WGU C836 Fundamentals of Information
Security OA Practice Exam | Complete
Question Bank with Verified Answers
and Detailed Rationales | Updated 2026
Edition | Already Graded A+
Question 1
A company developing and distributing open source applications realizes that
attackers are copying the publicly available, open source code and inserting
malware into the code. Which type of cryptographic tool should the company use
to protect the integrity of its open source applications?
A. Symmetric cryptography
B. Hash functions
C. Block cipher
D. Asymmetric cryptography
Answer: B
Rationale: Hash functions generate unique digital fingerprints (hashes) of files.
Users can verify that the code hasn't been modified by comparing hashes,
protecting integrity. Symmetric and asymmetric cryptography are used for
confidentiality, not integrity verification.
Question 2
Nessus is an example of a(n) _____ tool.
A. Penetration testing
B. Vulnerability scanning
C. Anti-malware
D. Anti-virus
E. Fuzzing
Answer: B
Rationale: Nessus is a widely used vulnerability assessment tool that scans for
known vulnerabilities, misconfigurations, and security weaknesses. It is not a
penetration testing tool, anti-malware, or fuzzer.
pg. 1
,Question 3
In addition to a username and corresponding password, a desktop application asks
users to submit a special code. This code is produced by an application running on
the users' mobile phone. Which authentication technique is the phone application
providing?
A. Something you have
B. Something you are
C. Something you know
D. Something you do
Answer: A
Rationale: A code generated on a mobile phone is "something you have" - the
phone is a physical possession. This is an example of a possession factor in multi-
factor authentication.
Question 4
A new software development company has determined that one of its proprietary
algorithms is at a high risk for unauthorized disclosure. The company's security up
to this point has been fairly lax. Which procedure should the company implement
to protect this asset?
A. Transfer the algorithm onto servers in the demilitarized zone
B. Store the algorithm on highly available servers
C. Relocate the algorithm to encrypted storage
D. Create multiple off-site backups of the algorithm
Answer: C
Rationale: Encrypted storage protects data at rest from unauthorized access and
disclosure. This is the most direct way to protect the confidentiality of a
proprietary algorithm.
Question 5
A hospital allows its patients to pay by credit card. Which set of regulations apply
to the hospital's operations?
A. HIPAA and FCRA
B. FERPA and PCI DSS
C. HIPAA and PCI DSS
D. FERPA and HITECH
Answer: C
Rationale: HIPAA applies due to protected health information (PHI). PCI DSS
pg. 2
,applies because the hospital processes credit card payments. Both regulations apply
simultaneously.
Question 6
Eavesdropping on a phone is an example of:
A. Modification
B. Interception
C. Fabrication
D. Interruption
Answer: B
Rationale: Eavesdropping is listening to communications without authorization,
an interception attack. Interception attacks target confidentiality.
Question 7
The set of methods we use to establish a claim of identity as being true is called:
A. Authentication
B. Authorization
C. Identification
D. Identity verification
Answer: A
Rationale: Authentication is the process of verifying a claim of identity. It
confirms that a user is who they claim to be.
Question 8
Small bits of software that take advantage of flaws in other software or
applications to cause them to behave in ways that were not intended by their
creators are called:
A. Intruders
B. Exploits
C. Fuzzers
D. Vulnerabilities
E. Scanners
Answer: B
Rationale: An exploit is code that takes advantage of a vulnerability to cause
unintended behavior or to gain unauthorized access.
pg. 3
, Question 9
Penalizes for acting against the rules:
A. Deterrence
B. Avoidance
C. Retribution
D. Rehabilitation
Answer: A
Rationale: Deterrence uses the threat of penalties to discourage security violations.
It discourages potential violators through the threat of consequences.
Question 10
Which file action implements the principle of confidentiality from the CIA triad?
A. Compression
B. Hash
C. Backup
D. Encryption
Answer: D
Rationale: Encryption is the primary mechanism for implementing confidentiality.
It transforms data into an unreadable format that can only be decrypted with the
proper key.
Question 11
Step 5 of the risk management process is:
A. Assess if a threat and a vulnerability both exist
B. Identify any weaknesses that exist in our assets
C. Begin to identify and categorize threats that could harm our assets
D. Put controls in place
Answer: D
Rationale: Step 5 is Mitigate Risks - putting controls in place to address identified
risks. This is the final step after identifying assets, threats, vulnerabilities, and
assessing risks.
Question 12
Something that has the potential to cause harm to our assets is known as a(n):
A. Impact
B. Risk
C. Vulnerability
pg. 4
Security OA Practice Exam | Complete
Question Bank with Verified Answers
and Detailed Rationales | Updated 2026
Edition | Already Graded A+
Question 1
A company developing and distributing open source applications realizes that
attackers are copying the publicly available, open source code and inserting
malware into the code. Which type of cryptographic tool should the company use
to protect the integrity of its open source applications?
A. Symmetric cryptography
B. Hash functions
C. Block cipher
D. Asymmetric cryptography
Answer: B
Rationale: Hash functions generate unique digital fingerprints (hashes) of files.
Users can verify that the code hasn't been modified by comparing hashes,
protecting integrity. Symmetric and asymmetric cryptography are used for
confidentiality, not integrity verification.
Question 2
Nessus is an example of a(n) _____ tool.
A. Penetration testing
B. Vulnerability scanning
C. Anti-malware
D. Anti-virus
E. Fuzzing
Answer: B
Rationale: Nessus is a widely used vulnerability assessment tool that scans for
known vulnerabilities, misconfigurations, and security weaknesses. It is not a
penetration testing tool, anti-malware, or fuzzer.
pg. 1
,Question 3
In addition to a username and corresponding password, a desktop application asks
users to submit a special code. This code is produced by an application running on
the users' mobile phone. Which authentication technique is the phone application
providing?
A. Something you have
B. Something you are
C. Something you know
D. Something you do
Answer: A
Rationale: A code generated on a mobile phone is "something you have" - the
phone is a physical possession. This is an example of a possession factor in multi-
factor authentication.
Question 4
A new software development company has determined that one of its proprietary
algorithms is at a high risk for unauthorized disclosure. The company's security up
to this point has been fairly lax. Which procedure should the company implement
to protect this asset?
A. Transfer the algorithm onto servers in the demilitarized zone
B. Store the algorithm on highly available servers
C. Relocate the algorithm to encrypted storage
D. Create multiple off-site backups of the algorithm
Answer: C
Rationale: Encrypted storage protects data at rest from unauthorized access and
disclosure. This is the most direct way to protect the confidentiality of a
proprietary algorithm.
Question 5
A hospital allows its patients to pay by credit card. Which set of regulations apply
to the hospital's operations?
A. HIPAA and FCRA
B. FERPA and PCI DSS
C. HIPAA and PCI DSS
D. FERPA and HITECH
Answer: C
Rationale: HIPAA applies due to protected health information (PHI). PCI DSS
pg. 2
,applies because the hospital processes credit card payments. Both regulations apply
simultaneously.
Question 6
Eavesdropping on a phone is an example of:
A. Modification
B. Interception
C. Fabrication
D. Interruption
Answer: B
Rationale: Eavesdropping is listening to communications without authorization,
an interception attack. Interception attacks target confidentiality.
Question 7
The set of methods we use to establish a claim of identity as being true is called:
A. Authentication
B. Authorization
C. Identification
D. Identity verification
Answer: A
Rationale: Authentication is the process of verifying a claim of identity. It
confirms that a user is who they claim to be.
Question 8
Small bits of software that take advantage of flaws in other software or
applications to cause them to behave in ways that were not intended by their
creators are called:
A. Intruders
B. Exploits
C. Fuzzers
D. Vulnerabilities
E. Scanners
Answer: B
Rationale: An exploit is code that takes advantage of a vulnerability to cause
unintended behavior or to gain unauthorized access.
pg. 3
, Question 9
Penalizes for acting against the rules:
A. Deterrence
B. Avoidance
C. Retribution
D. Rehabilitation
Answer: A
Rationale: Deterrence uses the threat of penalties to discourage security violations.
It discourages potential violators through the threat of consequences.
Question 10
Which file action implements the principle of confidentiality from the CIA triad?
A. Compression
B. Hash
C. Backup
D. Encryption
Answer: D
Rationale: Encryption is the primary mechanism for implementing confidentiality.
It transforms data into an unreadable format that can only be decrypted with the
proper key.
Question 11
Step 5 of the risk management process is:
A. Assess if a threat and a vulnerability both exist
B. Identify any weaknesses that exist in our assets
C. Begin to identify and categorize threats that could harm our assets
D. Put controls in place
Answer: D
Rationale: Step 5 is Mitigate Risks - putting controls in place to address identified
risks. This is the final step after identifying assets, threats, vulnerabilities, and
assessing risks.
Question 12
Something that has the potential to cause harm to our assets is known as a(n):
A. Impact
B. Risk
C. Vulnerability
pg. 4
