Network Security Fundamentals ECSS Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An employee receives an email that appears to be from the company's CEO, asking for a list of employee passwords. The email contains a link to a fake login page. Which type of threat is this, and what is the BEST immediate action for the employee?

   • AMalware; run a full antivirus scan on the computer
   • BMan-in-the-middle; change the password immediately
   • CPhishing; do not click the link and report the email to the security team
   • DDenial-of-service; ignore the email and continue working
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company's security policy requires that all network devices be configured to a secure baseline. The security team needs to document the exact configuration settings that must be applied. Which document should they create?

   • AA risk assessment
   • BA security policy
   • CA security standard
   • DA procedure
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company has a legacy application that requires a weak password policy because of hard-coded limitations. The application is critical to operations and cannot be replaced. Which compensating control would most effectively reduce the risk of credential-based attacks?

   • ADisable account lockout to avoid user frustration
   • BAllow password reuse to simplify user experience
   • CIncrease the password length to the maximum allowed by the application
   • DImplement multi-factor authentication (MFA) at the network level for access to the application
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   How do standards and procedures differ from a security policy?

   • AStandards and procedures provide specific implementation details and step-by-step instructions, while policies provide high-level rules
   • BStandards and procedures are only for IT staff, while policies apply to all employees
   • CStandards and procedures are optional, while policies are mandatory
   • DStandards and procedures are created by external vendors, while policies are internal
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A company has a policy that requires all software to be patched within 30 days of release. However, a critical business application is incompatible with the latest patch and crashes when the patch is applied. The security team must balance security and business continuity. Which approach is the BEST?

   • ADisable the application until a compatible patch is available
   • BApply the patch immediately to production and hope it does not crash
   • CSkip the patch and accept the risk to avoid any disruption
   • DApply the patch to a test environment, verify compatibility, and then deploy to production with a rollback plan
   Reveal Solution Discussion Select an answer first