Google IT Support — All Questions

What are the three core principles of the classic information security 'CIA triad'?

• a.Compliance, Inspection, Auditing
• b.Cryptography, Identity, Authorization
• c.Confidentiality, Integrity, Availability✓
• d.Control, Isolation, Access

The CIA triad stands for Confidentiality, Integrity, and Availability. Confidentiality keeps data private, integrity ensures data is accurate and unaltered, and availability ensures systems and data are accessible when needed. These principles guide most security decisions.

What does encryption accomplish?

• a.It converts readable data into an unreadable form that only authorized parties can decode✓
• b.It permanently deletes data
• c.It compresses files to save space
• d.It speeds up data transfer

Encryption transforms plaintext into ciphertext using an algorithm and a key, making it unreadable to anyone without the correct key. This protects data confidentiality both in transit and at rest. Only authorized parties with the key can decrypt and read the data.

In the AAA security framework, what do the three A's stand for?

• a.Assign, Approve, Archive
• b.Authentication, Authorization, Accounting✓
• c.Analyze, Act, Adapt
• d.Access, Audit, Alert

AAA stands for Authentication, Authorization, and Accounting. Authentication verifies identity, authorization determines what an authenticated user may do, and accounting tracks their activity. Together they provide a structured approach to controlling and auditing access.

What is multi-factor authentication (MFA)?

• a.Using the same password on multiple sites
• b.Encrypting a hard drive twice
• c.Requiring two or more independent forms of verification to prove identity✓
• d.Logging in from multiple devices

MFA requires two or more distinct factors to authenticate, such as something you know (password), something you have (a phone or token), or something you are (a fingerprint). This greatly increases security because a stolen password alone is not enough. MFA is a strong defense against account compromise.

What is the difference between symmetric and asymmetric encryption?

• a.There is no difference
• b.Asymmetric does not use keys
• c.Symmetric uses one shared key while asymmetric uses a public/private key pair✓
• d.Symmetric is always weaker than asymmetric

Symmetric encryption uses a single shared key for both encrypting and decrypting data, which is fast but requires securely sharing the key. Asymmetric encryption uses a mathematically linked public and private key pair, allowing secure exchange without sharing a secret key. Many systems combine both for efficiency and security.

What is 'phishing'?

• a.A method of encrypting emails
• b.A type of firewall
• c.A backup technique
• d.A fraudulent attempt to trick people into revealing sensitive information✓

Phishing is a social engineering attack where criminals impersonate a trustworthy source, often via email, to trick victims into revealing passwords, financial details, or other sensitive data. Warning signs include urgent language, suspicious links, and mismatched sender addresses. User awareness is a key defense.

What is the purpose of a firewall?

• a.To defragment the hard drive
• b.To monitor and control incoming and outgoing network traffic based on rules✓
• c.To store user passwords
• d.To speed up the internet connection

A firewall inspects network traffic and permits or blocks it according to a set of security rules. It acts as a barrier between trusted internal networks and untrusted external ones. Firewalls can be hardware appliances, software, or both.

Why is 'principle of least privilege' important in security?

• a.It limits users and processes to only the access they need, reducing risk✓
• b.It increases available bandwidth
• c.It eliminates the need for passwords
• d.It makes systems boot faster

The principle of least privilege means granting users and processes only the minimum access required to perform their tasks. This limits the potential damage from compromised accounts or mistakes. It is a foundational concept in reducing an organization's attack surface.

What is malware?

• a.A hardware cooling device
• b.A type of network cable
• c.Software designed to harm, exploit, or gain unauthorized access to systems✓
• d.A legitimate operating system update

Malware is malicious software created to damage systems, steal data, or gain unauthorized access. Categories include viruses, worms, trojans, ransomware, and spyware. Antivirus software, patching, and cautious user behavior help defend against it.

What does hashing provide that plain encryption does not necessarily provide?

• a.A one-way transformation useful for verifying data integrity✓
• b.Faster internet speeds
• c.Reversible transformation of data
• d.Automatic data backups

Hashing produces a fixed-length one-way digest of data that cannot be reversed back to the original. It is commonly used to verify integrity and to store passwords securely. If input changes even slightly, the resulting hash changes significantly.

What is a VPN (Virtual Private Network) primarily used for?

• a.To increase RAM
• b.To generate stronger Wi-Fi signals
• c.To create a secure, encrypted connection over a public network✓
• d.To defragment drives

A VPN creates an encrypted tunnel between a device and a remote network over the public internet. This protects data from eavesdropping and can mask the user's location. It is widely used for secure remote access to corporate resources.

Which of the following is the strongest password practice?

• a.Using a long, unique passphrase and a password manager✓
• b.Using your birthday for easy recall
• c.Using the same short password everywhere
• d.Writing your password on a sticky note on the monitor

Strong passwords are long, unique to each account, and hard to guess, ideally managed with a password manager. Reusing passwords or choosing personal information makes accounts vulnerable. Combining strong passwords with multi-factor authentication provides even better protection.

What is 'social engineering' in the context of security?

• a.Encrypting social media posts
• b.Manipulating people into divulging information or performing insecure actions✓
• c.Building physical networks
• d.Designing social media platforms

Social engineering exploits human psychology rather than technical vulnerabilities to gain access or information. Tactics include impersonation, pretexting, and creating a false sense of urgency. Training and healthy skepticism are the best defenses against it.

What is the purpose of network hardening?

• a.To reduce vulnerabilities by disabling unnecessary services and applying secure configurations✓
• b.To add more user accounts
• c.To increase the physical length of network cables
• d.To boost the monitor refresh rate

Network hardening reduces the attack surface by closing unused ports, disabling unnecessary services, applying patches, and enforcing strong configurations. These measures make it harder for attackers to find and exploit weaknesses. Hardening is an ongoing security practice.

What does 'ransomware' do?

• a.It encrypts a victim's files and demands payment to restore access✓
• b.It backs up your files automatically
• c.It updates the operating system
• d.It speeds up the computer

Ransomware is malware that encrypts a victim's data and demands a ransom, often in cryptocurrency, in exchange for the decryption key. Reliable, offline backups are the best defense, allowing recovery without paying. Paying does not guarantee data recovery and encourages further attacks.

Why should Wi-Fi networks use WPA2 or WPA3 encryption instead of WEP?

• a.WEP supports more devices
• b.WEP is outdated and easily cracked while WPA2/WPA3 provide stronger security✓
• c.WPA3 does not use any encryption
• d.WEP is faster and more secure

WEP is an old wireless security standard with serious flaws that can be broken quickly. WPA2 and the newer WPA3 use much stronger encryption and authentication. Networks should always use the strongest supported standard with a robust passphrase.

What is a 'zero-day' vulnerability?

• a.A security flaw unknown to the vendor and unpatched at the time it is exploited✓
• b.A firewall that blocks all traffic
• c.A password that expires daily
• d.A vulnerability that has existed for zero days

A zero-day vulnerability is a security flaw that is unknown to the software vendor and has no available patch when attackers begin exploiting it. These are especially dangerous because defenders have had no time to fix them. Rapid patching and layered defenses help mitigate the risk.

What is the role of a digital certificate in security?

• a.To increase disk space
• b.To cool the server
• c.To bind a public key to an identity and enable trust, often for HTTPS✓
• d.To store a user's photos

A digital certificate, issued by a trusted certificate authority, binds a public key to a verified identity such as a website. Browsers use certificates to confirm they are communicating with the legitimate server and to establish encrypted HTTPS connections. This underpins trust on the web.

What is 'two-factor authentication' an example of?

• a.A network cable standard
• b.Strengthening authentication with an additional verification step✓
• c.A backup strategy
• d.A type of encryption algorithm

Two-factor authentication is a form of multi-factor authentication that adds a second verification step beyond a password, such as a code from a phone. This makes accounts much harder to compromise. Even if a password is stolen, the attacker still lacks the second factor.

What is the best response when a user receives a suspicious email asking them to urgently click a link and enter their password?

• a.Do not click the link and verify the request through a trusted channel✓
• b.Reply with the password to confirm identity
• c.Immediately click and enter the password to be safe
• d.Forward it to all coworkers

Suspicious, urgent requests for credentials are classic phishing signs. The safest action is to avoid clicking the link and instead verify the request directly through a known, trusted contact or website. Reporting the email to IT or security helps protect others.