TheorySecurityX Test Prep
Practice Test
Practice 1511+ real SecurityX Test Prep questions with clear explanations, realistic mock exams, and progress tracking - free to start and fully offline.
Heads up: the app and the web exam use separate accounts — a web unlock and an in-app purchase do not carry over. Buy on the web to practice on the web.
SecurityX Test Prep exam — full Q&A walkthrough
Every question read aloud with the answer explained. Play it on your commute, then test yourself.
30 free SecurityX Test Prep questions
Sampled across every topic area — not just the first page. Try them as a quiz or flip them as flashcards.
-
SecurityX Test Prep
Which of the following is an advantage of using elliptic curve cryptography (ECC) over RSA?
Correct — D. Answer: ECC requires shorter key lengths to achieve comparable security. Elliptic curve cryptography (ECC) is known for its efficiency in key length. It provides the same level of security as RSA but with significantly shorter key sizes. This results in faster computations and less storage requirement. Contrary to the distractors, ECC is not necessarily faster to implement in hardware, and its complexity can make it challenging to understand and implement. It also does not generate longer keys but rather achieves stronger security with shorter keys. -
SecurityX Test Prep
A system administrator notices an employee with a company-issued laptop has installed software not available in the official repositories. What is the likely security issue with the laptop?
Correct — B. Answer: The laptop has been rooted. Rooting removes system-imposed restrictions, allowing the installation of software from any source. Encrypting data through Full-Device Encryption (FDE) ensures data security. An eFuse is used to prevent tampering with system components. BIOS and firmware issues often relate to versioning and compatibility management. -
SecurityX Test Prep
Which of the following techniques involves examining and monitoring server traffic in real-time to identify and mitigate potential security threats?
Correct — B. Answer: Network traffic analysis Network traffic analysis is the process of intercepting and examining messages to deduce information from patterns in communication, which helps in identifying malicious activities and security threats in real-time. Sandboxing is a way to safely run a program in a specific isolated environment. Static code analysis involves examining code without executing it, to find vulnerabilities early in the development process. Peering is a technique for directly connecting two networks. -
SecurityX Test Prep
BrightFuture Corp. uses an extensive IoT network for industrial monitoring. To ensure no unauthorized access to their sensor data, BrightFuture Corp. produces and securely stores its own cryptographic keys, without granting any access to their IoT service provider. What approach to key management is BrightFuture Corp. using?
Correct — A. Answer: HYOK With an HYOK (hold your own key) model, customers create and manage their own keys. The IoT service provider does not have access to the keys and cannot decrypt the data. With a BYOK (bring your own key) model, customers create and manage their own keys, but the IoT service provider is allowed access to the keys and can decrypt the data. BYOD (bring your own device) is related to employees using their own devices to access corporate resources. A RRSIG (resource record digital signature) record is a type of DNSSEC record. -
SecurityX Test Prep
A security specialist is evaluating a company's procedures for maintaining secure backups of sensitive data. They find that: encryption is enforced for all backups; access to backup media requires multi-factor authentication (MFA); all backup activities are logged and audited; and backup data can be deleted by an administrator. Based on this information, what should the specialist recommend?
Correct — C. Disallow an administrator from deleting backup data. Implementing strong security controls, such as disallowing any user (including administrators) from deleting backup data, is critical. Enforcing MFA, encryption, and logging and auditing activities are essential practices to ensure secure backups. -
SecurityX Test Prep
A cybersecurity team needs to identify potential vulnerabilities in their network devices. Which of the following tools is NOT primarily used for vulnerability scanning?
Correct — C. Correct answer: Wireshark Wireshark is a network protocol analyzer used to capture and analyze network traffic, not a vulnerability scanner. Nessus is a widely used vulnerability scanner that helps identify vulnerabilities, configuration issues, and policy compliance. OpenVAS (Open Vulnerability Assessment System) is also a comprehensive vulnerability scanning tool to detect security issues. Qualys is a cloud-based service that provides vulnerability scanning, compliance management, and other security services. -
SecurityX Test Prep
Which of the following is a protocol used for secure remote management and communication?
Correct — B. Answer: SSH Secure Shell (SSH) is a protocol used for secure remote management and for securely accessing a remote computer over an unsecured network. It encrypts the data being transmitted, ensuring confidentiality and integrity. FTP is the File Transfer Protocol, which is used for transferring files but does not encrypt the data. HTTP stands for HyperText Transfer Protocol, used primarily for accessing websites over the internet but without built-in encryption. SNMP is the Simple Network Management Protocol, which is used for network management but typically lacks encryption. -
SecurityX Test Prep
What does the Wireshark "tcp.flags.syn == 1 and tcp.flags.ack == 0" filter do?
Correct — A. Answer: Filter for TCP SYN packets The Wireshark filter "tcp.flags.syn == 1 and tcp.flags.ack == 0" is used to capture TCP SYN packets. TCP SYN packets are the first step in the TCP three-way handshake and are useful for identifying network connections being initiated. The command "tcp.flags.syn == 1 and tcp.flags.ack == 0" would be used within Wireshark to filter out only SYN packets, which are used to initiate TCP connections. Other filters such as "tcp.port" for port-specific traffic and "ip.addr" for traffic from a specific IP address can be combined with this filter for more granular monitoring. Filtering for TCP SYN packets can help network security professionals monitor for new connection attempts and potential scan activities. -
SecurityX Test Prep
All of the following are key sources for obtaining information on network vulnerabilities EXCEPT:
Correct — C. Answer: ISO The International Organization for Standardization (ISO) provides standards for various aspects of technology and security, but does not provide real-time information on network vulnerabilities. The United States Computer Emergency Readiness Team (US-CERT) provides security advisories. The Open Vulnerability and Assessment Language (OVAL) produces definitions for detecting vulnerabilities. The National Vulnerability Database (NVD) is a repository of vulnerability information. -
SecurityX Test Prep
TechCorp aims to identify security vulnerabilities in its applications during development, before the applications are moved to cloud infrastructure. Which security tool should TechCorp implement to achieve this goal?
Correct — B. Answer: SAST Static application security testing (SAST) tools analyze source code for potential security vulnerabilities such as buffer overflows and injection flaws early in the development lifecycle. This allows developers to rectify issues before deploying the application to the cloud. Dynamic application security testing (DAST) tools evaluate applications in runtime and do not analyze source code. A port scanner reviews network endpoints to identify open ports and running services. Vulnerability scanners are generally used to detect known vulnerabilities in deployed systems and applications. -
SecurityX Test Prep
Which of the following is a widely accepted framework for managing and improving an organization’s overall cybersecurity posture, covering areas such as risk management, communications, and governance?
Correct — D. Answer: NIST Cybersecurity Framework The NIST Cybersecurity Framework provides a policy framework of computer security guidance for how private sector organizations in the US can assess and improve their ability to prevent, detect, and respond to cyber attacks. COBIT (Control Objectives for Information and related Technologies) focuses on governance and management of enterprise IT. PCI-DSS (Payment Card Industry Data Security Standard) is a proprietary information security standard for organizations that handle branded credit cards. HIPAA (Health Insurance Portability and Accountability Act) is US legislation that provides data privacy and security provisions for safeguarding medical information. -
SecurityX Test Prep
During a cybersecurity exercise, you create a fake online persona to gather sensitive data from a company's employees. What type of intelligence gathering is this?
Correct — B. Answer: HUMINT HUMINT (human intelligence) involves interacting with people to collect information or gain access. SIGINT (signals intelligence) is the collection and analysis of electronic communications and signals. SOCMINT (social media intelligence) involves monitoring and analyzing data from social media platforms. TECHINT (technical intelligence) involves gathering information on the technical characteristics and capabilities of foreign weapons and equipment. -
SecurityX Test Prep
A database administrator wants to ensure their database servers do not have any vulnerabilities that attackers could exploit. Which of the following tools would provide the MOST benefit in this scenario?
Correct — A. Answer: Nessus The administrator needs a vulnerability scanner. Nessus is one of the most widely used vulnerability scanners available. It is free for personal use on non-enterprise networks and can provide in-depth information about various vulnerabilities and weaknesses discovered within the database servers. Wireshark is a tool for capturing and analyzing network traffic. The traceroute command helps determine the path network traffic takes to a destination. John the Ripper is a password cracker. -
SecurityX Test Prep
Identify the four primary steps in the Incident Response Life Cycle as defined by NIST.
Correct — C. Answer: Preparation, Detection and Analysis, Containment, Eradication, and Recovery, Post-Incident Activity The Incident Response Life Cycle as defined by NIST consists of several steps aimed at addressing and mitigating security incidents. Initially, organizations prepare by setting up the necessary infrastructure and policies. Detection and analysis involve identifying and understanding the scope of an incident. Containment, eradication, and recovery deals with isolating affected systems, removing threats, and restoring operations. Post-incident activity includes reviewing and learning from the incident to improve future response efforts. -
SecurityX Test Prep
Firewalls operate at which layer of the OSI model? They enforce rules using what tables?
Correct — A. Answer: 4, Access Control Lists (ACL). Firewalls primarily operate at Layer 4 of the OSI model. This involves managing traffic based on TCP/UDP port numbers, which is a characteristic of the Transport layer. The rules and policies they apply to network traffic are stored in Access Control Lists (ACLs). IP tables and MAC filtering are related but not the primary methods used by firewalls. Distributed Control Systems (DCS) are unrelated to OSI model layers and firewall functions. -
SecurityX Test Prep
In a network security environment, it is often necessary to configure access control lists (ACLs) to ensure proper traffic flow. Which of the following is the correct syntax for an ACL rule that will permit all TCP traffic from source IP address 192.168.10.10 to destination IP address 172.16.20.20?
Correct — D. Answer: access-list 200 permit TCP 192.168.10.10 any 172.16.20.20 any Access control lists (ACLs) are used to filter network traffic by controlling whether routed packets are forwarded or blocked at the router's interfaces. The correct syntax for an ACL rule follows the format: Rule name/number, Action, Protocol, Source IP, Source Port, Destination IP, Destination Port. In the correct answer, 'permit' allows the traffic, 'TCP' is the protocol specified, '192.168.10.10' is the source IP, 'any' specifies that any port can be used by the source, '172.16.20.20' is the destination IP, and 'any' specifies that any port can be used by the destination. -
SecurityX Test Prep
Alice, a network administrator, sets a policy to send an alert if bandwidth utilization of a network link exceeds 80% during office hours. What type of threshold is this?
Correct — D. Answer: Fixed Alert thresholds based on fixed numeric values or calculations are called fixed thresholds. An 80% bandwidth utilization threshold is an example of a fixed value. State-based thresholds are triggered when a system state changes, such as a change in operational mode or network status. Historical thresholds consider past and present values and are often used to compare different periods. Adaptive is a distractor answer. Adaptive thresholds adjust based on varying conditions, such as user load or varying network traffic patterns. -
SecurityX Test Prep
Which of the following is a primary advantage of using a TPM (Trusted Platform Module) in a security architecture?
Correct — D. Answer: Secure storage for encryption keys A Trusted Platform Module (TPM) provides secure storage for encryption keys and other security-related credentials. It helps ensure the integrity of a system by securely storing cryptographic keys used for encryption, preventing tampering and unauthorized access. However, TPMs do not protect against physical theft, provide high processing power for encryption tasks, or ensure a constant system uptime. Device encryption protects the data on the device, while secure storage protects the keys and credentials used to encrypt the data itself. -
SecurityX Test Prep
TechCorp develops proprietary algorithms that they include in their software packages. In their efforts to ensure client trust, what method can TechCorp employ to assure clients that the software they receive is authentic and tamper-free?
Correct — A. Digital signature is a security method used to guarantee the authenticity and integrity of software packages. It involves applying a cryptographic signature to the software using a trusted key, ensuring that the software has not been tampered with from the time it was signed. Third-party audit refers to a review conducted by an independent organization to confirm compliance and effectiveness but is not specifically for ensuring software authenticity. Checksum verification checks for data integrity but does not confirm the authenticity of the creator. Sandboxing is an isolation technique to run code in a secure environment, not specifically for ensuring authenticity. -
SecurityX Test Prep
As an IT security analyst for Tech Corp, you've been assigned to implement a solution that monitors and detects unauthorized devices connecting to the company's wired network. Which of the following tools would provide the BEST solution?
Correct — D. Answer: NIDS A NIDS (network intrusion detection system) is designed to monitor and analyze network traffic to detect unauthorized devices and other suspicious activities on a network. WIDS (wireless intrusion detection system) is used for monitoring wireless networks, not wired networks. HIDS (host intrusion detection system) focuses on individual endpoints or devices. VPN (virtual private network) is a tunneling protocol for secure communications, not a monitoring tool. -
SecurityX Test Prep
An online retail company seeks to ensure that external payment processing services can securely and effectively handle customer transactions. This system must define how payment requests will be sent and how confirmations will be received. What type of solution will allow for this?
Correct — B. Answer: API gateway An Application Programming Interface (API) gateway handles interactions between different types of systems. An API gateway can be used to manage API calls from external sources, such as payment processing services, and securely facilitates the sending of requests and receiving of confirmations. A firewall is a security device that monitors and controls incoming and outgoing network traffic. A load balancer distributes network or application traffic across multiple servers. A proxy server acts as an intermediary for requests from clients seeking resources from other servers. -
SecurityX Test Prep
Where can firewall devices be strategically placed within a corporate network?
Correct — A. Answer: At the network perimeter and at key internal segment points Firewalls are essential for protecting a corporate network. They should be positioned at both the network perimeter to guard against external threats and at key internal segments to monitor and control traffic within the network. -
SecurityX Test Prep
Which of the following is NOT one of the principles of the Zero Trust security model?
Correct — C. Answer: Open access networks The principles of the Zero Trust security model include assume breach, verify explicitly, and least privilege. Open access networks are not a principle of the Zero Trust security model. -
SecurityX Test Prep
An organization needs to ensure secure communication between their data center and branch offices. What solution should they implement to achieve this?
Correct — D. Answer: Site-to-site VPN A site-to-site VPN connects separate networks over the internet to function as a single network. This provides a secure, encrypted connection for data transfer. A remote access VPN is typically used to create a secure tunnel for individual users to connect to an internal network. Network Access Control (NAC) manages authorization of devices before connection, while Network Address Translation (NAT) allows multiple devices on a local network to access external networks using a single public IP address. -
SecurityX Test Prep
How is information about the structure of a file, such as permissions or owner, described in a Linux file system?
Correct — B. Answer: Metadata. Metadata provides information about the structure and attributes of a file, such as permissions, owner, and timestamps in a Linux file system. Superdata and XOR data are non-existent terms used as distractors. -
SecurityX Test Prep
What is the default port used by SSH?
Correct — A. Answer: 22. By default, SSH (Secure Shell) uses port 22. Port 80 is used for HTTP, port 21 is used for FTP, and port 443 is used for HTTPS. -
SecurityX Test Prep
Which file transfer protocol is both platform-independent and capable of securely transferring files over a network?
Correct — C. Answer: SFTP SFTP (SSH File Transfer Protocol) is a secure and platform-independent method for transferring files over a network, as it leverages SSH (Secure Shell) for encryption. FTP (File Transfer Protocol) lacks inherent security features and generally operates without encryption. TFTP (Trivial File Transfer Protocol) is a simplified version of FTP without authentication and encryption mechanisms. HTTP (HyperText Transfer Protocol) is primarily used for transferring web pages and data over the web but lacks specific focus on secure file transfers. -
SecurityX Test Prep
Your organization is preparing for an annual compliance audit. The compliance officer has requested you to document the current compliance status, identify areas where compliance is not met, and suggest remedies to ensure full compliance before the audit date. Which of the following should you do to meet this objective?
Correct — C. Answer: Perform a compliance gap analysis A compliance gap analysis identifies the current state of compliance, desired compliance state, and necessary steps to achieve full compliance. GAAP (Generally Accepted Accounting Principles) is not directly relevant to the compliance audit preparation. MTBF (Mean Time Between Failures) and MTTR (Mean Time to Repair) analyses are distractors and do not directly address compliance requirements. -
SecurityX Test Prep
BetaTech Ltd. and GammaSolutions Co. are unable to finalize a binding contract for their joint project. Instead, they draft a document, signed by representatives from both companies, outlining the terms and expectations. What is this type of document called?
Correct — C. Answer: Memorandum of understanding An MOU (memorandum of understanding) is an agreement between multiple parties that is often non-binding, but formally details a shared understanding or agreement. An ISA (interconnection security agreement) is a specific telecommunications contract related to network connections. An OLA (operation level agreement) is an agreement about responsibilities between different support teams. An SLA (service level agreement) is a minimum guaranteed service level a provider commits to. For example, an SLA may specify 99.9% uptime and 1-hour support response times. -
SecurityX Test Prep
In the context of cybersecurity risk management, what does SLE stand for?
Correct — D. Answer: Single Loss Expectancy The single loss expectancy (SLE) is a measure of the monetary loss or impact of a single occurrence of a threat. It is often used in risk assessments to estimate the potential financial impact of security incidents.
SecurityX Test Prep sample questions
Tap any question below to reveal the answer and a plain-English explanation.
SecurityX Test Prep Which of the following is NOT one of the principles of the Zero Trust security model?
A. Verify explicitly
B. Least privilege principle
C. Open access networks ✓
D. Assume breach
Correct — C. Answer: Open access networks The principles of the Zero Trust security model include assume breach, verify explicitly, and least privilege. Open access networks are not a principle of the Zero Trust security model.
SecurityX Test Prep An organization needs to ensure secure communication between their data center and branch offices. What solution should they implement to achieve this?
A. Remote access VPN
B. Network Access Control (NAC)
C. Network Address Translation (NAT)
D. Site-to-site VPN ✓
Correct — D. Answer: Site-to-site VPN A site-to-site VPN connects separate networks over the internet to function as a single network. This provides a secure, encrypted connection for data transfer. A remote access VPN is typically used to create a secure tunnel for individual users to connect to an internal network. Network Access Control (NAC) manages authorization of devices before connection, while Network Address Translation (NAT) allows multiple devices on a local network to access external networks using a single public IP address.
SecurityX Test Prep How is information about the structure of a file, such as permissions or owner, described in a Linux file system?
A. Mapping data
B. Metadata ✓
C. Superdata
D. XOR data
Correct — B. Answer: Metadata. Metadata provides information about the structure and attributes of a file, such as permissions, owner, and timestamps in a Linux file system. Superdata and XOR data are non-existent terms used as distractors.
SecurityX Test Prep What is the default port used by SSH?
A. 22 ✓
B. 80
C. 21
D. 443
Correct — A. Answer: 22. By default, SSH (Secure Shell) uses port 22. Port 80 is used for HTTP, port 21 is used for FTP, and port 443 is used for HTTPS.
SecurityX Test Prep Which file transfer protocol is both platform-independent and capable of securely transferring files over a network?
A. TFTP
B. HTTP
C. SFTP ✓
D. FTP
Correct — C. Answer: SFTP SFTP (SSH File Transfer Protocol) is a secure and platform-independent method for transferring files over a network, as it leverages SSH (Secure Shell) for encryption. FTP (File Transfer Protocol) lacks inherent security features and generally operates without encryption. TFTP (Trivial File Transfer Protocol) is a simplified version of FTP without authentication and encryption mechanisms. HTTP (HyperText Transfer Protocol) is primarily used for transferring web pages and data over the web but lacks specific focus on secure file transfers.
SecurityX Test Prep Your organization is preparing for an annual compliance audit. The compliance officer has requested you to document the current compliance status, identify areas where compliance is not met, and suggest remedies to ensure full compliance before the audit date. Which of the following should you do to meet this objective?
A. Execute MTBF analysis
B. Execute MTTR analysis
C. Perform a compliance gap analysis ✓
D. Conduct a revenue audit based on GAAP
Correct — C. Answer: Perform a compliance gap analysis A compliance gap analysis identifies the current state of compliance, desired compliance state, and necessary steps to achieve full compliance. GAAP (Generally Accepted Accounting Principles) is not directly relevant to the compliance audit preparation. MTBF (Mean Time Between Failures) and MTTR (Mean Time to Repair) analyses are distractors and do not directly address compliance requirements.
SecurityX Test Prep BetaTech Ltd. and GammaSolutions Co. are unable to finalize a binding contract for their joint project. Instead, they draft a document, signed by representatives from both companies, outlining the terms and expectations. What is this type of document called?
A. Service level agreement
B. Operation level agreement
C. Memorandum of understanding ✓
D. Interconnection security agreement
Correct — C. Answer: Memorandum of understanding An MOU (memorandum of understanding) is an agreement between multiple parties that is often non-binding, but formally details a shared understanding or agreement. An ISA (interconnection security agreement) is a specific telecommunications contract related to network connections. An OLA (operation level agreement) is an agreement about responsibilities between different support teams. An SLA (service level agreement) is a minimum guaranteed service level a provider commits to. For example, an SLA may specify 99.9% uptime and 1-hour support response times.
SecurityX Test Prep In the context of cybersecurity risk management, what does SLE stand for?
A. Single Loss Event
B. Security Level Expense
C. Security Loss Estimate
D. Single Loss Expectancy ✓
Correct — D. Answer: Single Loss Expectancy The single loss expectancy (SLE) is a measure of the monetary loss or impact of a single occurrence of a threat. It is often used in risk assessments to estimate the potential financial impact of security incidents.
About the SecurityX Test Prep test
The SecurityX Test Prep measures the IT & Cybersecurity knowledge you'll actually rely on — tested the way the real exam asks it, not with trick questions. Practising real SecurityX Test Prep-style questions, then sitting a full timed mock exam, is the fastest way to walk in knowing you'll pass.
You will be tested on
- The core topics and terminology you'll be tested on
- Rules, standards and best-practice procedures
- Real-world scenarios and how to respond
- Common mistakes and how to avoid them
How TheoryPractice helps you pass
- Real exam-style questions with instant, detailed explanations
- Full timed mock exams that mirror the real test format
- Flashcards & quiz modes from the same question bank
- Progress tracking so you know exactly when you're ready
Topics in this question bank
The core topics and terminology you'll be tested on
Rules, standards and best-practice procedures
Real-world scenarios and how to respond
Common mistakes and how to avoid them
Full SecurityX Test Prep bank + unlimited mocks
Try 30 questions free. Unlock the complete SecurityX Test Prep question bank, every explanation, and unlimited timed mock exams. Practice on any device.
Unlock SecurityX Test Prep →