SECURITY CLASS D MODULE 1-3 Exam Prep Document |
2026/2027 Edition | 150 Verified Questions - 140 Questions
with Answers
SECURITY CLASS D MODULE 1-140 QUESTIONS AND ANSWERS 2026-2027 ALREADY GRADED A+. 100%
Verified Solutions | Updated Per Latest Guidelines | Graded A+
This comprehensive exam preparation document covers Modules 1-3 of Security Class D, featuring
150 verified questions and answers. Designed to align with the latest 2026/2027 academic standards, it
provides thorough coverage of essential security concepts, procedures, and regulations. Each question
is accompanied by a detailed rationale to reinforce understanding and ensure exam readiness. Ideal for
students seeking a high score, this resource is rated A+ for its accuracy and completeness.
Key Features:
Security fundamentals and legal aspects
Patrol procedures and emergency response
Access control and surveillance techniques
Report writing and communication skills
Ethics and professionalism in security
Risk assessment and incident management
Updates for 2026:
- Revised to reflect 2026/2027 security regulations
- Added new questions on emerging security technologies
- Updated rationales for clarity and depth
- Incorporated feedback from recent exam takers
- Aligned with latest industry best practices
Abstract:
This exam preparation document for Security Class D Modules 1-3 is meticulously crafted to provide a
comprehensive review of core security principles. It encompasses a wide range of topics, including legal and
ethical considerations, patrol techniques, access control, emergency response, and report writing. Each of the 150
questions is designed to test critical knowledge and application, with detailed rationales that explain the correct
answers and distractors. The content is updated to reflect the 2026/2027 academic year, ensuring alignment with
current standards and practices. This resource is an essential tool for students aiming to achieve a top grade,
offering a structured and thorough approach to exam success. By engaging with this material, learners will build
confidence and proficiency in security management, preparing them for both the exam and real-world scenarios.
Keywords:
Security Class D, Exam Prep, Module 1-3, Verified Questions, 2026/2027, Security Fundamentals, Patrol
Procedures, Access Control
Answer Format:
Each question is presented in multiple-choice format with four options. The correct answer is clearly indicated,
followed by a comprehensive rationale explaining why it is correct and why the other options are incorrect. This
format reinforces learning and helps students understand the underlying concepts.
Compliance Checklist:
Aligned with 2026/2027 curriculum standards
150 verified questions with accurate answers
Page 1
, Detailed rationales for every question
Covers all key topics from Modules 1-3
Suitable for self-study and exam review
Rated A+ by previous users
Content Area Overview:
Content Area Questions Key Topics Weight
Security Fundamentals and 1-30 Legal authorities, ethics, liability, use of 20%
Legal Aspects force, security industry overview
Patrol Procedures and 31-60 Patrol techniques, observation, emergency 20%
Emergency Response response, first aid, evacuation procedures
Access Control and Surveillance 61-90 Access control systems, identification, 20%
CCTV, alarm systems, surveillance
techniques
Report Writing and 91-110 Report writing, note-taking, communication 13%
Communication skills, radio procedures, incident
documentation
Ethics and Professionalism 111-130 Professional conduct, confidentiality, 13%
conflict resolution, cultural sensitivity, code
of ethics
Risk Assessment and Incident 131-150 Risk assessment, threat analysis, incident 14%
Management management, crime prevention, safety
procedures
Page 2
,Q1. In a zero-trust architecture, which of the following represents the most significant
departure from traditional perimeter-based security when applied to internal
network traffic?
A. Encrypting all data at rest
B. Continuous authentication and authorization for every request, regardless of source
C. Implementing a demilitarized zone (DMZ) for external services
D. Deploying a next-generation firewall at the network edge
Correct Answer: B. Continuous authentication and authorization for every request,
regardless of source
Rationale: Zero-trust eliminates implicit trust based on network location, requiring
verification for every access attempt, even from within the perimeter. Encryption at rest,
DMZs, and edge firewalls are traditional measures that do not address the core principle
of never trusting internal traffic by default.
Why Wrong:
A - Encryption at rest protects data but does not address access control or trust
assumptions.
C - DMZs are a perimeter-based concept, not a zero-trust principle.
D - Edge firewalls are part of traditional perimeter defense, not zero-trust.
Reference: Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). Zero Trust
Architecture. NIST SP 800-207.
Q2. A security analyst discovers that an attacker exfiltrated data by encoding it in
DNS queries to a domain the attacker controls. Which of the following best describes
this technique and the most effective mitigation?
A. DNS tunneling; implement DNSSEC to authenticate DNS responses
B. DNS rebinding; deploy DNS sinkholes to block malicious domains
C. DNS tunneling; deploy egress filtering and monitor DNS traffic for anomalies
D. DNS cache poisoning; enforce DNS over HTTPS to encrypt queries
Correct Answer: C. DNS tunneling; deploy egress filtering and monitor DNS traffic
for anomalies
Rationale: DNS tunneling encapsulates data in DNS queries, bypassing traditional egress
filters. Mitigation requires egress filtering that restricts allowed DNS destinations and
anomaly detection to identify unusual query patterns. DNSSEC prevents spoofing but not
tunneling; sinkholes block known domains but not novel ones; DNS over HTTPS does not
prevent tunneling because queries are still sent.
Why Wrong:
A - DNSSEC ensures authenticity but does not detect or prevent data exfiltration via
tunneling.
B - DNS rebinding is a different attack involving malicious web pages; sinkholes only
Page 3
, block known malicious domains.
D - DNS cache poisoning is a different attack; DNS over HTTPS does not stop
tunneling.
Reference: Farnham, G., & Atlasis, A. (2013). Detecting DNS Tunneling. SANS Institute.
Q3. In a post-quantum cryptography context, which of the following algorithms is
considered a leading candidate for key encapsulation due to its security reduction to a
hard lattice problem and efficient implementation?
A. RSA-OAEP
B. Elliptic Curve Diffie-Hellman (ECDH)
C. CRYSTALS-Kyber
D. AES-256-GCM
Correct Answer: C. CRYSTALS-Kyber
Rationale: CRYSTALS-Kyber is a lattice-based key encapsulation mechanism selected by
NIST for standardization, offering security based on the Module-LWE problem. RSA and
ECDH are vulnerable to quantum attacks via Shor's algorithm. AES-256-GCM is a
symmetric cipher that requires larger key sizes but is not a KEM.
Why Wrong:
A - RSA is vulnerable to Shor's algorithm on a quantum computer.
B - ECDH relies on elliptic curve discrete log, also broken by Shor's algorithm.
D - AES is a symmetric encryption algorithm, not a key encapsulation mechanism.
Reference: NIST (2022). Post-Quantum Cryptography: Selected Algorithms 2022.
Q4. A security engineer needs to implement a mechanism that ensures a message's
integrity and proves the sender's identity, but the message content must remain
confidential. Which of the following combinations achieves all three goals?
A. Encrypt the message with the sender's private key
B. Sign the message with the sender's private key and encrypt with the recipient's
public key
C. Encrypt the message with the recipient's public key and hash with SHA-256
D. Use a MAC with a shared secret key
Correct Answer: B. Sign the message with the sender's private key and encrypt with
the recipient's public key
Rationale: Signing with the sender's private key provides authentication and integrity,
while encrypting with the recipient's public key ensures confidentiality. This is the
standard sign-then-encrypt approach. Encrypting with a private key does not provide
confidentiality. Hashing with SHA-256 provides integrity but not authentication or
confidentiality. A MAC provides integrity and authentication but not confidentiality.
Page 4
2026/2027 Edition | 150 Verified Questions - 140 Questions
with Answers
SECURITY CLASS D MODULE 1-140 QUESTIONS AND ANSWERS 2026-2027 ALREADY GRADED A+. 100%
Verified Solutions | Updated Per Latest Guidelines | Graded A+
This comprehensive exam preparation document covers Modules 1-3 of Security Class D, featuring
150 verified questions and answers. Designed to align with the latest 2026/2027 academic standards, it
provides thorough coverage of essential security concepts, procedures, and regulations. Each question
is accompanied by a detailed rationale to reinforce understanding and ensure exam readiness. Ideal for
students seeking a high score, this resource is rated A+ for its accuracy and completeness.
Key Features:
Security fundamentals and legal aspects
Patrol procedures and emergency response
Access control and surveillance techniques
Report writing and communication skills
Ethics and professionalism in security
Risk assessment and incident management
Updates for 2026:
- Revised to reflect 2026/2027 security regulations
- Added new questions on emerging security technologies
- Updated rationales for clarity and depth
- Incorporated feedback from recent exam takers
- Aligned with latest industry best practices
Abstract:
This exam preparation document for Security Class D Modules 1-3 is meticulously crafted to provide a
comprehensive review of core security principles. It encompasses a wide range of topics, including legal and
ethical considerations, patrol techniques, access control, emergency response, and report writing. Each of the 150
questions is designed to test critical knowledge and application, with detailed rationales that explain the correct
answers and distractors. The content is updated to reflect the 2026/2027 academic year, ensuring alignment with
current standards and practices. This resource is an essential tool for students aiming to achieve a top grade,
offering a structured and thorough approach to exam success. By engaging with this material, learners will build
confidence and proficiency in security management, preparing them for both the exam and real-world scenarios.
Keywords:
Security Class D, Exam Prep, Module 1-3, Verified Questions, 2026/2027, Security Fundamentals, Patrol
Procedures, Access Control
Answer Format:
Each question is presented in multiple-choice format with four options. The correct answer is clearly indicated,
followed by a comprehensive rationale explaining why it is correct and why the other options are incorrect. This
format reinforces learning and helps students understand the underlying concepts.
Compliance Checklist:
Aligned with 2026/2027 curriculum standards
150 verified questions with accurate answers
Page 1
, Detailed rationales for every question
Covers all key topics from Modules 1-3
Suitable for self-study and exam review
Rated A+ by previous users
Content Area Overview:
Content Area Questions Key Topics Weight
Security Fundamentals and 1-30 Legal authorities, ethics, liability, use of 20%
Legal Aspects force, security industry overview
Patrol Procedures and 31-60 Patrol techniques, observation, emergency 20%
Emergency Response response, first aid, evacuation procedures
Access Control and Surveillance 61-90 Access control systems, identification, 20%
CCTV, alarm systems, surveillance
techniques
Report Writing and 91-110 Report writing, note-taking, communication 13%
Communication skills, radio procedures, incident
documentation
Ethics and Professionalism 111-130 Professional conduct, confidentiality, 13%
conflict resolution, cultural sensitivity, code
of ethics
Risk Assessment and Incident 131-150 Risk assessment, threat analysis, incident 14%
Management management, crime prevention, safety
procedures
Page 2
,Q1. In a zero-trust architecture, which of the following represents the most significant
departure from traditional perimeter-based security when applied to internal
network traffic?
A. Encrypting all data at rest
B. Continuous authentication and authorization for every request, regardless of source
C. Implementing a demilitarized zone (DMZ) for external services
D. Deploying a next-generation firewall at the network edge
Correct Answer: B. Continuous authentication and authorization for every request,
regardless of source
Rationale: Zero-trust eliminates implicit trust based on network location, requiring
verification for every access attempt, even from within the perimeter. Encryption at rest,
DMZs, and edge firewalls are traditional measures that do not address the core principle
of never trusting internal traffic by default.
Why Wrong:
A - Encryption at rest protects data but does not address access control or trust
assumptions.
C - DMZs are a perimeter-based concept, not a zero-trust principle.
D - Edge firewalls are part of traditional perimeter defense, not zero-trust.
Reference: Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). Zero Trust
Architecture. NIST SP 800-207.
Q2. A security analyst discovers that an attacker exfiltrated data by encoding it in
DNS queries to a domain the attacker controls. Which of the following best describes
this technique and the most effective mitigation?
A. DNS tunneling; implement DNSSEC to authenticate DNS responses
B. DNS rebinding; deploy DNS sinkholes to block malicious domains
C. DNS tunneling; deploy egress filtering and monitor DNS traffic for anomalies
D. DNS cache poisoning; enforce DNS over HTTPS to encrypt queries
Correct Answer: C. DNS tunneling; deploy egress filtering and monitor DNS traffic
for anomalies
Rationale: DNS tunneling encapsulates data in DNS queries, bypassing traditional egress
filters. Mitigation requires egress filtering that restricts allowed DNS destinations and
anomaly detection to identify unusual query patterns. DNSSEC prevents spoofing but not
tunneling; sinkholes block known domains but not novel ones; DNS over HTTPS does not
prevent tunneling because queries are still sent.
Why Wrong:
A - DNSSEC ensures authenticity but does not detect or prevent data exfiltration via
tunneling.
B - DNS rebinding is a different attack involving malicious web pages; sinkholes only
Page 3
, block known malicious domains.
D - DNS cache poisoning is a different attack; DNS over HTTPS does not stop
tunneling.
Reference: Farnham, G., & Atlasis, A. (2013). Detecting DNS Tunneling. SANS Institute.
Q3. In a post-quantum cryptography context, which of the following algorithms is
considered a leading candidate for key encapsulation due to its security reduction to a
hard lattice problem and efficient implementation?
A. RSA-OAEP
B. Elliptic Curve Diffie-Hellman (ECDH)
C. CRYSTALS-Kyber
D. AES-256-GCM
Correct Answer: C. CRYSTALS-Kyber
Rationale: CRYSTALS-Kyber is a lattice-based key encapsulation mechanism selected by
NIST for standardization, offering security based on the Module-LWE problem. RSA and
ECDH are vulnerable to quantum attacks via Shor's algorithm. AES-256-GCM is a
symmetric cipher that requires larger key sizes but is not a KEM.
Why Wrong:
A - RSA is vulnerable to Shor's algorithm on a quantum computer.
B - ECDH relies on elliptic curve discrete log, also broken by Shor's algorithm.
D - AES is a symmetric encryption algorithm, not a key encapsulation mechanism.
Reference: NIST (2022). Post-Quantum Cryptography: Selected Algorithms 2022.
Q4. A security engineer needs to implement a mechanism that ensures a message's
integrity and proves the sender's identity, but the message content must remain
confidential. Which of the following combinations achieves all three goals?
A. Encrypt the message with the sender's private key
B. Sign the message with the sender's private key and encrypt with the recipient's
public key
C. Encrypt the message with the recipient's public key and hash with SHA-256
D. Use a MAC with a shared secret key
Correct Answer: B. Sign the message with the sender's private key and encrypt with
the recipient's public key
Rationale: Signing with the sender's private key provides authentication and integrity,
while encrypting with the recipient's public key ensures confidentiality. This is the
standard sign-then-encrypt approach. Encrypting with a private key does not provide
confidentiality. Hashing with SHA-256 provides integrity but not authentication or
confidentiality. A MAC provides integrity and authentication but not confidentiality.
Page 4
