provide?

• a.Reversible transformation of data
• b.A one-way transformation useful for verifying data integrity✓
• c.Faster internet speeds
• d.Automatic data backups

Hashing produces a fixed-length one-way digest of data that cannot be reversed back to the original. It is commonly used to verify integrity and to store passwords securely. If input changes even slightly, the resulting hash changes significantly.

What is a VPN (Virtual Private Network) primarily used for?

• a.To increase RAM
• b.To defragment drives
• c.To create a secure, encrypted connection over a public network✓
• d.To generate stronger Wi-Fi signals

A VPN creates an encrypted tunnel between a device and a remote network over the public internet. This protects data from eavesdropping and can mask the user's location. It is widely used for secure remote access to corporate resources.

Which of the following is the strongest password practice?

• a.Using your birthday for easy recall
• b.Using the same short password everywhere
• c.Writing your password on a sticky note on the monitor
• d.Using a long, unique passphrase and a password manager✓

Strong passwords are long, unique to each account, and hard to guess, ideally managed with a password manager. Reusing passwords or choosing personal information makes accounts vulnerable. Combining strong passwords with multi-factor authentication provides even better protection.

What is 'social engineering' in the context of security?

• a.Manipulating people into divulging information or performing insecure actions✓
• b.Designing social media platforms
• c.Building physical networks
• d.Encrypting social media posts

Social engineering exploits human psychology rather than technical vulnerabilities to gain access or information. Tactics include impersonation, pretexting, and creating a false sense of urgency. Training and healthy skepticism are the best defenses against it.

What is the purpose of network hardening?

• a.To increase the physical length of network cables
• b.To reduce vulnerabilities by disabling unnecessary services and applying secure configurations✓
• c.To boost the monitor refresh rate
• d.To add more user accounts

Network hardening reduces the attack surface by closing unused ports, disabling unnecessary services, applying patches, and enforcing strong configurations. These measures make it harder for attackers to find and exploit weaknesses. Hardening is an ongoing security practice.

What does 'ransomware' do?

• a.It speeds up the computer
• b.It backs up your files automatically
• c.It encrypts a victim's files and demands payment to restore access✓
• d.It updates the operating system

Ransomware is malware that encrypts a victim's data and demands a ransom, often in cryptocurrency, in exchange for the decryption key. Reliable, offline backups are the best defense, allowing recovery without paying. Paying does not guarantee data recovery and encourages further attacks.

Why should Wi-Fi networks use WPA2 or WPA3 encryption instead of WEP?

• a.WEP is faster and more secure
• b.WPA3 does not use any encryption
• c.WEP supports more devices
• d.WEP is outdated and easily cracked while WPA2/WPA3 provide stronger security✓

WEP is an old wireless security standard with serious flaws that can be broken quickly. WPA2 and the newer WPA3 use much stronger encryption and authentication. Networks should always use the strongest supported standard with a robust passphrase.

What is a 'zero-day' vulnerability?

• a.A security flaw unknown to the vendor and unpatched at the time it is exploited✓
• b.A vulnerability that has existed for zero days
• c.A password that expires daily
• d.A firewall that blocks all traffic

A zero-day vulnerability is a security flaw that is unknown to the software vendor and has no available patch when attackers begin exploiting it. These are especially dangerous because defenders have had no time to fix them. Rapid patching and layered defenses help mitigate the risk.

What is the role of a digital certificate in security?

• a.To store a user's photos
• b.To bind a public key to an identity and enable trust, often for HTTPS✓
• c.To increase disk space
• d.To cool the server

A digital certificate, issued by a trusted certificate authority, binds a public key to a verified identity such as a website. Browsers use certificates to confirm they are communicating with the legitimate server and to establish encrypted HTTPS connections. This underpins trust on the web.

What is 'two-factor authentication' an example of?

• a.A type of encryption algorithm
• b.A backup strategy
• c.Strengthening authentication with an additional verification step✓
• d.A network cable standard

Two-factor authentication is a form of multi-factor authentication that adds a second verification step beyond a password, such as a code from a phone. This makes accounts much harder to compromise. Even if a password is stolen, the attacker still lacks the second factor.

What is the best response when a user receives a suspicious email asking them to urgently click a link and enter their password?

• a.Do not click the link and verify the request through a trusted channel✓
• b.Immediately click and enter the password to be safe
• c.Forward it to all coworkers
• d.Reply with the password to confirm identity

Suspicious, urgent requests for credentials are classic phishing signs. The safest action is to avoid clicking the link and instead verify the request directly through a known, trusted contact or website. Reporting the email to IT or security helps protect others.