WGU Network-and-Security-Foundation Network-and-Security-Foundation Exam Practice Test

Availabilityensures that systems, applications, and data remain accessible and operational for authorized users when needed. Organizations implement redundancy, failover mechanisms, and backup systems to maintain availability.

Integrityensures that data remains accurate and unchanged.

Confidentialityprotects sensitive data from unauthorized access.

Innovationis not a component of the CIA triad.

Phishingis a cyberattack where attackers impersonate legitimate entities (e.g., banks, companies) and send fraudulent emails or messages designed to trick recipients into revealing sensitive information, such as usernames, passwords, or financial details. The fake link in the email directs victims to a malicious site that captures their credentials.

IP address spoofingdisguises a system’s identity but does not involve email deception.

Session hijackingtakes over an active session but does not involve email scams.

Man-in-the-middle attackintercepts communication rather than tricking users via emails.

Confidentialityin IT security ensures that sensitive data remains private and protected from unauthorized access. Encryption is a key measure used to maintain confidentiality by encoding data so that only authorized users can access it.

Integrityensures that data remains accurate and unchanged.

Availabilityensures that data is accessible when needed.

Consistencyis not a component of the CIA triad.

Confidentialityprotects data from unauthorized access, includingpassive attackslike eavesdropping, wiretapping, and packet sniffing. Encryption, access controls, and secure authentication mechanisms help enforce confidentiality.

Availabilityensures uptime and system accessibility.

Integrityensures data accuracy but does not prevent interception.

Adaptationis not part of the CIA triad.

Role-Based Access Control (RBAC)assigns permissions based on a user's role within an organization, such as department, job function, or hierarchy. This ensures that usersonly have access to resources necessary for their duties.

Attribute-based access control (ABAC)considers dynamic attributes like time, location, and device.

Context-based access controlrestricts access based on environmental conditions.

Discretionary access control (DAC)allows data owners to determine access rights.

Confidentialityensures that only authorized users have access to sensitive information. Without proper access controls, employees may be able to view or modify sensitive data without proper authorization, leading to a confidentiality breach.

Integrityinvolves protecting data from unauthorized modifications.

Availabilityensures that systems remain operational.

Interpretationis not part of the CIA triad.

TheNetwork or Internet layerof the TCP/IP model is responsible for addressing, routing, and delivering packets across networks. TheInternet Protocol (IP)operates at this layer, ensuring thatdata is correctly routed from the source to the destination.

Physical or network access layerdeals with hardware transmission (e.g., Ethernet, Wi-Fi).

Application layerincludes end-user services (e.g., HTTP, FTP).

Transport layermanages data flow using protocols like TCP and UDP but does not handle IP addressing.

Adictionary attackis a password-cracking method that systematically tries common words, phrases, and predictable passwords (e.g., "password123", "admin2024") to gain access to an account. Attackers often compile large lists of weak or reused passwords.

Phishingtricks users into revealing passwords but does not systematically test multiple words.

Credential stuffinguses breached passwords rather than guessing from a list.

Social engineeringmanipulates users but does not rely on automated password attempts.

Restricting physical accessto data storage facilities is a critical part of database security. Even with strong cybersecurity measures,unauthorized physical accessto servers can lead to breaches. Security strategies includebiometric authentication, surveillance cameras, and restricted entry zones.

Disclosing breachesis required by compliance laws but does not protect data proactively.

Developing algorithmsimproves security but is not a fundamental checklist item.

Outsourcing data managementcan introduce security risks if not properly controlled.

A violation ofintegrityoccurs whendata is modified incorrectly, whether intentionally or by accident. In this case, anemployee modifying a customer account incorrectlydemonstrates a breach of data integrity.

A and Crelate toavailability, as they describe system downtime.

Drelates toconfidentiality, as it describes improper data protection.

Session hijackingoccurs when an attacker takes over an established connection between two devices, often by stealing session tokens or manipulating network traffic. This allows the attacker to impersonate a legitimate user and gain unauthorized access.

Dictionary attackinvolves password guessing, not hijacking active connections.

Social engineeringtricks users into providing information but does not hijack sessions.

IP address spoofingdisguises the attacker's identity but does not necessarily take over a session.

Platform as a Service (PaaS)provides a pre-configured computing environment that includes an operating system, runtime, and development tools, making it ideal for developers who want a ready-to-use platform. Examples include Google App Engine and Microsoft Azure App Services.

SaaSprovides fully hosted applications, not just pre-configured virtual machines.

IaaSprovides infrastructure without pre-installed software.

FaaSexecutes specific functions without persistent infrastructure.

AType 2 hypervisor(hosted hypervisor) runs on top of an existing operating system and allows for the creation of virtual machines. Examples include VMware Workstation and Oracle VirtualBox.

Type 1 hypervisorsrun directly on hardware without an OS (e.g., VMware ESXi, Microsoft Hyper-V).

Open-source and proprietarydescribe licensing models, not hypervisor types.

Multifactor authentication (MFA)requires users to verify their identity usingmultiple factors, such assomething they know (password), something they have (a token or phone), or somewhere they are (geolocation-based access control). Requiring both location verification andpassword authentication demonstrates MFA.

Certificate verificationchecks digital certificates for security but does not use multiple authentication factors.

User-based accountinglogs user activities but does not verify identity.

Single sign-on (SSO)allows access to multiple systems with one login but is not necessarily MFA.

Availabilityensures that systems and data remain accessible and operational, even in the event of failures or attacks. Adisaster recovery plan (DRP)focuses on restoring IT infrastructure and operations after incidents like hardware failures, cyberattacks, or natural disasters. Strategies include data backups, failover systems, and redundant architectures.

Confidentialityfocuses on restricting unauthorized access.

Integrityensures data remains unaltered, but does not address service continuity.

Innovationis unrelated to the CIA triad.

Social engineeringinvolves manipulating people into divulging confidential information, often by impersonation, deception, or psychological tactics. Using aforged ID cardto gain trust and extract sensitive information is a classic example of social engineering.

Brute-force attackattempts to guess passwords through automated methods.

Man-in-the-middle attackintercepts communication but does not rely on deception.

Pharmingtricks users into visiting fraudulent websites but does not involve impersonation.

TheTransport layerin the TCP/IP model includes theUser Datagram Protocol (UDP)andTransmission Control Protocol (TCP). UDP is a connectionless protocol used for fast, lightweight data transmission where reliability is not the priority (e.g., video streaming, VoIP).

Application layerhandles end-user services but not transport mechanisms.

Network or internet layerdeals with IP addressing and routing, not UDP.

Physical or network access layerconcerns hardware transmission methods.

IP address spoofingis a cyberattack where an attacker disguises their system by falsifying its IP address, making it appear as a trusted device in a network. This technique is used for bypassing security controls, launching denial-of-service (DoS) attacks, or impersonating legitimate users.

Pharmingredirects users to fake websites to steal credentials.

Man-in-the-middle attackintercepts communications between two parties.

Session hijackingtakes over an active session but does not involve falsifying an IP address.