Security Principles, Policies & VPNs Practice Questions

Answers and explanations appear when you work through the set above.

1. An attacker sends crafted traffic that triggers a known software flaw. What is the crafted technique?

   • A compensating control
   • An exploit
   • An asset inventory
   • A security policy

2. Which measure most directly reduces tailgating into a wiring closet?

   • Disabling CDP on uplinks
   • Changing the wireless SSID
   • Controlled physical entry with visitor supervision
   • Increasing password length on switches

3. An employee receives a plausible email requesting an urgent password reset at an unfamiliar site. What should awareness training encourage?

   • Reply with the password to confirm ownership
   • Forward it to all colleagues as a warning without checking
   • Approve the request because the sender's display name is familiar
   • Verify through the established channel and report the message

4. A policy requires a password and a hardware security key. What does this add?

   • Authentication using different factor categories
   • Two passwords in the same category
   • A replacement for authorisation
   • Encryption of all network traffic

5. Which choice is an example of a biometric authentication factor?

   • A client certificate private key
   • A fingerprint measurement
   • A remembered PIN
   • A one-time code from a hardware token

6. Why does a password policy address reuse and storage as well as complexity?

   • A sufficiently complex password is safe to reuse across unrelated services
   • Server-side hashing prevents damage when a password is reused on a compromised service
   • A complex reused or exposed password can still compromise accounts
   • Using a password manager removes the need to protect stored password verifiers

7. A remote employee needs an encrypted connection from a laptop into the company network. Which VPN model fits?

   • Site-to-site VPN between branch gateways
   • An unencrypted GRE tunnel alone
   • A switch access VLAN
   • Remote-access VPN

8. Two branch networks need to communicate across an untrusted WAN with protected traffic. Which model fits?

   • Site-to-site IPsec VPN
   • A remote user's browser session
   • An open wireless network
   • A local console connection

9. What does IPsec provide when appropriately configured to encrypt and authenticate traffic?

   • Guaranteed availability of the WAN
   • Packet confidentiality, integrity, data-origin authentication, and anti-replay protection
   • Automatic trust of every application on either endpoint
   • A replacement for all routing decisions

10. An administrator can sign in but cannot change routing configuration. Which AAA function controls the allowed action?

    • Accounting
    • Address allocation
    • Authorisation
    • Authentication

11. Which AAA function produces a record of commands executed during an administrative session?

    • Authentication
    • Authorisation
    • Encryption
    • Accounting

12. Why should a local device account have only the privileges needed for its task?

    • It reduces the impact of mistakes or account compromise
    • It prevents the user from needing authentication
    • It guarantees that logs cannot be modified
    • It replaces network access control lists

13. A WLAN uses WPA2 Personal. What credential must a client share with the access network?

    • The DHCP server's hostname
    • The configured pre-shared key
    • A RADIUS server's administrative password
    • The controller's console password

14. How does WPA3 Personal differ from WPA2 Personal in its authentication and key-establishment method?

    • It requires WEP for older devices
    • It uses a controller's management password as the client key
    • It uses SAE rather than WPA2 Personal's PSK-based method
    • It removes the need for authentication