6 Network Security Online Quiz Questions

An attacker uses username-and-password pairs exposed in one breach to attempt sign-ins to another service. Which threat is this?

True or false: Symmetric encryption uses the same secret key to encrypt and decrypt data.

What is the fixed-length output produced by hashing data called?

A company wants a control that filters HTTP/HTTPS requests to help protect its web application from application-layer attacks. Which technology best fits this purpose?

Select all combinations that use evidence from at least two different MFA factor categories.

True or false: An intrusion detection system (IDS) monitors and alerts, while an intrusion prevention system (IPS) can block or otherwise stop detected traffic.

What access-control model makes decisions using attributes such as the user, device, resource, location, or time?

A public web server is placed in a DMZ and must retrieve data from an internal database. Which firewall policy best follows the described DMZ design?

Select all design choices that can help limit lateral movement by restricting communications within or between network zones.

A user on a corporate network requests access to a sensitive application. Describe how a zero-trust design should decide whether to grant access and what limits or checks it should apply.

An organization deploys a decoy system to attract and observe suspicious activity. How should it treat this system in relation to production assets?

A service is flooded with traffic until legitimate users can no longer access it. What broad attack category does this describe?

Malware spreads from one device to others across a network without anyone opening an infected file. Which type of malware best fits this behavior?

What defensive technology filters HTTP/HTTPS traffic to protect web applications from application-layer attacks?

An organization wants employees to use multifactor authentication. Which sign-in method meets the requirement for evidence from at least two different factor categories?

True or false: Under a zero-trust approach, a user or device should not be trusted implicitly just because it is inside the corporate network.

An application grants access only when the user's role, the device's status, and the request's location meet policy conditions. Which access-control model best describes this approach?

A network team wants a system that monitors traffic for suspicious activity and alerts analysts but does not block the traffic. Which technology best fits that requirement?