The Ultimate and Complete WGU C836 Fundamentals of Information Security Study
Guide, Covering the CIA Triad, Parkerian Hexad, Threats and Vulnerabilities, Attack
Types, Risk Management, Incident Response, Identification Authentication and
Authorization, Least Privilege, Access Control Models, Network Access Control Lists,
Accountability and Auditing, Symmetric and Asymmetric Cryptography, Hash
Functions, Digital Signatures, Certificates, SSL and TLS, VPNs and IPsec, Data at Rest
Data in Transit and Data in Use, DDoS and Man-in-the-Middle Attacks, Security
Policies and Compliance, FISMA, FERPA, HIPAA, HITECH, SOX, GLBA and PCI DSS,
Phishing and Social Engineering, Physical Security, Defense in Depth, RAID, IDS and
IPS, Network Segmentation, Firewalls, Proxy Servers, DMZs, Port Scanning, Nmap,
Wireshark, Tcpdump, Honeypots, Burp Suite, Operating-System Hardening,
Vulnerability Scanning, Nessus, Application Security, Buffer Overflows, SQL Injection,
Practice Questions With Detailed Rationales, Real-World Security Scenarios, and
Comprehensive Preparation for the WGU C836 Objective Assessment
Question 1: Which of the following best defines the "CIA Triad" in the context of information
security?
A. Confidentiality, Integrity, Availability
B. Confidentiality, Identity, Authorization
C. Compliance, Integrity, Authentication
D. Control, Identity, Assessment
CORRECT ANSWER: A. Confidentiality, Integrity, Availability
Rationale: The CIA Triad is the foundational model for information security policy.
Confidentiality ensures data is accessible only to authorized users, Integrity guarantees the data
is accurate and unaltered, and Availability ensures systems and data are accessible when
needed.
Question 2: A security administrator discovers that a user's password was successfully
guessed through a brute-force attack. Which of the following controls would have most
effectively mitigated this specific attack?
A. Implementing a firewall
B. Enforcing a lockout policy after a certain number of failed attempts
C. Installing an intrusion detection system
D. Encrypting the hard drive
CORRECT ANSWER: B. Enforcing a lockout policy after a certain number of failed attempts
,Rationale: A lockout policy disables an account after a set number of failed login attempts,
making brute-force attacks (which rely on trying many passwords) ineffective. A firewall and IDS
are network controls, and encryption protects data at rest, not the authentication process.
Question 3: What is the primary difference between a vulnerability and a threat in risk
management?
A. A vulnerability is a potential exploit, while a threat is the actualized attack.
B. A vulnerability is a weakness, while a threat is an entity that can exploit that weakness.
C. A vulnerability is a risk calculation, while a threat is a countermeasure.
D. A vulnerability is an external factor, while a threat is an internal weakness.
CORRECT ANSWER: B. A vulnerability is a weakness, while a threat is an entity that can
exploit that weakness.
Rationale: In risk management, a vulnerability is a flaw or weakness in an asset or system. A
threat is a person, event, or entity that has the potential to exploit that weakness. A risk is the
potential for loss when a threat exploits a vulnerability.
Question 4: Which of the following is a primary characteristic of a "Stateful" firewall as
opposed to a "Stateless" firewall?
A. It filters traffic based solely on the source IP address.
B. It inspects the packet header only.
C. It maintains context about active connections and makes decisions based on the connection's
state.
D. It is only capable of blocking specific application-layer protocols.
CORRECT ANSWER: C. It maintains context about active connections and makes decisions
based on the connection's state.
Rationale: A stateful firewall tracks the state of network connections. It remembers if a packet
is part of an existing, legitimate connection, allowing it to make more intelligent filtering
decisions than a stateless firewall, which inspects each packet in isolation.
Question 5: In a Public Key Infrastructure (PKI), what is the primary role of a Certificate
Authority (CA)?
A. To generate the user's private key.
B. To issue and sign digital certificates to bind a public key to an identity.
,C. To store all encrypted passwords for the organization.
D. To act as the first line of defense in a network perimeter.
CORRECT ANSWER: B. To issue and sign digital certificates to bind a public key to an identity.
Rationale: The Certificate Authority (CA) is a trusted entity that issues digital certificates. By
digitally signing the certificate, the CA vouches for the identity of the certificate holder and
binds that identity to their public key.
Question 6: A user receives an email that appears to be from their bank, asking them to click
a link and verify their account details. The link leads to a fake website that looks legitimate.
This is an example of which type of attack?
A. Phishing
B. Spoofing
C. Man-in-the-Middle
D. Replay Attack
CORRECT ANSWER: A. Phishing
Rationale: This scenario describes a classic phishing attack, where the attacker masquerades as
a trusted entity to trick the victim into providing sensitive information via a fraudulent website.
Spoofing is the act of falsifying an identity, which is a component of the attack, but the
overarching social-engineering scheme is phishing.
Question 7: Which security control is designed to prevent unauthorized users from accessing
a physical facility?
A. Encryption
B. Mantrap
C. Firewall
D. Intrusion Prevention System
CORRECT ANSWER: B. Mantrap
Rationale: A mantrap is a physical security control designed to prevent tailgating and
unauthorized entry. It consists of a small room with two sets of interlocking doors, where the
first door must close before the second one opens, allowing for identity verification.
Question 8: The "Principle of Least Privilege" is a fundamental concept in access control.
What does it state?
, A. All users should have the same level of access.
B. Users should be given the most restrictive set of privileges required to perform their job
functions.
C. Access privileges should be reviewed on a monthly basis.
D. Users should have administrative rights to troubleshoot their own systems.
CORRECT ANSWER: B. Users should be given the most restrictive set of privileges required to
perform their job functions.
Rationale: The Principle of Least Privilege dictates that users, applications, and systems should
only be given the minimum necessary permissions to perform their specific tasks. This limits the
potential damage from errors, malicious insiders, or compromised accounts.
Question 9: Which of the following is a symmetric encryption algorithm that was developed
by the U.S. government and is currently considered secure for sensitive data?
A. RSA
B. AES
C. ECC
D. Diffie-Hellman
CORRECT ANSWER: B. AES
Rationale: AES (Advanced Encryption Standard) is a symmetric block cipher adopted by the U.S.
government. It is widely used globally and considered secure. RSA and ECC are asymmetric
algorithms, while Diffie-Hellman is a key exchange protocol.
Question 10: What is the primary purpose of a non-disclosure agreement (NDA) in an
organization's security policy?
A. To prevent competitors from hiring employees.
B. To bind employees and partners to confidentiality regarding proprietary information.
C. To define the acceptable use of company equipment.
D. To outline the disaster recovery procedures.
CORRECT ANSWER: B. To bind employees and partners to confidentiality regarding
proprietary information.
Rationale: An NDA is a legal contract used to protect sensitive, proprietary, or confidential
information. It creates a legally binding obligation for the signer to not disclose the specified
information to third parties.
Guide, Covering the CIA Triad, Parkerian Hexad, Threats and Vulnerabilities, Attack
Types, Risk Management, Incident Response, Identification Authentication and
Authorization, Least Privilege, Access Control Models, Network Access Control Lists,
Accountability and Auditing, Symmetric and Asymmetric Cryptography, Hash
Functions, Digital Signatures, Certificates, SSL and TLS, VPNs and IPsec, Data at Rest
Data in Transit and Data in Use, DDoS and Man-in-the-Middle Attacks, Security
Policies and Compliance, FISMA, FERPA, HIPAA, HITECH, SOX, GLBA and PCI DSS,
Phishing and Social Engineering, Physical Security, Defense in Depth, RAID, IDS and
IPS, Network Segmentation, Firewalls, Proxy Servers, DMZs, Port Scanning, Nmap,
Wireshark, Tcpdump, Honeypots, Burp Suite, Operating-System Hardening,
Vulnerability Scanning, Nessus, Application Security, Buffer Overflows, SQL Injection,
Practice Questions With Detailed Rationales, Real-World Security Scenarios, and
Comprehensive Preparation for the WGU C836 Objective Assessment
Question 1: Which of the following best defines the "CIA Triad" in the context of information
security?
A. Confidentiality, Integrity, Availability
B. Confidentiality, Identity, Authorization
C. Compliance, Integrity, Authentication
D. Control, Identity, Assessment
CORRECT ANSWER: A. Confidentiality, Integrity, Availability
Rationale: The CIA Triad is the foundational model for information security policy.
Confidentiality ensures data is accessible only to authorized users, Integrity guarantees the data
is accurate and unaltered, and Availability ensures systems and data are accessible when
needed.
Question 2: A security administrator discovers that a user's password was successfully
guessed through a brute-force attack. Which of the following controls would have most
effectively mitigated this specific attack?
A. Implementing a firewall
B. Enforcing a lockout policy after a certain number of failed attempts
C. Installing an intrusion detection system
D. Encrypting the hard drive
CORRECT ANSWER: B. Enforcing a lockout policy after a certain number of failed attempts
,Rationale: A lockout policy disables an account after a set number of failed login attempts,
making brute-force attacks (which rely on trying many passwords) ineffective. A firewall and IDS
are network controls, and encryption protects data at rest, not the authentication process.
Question 3: What is the primary difference between a vulnerability and a threat in risk
management?
A. A vulnerability is a potential exploit, while a threat is the actualized attack.
B. A vulnerability is a weakness, while a threat is an entity that can exploit that weakness.
C. A vulnerability is a risk calculation, while a threat is a countermeasure.
D. A vulnerability is an external factor, while a threat is an internal weakness.
CORRECT ANSWER: B. A vulnerability is a weakness, while a threat is an entity that can
exploit that weakness.
Rationale: In risk management, a vulnerability is a flaw or weakness in an asset or system. A
threat is a person, event, or entity that has the potential to exploit that weakness. A risk is the
potential for loss when a threat exploits a vulnerability.
Question 4: Which of the following is a primary characteristic of a "Stateful" firewall as
opposed to a "Stateless" firewall?
A. It filters traffic based solely on the source IP address.
B. It inspects the packet header only.
C. It maintains context about active connections and makes decisions based on the connection's
state.
D. It is only capable of blocking specific application-layer protocols.
CORRECT ANSWER: C. It maintains context about active connections and makes decisions
based on the connection's state.
Rationale: A stateful firewall tracks the state of network connections. It remembers if a packet
is part of an existing, legitimate connection, allowing it to make more intelligent filtering
decisions than a stateless firewall, which inspects each packet in isolation.
Question 5: In a Public Key Infrastructure (PKI), what is the primary role of a Certificate
Authority (CA)?
A. To generate the user's private key.
B. To issue and sign digital certificates to bind a public key to an identity.
,C. To store all encrypted passwords for the organization.
D. To act as the first line of defense in a network perimeter.
CORRECT ANSWER: B. To issue and sign digital certificates to bind a public key to an identity.
Rationale: The Certificate Authority (CA) is a trusted entity that issues digital certificates. By
digitally signing the certificate, the CA vouches for the identity of the certificate holder and
binds that identity to their public key.
Question 6: A user receives an email that appears to be from their bank, asking them to click
a link and verify their account details. The link leads to a fake website that looks legitimate.
This is an example of which type of attack?
A. Phishing
B. Spoofing
C. Man-in-the-Middle
D. Replay Attack
CORRECT ANSWER: A. Phishing
Rationale: This scenario describes a classic phishing attack, where the attacker masquerades as
a trusted entity to trick the victim into providing sensitive information via a fraudulent website.
Spoofing is the act of falsifying an identity, which is a component of the attack, but the
overarching social-engineering scheme is phishing.
Question 7: Which security control is designed to prevent unauthorized users from accessing
a physical facility?
A. Encryption
B. Mantrap
C. Firewall
D. Intrusion Prevention System
CORRECT ANSWER: B. Mantrap
Rationale: A mantrap is a physical security control designed to prevent tailgating and
unauthorized entry. It consists of a small room with two sets of interlocking doors, where the
first door must close before the second one opens, allowing for identity verification.
Question 8: The "Principle of Least Privilege" is a fundamental concept in access control.
What does it state?
, A. All users should have the same level of access.
B. Users should be given the most restrictive set of privileges required to perform their job
functions.
C. Access privileges should be reviewed on a monthly basis.
D. Users should have administrative rights to troubleshoot their own systems.
CORRECT ANSWER: B. Users should be given the most restrictive set of privileges required to
perform their job functions.
Rationale: The Principle of Least Privilege dictates that users, applications, and systems should
only be given the minimum necessary permissions to perform their specific tasks. This limits the
potential damage from errors, malicious insiders, or compromised accounts.
Question 9: Which of the following is a symmetric encryption algorithm that was developed
by the U.S. government and is currently considered secure for sensitive data?
A. RSA
B. AES
C. ECC
D. Diffie-Hellman
CORRECT ANSWER: B. AES
Rationale: AES (Advanced Encryption Standard) is a symmetric block cipher adopted by the U.S.
government. It is widely used globally and considered secure. RSA and ECC are asymmetric
algorithms, while Diffie-Hellman is a key exchange protocol.
Question 10: What is the primary purpose of a non-disclosure agreement (NDA) in an
organization's security policy?
A. To prevent competitors from hiring employees.
B. To bind employees and partners to confidentiality regarding proprietary information.
C. To define the acceptable use of company equipment.
D. To outline the disaster recovery procedures.
CORRECT ANSWER: B. To bind employees and partners to confidentiality regarding
proprietary information.
Rationale: An NDA is a legal contract used to protect sensitive, proprietary, or confidential
information. It creates a legally binding obligation for the signer to not disclose the specified
information to third parties.
