WGU Network-and-Security-Foundation Network-and-Security-Foundation Exam Practice Test

Detecting code vulnerabilitiesthroughregular security audits, code reviews, and static analysis toolshelps prevent buffer overflow attacks. Developers should implementbounds checking,memory-safe programming languages, and input validationto mitigate risks.

Disabling cachingdoes not prevent buffer overflow attacks.

Server-side validationhelps with input security but does not directly address buffer overflows.

Intrusion protection softwaremay detect attacks but does not prevent vulnerabilities in code.

Awireless routeris designed to create an access point that allows wireless devices to connect to a network. It combines the functions of a traditional router with a wireless access point, enabling communication between wired and wireless devices. These routers use Wi-Fi standards (e.g., 802.11ac, 802.11ax) to transmit data wirelessly.

Broadband routersprimarily provide internet connectivity but do not necessarily include Wi-Fi functionality unless specified.

Core routershandle large-scale data routing in the backbone of networks but are not designed for access point creation.

Inter-provider border routersfunction at an ISP level for routing traffic between different networks, not for providing user access.

Theeconomy of mechanismprinciple states that security systems should beas simple and small as possible. Reducing complexity makes security mechanisms easier to understand, audit, and defend against attacks.

Least common mechanismreduces shared resources to limit security risks.

Least privilegerestricts access based on necessity.

Zero-trust modelassumes no implicit trust in users or devices.

IP address spoofingis a cyberattack where an attacker disguises their system by falsifying its IP address, making it appear as a trusted device in a network. This technique is used for bypassing security controls, launching denial-of-service (DoS) attacks, or impersonating legitimate users.

Pharmingredirects users to fake websites to steal credentials.

Man-in-the-middle attackintercepts communications between two parties.

Session hijackingtakes over an active session but does not involve falsifying an IP address.

TheNetwork layer(Layer 3 of the OSI model) includes theInternet Control Message Protocol (ICMP), which is used for network diagnostics (e.g.,pingcommand). ICMP helps in error reporting and network troubleshooting.

Transport layerhandles reliable data delivery (e.g., TCP, UDP).

Session layermanages communication sessions.

Application layerprovides end-user services.

Infrastructure as a Service (IaaS)provides virtualized computing resources, including virtual machines, storage, and networking, while allowing users full control over operating systems and applications. Examples include AWS EC2 and Google Compute Engine.

SaaSprovides ready-to-use applications (e.g., Google Docs).

FaaSruns code in response to events (e.g., AWS Lambda).

PaaSprovides development environments but not full infrastructure control.

A broadband router is a type of network router that connects multiple computers within a local network while also providing internet access. It functions as a gateway between the local network and the internet by handling data packet transmission and routing. Broadband routers are widely used in small offices and homes because they offer essential networking services, including DHCP, NAT, and sometimes wireless connectivity.

Inter-provider border routersare used by ISPs to route data between different providers and do not serve as an internet gateway for end users.

Subscriber edge routersare typically deployed at the edge of an ISP's network to connect subscriber networks but do not provide full internet routing functionalities.

Core routersoperate at the backbone level of a network, facilitating high-speed data transfer but not connecting end-user devices directly.

Integrityin IT security ensures that data remains accurate, unaltered, and trustworthy throughout its lifecycle. This means that data transmission should occurwithout errorsand should not be modified by unauthorized parties. Mechanisms like checksums, hashing, and digital signatures help maintain integrity.

Encryption (B)enhances confidentiality, not integrity.

Accessibility (C and D)relates to availability, not integrity.

Having restoration policies in placeensures that in the event of data breaches, ransomware, or system failures, data can be quickly restored from secure backups. This minimizes downtime and data loss.

Using a variable network topologydoes not directly improve data security.

Changing passwords weeklymay lead to weaker security due to password fatigue.

WEPis obsolete and does not provide strong encryption for data protection.

A violation ofintegrityoccurs whendata is modified incorrectly, whether intentionally or by accident. In this case, anemployee modifying a customer account incorrectlydemonstrates a breach of data integrity.

A and Crelate toavailability, as they describe system downtime.

Drelates toconfidentiality, as it describes improper data protection.

AWireless Local Area Network (WLAN)enables wireless connectivity within a defined geographic area, such as a library, office, or coffee shop. WLANs use Wi-Fi technology to allow users to access the internet without physical cables.

Storage Area Networks (SANs)are used for data storage and do not provide internet connectivity to users.

Metropolitan Area Networks (MANs)cover larger areas, such as cities, and are not used within a single building.

Personal Area Networks (PANs)connect personal devices like smartphones and laptops over short distances, such as via Bluetooth, but do not support public internet access.

ABus topologyis a network setup in which all devices share a single communication channel (central wire), and data is transmitted along this cable. Each device listens for data but only processes packets addressed to it. This topology was widely used in older Ethernet networks.

Star topologyuses a central switch or hub, not a shared wire.

Point-to-point topologyinvolves a direct link between two devices, not multiple devices sharing a medium.

Ring topologyconnects each device to two adjacent devices in a circular path, not a single shared bus.

Accounting(also known asauditing or logging) is a network security concept that tracks user activities, includingsuccessful and failed authentication attempts, system changes, and resource access. This helps in detecting and mitigating security breaches.

Authenticationverifies user identity but does not track activity.

Availabilityensures systems remain operational.

Authorizationcontrols user permissions but does not log activities.

Anaccess point (AP)is a network device that extends the coverage of a wireless network by acting as a bridge between wired and wireless devices. It allows users to connect to a network without needing a direct wired connection. APs are particularly useful in large office spaces where Wi-Fi signals may not reach all areas.

Routersprimarily manage network traffic but do not directly extend network range unless they include built-in AP functionality.

Serversare used for hosting applications and storing data but do not extend network connectivity.

Switchesconnect wired devices within a local network but do not extend wireless network range.

Thedigcommand in Linux is used for DNS troubleshooting. It queries DNS records and provides detailed information about domain name resolutions.

traceroutetracks the path packets take to a destination but does not diagnose DNS.

netstatlists active connections, not DNS records.

ifconfigis used for managing network interfaces.

Data modification attacksinvolve unauthorized changes to stored data, altering information to mislead, disrupt, or destroy integrity. Attackers may modify logs, transactions, or records for fraud or sabotage.

Launch pointis when a system is used to attack others.

Data exportis the theft of data.

Denial of availabilitymakes data inaccessible, but does not necessarily modify it.

Credential stuffingis a cyberattack where attackers use stolen username-password combinations from one breach to try logging into other services, exploiting users who reuse passwords. Automated tools test multiple credentials against multiple sites, leading to unauthorized access.

Brute-force attacksystematically tries all possible passwords but does not use breached data.

Session hijackingintercepts active user sessions but does not use stolen credentials.

Social engineeringmanipulates users into revealing credentials, rather than using breached data.

Pharmingis an attack that manipulates theDomain Name System (DNS)to redirect users to fraudulent websites without their knowledge. Attackers poison DNS records or compromise routers to reroute traffic to malicious sites designed to steal information.

Brute-force attackinvolves password guessing, not domain manipulation.

IP address spoofingdisguises a device’s identity but does not alter DNS records.

Session hijackingtakes over active user sessions but does not redirect websites.