SecurityX Test Prep practice questions and answers 2026. Tap an option to test yourself — you'll see the correct answer and a plain-English explanation for every question. Free, no login.
Q11Which of the following is a widely accepted framework for managing and improving an organization’s overall cybersecurity posture, covering areas such as risk management, communications, and governance?
✓ Correct answer: D. NIST Cybersecurity Framework
Answer: NIST Cybersecurity Framework The NIST Cybersecurity Framework provides a policy framework of computer security guidance for how private sector organizations in the US can assess and improve their ability to prevent, detect, and respond to cyber attacks. COBIT (Control Objectives for Information and related Technologies) focuses on governance and management of enterprise IT. PCI-DSS (Payment Card Industry Data Security Standard) is a proprietary information security standard for organizations that handle branded credit cards. HIPAA (Health Insurance Portability and Accountability Act) is US legislation that provides data privacy and security provisions for safeguarding medical information.
Q12During a cybersecurity exercise, you create a fake online persona to gather sensitive data from a company's employees. What type of intelligence gathering is this?
✓ Correct answer: B. HUMINT
Answer: HUMINT HUMINT (human intelligence) involves interacting with people to collect information or gain access. SIGINT (signals intelligence) is the collection and analysis of electronic communications and signals. SOCMINT (social media intelligence) involves monitoring and analyzing data from social media platforms. TECHINT (technical intelligence) involves gathering information on the technical characteristics and capabilities of foreign weapons and equipment.
Q13A database administrator wants to ensure their database servers do not have any vulnerabilities that attackers could exploit. Which of the following tools would provide the MOST benefit in this scenario?
✓ Correct answer: A. Nessus
Answer: Nessus The administrator needs a vulnerability scanner. Nessus is one of the most widely used vulnerability scanners available. It is free for personal use on non-enterprise networks and can provide in-depth information about various vulnerabilities and weaknesses discovered within the database servers. Wireshark is a tool for capturing and analyzing network traffic. The traceroute command helps determine the path network traffic takes to a destination. John the Ripper is a password cracker.
Q14Identify the four primary steps in the Incident Response Life Cycle as defined by NIST.
✓ Correct answer: C. Preparation, Detection and Analysis, Containment, Eradication, and Recovery, Post-Incident Activity
Answer: Preparation, Detection and Analysis, Containment, Eradication, and Recovery, Post-Incident Activity The Incident Response Life Cycle as defined by NIST consists of several steps aimed at addressing and mitigating security incidents. Initially, organizations prepare by setting up the necessary infrastructure and policies. Detection and analysis involve identifying and understanding the scope of an incident. Containment, eradication, and recovery deals with isolating affected systems, removing threats, and restoring operations. Post-incident activity includes reviewing and learning from the incident to improve future response efforts.
Q15Firewalls operate at which layer of the OSI model? They enforce rules using what tables?
✓ Correct answer: A. 4, Access Control Lists (ACL)
Answer: 4, Access Control Lists (ACL). Firewalls primarily operate at Layer 4 of the OSI model. This involves managing traffic based on TCP/UDP port numbers, which is a characteristic of the Transport layer. The rules and policies they apply to network traffic are stored in Access Control Lists (ACLs). IP tables and MAC filtering are related but not the primary methods used by firewalls. Distributed Control Systems (DCS) are unrelated to OSI model layers and firewall functions.
Q16In a network security environment, it is often necessary to configure access control lists (ACLs) to ensure proper traffic flow. Which of the following is the correct syntax for an ACL rule that will permit all TCP traffic from source IP address 192.168.10.10 to destination IP address 172.16.20.20?
✓ Correct answer: D. access-list 200 permit TCP 192.168.10.10 any 172.16.20.20 any
Answer: access-list 200 permit TCP 192.168.10.10 any 172.16.20.20 any Access control lists (ACLs) are used to filter network traffic by controlling whether routed packets are forwarded or blocked at the router's interfaces. The correct syntax for an ACL rule follows the format: Rule name/number, Action, Protocol, Source IP, Source Port, Destination IP, Destination Port. In the correct answer, 'permit' allows the traffic, 'TCP' is the protocol specified, '192.168.10.10' is the source IP, 'any' specifies that any port can be used by the source, '172.16.20.20' is the destination IP, and 'any' specifies that any port can be used by the destination.
Q17Alice, a network administrator, sets a policy to send an alert if bandwidth utilization of a network link exceeds 80% during office hours. What type of threshold is this?
✓ Correct answer: D. Fixed
Answer: Fixed Alert thresholds based on fixed numeric values or calculations are called fixed thresholds. An 80% bandwidth utilization threshold is an example of a fixed value. State-based thresholds are triggered when a system state changes, such as a change in operational mode or network status. Historical thresholds consider past and present values and are often used to compare different periods. Adaptive is a distractor answer. Adaptive thresholds adjust based on varying conditions, such as user load or varying network traffic patterns.
Q18Which of the following is a primary advantage of using a TPM (Trusted Platform Module) in a security architecture?
✓ Correct answer: D. Secure storage for encryption keys
Answer: Secure storage for encryption keys A Trusted Platform Module (TPM) provides secure storage for encryption keys and other security-related credentials. It helps ensure the integrity of a system by securely storing cryptographic keys used for encryption, preventing tampering and unauthorized access. However, TPMs do not protect against physical theft, provide high processing power for encryption tasks, or ensure a constant system uptime. Device encryption protects the data on the device, while secure storage protects the keys and credentials used to encrypt the data itself.
Q19TechCorp develops proprietary algorithms that they include in their software packages. In their efforts to ensure client trust, what method can TechCorp employ to assure clients that the software they receive is authentic and tamper-free?
✓ Correct answer: A. Digital signature
Digital signature is a security method used to guarantee the authenticity and integrity of software packages. It involves applying a cryptographic signature to the software using a trusted key, ensuring that the software has not been tampered with from the time it was signed. Third-party audit refers to a review conducted by an independent organization to confirm compliance and effectiveness but is not specifically for ensuring software authenticity. Checksum verification checks for data integrity but does not confirm the authenticity of the creator. Sandboxing is an isolation technique to run code in a secure environment, not specifically for ensuring authenticity.
Q20As an IT security analyst for Tech Corp, you've been assigned to implement a solution that monitors and detects unauthorized devices connecting to the company's wired network. Which of the following tools would provide the BEST solution?
✓ Correct answer: D. NIDS
Answer: NIDS A NIDS (network intrusion detection system) is designed to monitor and analyze network traffic to detect unauthorized devices and other suspicious activities on a network. WIDS (wireless intrusion detection system) is used for monitoring wireless networks, not wired networks. HIDS (host intrusion detection system) focuses on individual endpoints or devices. VPN (virtual private network) is a tunneling protocol for secure communications, not a monitoring tool.
Use the free SecurityX Test Prep sample, download the PDF, then unlock web-based timed mock exams for a full exam rehearsal.
Theory