Free 020-100 practice test: 30 questions with answers

A reverse proxy in a DMZ limits direct contact between the internet and internal systems, and restrictive inbound rules allow only the ports the service needs. Publishing the database directly and disabling the firewall both increase exposure.

DNS resolves host names into IP addresses so that clients can connect. DHCP hands out addresses and settings, NTP keeps clocks synchronized, and SMTP moves email, so none of the other services performs name-to-address lookup.

ARP spoofing poisons the ARP caches of hosts so that traffic is redirected through the attacker, creating a man-in-the-middle position. A SYN flood is a denial-of-service attack, a zone transfer discloses DNS data, and a port scan is reconnaissance; none redirects traffic through the attacker.

A stateful firewall keeps a table of active connections and permits reply packets that belong to them, while still blocking unsolicited inbound traffic. Encryption belongs to protocols such as TLS or IPsec, address assignment is DHCP's job, and page caching is a proxy or cache function.

A VPN encrypts traffic across the untrusted network and terminates inside the corporate perimeter, protecting confidentiality in transit. MAC randomization only changes a hardware identifier, anonymous file sharing weakens access control, and compression does not encrypt the data.

Tor sends traffic through several relays using layered encryption, so no single relay knows both the client and the destination. Ad blocking, a faster resolver and saved passwords do not hide the user's location, and a faster resolver does not change what the local network can observe about the user.

Symmetric encryption is fast enough for bulk data and suits a single shared key used for both encryption and decryption. Asymmetric encryption is far slower for large files and is usually reserved for key exchange, hashing cannot be reversed to restore the archive, and signatures provide integrity and authenticity rather than confidentiality.

A certificate authority vouches for the binding between a public key and an identity by signing the certificate, and clients check the chain back to a trusted root and the validity period. Private keys must never be published, and revoked certificates must be rejected before they expire, which is why revocation mechanisms exist.

Browsers check the validity period of a certificate and warn when it has expired, which is exactly what the visitors see. Closing port 80 or removing a DNS zone would cause different failures such as connection errors or name resolution failures, and a browser does not block every page from a site because a certificate has lapsed.

S/MIME is the standard for encrypting and signing email with X.509 certificates, which fits clients that already hold such certificates. HSTS only applies to web browsing, IPsec works at the network layer between gateways, and SSH agent forwarding has nothing to do with email content protection.

Full-disk encryption protects data at rest, so a stolen or removed drive yields unreadable data without the key. Protecting data in transit is the job of protocols such as TLS or VPNs, encryption does not prevent authorized users from changing their own files, and verifying application signatures is a code-signing or application-control feature.

If an attacker who obtains the files also obtains the key, the encryption protects nothing, so keys should be separated from the data and held in a key management system or hardware security module. The other options make false universal claims, since databases can encrypt numeric columns and encryption does not disable audit logging.

UEFI Secure Boot verifies that boot loaders and related components carry trusted signatures before they run. Disk quotas, network address translation and log rotation are useful administration or networking features but do nothing to verify the integrity of boot code.

A TPM is a dedicated security chip that protects keys and records measurements used for measured boot and attestation. Graphics acceleration, wireless peripherals and cooling are handled by other hardware, so they are not the TPM's role.

Parameterized queries keep the SQL structure separate from the data, so input cannot change the query, which is the root cause of SQL injection. Longer timeouts, hidden error messages and CAPTCHAs may reduce some exposure, but none of them stops crafted input from altering the query.

Standard accounts limit what malware can change system-wide, and allowlisting prevents unapproved executables from starting. Disabling updates leaves known vulnerabilities open, and enabling macros everywhere is a common malware delivery path.

Offline or immutable backups cannot be modified by an attacker who has reached the production network, so a clean restore point survives. A backup that writes to a mapped drive stays reachable, compression does not protect data, and running backups at peak hours mainly hurts performance.

RAID 1 mirrors data across disks, so the array keeps working when one disk fails. Striping without redundancy describes RAID 0, parity-based rebuilding describes RAID 5 or 6, and encryption is not a RAID function. RAID also does not replace backups because it protects against disk failure, not deletion or ransomware.

Using a password plus a possession-based one-time code is multi-factor authentication. Single sign-on concerns reusing one login across services, while role-based and mandatory access control are authorization models that decide what a user may do after authentication.

A salted hash is one-way, so a leaked database does not reveal the original passwords directly, though weak passwords can still be cracked. Support staff should not be able to read passwords, a strong hash does not justify weak passwords, and a unique salt means identical passwords produce different hashes.

Data minimization means collecting only what a stated purpose requires, and city-level location is enough for a forecast. Mirroring, deduplication and encryption are storage or security techniques that do not limit what the app collects in the first place.

Limiting permissions to what the role needs and removing stale accounts shrink what an attacker can reach through any single account. Shared administrator logins and default broad access make a single compromise far more damaging.

False acceptance rate measures how often an impostor is incorrectly matched and accepted. False rejection rate measures genuine users being refused, crossover error rate is the point where the two errors are equal, and throughput measures speed rather than accuracy.

Federated single sign-on lets applications trust the corporate identity provider after one authentication, which reduces password sprawl. Shared accounts remove accountability, copied password files spread credentials, and disabling authentication removes access control altogether.

Listing assets, their owners and the impact of losing them is the asset identification and impact analysis at the core of a risk assessment. Penetration testing probes for exploitable weaknesses, incident response handles events already underway, and awareness training educates people, so none of those builds the asset and impact inventory.

Insurance shifts the financial impact of a loss to a third party, which is risk transfer. Avoidance would stop the risky activity entirely, mitigation would reduce likelihood or impact with controls, and acceptance would leave the risk untreated, so the other three do not describe this decision.

Ethical testers stay within the agreed scope, limit access to what is needed to demonstrate the issue, and report it responsibly to the client. Downloading customer data exceeds what is needed, publishing the flaw is irresponsible disclosure, and cataloguing all the data goes well beyond authorized testing.

Senior management and the board set the acceptable level of risk and allocate budget, since they are accountable for the organization's exposure. Technicians, testers and developers implement or test controls but do not set the organization's risk appetite.

Ethical administrators respect privacy and act only under authorized, documented processes, so refusing and escalating through HR or legal channels is correct. Reading subject lines, reading quickly without notes, or forwarding the mailbox all still expose private communications without authorization.

A common way to express risk in qualitative and semi-quantitative assessments is likelihood multiplied by impact, which ranks risks for treatment. The other formulas have no standard meaning in risk assessment, since they combine unrelated counts, costs or ratios.