CSLB General Building (B) — All Questions

A user receives an email that appears to be from the company's bank, urging them to click a link and confirm their password immediately. What type of attack is this?

• a.Phishing✓
• b.DDoS
• c.SQL injection
• d.Zero-day exploit

Phishing uses fraudulent messages impersonating a trusted party to trick users into revealing credentials or clicking malicious links. A DDoS floods a service with traffic, and SQL injection targets databases, neither of which fits this scenario.

Which type of malware encrypts a victim's files and demands payment in exchange for the decryption key?

• a.Rootkit
• b.Ransomware✓
• c.Keylogger
• d.Adware

Ransomware encrypts data and extorts the victim for a decryption key, often with a deadline. A keylogger records keystrokes, a rootkit hides deep in the system, and adware displays unwanted ads.

An attacker follows an authorized employee through a secured door before it closes, without presenting their own badge. What is this physical technique called?

• a.Phishing
• b.Shoulder surfing
• c.Tailgating✓
• d.Whaling

Tailgating (piggybacking) is when an unauthorized person follows an authorized one through a controlled entrance. Shoulder surfing is watching someone enter credentials. Whaling is phishing that targets executives.

Which authentication approach requires two or more independent factors, such as a password plus a code from an authenticator app?

• a.Single sign-on
• b.Least privilege
• c.Access control list
• d.Multifactor authentication✓

Multifactor authentication (MFA) combines factors from different categories (something you know, have, or are), such as a password plus an app code. Single sign-on centralizes logins but is not inherently multifactor.

Which practice grants each user only the minimum permissions needed to perform their job, reducing the impact of a compromised account?

• a.Principle of least privilege✓
• b.Open sharing
• c.Default allow
• d.Full administrator access for all

The principle of least privilege limits users to the access their role requires, shrinking the attack surface if an account is compromised. Granting everyone administrator rights greatly increases risk.

Which type of malware disguises itself as legitimate software to trick a user into installing it, then performs malicious actions in the background?

• a.Worm
• b.Trojan horse✓
• c.Boot sector virus
• d.Logic bomb

A Trojan horse masquerades as a useful program to get installed, then carries a hidden malicious payload. A worm self-replicates across networks, and a logic bomb triggers on a condition rather than relying on disguise.

A technician wants to protect a laptop's data so it cannot be read if the device is lost or stolen. Which control best achieves this?

• a.A screen saver
• b.A stronger Wi-Fi password
• c.Full-disk encryption✓
• d.Disabling the firewall

Full-disk encryption renders stored data unreadable without the key, protecting it if the hardware is lost or stolen. A screen saver or Wi-Fi password does not protect data at rest on the drive.

Which social engineering tactic involves an attacker impersonating IT support over the phone to convince a user to reveal their password?

• a.Tailgating
• b.Evil twin
• c.Dumpster diving
• d.Vishing✓

Vishing is voice phishing, where the attacker uses a phone call and pretext (such as posing as IT) to extract sensitive information. Dumpster diving searches discarded materials, and an evil twin is a rogue Wi-Fi access point.

Which Windows security feature filters inbound and outbound network traffic based on configurable rules to help block unauthorized connections?

• a.Windows Defender Firewall✓
• b.Disk Cleanup
• c.Task Manager
• d.Snipping Tool

Windows Defender Firewall inspects network traffic and permits or blocks it according to rules, helping stop unauthorized connections. The other tools do not perform network filtering.

When disposing of drives that held sensitive data, which method most reliably prevents any data recovery from a hard disk drive?

• a.Quick formatting the drive
• b.Physical destruction (shredding or drilling)✓
• c.Moving files to the Recycle Bin
• d.Renaming the files

Physical destruction such as shredding or drilling reliably prevents recovery from a magnetic hard drive. A quick format and Recycle Bin deletion leave data recoverable, and renaming does nothing to remove data.

Which term describes a previously unknown software vulnerability that attackers exploit before the vendor has released a patch?

• a.Brute-force attack
• b.Man-in-the-middle
• c.Zero-day vulnerability✓
• d.Replay attack

A zero-day vulnerability is a flaw unknown to the vendor, giving defenders zero days to patch before exploitation. A brute-force attack guesses credentials and a replay attack reuses captured data.

Which of the following is the strongest wireless encryption standard a technician should select when configuring a modern home or small-office router?

• a.WEP
• b.WPA
• c.WPS
• d.WPA3✓

WPA3 is the newest and strongest Wi-Fi security standard, improving on WPA2 with better key exchange. WEP and the original WPA are outdated and insecure, and WPS is a convenience feature that can weaken security.

Which best practice reduces the risk that a stolen password alone can compromise an account?

• a.Requiring multifactor authentication✓
• b.Reusing one password everywhere
• c.Disabling account lockout
• d.Writing passwords on a sticky note

Requiring MFA means a stolen password is not enough because an additional factor is needed. Reusing passwords and disabling lockout increase exposure, and writing passwords down risks disclosure.

A pop-up claims the computer is infected and urges the user to call a phone number for paid removal help. What is this most likely an example of?

• a.A legitimate antivirus alert
• b.A rogue/fake security alert (scareware)✓
• c.A Windows Update notice
• d.A driver installation prompt

Scareware displays alarming fake alerts to pressure users into calling scammers or buying useless software. Legitimate antivirus tools do not ask users to call an unknown number. Treat such pop-ups as social engineering.

Which access-control concept assigns permissions to users based on their job function or group rather than individually?

• a.Full disk encryption
• b.Port forwarding
• c.Role-based access control✓
• d.MAC address filtering

Role-based access control (RBAC) grants permissions according to a user's role or group, simplifying administration and enforcing consistency. The other options relate to encryption or networking, not permission assignment.

A user wants to prevent unauthorized people from reading over their shoulder as they type a password in a public place. Which countermeasure is most directly relevant?

• a.Enabling a firewall
• b.Updating antivirus
• c.Using a longer Wi-Fi key
• d.Using a privacy screen filter and shielding the keyboard✓

A privacy screen filter narrows viewing angles and shielding the keyboard defeats shoulder surfing in public. Firewalls, antivirus, and Wi-Fi keys do not stop someone physically observing the screen or keystrokes.

Which characteristic makes a password policy stronger against brute-force and dictionary attacks?

• a.Increased length and complexity✓
• b.Using the username as the password
• c.Never expiring shared passwords
• d.Disabling case sensitivity

Longer, more complex passwords dramatically increase the number of combinations an attacker must try. Using the username or a shared, never-expiring credential makes guessing trivial and weakens security.

Which type of malware is specifically designed to hide its presence and maintain privileged access, often loading before the operating system fully starts?

• a.Adware
• b.Rootkit✓
• c.Spyware
• d.Ransomware

A rootkit conceals itself and other malware while retaining privileged control, sometimes hooking into the boot process. Adware merely shows ads and spyware collects data, but neither is defined primarily by deep stealth.

Which authentication factor category does a fingerprint or facial scan belong to?

• a.Something you know
• b.Something you have
• c.Something you are✓
• d.Somewhere you are

Biometrics such as fingerprints and facial scans are 'something you are'. Passwords are 'something you know' and a token or phone is 'something you have'. Combining categories yields multifactor authentication.

A company wants to make sure former employees can no longer access systems the moment they leave. Which practice addresses this?

• a.Sharing one admin account
• b.Ignoring account audits
• c.Leaving accounts enabled indefinitely
• d.Promptly disabling accounts during offboarding✓

Disabling accounts immediately during offboarding removes access when an employee departs. Shared admin accounts and dormant enabled accounts create lingering, hard-to-attribute access that attackers can exploit.

Which term describes an attacker setting up a rogue Wi-Fi access point with the same name as a legitimate network to intercept traffic?

• a.Evil twin✓
• b.Tailgating
• c.Watering hole
• d.SQL injection

An evil twin is a malicious access point impersonating a trusted SSID so victims connect and expose their traffic. Tailgating is a physical intrusion and SQL injection targets databases, not wireless clients.

What is the primary security benefit of keeping operating systems and applications patched and up to date?

• a.It increases screen brightness
• b.It closes known vulnerabilities before they can be exploited✓
• c.It removes the need for backups
• d.It disables all user accounts

Patching remediates known vulnerabilities, reducing the window in which attackers can exploit them. It does not replace backups, alter brightness, or disable accounts.

Which practice helps protect users from entering credentials on a fraudulent website that mimics a real one?

• a.Disabling the firewall
• b.Turning off automatic updates
• c.Verifying the site's URL and valid HTTPS certificate✓
• d.Reusing the same password everywhere

Checking the exact domain and confirming a valid HTTPS certificate helps users detect lookalike phishing sites before entering credentials. Disabling the firewall or reusing passwords increases risk rather than reducing it.

Which control ensures that a mobile device's data can be erased remotely if the device is lost or stolen?

• a.A louder ringtone
• b.Disabling encryption
• c.Turning off the passcode
• d.Remote wipe capability✓

Remote wipe lets an administrator or user erase a lost or stolen device's data over the network. Disabling encryption or the passcode would weaken protection, and ringtones are irrelevant to data safety.

Which practice ensures that a critical account remains protected even if its password is exposed in a data breach elsewhere?

• a.Reusing the same password across sites
• b.Enabling multifactor authentication and using a unique password✓
• c.Writing the password in a shared document
• d.Disabling the login screen

A unique password combined with multifactor authentication means a password leaked from another site cannot alone unlock the account. Reusing passwords or sharing them in documents spreads the risk of a single breach.