WGU C836 - Fundamentals of Information Security OA Exam | Complete Test Bank with Actual Exam Questions, Verified Correct Answers and Detailed Rationales (100% Correct Solutions) | Latest Update 2026/2027 Edition | Already Graded A+

WGU C836 - Fundamentals of Information Security OA
Exam | Complete Test Bank with Actual Exam
Questions, Verified Answers and Detailed Rationales
(100% Correct Answers) | Latest Update 2026/2027
Edition | Already Graded A+

Question 1
Which cybersecurity term is defined as the potential for an attack on a resource?
A. Impact
B. Vulnerability
C. Risk
D. Threat
Answer: D
Rationale: A threat is defined as the potential for an attack on a resource. It
represents the possibility that a threat agent (attacker) could exploit a vulnerability.
Risk is the likelihood that a threat will exploit a vulnerability, vulnerability is a
weakness, and impact is the consequence of a successful attack .

Question 2
Which security type deliberately exposes a system's vulnerabilities or resources to
an attacker?
A. Intrusion detection
B. Firewalls
C. Honeypots
D. Intrusion prevention
Answer: C
Rationale: A honeypot is a system designed to deliberately expose vulnerabilities
to bait attackers. It is used to study attack patterns and divert attackers from
production systems. Honeypots act as decoys that appear vulnerable to lure
attackers away from real assets .

Question 3
Which tool can be used to map devices on a network, along with their operating
system types and versions?
A. Packet sniffer
B. Packet filter
pg. 1

,C. Port scanner
D. Stateful firewall
Answer: C
Rationale: A port scanner maps devices on a network and can identify operating
system types and versions by analyzing how devices respond to network probes.
This helps identify potential vulnerabilities associated with specific OS versions .

Question 4
Which web attack is a server-side attack?
A. Clickjacking
B. Cross-site scripting
C. SQL injection
D. Cross-site request forgery
Answer: C
Rationale: SQL injection is a server-side attack where malicious SQL code is
inserted into input fields to manipulate the database. Clickjacking, XSS, and XSRF
are primarily client-side attacks .

Question 5
An organization employs a VPN to safeguard its information. Which security
principle is protected by a VPN?
A. Data in motion
B. Data at rest
C. Data in use
D. Data in storage
Answer: A
Rationale: A VPN (Virtual Private Network) protects data in motion (data being
transmitted across networks) by encrypting it. This ensures confidentiality and
integrity during transmission.

Question 6
A malicious hacker was successful in a denial of service (DoS) attack against an
institution's mail server. Fortunately, no data was lost or altered while the server
was offline. Which type of attack is this?
A. Modification
B. Fabrication
C. Interception
pg. 2

,D. Interruption
Answer: D
Rationale: A Denial of Service (DoS) attack is an interruption attack because it
makes the service unavailable. Even though no data was lost or altered, the
availability of the service was compromised.

Question 7
A company has had several successful denial of service (DoS) attacks on its email
server. Which security principle is being attacked?
A. Possession
B. Integrity
C. Confidentiality
D. Availability
Answer: D
Rationale: DoS attacks target the availability of resources. The goal is to prevent
legitimate users from accessing the service, compromising the Availability pillar of
the CIA triad.

Question 8
A new start-up company has started working on a social networking website. The
company has moved all its source code to a cloud provider and wants to protect
this source code from unauthorized access. Which cyber defense concept should
the start-up company use to maintain the confidentiality of its source code?
A. Alarm systems
B. Account permissions
C. Antivirus software
D. File encryption
Answer: D
Rationale: File encryption is the most effective way to protect data confidentiality
at rest. Even if unauthorized access is gained, encrypted files cannot be read
without the proper decryption key.

Question 9
A company has an annual audit of installed software and data storage systems.
During the audit, the auditor asks how the company's most critical data is used.
This determination helps the auditor ensure that the proper defense mechanisms are
in place to protect critical data. Which principle of the Parkerian hexad is the
pg. 3

, auditor addressing?
A. Possession
B. Integrity
C. Authenticity
D. Utility
Answer: D
Rationale: Utility refers to the usefulness of the data. Understanding how data is
used helps determine the proper defense mechanisms needed. The Parkerian hexad
extends the CIA triad with possession, authenticity, and utility.

Question 10
Which web attack is possible due to a lack of input validation?
A. Extraneous files
B. Clickjacking
C. SQL injection
D. Cross-site request forgery
Answer: C
Rationale: SQL injection exploits a lack of input validation by injecting malicious
SQL code into input fields. Proper input validation is a critical defense against this
attack.

Question 11
Which file action implements the principle of confidentiality from the CIA triad?
A. Compression
B. Hash
C. Backup
D. Encryption
Answer: D
Rationale: Encryption is the primary mechanism for implementing confidentiality.
It transforms data into an unreadable format that can only be decrypted with the
proper key.

Question 12
Which cyber defense concept suggests limiting permissions to only what is
necessary to perform a particular task?
A. Authentication
B. Authorization
pg. 4