CompTIA Security+ — All Questions

Which type of encryption uses the same key to encrypt and decrypt data?

• a.Asymmetric
• b.Hashing
• c.Symmetric✓
• d.Steganographic

Symmetric encryption uses a single shared secret key for both encryption and decryption, such as AES. It is fast and suited to bulk data. The main challenge is securely distributing the shared key.

Which cryptographic method uses a public and private key pair?

• a.Asymmetric encryption✓
• b.Salting
• c.Hashing
• d.Symmetric encryption

Asymmetric encryption uses a mathematically linked key pair: a public key to encrypt and a private key to decrypt, or the reverse for signatures. It solves the key distribution problem of symmetric systems. RSA and elliptic curve are common examples.

Which one-way function produces a fixed-length value that cannot be reversed to the original input?

• a.Steganography
• b.Symmetric cipher
• c.Hashing✓
• d.Tokenization

Hashing transforms input into a fixed-length digest that cannot be feasibly reversed. It verifies integrity because any change to the input changes the hash. SHA-256 is a widely used secure hashing algorithm.

Adding a unique random value to each password before hashing to defeat precomputed attacks is called:

• a.Salting✓
• b.Peppering
• c.Stretching
• d.Encoding

Salting prepends or appends a unique random value to each password before hashing. This ensures identical passwords produce different hashes and defeats rainbow tables. Each salt must be unique and stored alongside the hash.

Which entity in a PKI issues and signs digital certificates?

• a.Key escrow agent
• b.Certificate authority✓
• c.Registration authority
• d.Certificate holder

A certificate authority (CA) issues, signs, and vouches for digital certificates, binding a public key to an identity. Trust in the CA underpins the entire PKI. A compromised CA can undermine trust for all certificates it issued.

Which mechanism lets a client quickly check whether a single certificate has been revoked?

• a.Certificate pinning
• b.Key stretching
• c.Online Certificate Status Protocol✓
• d.Certificate signing request

The Online Certificate Status Protocol (OCSP) queries a responder in real time to check a certificate's revocation status. It is faster and more current than downloading a full certificate revocation list. OCSP stapling improves performance and privacy.

What does a digital signature primarily provide?

• a.Integrity and non-repudiation✓
• b.Availability
• c.Faster encryption
• d.Confidentiality only

A digital signature proves the message came from the holder of the private key and was not altered, giving integrity, authentication, and non-repudiation. It does not by itself keep the content secret. It is created by encrypting a hash with the signer's private key.

Which authentication factor category does a fingerprint belong to?

• a.Something you are✓
• b.Something you know
• c.Something you have
• d.Somewhere you are

A fingerprint is a biometric, which is the 'something you are' factor based on physical characteristics. Combining it with a different factor, such as a password, creates multifactor authentication. Biometrics resist sharing but raise privacy and revocation concerns.

Requiring a password plus a one-time code from a phone app is an example of:

• a.Role-based access
• b.Federation
• c.Multifactor authentication✓
• d.Single sign-on

Multifactor authentication combines two or more independent factor categories, here something you know and something you have. This greatly reduces the risk from a stolen password alone. An attacker would need to defeat both factors.

Which access control model grants permissions based on a user's assigned job function?

• a.Rule-based access control
• b.Mandatory access control
• c.Discretionary access control
• d.Role-based access control✓

Role-based access control (RBAC) assigns permissions to roles, and users inherit access by being placed in a role. It simplifies administration and enforces consistency. Changing a role updates access for everyone assigned to it.

Which model uses security labels and clearances, common in government, where the system enforces access centrally?

• a.Discretionary access control
• b.Attribute-based access control
• c.Mandatory access control✓
• d.Role-based access control

Mandatory access control (MAC) enforces access based on classification labels and clearances set by a central authority. Users cannot change permissions on resources they own. It is used where strict, non-discretionary control is required.

Which secure protocol replaces Telnet for encrypted remote command-line access?

• a.HTTP
• b.SNMPv1
• c.FTP
• d.SSH✓

Secure Shell (SSH) provides encrypted remote administration, replacing the plaintext Telnet protocol. It protects credentials and session data in transit. SSH also underpins secure file transfer and tunneling.

Which protocol secures web traffic by encrypting HTTP with TLS?

• a.SMTP
• b.LDAP
• c.SFTP
• d.HTTPS✓

HTTPS layers HTTP over TLS to encrypt web traffic, protecting confidentiality and integrity between browser and server. It also authenticates the server through its certificate. Modern sites should use TLS 1.2 or 1.3 with strong ciphers.

Which protocol provides secure file transfer by running over an SSH connection?

• a.TFTP
• b.FTPS
• c.SFTP✓
• d.HTTP

SFTP transfers files over an SSH channel, encrypting both credentials and data. It differs from FTPS, which is FTP secured with TLS. SFTP uses a single connection, simplifying firewall configuration.

Which technology creates an encrypted tunnel for remote users to access a private network over the internet?

• a.DMZ
• b.NAT
• c.VPN✓
• d.Proxy

A virtual private network (VPN) establishes an encrypted tunnel over an untrusted network, protecting traffic between the remote user and the corporate network. It preserves confidentiality and integrity in transit. IPsec and TLS are common VPN foundations.

Which single sign-on standard is widely used to exchange authentication data between identity providers and web applications?

• a.TACACS+
• b.SAML✓
• c.RADIUS
• d.Kerberos

Security Assertion Markup Language (SAML) exchanges authentication and authorization assertions between an identity provider and service providers, enabling web single sign-on. The identity provider vouches for the user so each application does not manage passwords. It is common in enterprise federation.

Replacing sensitive data such as a credit card number with a non-sensitive substitute value is called:

• a.Tokenization✓
• b.Hashing
• c.Salting
• d.Compression

Tokenization swaps sensitive data for a meaningless token, keeping the real value in a secure vault. The token has no exploitable value if stolen. It is widely used to reduce the scope of payment card data handling.

A dedicated hardware device that securely generates and stores cryptographic keys is a:

• a.Proximity token
• b.TPM
• c.Smart card
• d.Hardware security module✓

A hardware security module (HSM) is a tamper-resistant device that generates, stores, and manages cryptographic keys and performs crypto operations. It keeps keys isolated from general-purpose systems. HSMs are common in PKI and high-assurance environments.

Which chip on a motherboard stores keys and supports features like full-disk encryption and secure boot?

• a.Smart card
• b.CPU cache
• c.HSM
• d.Trusted Platform Module✓

The Trusted Platform Module (TPM) is a chip integrated into a device that securely stores keys and measurements for boot integrity and disk encryption. It binds encryption to specific hardware. It underpins features like BitLocker and secure boot.

Which property ensures a sender cannot later deny having sent a signed message?

• a.Availability
• b.Non-repudiation✓
• c.Anonymity
• d.Confidentiality

Non-repudiation prevents a party from convincingly denying an action, such as sending a digitally signed message. It relies on the private key being unique to the signer. Digital signatures and reliable logs provide non-repudiation.

A bank requires customers to enter a password and then approve a push notification on their enrolled phone before accessing their account. Which authentication factors are being combined?

• a.Two separate instances of something you know, which does not truly raise assurance
• b.Something you know and something you have✓
• c.Something you are and somewhere you are, tied to a physical biometric location
• d.Something you have and something you do, based on continuous behavioral analysis

The password is knowledge (something you know) and the enrolled phone is possession (something you have), so two distinct factor categories are combined. Genuine multifactor authentication requires categories that fail independently, so stealing one does not defeat the other. Two passwords would still be a single category and add little assurance.

An organization deploys single sign-on so employees authenticate once to reach many applications. What is the primary security trade-off administrators must plan for?

• a.A compromised SSO credential can unlock every connected application at once✓
• b.Encryption of network traffic between the applications is automatically disabled by design
• c.Users are forced to memorize a separate, complex password for every individual application they use
• d.Applications can no longer share any authentication information between one another

SSO concentrates risk because one authentication grants access to many systems, so a stolen SSO credential becomes a master key. That is why SSO should be paired with strong MFA and session controls. The convenience of one login is exactly what raises the stakes if it is compromised.

A user logs into a partner's cloud application using their own company credentials, and the company's identity system vouches for them. In this federated setup, what role does the company's identity system play?

• a.Certificate authority that signs the TLS certificate presented by the application
• b.Service provider, which hosts the partner application and stores its user data
• c.Relying party that consumes the assertion and makes the final resource decision
• d.Identity provider that authenticates the user and issues assertions✓

In federation the identity provider (IdP) authenticates the user and issues a signed assertion, while the partner acts as the service provider or relying party that trusts it. This lets users access external apps without those apps ever handling company passwords. Distinguishing the IdP from the SP is central to understanding SAML and OIDC flows.

A photo-printing website asks to access a user's cloud photo library without ever seeing the user's cloud password, using a delegated access token. Which framework is being used?

• a.OAuth 2.0✓
• b.Kerberos, which issues time-limited tickets for authentication inside a single domain
• c.RADIUS, which centralizes network access authentication, authorization, and accounting
• d.SAML, an XML-based standard used mainly for enterprise browser single sign-on assertions

OAuth 2.0 is an authorization framework that issues scoped access tokens so one service can act on a user's behalf without receiving their password. It delegates access, not identity, which is why scopes limit what the token can do. Limiting scope and token lifetime is key to using it safely.

A developer needs not just delegated access but also verified identity information about the user, returned in a signed ID token. Which protocol layered on OAuth 2.0 provides this?

• a.802.1X
• b.LDAP
• c.TACACS+, which separates authentication, authorization, and accounting for device admin
• d.OpenID Connect✓

OpenID Connect adds an identity layer on top of OAuth 2.0, returning a signed ID token that proves who the user is. OAuth alone handles authorization, so OIDC is what supplies authenticated identity. This distinction is why OIDC is used for modern web and mobile sign-in.

In a Windows domain, a workstation presents a time-stamped ticket to reach a file server without re-entering a password. Why does Kerberos rely on tightly synchronized clocks across the domain?

• a.Because tickets are stored permanently and never expire once they are issued to a host
• b.Because time stamps limit ticket validity and help prevent replay attacks✓
• c.Because the key distribution center encrypts all file contents using the workstation clock
• d.Because domain controllers bill each user for the exact number of seconds of access used

Kerberos tickets carry time stamps and short lifetimes, so synchronized clocks let servers reject stale or replayed tickets. If clocks drift too far apart, valid tickets are refused and stale ones might be accepted. This is why time synchronization is a hard requirement in Kerberos realms.

An administrator notices directory queries and bind credentials are traveling in cleartext over port 389. Which change encrypts this directory traffic?

• a.Disable anonymous binds but keep the existing plaintext connection on port 389
• b.Move the directory server into the screened subnet that faces the public internet
• c.Use LDAPS, wrapping LDAP in TLS on port 636✓
• d.Switch the directory to broadcast its queries over UDP so that lookups complete faster

LDAPS encapsulates LDAP inside TLS, typically on port 636, encrypting both queries and bind credentials in transit. Cleartext LDAP exposes directory passwords to any on-path attacker. Encrypting the channel, not just restricting binds, is what protects the credentials.

A network team wants centralized administrator login to routers with the ability to authorize individual commands and log each one separately. Which protocol best fits because it separates authentication, authorization, and accounting?

• a.TACACS+✓
• b.SAML, an assertion format used mostly for browser-based web single sign-on flows
• c.RADIUS, which combines the authentication and authorization steps into a single exchange
• d.Kerberos, which is designed for domain single sign-on using time-limited tickets

TACACS+ separates authentication, authorization, and accounting into independent functions, enabling per-command authorization and detailed logging for device administration. RADIUS merges authentication and authorization, giving less granular command control. This separation is why TACACS+ is favored for network device admin.

To reduce standing administrative rights, a company grants elevated access only for a short approved window and records the session. Which control is this?

• a.Mandatory access control, enforcing sensitivity labels assigned by a central authority
• b.Privileged access management with just-in-time elevation✓
• c.Discretionary access control, letting each resource owner set their own file permissions
• d.Single sign-on, which authenticates the user once for access to many applications

Privileged access management with just-in-time elevation removes always-on admin rights, granting them briefly on request and recording the activity. This shrinks the window an attacker can abuse stolen admin credentials. Time-boxing and session recording are what distinguish it from static privileged accounts.

A DevOps team stops hardcoding database passwords in scripts and instead retrieves them at runtime from a centralized secrets manager that rotates them automatically. What risk does this primarily reduce?

• a.The risk of exposed, static, long-lived credentials embedded directly in source code✓
• b.The risk that end users will choose weak passphrases for their own personal accounts
• c.The risk that TLS certificates will silently expire and break client connections later
• d.The risk of denial-of-service caused by too many simultaneous inbound connections

A secrets manager keeps credentials out of code and rotates them, so a leaked repository or old backup no longer hands attackers valid passwords. Hardcoded secrets are long-lived and hard to rotate once exposed. Centralized, rotating retrieval directly addresses that exposure.

An access system evaluates the user's department, the device's health, the time of day, and data sensitivity before allowing a request. Which access control model is described?

• a.Discretionary access control, where the owner of the resource decides who may access it
• b.Attribute-based access control✓
• c.Rule-based access control, applying one fixed access list equally to every single user
• d.Role-based access control, which grants permissions strictly by the user's assigned job role

Attribute-based access control (ABAC) makes decisions from multiple attributes of the user, device, resource, and context, enabling fine-grained, dynamic policies. Role-based control keys only on job role and is less context-aware. Combining many attributes is the defining trait of ABAC.

A cloud platform blocks logins from unmanaged devices and requires MFA when a sign-in comes from an unusual country. What is this adaptive approach called?

• a.Implicit trust, which grants access automatically to anyone already inside the network
• b.Full-disk encryption, which protects data stored locally on the endpoint while at rest
• c.Conditional access based on risk and device posture✓
• d.Static access lists that never change regardless of context or the current risk signals

Conditional access evaluates signals such as device compliance, location, and risk to decide whether and how to grant access, stepping up authentication when risk rises. It embodies zero-trust thinking by never trusting a session on network location alone. Adapting requirements to context is its central idea.

A security team tuning a fingerprint reader wants the setting where the false acceptance rate equals the false rejection rate, used to compare device accuracy. What is this point called?

• a.Crossover error rate✓
• b.The annualized rate of occurrence of an unauthorized person entering through the door
• c.The single loss expectancy associated with one individual failed authentication event
• d.The maximum tolerable downtime allowed before the failed reader has to be replaced

The crossover error rate (CER) is where false acceptance and false rejection rates are equal, giving a single number to compare biometric accuracy. A lower CER means a more accurate sensor overall. It lets teams tune sensitivity while understanding the balance between wrongly admitting and wrongly rejecting users.

During an audit, several active accounts belong to employees who left the company months ago. Which identity lifecycle failure does this reveal?

• a.Failure to deprovision accounts promptly at offboarding✓
• b.Improper encryption of the directory database in which the user accounts are stored
• c.Excessive multifactor prompts that cause users to approve push requests carelessly
• d.Weak password complexity requirements enforced at the moment of initial account creation

Leftover active accounts show a breakdown in deprovisioning, the offboarding step that disables access when someone leaves. Orphaned accounts are prime targets because no one monitors them. Tying account deactivation to HR offboarding prevents this gap.

An engineer needs to encrypt large volumes of stored data quickly using a single shared key and selects AES. Why is a symmetric cipher like AES preferred here over an asymmetric one?

• a.Because asymmetric ciphers are technically unable to encrypt data of any size at all
• b.Because AES automatically distributes its own keys with no coordination required at all
• c.Because symmetric encryption uniquely provides non-repudiation of the original sender
• d.Because symmetric ciphers are much faster for bulk data encryption✓

Symmetric ciphers such as AES are far faster and less compute-intensive than asymmetric algorithms, making them ideal for encrypting large data volumes. Asymmetric crypto is slow and typically used only to exchange keys or sign. Speed on bulk data is the reason AES is chosen here.

A protocol encrypts a real-time voice stream one bit or byte at a time as it is generated, rather than in fixed 128-bit blocks. Which cipher type suits this continuous data best?

• a.An asymmetric cipher, using the recipient's public key to protect each individual byte
• b.A stream cipher✓
• c.A hashing algorithm, which produces a fixed digest and cannot be reversed to plaintext
• d.A block cipher in ECB mode, which encrypts every identical block in exactly the same way

A stream cipher encrypts data continuously, bit or byte at a time, which fits real-time streams like voice where data arrives incrementally. Block ciphers work on fixed-size chunks and can add latency or padding. Matching the cipher to the data flow is the key idea here.

Two parties who have never met need to agree on a shared secret over an open network without ever transmitting the secret itself. Which mechanism enables this?

• a.A certificate revocation list distributed to every client on the network on a daily basis
• b.A cryptographic hash function applied to each party's public identity string on both ends
• c.Diffie-Hellman key exchange✓
• d.Symmetric AES encryption using a key that must already be shared beforehand in person

Diffie-Hellman lets two parties derive a shared secret over an untrusted channel without sending the secret, using public exchanges and private values. It solves the bootstrapping problem of symmetric keys. This is why it underpins secure session establishment in protocols like TLS.

A security architect wants assurance that if a server's long-term private key is later stolen, past recorded TLS sessions still cannot be decrypted. Which property, achieved with ephemeral keys, provides this?

• a.Perfect forward secrecy✓
• b.Non-repudiation, which proves which specific party originally sent each recorded message
• c.Certificate pinning, which hardcodes an expected certificate directly into the client app
• d.Key escrow, which stores a recoverable copy of the key with a trusted third-party agent

Perfect forward secrecy uses ephemeral, per-session keys that are discarded, so compromising the long-term key does not expose previously recorded sessions. Each session's secret is independent of the server's static key. This limits the blast radius of a future key theft.

A mobile device team wants strong asymmetric security with smaller keys and lower power use than RSA. Which algorithm family meets this need?

• a.SHA-3, a hashing standard that only produces fixed-length integrity digests of data
• b.AES, a symmetric block cipher that is entirely unrelated to public-key operations
• c.Elliptic curve cryptography✓
• d.RSA with 4096-bit keys, maximizing key length regardless of the device's battery life

Elliptic curve cryptography achieves comparable security to RSA with much smaller keys, reducing computation, memory, and power draw. This efficiency suits constrained mobile and IoT devices. Smaller keys for equivalent strength are ECC's defining advantage.

To make stored password hashes far more expensive to crack, a developer chooses an algorithm deliberately designed to be slow and memory-hard, such as Argon2 or bcrypt. What is this technique called?

• a.Tokenization, which replaces the password with an unrelated reference value in a vault
• b.Certificate stapling, which attaches a signed revocation status to the TLS handshake
• c.Steganography, which conceals the password inside an unrelated image or media file
• d.Key stretching✓

Key stretching applies deliberately slow, resource-intensive functions like bcrypt, PBKDF2, or Argon2 so each password guess costs an attacker significant time. This blunts brute-force and dictionary attacks against stolen hashes. Intentional slowness is exactly the point of the technique.

An API includes a keyed hash with each message so the receiver can confirm both that the content is unchanged and that it came from a party sharing the secret key. What is this construct?

• a.A digital certificate that was issued and signed by a publicly trusted authority
• b.A symmetric AES ciphertext block chained to the previously encrypted message block
• c.A plain SHA-256 digest, which verifies integrity but says nothing about the sender
• d.An HMAC✓

A hash-based message authentication code (HMAC) combines a shared secret key with a hash, providing both integrity and authenticity. A plain hash detects change but not who produced it. Mixing in the secret key is what proves the message came from a key holder.

Before a certificate authority can issue a TLS certificate, an admin generates a request containing the server's public key and identifying details, signed by the matching private key. What is this request called?

• a.A certificate signing request✓
• b.A certificate revocation list, which enumerates the certificates that are no longer trusted
• c.A key escrow deposit that places a recoverable copy of the private key with a third party
• d.An online certificate status protocol response confirming a certificate's validity in real time

A certificate signing request (CSR) packages the public key and identity information and is signed by the corresponding private key to prove key ownership. The CA validates it before issuing a signed certificate. The private key itself never leaves the requester, which is why only the CSR is sent.

To limit exposure of its most trusted key, an organization keeps its root CA offline and issues day-to-day certificates from a subordinate CA. What is the main security benefit?

• a.Clients can skip verifying the certificate chain entirely because the root is offline
• b.The intermediate CA removes the need to ever renew certificates before they expire
• c.The offline root key stays protected while the intermediate handles routine issuance✓
• d.Certificates no longer need to be validated against any revocation source by clients

Keeping the root CA offline protects the most critical key, while an intermediate CA does everyday signing. If an intermediate is compromised it can be revoked without destroying the entire trust hierarchy. This tiered design contains damage and preserves the root's integrity.

A high-traffic site wants clients to learn a certificate's revocation status without each client separately querying the CA, reducing latency and privacy leakage. Which approach fits?

• a.Pinning the certificate so the client rejects any other certificate that is presented
• b.Distributing a full certificate revocation list to every visiting browser once every hour
• c.Disabling revocation checking entirely in order to speed up the TLS handshake time
• d.OCSP stapling✓

OCSP stapling has the server periodically fetch a signed revocation status and attach it to the TLS handshake, so clients get proof without contacting the CA themselves. This cuts latency and stops the CA from seeing which clients visit. The server, not each client, does the checking.

A mobile banking app hardcodes the expected server certificate so that even a fraudulent but validly-signed certificate from another CA is rejected. This defense is called:

• a.Certificate pinning✓
• b.Key stretching, which slows down brute-force attempts against stored password hashes
• c.Wildcard certification, covering every subdomain under one shared certificate at once
• d.Cross-certification between two otherwise independent certificate authority hierarchies

Certificate pinning embeds the expected certificate or key in the app so it refuses any other certificate, even one a CA would normally trust. This blocks man-in-the-middle attacks using rogue but validly issued certificates. The trade-off is that pinned certificates must be updated before they change.

A company wants one certificate to secure store.example.com, mail.example.com, and any other host under example.com. Which certificate type covers all subdomains at one level?

• a.A code-signing certificate that is used to prove the authorship of software binaries
• b.An extended validation certificate that requires rigorous vetting of the organization
• c.A self-signed certificate that is generated without any external authority involved at all
• d.A wildcard certificate✓

A wildcard certificate uses a name like *.example.com to secure any single-level subdomain, simplifying management. The convenience comes with risk, since one compromised private key affects every covered host. Understanding its scope and shared-key risk is the exam point.

An internal test server presents a certificate that no public CA vouches for, so browsers warn users. Why does a self-signed certificate trigger this warning?

• a.Because no trusted third party has verified the certificate's authenticity✓
• b.Because self-signed certificates are hardcoded to expire within twenty-four hours only
• c.Because self-signed certificates always use a weaker cipher than CA-issued certificates
• d.Because the private key is automatically published alongside the certificate's public key

A self-signed certificate is not vouched for by any CA in the browser's trust store, so the client cannot confirm the server's identity and warns the user. The encryption strength can be identical; the issue is missing third-party validation. Trust chaining, not cipher strength, is what is absent.

So encrypted data is not permanently lost when an employee leaves or forgets a passphrase, an organization stores a protected recovery copy of decryption keys with a trusted custodian. This practice is:

• a.Certificate pinning, which hardcodes a trusted certificate to detect fraudulent impostors
• b.Perfect forward secrecy, which isolates each session's keys from the long-term server key
• c.Salting, which adds a unique random value to every password before it is hashed and stored
• d.Key escrow✓

Key escrow stores a recoverable copy of cryptographic keys with a trusted party so data can be recovered if the original key is lost. It supports business continuity but also creates a high-value target that must be tightly controlled. The recovery copy is the essence of escrow.

Anticipating that today's algorithms may weaken over time, an architect designs systems so cryptographic algorithms can be swapped with minimal disruption. This design goal is called:

• a.Steganographic embedding of secret data within ordinary-looking image or media files
• b.Cryptographic agility✓
• c.Homomorphic encryption, which allows computation to be performed directly on ciphertext
• d.Ephemeral keying, which discards each session's keys immediately after the exchange ends

Cryptographic agility is designing systems so algorithms and key sizes can be replaced as standards evolve or weaknesses emerge. It matters because ciphers age and quantum computing threatens some today. Building in swap-ability avoids costly rip-and-replace later.

Before publishing a software update, a vendor signs the installer with its private key so users can verify the code's origin and that it was not modified. Which control is this?

• a.Code signing✓
• b.A certificate revocation list, which clients consult before installing any new software
• c.Tokenization, which substitutes sensitive values with non-sensitive placeholder tokens
• d.Full-disk encryption, which protects data stored at rest on the end user's local device

Code signing attaches a digital signature to software so users can confirm the publisher and detect tampering before running it. A broken or missing signature signals modification or an untrusted source. This provides integrity and authenticity for distributed code.

An executive needs to send email that is both encrypted and digitally signed using certificate-based keys. Which standard provides this for email messages?

• a.DKIM, which attaches a domain signature to message headers for server-side verification
• b.DMARC, which tells receiving servers how to handle messages that fail alignment checks
• c.SPF, which lists the mail servers that are authorized to send for a given domain name
• d.S/MIME✓

S/MIME uses certificates and key pairs to encrypt and digitally sign individual email messages, giving confidentiality, integrity, and authentication at the message level. SPF, DKIM, and DMARC authenticate the sending domain but do not encrypt the message body. Per-message signing and encryption are what S/MIME adds.

A team discovers two different files produce the same MD5 digest, letting an attacker substitute a malicious file undetected. What weakness does this demonstrate?

• a.A hash collision in a broken algorithm✓
• b.A downgrade attack forcing negotiation of an older and weaker TLS protocol version
• c.A replay attack that reuses previously captured authentication credentials on a service
• d.A brute-force attack succeeding against an otherwise strong password hashing scheme

A hash collision occurs when two different inputs produce the same digest, and MD5 and SHA-1 are broken because collisions can be engineered. This lets an attacker swap a benign file for a malicious one with a matching hash. Using collision-resistant algorithms like SHA-256 prevents it.

Two users choose the identical password, yet their stored hashes differ because a unique random value was added to each before hashing. What is that per-password value?

• a.A salt✓
• b.A pepper, which is a single secret value shared across every password in the whole system
• c.A nonce that is transmitted openly to the client during every login handshake attempt
• d.An initialization vector reused to chain each successive block of ciphertext together

A salt is a unique random value added to each password before hashing, so identical passwords yield different hashes and precomputed rainbow tables fail. A pepper, by contrast, is a single secret applied to all passwords. Per-password uniqueness is what distinguishes a salt.

TLS encrypts the bulk session with a fast symmetric key but uses the server's public key only to protect that symmetric key during setup. Combining both this way is known as:

• a.Steganography, which hides the symmetric key inside an innocuous cover image or file
• b.Hybrid encryption using a digital envelope✓
• c.A hash-based message authentication code applied across the entire encrypted data stream
• d.Key escrow, which deposits session keys with a neutral third-party recovery custodian

Hybrid encryption uses fast symmetric encryption for the data and slower asymmetric encryption only to protect the symmetric key, a pattern called a digital envelope. This captures the speed of symmetric crypto and the key-distribution ease of asymmetric crypto. TLS relies on exactly this combination.

To stop attackers from feeding forged DNS responses to clients, an organization signs its DNS records so resolvers can cryptographically verify their authenticity. Which extension provides this?

• a.A web application firewall that inspects inbound HTTP requests for injection patterns
• b.A virtual private network that tunnels all client traffic back to the headquarters site
• c.Network address translation, which hides many internal hosts behind one public address
• d.DNSSEC✓

DNSSEC adds digital signatures to DNS records so resolvers can verify responses are authentic and unmodified, defeating cache poisoning and spoofing. It provides origin authentication and integrity but not confidentiality. Signed records are what let a resolver trust an answer.

A site-to-site VPN must both encrypt payloads and authenticate them between two gateways, protecting the entire original IP packets. Which IPsec component and mode apply?

• a.The TLS record protocol, which secures application streams rather than raw IP packets
• b.GRE encapsulation alone, which forwards packets without providing any confidentiality
• c.ESP in tunnel mode✓
• d.AH in transport mode, which authenticates the packet but does not encrypt the payload

Encapsulating Security Payload (ESP) provides both encryption and authentication, and tunnel mode wraps the entire original IP packet, which suits gateway-to-gateway VPNs. AH authenticates but does not encrypt, and transport mode leaves original headers exposed. ESP plus tunnel mode meets both requirements.

A security review flags that servers still accept SSL 3.0 and TLS 1.0, enabling downgrade attacks. What is the recommended remediation?

• a.Enable every available protocol version so the widest possible range of clients can connect
• b.Replace the certificates with self-signed ones to sidestep protocol version negotiation
• c.Disable obsolete protocols and require TLS 1.2 or 1.3✓
• d.Rely only on the certificate's validity and ignore which protocol version was negotiated

Downgrade attacks force use of older, weaker protocols, so disabling SSL and early TLS and requiring TLS 1.2 or 1.3 removes the vulnerable options. Certificate validity is unrelated to the negotiated protocol version. Eliminating weak versions is what closes the downgrade path.

Network monitoring currently uses a version of SNMP that sends community strings in cleartext. Which version adds authentication and encryption for management traffic?

• a.Syslog over UDP, which forwards event messages without providing any confidentiality
• b.SNMPv1, which is the original version relying solely on plaintext community strings
• c.SNMPv3✓
• d.NetFlow, which exports traffic-flow statistics rather than managing network devices

SNMPv3 adds authentication and encryption, protecting management credentials and data that earlier versions sent in cleartext. Versions 1 and 2c rely on community strings exposed to sniffing. Upgrading to v3 secures the management plane.

A VoIP deployment must keep call audio confidential and protected from tampering in transit. Which protocol secures the media stream?

• a.SMTP over TLS, which protects the transfer of email messages between mail servers
• b.SIP alone, which sets up and tears down call sessions but does not encrypt the media
• c.SNMP, which is used to poll and configure network devices remotely across the LAN
• d.SRTP✓

Secure Real-time Transport Protocol (SRTP) encrypts and authenticates the audio and video media stream in VoIP, protecting call content. SIP handles signaling and needs its own protection, such as SIP over TLS. Securing the media, not just signaling, is SRTP's role.

A domain owner wants receiving servers to reject spoofed mail claiming to come from their domain and to receive reports on abuse. Which policy layer builds on SPF and DKIM to enforce this?

• a.OCSP, which lets clients check a certificate's revocation status in near real time
• b.S/MIME, which encrypts and signs individual messages using each user's own certificate
• c.DMARC✓
• d.TLS, which encrypts the transport channel between two mail servers while in transit

DMARC builds on SPF and DKIM, telling receivers how to handle messages that fail alignment and providing aggregate reports on abuse. It is what turns sender authentication into an enforceable, reportable policy. SPF and DKIM verify; DMARC decides and reports.

During an investigation, analysts find event times inconsistent across servers, making correlation impossible. Securing and synchronizing which service fixes this?

• a.Network Time Protocol✓
• b.Domain Name System resolution of internal and external hostnames to their IP addresses
• c.Simple Mail Transfer Protocol, which delivers outbound email messages between servers
• d.Dynamic Host Configuration Protocol, which leases IP addresses out to client devices

Network Time Protocol (NTP) synchronizes clocks so log timestamps agree across systems, which is essential for correlating events during investigations. It should be secured because forged time can hide or misorder activity. Accurate, trusted time is the foundation of usable logs.

A firewall administrator prefers a secure file-transfer protocol that uses a single connection over one port, simplifying firewall rules. Which fits better than FTPS?

• a.TFTP, a lightweight protocol that provides no authentication or encryption whatsoever
• b.SFTP over SSH✓
• c.HTTP, which transmits the requested content without any form of transport encryption
• d.Plain FTP, which negotiates a separate dynamic data port for every file it transfers

SFTP runs over a single SSH connection on one port, so firewall rules are simple, unlike FTPS which uses separate control and dynamic data ports. Both are secure, but SFTP is friendlier to firewalls. Single-connection design is the practical advantage here.

To keep users' DNS lookups private from on-path observers on public Wi-Fi, a browser encrypts queries inside HTTPS. This technique is called:

• a.Split-horizon DNS, which returns different answers to internal versus external users
• b.Recursive resolution, in which a resolver queries the authoritative servers in sequence
• c.DNS over HTTPS✓
• d.A DNS sinkhole, which redirects known malicious domains to a controlled safe address

DNS over HTTPS (DoH) tunnels DNS queries inside HTTPS so on-path observers cannot see or tamper with lookups, improving privacy. DNS over TLS achieves similar protection on a dedicated port. Encrypting the query channel is what defeats passive DNS snooping.

Before a laptop plugged into a conference-room network jack gets access, a switch forces it to authenticate to a RADIUS server. Which standard enforces this port-based control?

• a.IEEE 802.1X✓
• b.WPA3, which is the current security standard used specifically for wireless client access
• c.NAT, which translates private internal addresses into publicly routable ones for internet use
• d.STP, which prevents switching loops by blocking redundant paths in the network topology

IEEE 802.1X provides port-based network access control, requiring devices to authenticate through an authenticator to a RADIUS server before the port passes traffic. It works on both wired and wireless links. Authenticating at the port before granting access is its defining function.

A wireless network requires both the client and the server to present certificates, eliminating passwords entirely for the strongest mutual authentication. Which EAP method is this?

• a.PSK, in which every device is configured with one identical pre-shared passphrase value
• b.EAP-MD5, which offers only a weak one-way password hash with no encryption or mutual proof
• c.EAP-TLS✓
• d.PEAP, which protects an inner authentication method inside a server-side TLS tunnel only

EAP-TLS requires certificates on both the client and the server, providing mutual authentication without passwords, which makes it the strongest common EAP method. Managing client certificates is the operational cost. Mutual certificate authentication is what sets it apart from tunnel-only methods.

A hotel Wi-Fi redirects newly connected guests to a web page requiring them to accept terms before internet access is granted. What is this mechanism?

• a.A pre-shared key that is rotated automatically for each guest on every new connection
• b.A RADIUS federation trust established between the hotel and each guest's home employer
• c.An evil twin access point that impersonates the legitimate hotel network's broadcast name
• d.A captive portal✓

A captive portal intercepts new connections and forces users to a web page to authenticate or accept terms before granting access. It is common on guest and public networks. The forced redirect before access is the identifying behavior.

A remote laptop must filter inbound and outbound connections based on rules even when it is off the corporate network. Which control operates directly on that endpoint?

• a.A load balancer that distributes incoming client requests across a pool of backend servers
• b.A network intrusion prevention system placed inline at the corporate data center edge
• c.A screened subnet that isolates public-facing servers from the internal trusted network
• d.A host-based firewall✓

A host-based firewall runs on the endpoint itself, filtering traffic wherever the device is, including off the corporate network. Network firewalls protect only while traffic passes through them. Traveling with the device is the host firewall's advantage.

An endpoint agent not only detects malicious behavior on the host but actively blocks the offending process in real time. Which best describes it?

• a.A data loss prevention agent that scans outbound files for sensitive or regulated content
• b.A host-based intrusion prevention system✓
• c.A host-based intrusion detection system, which only logs and alerts on suspicious activity
• d.A security information and event management platform that aggregates logs from many hosts

A host-based intrusion prevention system (HIPS) both detects and actively blocks malicious activity on the host, unlike a HIDS that only alerts. The distinction is the ability to stop, not merely observe. Inline prevention on the endpoint is the key trait.

To stop unknown executables from running, an administrator configures endpoints so only explicitly approved applications can launch and everything else is blocked. This is:

• a.Antivirus signature scanning, which matches files against a database of known malware hashes
• b.Blocklisting, which denies only the specific programs already known to be malicious
• c.Application allowlisting✓
• d.Sandboxing, which runs an untrusted program inside an isolated disposable container

Application allowlisting permits only approved programs to run and denies everything else, which stops unknown and zero-day executables by default. Blocklisting is the weaker inverse, blocking only known-bad items. Default-deny for applications is the strength of allowlisting.

A laptop is stolen while powered off, but the thief cannot read any data because the entire drive, including the operating system, was encrypted and unlocks only with the user's key. Which protection was in place?

• a.Full-disk encryption✓
• b.A host-based firewall that filters inbound network connections made to the device
• c.Antivirus software that scans downloaded files for known malicious code signatures
• d.A screen-lock timeout that requires a password after a period of user inactivity only

Full-disk encryption renders the entire drive unreadable without the key, protecting data at rest if a powered-off device is stolen. A screen lock or firewall would not stop someone removing the drive. Encrypting the whole volume is what defeats offline data theft.

To ensure a device loads only firmware and bootloaders signed by trusted keys, blocking bootkits that load before the OS, an administrator enables which UEFI feature?

• a.Full-disk encryption, which protects stored data at rest but not the early boot chain
• b.A host firewall, which filters network traffic only after the operating system has loaded
• c.Application allowlisting, which restricts which programs may run once the OS is running
• d.Secure Boot✓

Secure Boot verifies signatures on firmware and bootloaders so only trusted code runs during startup, blocking bootkits and rootkits that load before the OS. Disk encryption protects data but not the boot chain. Signature checking at boot is Secure Boot's purpose.

A company must enforce passcodes, push required apps, and remotely wipe hundreds of employee smartphones from one console. Which system provides this centralized control?

• a.A virtual private network client that tunnels the phone's traffic back to headquarters
• b.A host-based intrusion detection system installed individually on each mobile phone
• c.Mobile device management✓
• d.A data loss prevention gateway that inspects only the email leaving the organization

Mobile device management (MDM) centrally enforces policies, deploys apps, and can remotely lock or wipe enrolled devices. It gives administrators consistent control over a fleet of phones and tablets. Central lifecycle management is what defines MDM.

On employee-owned phones, a company isolates corporate email and files inside a managed, encrypted workspace separate from personal apps, so only that workspace can be wiped. This approach is:

• a.Geofencing, which disables the device whenever it leaves a defined geographic map region
• b.Containerization✓
• c.Full-disk encryption of the entire personal device, including all of the user's own photos
• d.A pre-shared wireless key that is configured identically on every enrolled employee phone

Containerization separates corporate data into a managed, encrypted workspace on a personal device, allowing selective wipe without touching personal content. This balances BYOD flexibility with corporate control. Isolating work data from personal data is its core benefit.

A logistics app automatically locks certain features whenever a company tablet leaves the warehouse's GPS boundary. Which control uses location this way?

• a.Containerization, which separates managed corporate data from the personal app data
• b.Remote wipe, which erases the device entirely once it is reported as lost or stolen
• c.Full-disk encryption, which protects the stored data if the device is powered down
• d.Geofencing✓

Geofencing defines a virtual geographic boundary and changes device behavior based on whether the device is inside or outside it. Here it disables features off-site to reduce risk. Acting on GPS-defined location is the defining trait of geofencing.

An employee reports their corporate phone lost in a taxi. Which MDM action best prevents data exposure by erasing the device's contents immediately?

• a.Rotating the wireless pre-shared key that is used across the entire office network
• b.Forcing a password change on the user's cloud email account from the admin console
• c.Remote wipe✓
• d.Enabling geofencing so the phone will alert when it next leaves the office boundary

Remote wipe erases the device's data from the management console, preventing exposure if it cannot be recovered. It is the direct response to a lost or stolen managed device. Immediate data erasure is what protects the information.

An MDM policy blocks devices whose operating system protections have been bypassed to gain unrestricted privileges, since such devices can evade security controls. What condition is being detected?

• a.A device with its screen-lock timeout configured to a longer inactivity interval
• b.A device that is simply running an older but still vendor-supported operating system version
• c.A device that is temporarily connected to an untrusted public wireless network
• d.Jailbreaking or rooting✓

Jailbreaking or rooting removes the OS's built-in security restrictions, letting apps run with full privileges and bypass controls. MDM detects and blocks such devices because they can no longer be trusted to enforce policy. The removal of platform protections is the risk being caught.

Thousands of internet-connected cameras were conscripted into a botnet because they all shipped with the same factory username and password. Which hardening step would most directly have prevented this?

• a.Exposing each camera's web interface directly to the internet for convenient remote viewing
• b.Placing every camera onto the same flat network segment for easier centralized management
• c.Changing the default credentials✓
• d.Enabling universal plug and play so the cameras open firewall ports automatically

Default credentials are publicly documented, so leaving them lets attackers log in en masse, which is how large IoT botnets form. Changing them to unique strong passwords closes that trivial entry path. Removing known defaults is the single most impactful step here.

A medical infusion pump runs a real-time embedded OS that the vendor rarely patches and cannot run endpoint agents. Which compensating control best reduces its risk?

• a.Isolating it on a segmented network with strict access controls✓
• b.Installing a full endpoint detection and response agent directly onto the infusion pump
• c.Enabling full-disk encryption on the pump's very limited internal flash storage chip
• d.Requiring users to run frequent authenticated credentialed vulnerability scans against it

Embedded and legacy medical devices often cannot be patched or run agents, so network isolation and tight access control are the practical compensating controls. Segmentation limits what can reach the device and what it can reach. When you cannot fix the device, you constrain its exposure.

An industrial plant connects its operational technology control network to the corporate IT network for reporting, raising concern about attacks crossing over. Which architecture best limits this exposure?

• a.Directly bridging both networks so engineers can freely manage control systems from any desk
• b.An industrial DMZ segmenting OT from IT with controlled data flows✓
• c.Disabling all logging on the control systems to conserve their very limited processing power
• d.Assigning every industrial controller a public IP address for convenient remote vendor access

An industrial DMZ places a controlled buffer between OT and IT, brokering only necessary data flows and preventing direct access to control systems. This contains threats that reach IT from spreading into OT. Segmentation with a mediated boundary is the recommended pattern.

An IoT vendor wants to push firmware updates over the air while ensuring devices reject any update not produced by the vendor. Which mechanism should the device enforce?

• a.Allowing updates from any server on the local network to speed up the deployment
• b.Disabling updates entirely so the firmware can never be tampered with by anyone remotely
• c.Verifying a digital signature on the firmware before installing✓
• d.Accepting any update that is delivered over an encrypted TLS channel automatically

Requiring a valid digital signature ensures the firmware truly came from the vendor and was not altered before the device installs it. An encrypted channel protects transit but does not prove authorship. Signature verification is what authenticates the update's source and integrity.

Beyond ports and IP addresses, a firewall must identify and block specific applications like peer-to-peer file sharing and inspect encrypted traffic. Which firewall type provides this?

• a.A next-generation firewall✓
• b.A basic access control list that is applied statically to a single router interface
• c.A stateful firewall that tracks connection state but is blind to the application identity
• d.A traditional packet-filtering firewall that examines only headers and port numbers

A next-generation firewall adds application awareness, deep packet inspection, and often TLS inspection and integrated intrusion prevention. This lets it identify and control specific apps rather than just ports. Application-layer visibility is what defines an NGFW.

A public web application keeps getting hit with SQL injection and cross-site scripting attempts. Which control specifically inspects HTTP requests to filter these application-layer attacks?

• a.A network intrusion detection sensor that only alerts on suspicious packets without blocking
• b.A web application firewall✓
• c.A load balancer that distributes traffic evenly across several identical backend web servers
• d.A traditional network firewall that filters traffic based on IP addresses and port numbers

A web application firewall inspects HTTP/HTTPS requests and filters application-layer attacks like SQL injection and cross-site scripting. Network firewalls operate lower in the stack and miss these payloads. Understanding web request content is what makes a WAF effective here.

To hide backend web servers and terminate TLS for inbound client requests, an organization places a device in front of its servers that accepts connections on their behalf. Which device is this?

• a.A reverse proxy✓
• b.A jump server that administrators connect through to reach isolated management segments
• c.A network intrusion detection sensor that mirrors traffic for passive inspection only
• d.A forward proxy, which sits in front of internal clients making outbound requests to the web

A reverse proxy sits in front of servers, accepting client connections, hiding backend details, and often terminating TLS and load balancing. A forward proxy, by contrast, fronts clients making outbound requests. Serving on behalf of the servers is what makes it reverse.

Before granting network access, a system checks that a connecting device has current antivirus, required patches, and disk encryption, quarantining it if not. Which technology enforces this?

• a.A load balancer that spreads client sessions evenly across multiple application servers
• b.A screened subnet that hosts internet-facing services away from internal trusted systems
• c.A reverse proxy that terminates inbound TLS connections on behalf of backend web servers
• d.Network access control✓

Network access control (NAC) checks device posture, such as patches, antivirus, and encryption, before admitting a device, quarantining or remediating non-compliant ones. This keeps unhealthy endpoints off the network. Posture assessment at admission is the NAC function.

To stop someone from unplugging a printer and connecting a rogue laptop or hub to a switch port, an administrator limits which and how many MAC addresses a port accepts. This is:

• a.Network address translation, which maps private internal addresses to public routable ones
• b.Quality of service, which prioritizes latency-sensitive traffic such as voice over data
• c.Spanning Tree Protocol, which prevents switching loops by blocking redundant network links
• d.Port security✓

Port security restricts which MAC addresses, and how many, a switch port allows, blocking unauthorized devices or hubs plugged into the port. Violations can shut down or restrict the port. Controlling access at the physical switch port is its purpose.

Without buying more switches, a network team wants to logically separate finance and guest traffic on the same physical infrastructure. Which technology accomplishes this?

• a.Port forwarding, which directs specific external traffic to a chosen internal host and port
• b.VLANs✓
• c.Link aggregation, which bundles multiple physical links together for greater bandwidth
• d.Network address translation, which conserves scarce public IPv4 addresses for many hosts

Virtual LANs (VLANs) logically segment one physical switch infrastructure into separate broadcast domains, isolating traffic like finance from guest. This limits reach and contains issues without extra hardware. Logical separation on shared switches is the VLAN advantage.

So administrators can still reach and recover network devices even when the production data path is down or compromised, they use a physically separate management channel. This is:

• a.Out-of-band management✓
• b.A screened subnet placed between the public internet and the internal user network
• c.In-band management, which shares the very same links that carry production user traffic
• d.A reverse proxy that accepts inbound web requests on behalf of internal application servers

Out-of-band management uses a dedicated, separate channel to reach devices independent of the production network, so admins retain access during outages or attacks. In-band management fails when the data path fails. Independence from the production path is the security benefit.

To block users from reaching known malicious or phishing domains, a company routes all lookups through a service that refuses to resolve blacklisted names. This control is:

• a.A virtual private network that encrypts all of the client traffic back to the headquarters
• b.A load balancer that distributes inbound web requests across several backend servers
• c.Network address translation, which hides many internal hosts behind one public address
• d.DNS filtering✓

DNS filtering, sometimes called protective DNS, refuses to resolve known malicious or unwanted domains, stopping connections before they start. It is a lightweight, broad control against phishing and malware callbacks. Blocking at name resolution is what makes it effective early.

Inbound mail should be scanned for malware, phishing links, and spam before reaching user inboxes, and outbound mail checked for data leakage. Which appliance performs this?

• a.An intrusion detection sensor that passively mirrors and analyzes raw network packets
• b.A web application firewall that inspects HTTP requests bound for public web applications
• c.A network access control server that checks each device's posture before admitting it
• d.A secure email gateway✓

A secure email gateway filters inbound and outbound mail for malware, phishing, spam, and data leakage before messages reach users or leave the organization. It is a focused control at the email boundary. Inspecting mail specifically is what distinguishes it from general network tools.

A wireless upgrade replaces the pre-shared key handshake with one resistant to offline dictionary attacks even when a weak passphrase is used. Which standard introduces this via SAE?

• a.WPA3✓
• b.Open authentication, which provides no encryption of the wireless traffic whatsoever
• c.WPA2-Personal, which still relies on the older four-way pre-shared key handshake method
• d.WEP, the original wireless privacy protocol that has long since been broken and deprecated

WPA3 replaces the PSK handshake with Simultaneous Authentication of Equals (SAE), which resists offline dictionary attacks even against weak passphrases. WPA2's four-way handshake could be captured and cracked offline. SAE's resistance to offline guessing is the major improvement.

Rather than sharing one Wi-Fi passphrase company-wide, an organization wants each employee to authenticate with their own credentials against a RADIUS server. Which wireless mode is required?

• a.WPA2/WPA3-Enterprise with 802.1X✓
• b.WPA2-Personal, in which every device is configured with the exact same pre-shared key
• c.WEP with a shared static key that is entered manually on each connecting client device
• d.An open network with a captive portal that only displays an acceptable use notice to users

Enterprise wireless mode uses 802.1X with a RADIUS server so each user authenticates individually, enabling per-user credentials, accounting, and revocation. Personal mode shares one key among all devices. Individual authentication is the reason Enterprise is required here.

At a coffee shop, an attacker broadcasts a Wi-Fi network using the same name as the legitimate one to lure clients into connecting through them. This attack is a(n):

• a.Jamming attack that overwhelms the wireless spectrum to deny service to all nearby users
• b.WPS brute-force attack that guesses the router's eight-digit setup PIN over and over again
• c.Evil twin✓
• d.Deauthentication flood that forcibly disconnects clients from the real access point repeatedly

An evil twin is a rogue access point that mimics a legitimate network's name to trick clients into connecting, enabling interception of their traffic. It relies on users trusting a familiar SSID. Impersonating the real network is the defining tactic.

A router feature meant to simplify setup lets clients join with an eight-digit PIN, but the PIN is brute-forceable in hours. Security guidance is to disable which feature?

• a.The 5 GHz radio band, which offers more non-overlapping channels than the 2.4 GHz band
• b.MAC address filtering, which restricts which device hardware addresses may connect at all
• c.SSID broadcasting, which advertises the network's name to any nearby wireless clients
• d.Wi-Fi Protected Setup✓

Wi-Fi Protected Setup (WPS) uses an eight-digit PIN that is vulnerable to brute force because it is validated in two halves, so it should be disabled. Its convenience comes at a serious security cost. Turning WPS off removes this easily exploited weakness.

An attacker repeatedly sends spoofed management frames that kick clients off a wireless network, often to force reconnection to a rogue access point. This is a:

• a.Rainbow table attack that precomputes hashes to reverse a captured passphrase quickly
• b.SQL injection attack targeting the router's web-based administrative management interface
• c.Deauthentication attack✓
• d.Cross-site scripting attack that executes script inside the victim's own browser session

A deauthentication attack forges management frames to disconnect wireless clients, which can cause denial of service or push victims onto an evil twin. Protected Management Frames mitigate it. Spoofing disconnect frames is the mechanism of the attack.

Before deploying access points in a new office, engineers map signal strength and interference to place APs and set power levels appropriately. This process is a:

• a.Business impact analysis that ranks critical processes by their tolerance for disruption
• b.Penetration test that attempts to actively exploit vulnerabilities across the network
• c.Wireless site survey✓
• d.Vulnerability scan that enumerates known weaknesses across all networked host systems

A wireless site survey measures signal coverage, interference, and capacity to plan access point placement and power settings. Good surveys prevent dead zones and rogue-AP opportunities from weak coverage. Mapping the RF environment is the purpose of the survey.

An administrator relies on allowing only known hardware addresses onto the Wi-Fi, but an attacker still gets on. Why is MAC filtering weak on its own?

• a.Because it requires every client to complete a certificate-based mutual handshake first
• b.Because it forces all of the devices on the network to share a single static pre-shared key
• c.Because MAC addresses can be sniffed and spoofed by an attacker✓
• d.Because MAC filtering encrypts the wireless traffic with an outdated and easily broken cipher

MAC addresses travel in cleartext and can be captured and spoofed, so an attacker can clone an allowed address to bypass filtering. It provides no real authentication or encryption. Being trivially forgeable is why MAC filtering is only a weak add-on.

A wireless network protects user passwords by wrapping the inner authentication inside a TLS tunnel established with only a server-side certificate. Which EAP method is this?

• a.EAP-TLS, which requires both the client and the server to present valid certificates
• b.PEAP✓
• c.EAP-MD5, which sends only a weak challenge-response with no protective outer tunnel
• d.PSK authentication, in which all clients share one identical static passphrase value

Protected EAP (PEAP) builds a TLS tunnel using only a server certificate and then runs the inner authentication protected inside it. This shields credentials without requiring client certificates. Server-side certificate plus a protected inner method is the PEAP pattern.

A retail store offers customer Wi-Fi but must ensure guests cannot reach point-of-sale systems or each other. Which combination best achieves this?

• a.Placing the guests and the POS terminals together on one shared VLAN for simpler management
• b.Disabling all encryption on the guest network to reduce the processing overhead placed on the access points
• c.A separate guest VLAN with client isolation and firewall rules blocking internal access✓
• d.Publishing the POS network passphrase to guests so that support requests are easier to handle

A separate guest VLAN with client isolation stops guests from reaching each other, and firewall rules block access to internal systems like the POS. This layered segmentation protects cardholder systems from untrusted users. Isolating and restricting guest traffic is the correct design.

To defend against deauthentication and disassociation spoofing, a modern wireless standard cryptographically protects management frames. This feature is:

• a.SSID hiding, which stops the network name from being openly broadcast to nearby clients
• b.Protected Management Frames✓
• c.MAC filtering, which restricts access to a preset list of allowed hardware addresses only
• d.Band steering, which nudges dual-band clients toward the less congested 5 GHz spectrum

Protected Management Frames (802.11w) authenticate and protect management frames so attackers cannot forge deauthentication or disassociation messages. This directly counters common wireless denial-of-service tricks. Cryptographically protecting management frames is the defense.

In a zero-trust data center, an architect enforces security policies between individual workloads so even east-west traffic inside the same subnet is inspected and controlled. This granular approach is:

• a.Microsegmentation✓
• b.A flat network design in which all servers communicate freely without any restrictions
• c.Perimeter security, which relies on a single strong firewall placed only at the network edge
• d.Port forwarding, which exposes specific internal services directly to external clients

Microsegmentation applies fine-grained policies between individual workloads, controlling east-west traffic that traditional perimeter firewalls never see. This limits lateral movement after a breach. Enforcing policy workload-to-workload is the zero-trust idea it implements.