Unit 4: Network, Endpoint, and Application Security Capabilities - Practice Quiz

1 What is the primary purpose of a firewall in a network?

2 Which device primarily detects and alerts on suspicious network activity without automatically blocking it?

3 What does a VPN primarily provide for network communication?

4 What is a security baseline in network security?

5 Which practice helps reduce the attack surface when establishing a network baseline?

6 What is the main benefit of network segmentation?

7 What is an endpoint in the context of endpoint security?

8 Which software is primarily designed to detect and remove malicious programs from a device?

9 What does EDR stand for in endpoint security?

10 Why is patch management important for endpoint security?

11 Which feature helps protect data on a lost or stolen mobile device?

12 What does MDM stand for in mobile security?

13 Which practice improves the security of a mobile device?

14 Why is device encryption recommended for mobile devices?

15 Which protocol provides a secure, encrypted version of HTTP?

16 Which protocol is considered insecure because it transmits data, including passwords, in plaintext?

17 What is the main purpose of TLS (Transport Layer Security)?

18 In the shared responsibility model, who is typically responsible for securing data placed in the cloud?

19 What type of attack injects malicious scripts into web pages viewed by other users?

20 What is the main function of a Web Application Firewall (WAF)?

21 An administrator wants to inspect encrypted traffic for malware without permanently breaking end-to-end encryption at the server. Which capability should be deployed at the network edge?

22 A company deploys a device that detects malicious traffic and actively drops the offending packets inline. Which technology is being used?

23 Which deployment best enforces the principle of least privilege for east-west traffic between workloads in a data center?

24 An auditor finds that routers still respond to Telnet. According to secure baseline practices, what is the recommended remediation?

25 A security baseline requires that unused switch ports be protected against unauthorized device connections. Which configuration meets this goal most directly?

26 Which practice helps ensure a network device configuration continues to match its approved secure baseline over time?

27 An organization wants to detect and respond to suspicious process behavior on laptops, including rolling back malicious changes. Which solution fits best?

28 A policy allows only pre-approved executables to run on endpoints and blocks everything else. What is this control called?

29 A laptop is stolen but contained sensitive data. Which previously implemented control would most effectively prevent data disclosure?

30 Which approach best reduces the endpoint attack surface before any threat occurs?

31 A company wants to separate corporate apps and data from personal apps on employee-owned phones in a BYOD program. Which capability achieves this?

32 An administrator must be able to erase corporate data if a managed phone is lost. Which MDM feature provides this?

33 Why is jailbreaking or rooting a managed mobile device considered a security risk?

34 Which setting most directly reduces the risk of unauthorized access if a mobile device is left unattended?

35 An organization wants to secure email transmission between mail servers without application changes. Which mechanism enforces encrypted SMTP delivery?

36 Which secure replacement should be used instead of plaintext FTP for transferring files over an untrusted network?

37 To prevent DNS responses from being tampered with in transit, which protocol extension provides origin authentication and integrity for DNS data?

38 A baseline requires monitoring network devices securely. Which SNMP version should be selected to meet confidentiality requirements?

39 A web application reflects user input directly into a page without encoding it. Which vulnerability is most likely present?

40 In the cloud shared responsibility model for IaaS, which task is typically the customer's responsibility?

41 A security architect deploys a next-generation firewall (NGFW) with TLS inspection enabled. Users begin reporting that certain banking and healthcare sites fail to load, while most sites work. The firewall logs show certificate pinning validation failed. What is the most accurate explanation?

42 An organization defines a network security baseline requiring that all east-west traffic between application tiers be explicitly authorized. During an audit, a reviewer finds that the web tier can reach the database tier directly on port 3306, bypassing the application tier. Which baseline principle is most directly violated?

43 An EDR solution flags a process that spawned powershell.exe with an encoded command, injected into explorer.exe, and made no disk writes. The SOC wants to detect this class of attack reliably in the future. Which detection approach is most effective?

44 A company issues corporate-owned Android devices and wants to prevent data exfiltration while allowing limited personal use. They need separate encrypted storage, policy enforcement on the corporate side, and no visibility into personal apps. Which approach best satisfies all three constraints?

45 A baseline mandates TLS 1.2+ with forward secrecy. A pentester finds a server negotiating TLS_RSA_WITH_AES_256_GCM_SHA384. Although TLS 1.2 and AES-256-GCM are used, this still violates the baseline. Why?

46 A web app issues a session cookie without the SameSite attribute and performs state-changing actions via GET requests. Which combination of controls most completely mitigates the resulting CSRF risk?

47 A SOC wants to detect lateral movement that uses legitimate credentials and standard protocols (SMB, RDP). Signature IDS produces no alerts. Which capability enhancement is most appropriate?

48 During baseline review, an engineer notes that management interfaces for switches and routers are reachable from the user VLAN over SSH. The devices use strong passwords and SSHv2. What is the most significant residual risk and best remediation?

49 An organization enables application allowlisting (whitelisting) but attackers still execute malicious code by abusing a signed, approved binary to run arbitrary scripts. What is this technique, and which control best counters it?

50 A hardened iOS fleet uses supervised mode with MDM. Security requires that lost devices resist offline brute-force of the passcode. Which factor most directly determines offline brute-force resistance of the device encryption?

51 An email security baseline requires authenticated, encrypted mail submission and anti-spoofing. A domain has SPF and DKIM but still suffers spoofing where the visible From: header is forged while passing SPF via a lookalike envelope sender. Which addition closes this gap?

52 A web app running on a cloud VM is vulnerable to SSRF. An attacker uses it to query http://169.254.169.254/. In an IMDSv1 environment, what is the most severe realistic consequence?

53 A DNS-based data exfiltration channel encodes stolen data in subdomain labels of frequent queries to an attacker-controlled domain. Which enhancement most directly detects this?

54 A baseline requires that wireless access use enterprise authentication. An auditor finds WPA2-Enterprise configured with PEAP-MSCHAPv2 and clients set to not validate the server certificate. Why does this still fail the baseline's intent?

55 A ransomware sample encrypts files but is only detected after thousands of files are affected. The team wants earlier, higher-fidelity detection without excessive false positives. Which endpoint capability best fits?

56 A BYOD policy must protect corporate email on personal devices while minimizing legal/privacy exposure for the company. Which hardening strategy best balances security and privacy?

57 An API baseline requires stateless authentication with short-lived tokens. A review finds JWTs signed with alg: none accepted by the server, and also tokens with a 24-hour lifetime. Which single flaw allows the most direct, immediate account takeover?

58 A company stores objects in a cloud bucket. A misconfiguration review must prevent public exposure even if an individual object ACL is set to public-read by a developer. Which control best enforces this organization-wide?

59 A zero-trust initiative replaces the flat VPN with per-application access. A user authenticates successfully but is still denied access to an app they previously used. Which zero-trust concept most likely explains the denial?

60 A microservices app runs in Kubernetes. A compromised pod should not be able to reach other services or the cloud metadata API. Which combination best enforces this least-privilege boundary?