Free Practice Quiz Question List

7 Defensive Security Practices Online Quiz Questions

Use this free practice quiz with 20 questions to review 7 Defensive Security Practices, test your knowledge, and prepare for your next test or exam.

20 questions

True or false

1 point

A file server does not need remote desktop access. Is it acceptable to expose that service broadly as long as the default credentials have been removed?

A
True
B
False

Choose one

1 point

An organization must decide which of several available patches to deploy first. Which approach best follows an effective patch process?

A
Install every available update immediately on every device, without testing or checking the source.
B
Prioritize updates by risk and importance, obtain them from trusted sources, test and install them, then verify installation.
C
Wait until users report problems before deciding whether to install updates.

Written response

1 point

What is one recommended characteristic of at least one backup copy relative to routine access? Enter one adjective.

Choose one

1 point

A company deploys endpoint detection and response (EDR). Which security decision is still appropriate?

A
Replace secure configuration and updates with EDR, since it can detect suspicious behavior.
B
Use EDR to help identify and investigate suspicious behavior while maintaining secure configuration and timely updates.
C
Disable EDR once host firewalls are enabled, because the controls serve the same purpose.

True or false

1 point

True or false: A completed backup proves that the data can be restored successfully.

A
True
B
False

Choose all

1 point

A team is establishing secure configurations for its systems. Which actions support that goal? Select all that apply.

A
Inventory systems and their owners before establishing approved baselines.
B
Allow settings to change without recording them, so administrators can work more quickly.
C
Disable services and features that are not needed.
D
Leave default credentials in place if a system is not directly internet-facing.
E
Record and review changes to detect drift from the baseline.

Written response

1 point

What two-word security principle describes limiting administrative privileges to what is needed? Enter the principle.

Choose one

1 point

A team has enabled logs but has not assigned anyone to handle alerts. What change would make its monitoring practice more actionable?

A
Generate alerts for every routine event, but do not assign anyone to review them.
B
Store logs only on the device where they were created and assume administrators will notice problems.
C
Define alerts for meaningful events and assign someone to investigate them.

Choose all

1 point

An organization is reviewing its incident response plan before an exercise. Which elements should the plan include? Select all that apply.

A
Name decision-makers and technical contacts.
B
Assume normal communication systems will always be available.
C
Describe how staff should report concerns.
D
Establish communication methods to use if normal systems are unavailable.
E
Leave coordination with leadership and outside parties undefined.

Open ended

1 point

After an incident has been contained and its cause addressed, what should an organization do to recover safely and learn from the event? Describe the key actions.

Choose one

1 point

An organization is setting backup frequency and retention for a critical service. Which approach best aligns those choices with recovery needs?

A
Choose backup frequency and retention based only on how much storage is currently available.
B
Determine what needs to be restored first and how quickly, then set backup frequency and retention to meet those needs.
C
Use the same backup schedule for every system, regardless of its recovery requirements.

Choose one

1 point

A proposed secure-configuration change could interrupt an essential service. What should the team do before deploying it broadly?

A
Deploy the change everywhere immediately to make settings consistent.
B
Test the change before broad deployment, especially if it could disrupt an essential service.
C
Skip the change and leave the current settings undocumented.
D
Disable all services on the system until the change is complete.

Choose one

1 point

A team has limited time for patching. Which system should generally receive higher priority?

A
Patch systems in alphabetical order by device name.
B
Update only systems that have reported a failure.
C
Prioritize actively exploited, internet-facing systems.
D
Wait until every system can be updated at the same time.

Choose one

1 point

An organization enables endpoint detection and response (EDR) on its laptops. Which statement best describes what EDR contributes?

A
It can help identify and investigate suspicious behavior, but does not replace secure configuration, least privilege, or timely updates.
B
It guarantees that every attack on a device will be prevented.
C
It makes software updates unnecessary once installed.
D
It removes the need to limit administrative privileges.

True or false

1 point

True or false: An organization should keep at least one backup copy offline or otherwise isolated from routine access.

A
True
B
False

Written response

1 point

What access status should at least one backup copy have to help protect it from routine access by compromised systems?

Choose one

1 point

A company collects login logs, but repeated failed logins do not prompt any follow-up. What change would most directly improve this monitoring practice?

A
Delete alerts as soon as they appear to prevent unnecessary work.
B
Keep logs only on the device that generated them and never review them.
C
Collect logs but avoid defining which events matter.
D
Assign someone to investigate meaningful alerts, such as repeated failed logins.

Written response

1 point

In the basic incident response sequence, what stage follows containment?

Fill in the blank

1 point

A legacy device cannot receive an update. The team adds alternative safeguards to reduce its risk; these are called .

Fill in the blank

1 point

An organization centralizes important logs. To keep the records trustworthy, it should protect them from unauthorized or deletion.