IS 5403 CYBERSECURITY WEEK 3 QUIZZES
QUESTIONS & CORRECT ANSWERS 2026
UPDATED 100% CORRECT TRINE UNIVERSITY
148 QUESTIONS
TABLE OF CONTENTS
# TOPIC
1 Analyze and evaluate cryptographic protocol implementations for confidentiality, integrity, and authenticity
guarantees
2 Apply access control models (RBAC, ABAC, MAC) to complex enterprise scenarios and identify policy
conflicts
3 Assess network security architectures using defense-in-depth, zero trust, and segmentation principles
4 Interpret risk management frameworks (NIST RMF, FAIR) to prioritize vulnerabilities and justify controls
5 Differentiate modern threat vectors and map them to appropriate detection and mitigation strategies
6 IS 5403 Cybersecurity Week 3 Quizzes Questions & Correct Answers 2026 Updated 100% Correct Trine
University
7 Foundations of Cybersecurity
8 Applied Cybersecurity
9 Advanced Cybersecurity
10 Cybersecurity Review
ABSTRACT
This study document brings together 148 carefully worded exam questions drawn from IS 5403
Cybersecurity Week 3 Quizzes Questions & Correct Answers 2026 Updated 100% Correct Trine
University, with the strongest emphasis placed on Analyze and evaluate cryptographic protocol
implementations for confidentiality, integrity, and authenticity guarantees, Apply access control
models (RBAC, ABAC, MAC) to complex enterprise scenarios and identify policy conflicts, Assess
network security architectures using defense-in-depth, zero trust and and segmentation principles.
Every item follows the wording style and level of reasoning you meet in the real paper, and each
one is paired with a clear rationale so the correct choice is never a guess. Work through the set at
your own pace, mark the questions that slow you down, then come back to them until the
reasoning feels automatic. Learners who revise this way walk into the exam room recognising the
pattern behind the questions instead of meeting them for the first time. Keep going - steady, honest
practice is what turns a difficult paper into a comfortable pass.
Page 1
,Q1 ANALYZE AND EVALUATE CRYPTOGRAPHIC PROTOCOL IMPLEMENTATIONS FOR
CONFIDENTIALITY, INTEGRITY, AND AUTHENTICITY GUARANTEES
A security architect must choose between implementing IPsec in tunnel mode
versus transport mode for a site-to-site VPN carrying both TCP and UDP traffic.
Which statement correctly captures the trade-off that determines the optimal
choice?
A. Tunnel mode encrypts the entire original IP packet including headers, enabling secure routing
across untrusted networks but adding overhead; transport mode preserves the original IP
header, offering lower latency for host-to-host communications. CORRECT
B. Transport mode encrypts the entire IP packet including the original header, making it suitable
for gateway-to-gateway VPNs, while tunnel mode only encrypts the payload for end-to-end
security.
C. Tunnel mode is limited to TCP traffic because it cannot encapsulate UDP headers, whereas
transport mode supports all IP protocols natively.
D. Transport mode provides authentication only and never confidentiality, while tunnel mode
provides both confidentiality and authentication, making transport mode unsuitable for any VPN.
RATIONALE: Tunnel mode encapsulates the entire original IP packet (including headers) within a
new IP packet, which is essential for site-to-site VPNs where internal addresses must be hidden;
transport mode leaves the original IP header intact and encrypts only the payload, reducing
overhead for host-to-host tunnels. Options B and D invert the definitions, and C falsely restricts
tunnel mode's protocol support.
Page 2
,Q2 ANALYZE AND EVALUATE CRYPTOGRAPHIC PROTOCOL IMPLEMENTATIONS FOR
CONFIDENTIALITY, INTEGRITY, AND AUTHENTICITY GUARANTEES
In a role-based access control (RBAC) system, a user is assigned to two roles:
Role A grants read access to /finance, and Role B grants write access to /finance.
The system enforces static separation of duty (SSD) with a constraint that no user
may hold both roles simultaneously. What is the most precise outcome when the
user attempts to write to /finance?
A. The write succeeds because RBAC permissions are additive and SSD only restricts role
assignment, not permission inheritance.
B. The write is denied because the user cannot hold both roles, so the session cannot activate
Role B to obtain write permission. CORRECT
C. The write succeeds because the user already has read access, and write access is implied by
read access in hierarchical RBAC.
D. The write is denied only if the system also enforces dynamic separation of duty (DSD); SSD
alone does not affect active sessions.
RATIONALE: Static separation of duty prevents a user from being assigned to conflicting roles at
all, so the user cannot be assigned Role B and thus cannot activate it to gain write permission.
Options A and C misunderstand RBAC's additive nature and hierarchy; D confuses SSD with
DSD, which governs simultaneous activation rather than assignment.
Page 3
, Q3 ANALYZE AND EVALUATE CRYPTOGRAPHIC PROTOCOL IMPLEMENTATIONS FOR
CONFIDENTIALITY, INTEGRITY, AND AUTHENTICITY GUARANTEES
A zero trust architecture (ZTA) implementation replaces perimeter firewalls with
per-request policy decisions. Which design principle is most critical to prevent
lateral movement after an endpoint compromise?
A. Implicit trust based on network location (inside vs. outside the corporate LAN).
B. Continuous verification of device posture and user identity for every resource request, with
least-privilege access. CORRECT
C. Static VLAN segmentation that isolates departments but allows unrestricted east-west traffic
within each VLAN.
D. Single sign-on (SSO) with long-lived session tokens to reduce authentication friction.
RATIONALE: Zero trust requires no implicit trust; every access request must be continuously
authenticated and authorized based on device posture and user identity, enforcing least privilege
to limit lateral movement. Options A and C retain implicit trust within zones, and D's long-lived
tokens increase risk by enabling replay or misuse after compromise.
Page 4
QUESTIONS & CORRECT ANSWERS 2026
UPDATED 100% CORRECT TRINE UNIVERSITY
148 QUESTIONS
TABLE OF CONTENTS
# TOPIC
1 Analyze and evaluate cryptographic protocol implementations for confidentiality, integrity, and authenticity
guarantees
2 Apply access control models (RBAC, ABAC, MAC) to complex enterprise scenarios and identify policy
conflicts
3 Assess network security architectures using defense-in-depth, zero trust, and segmentation principles
4 Interpret risk management frameworks (NIST RMF, FAIR) to prioritize vulnerabilities and justify controls
5 Differentiate modern threat vectors and map them to appropriate detection and mitigation strategies
6 IS 5403 Cybersecurity Week 3 Quizzes Questions & Correct Answers 2026 Updated 100% Correct Trine
University
7 Foundations of Cybersecurity
8 Applied Cybersecurity
9 Advanced Cybersecurity
10 Cybersecurity Review
ABSTRACT
This study document brings together 148 carefully worded exam questions drawn from IS 5403
Cybersecurity Week 3 Quizzes Questions & Correct Answers 2026 Updated 100% Correct Trine
University, with the strongest emphasis placed on Analyze and evaluate cryptographic protocol
implementations for confidentiality, integrity, and authenticity guarantees, Apply access control
models (RBAC, ABAC, MAC) to complex enterprise scenarios and identify policy conflicts, Assess
network security architectures using defense-in-depth, zero trust and and segmentation principles.
Every item follows the wording style and level of reasoning you meet in the real paper, and each
one is paired with a clear rationale so the correct choice is never a guess. Work through the set at
your own pace, mark the questions that slow you down, then come back to them until the
reasoning feels automatic. Learners who revise this way walk into the exam room recognising the
pattern behind the questions instead of meeting them for the first time. Keep going - steady, honest
practice is what turns a difficult paper into a comfortable pass.
Page 1
,Q1 ANALYZE AND EVALUATE CRYPTOGRAPHIC PROTOCOL IMPLEMENTATIONS FOR
CONFIDENTIALITY, INTEGRITY, AND AUTHENTICITY GUARANTEES
A security architect must choose between implementing IPsec in tunnel mode
versus transport mode for a site-to-site VPN carrying both TCP and UDP traffic.
Which statement correctly captures the trade-off that determines the optimal
choice?
A. Tunnel mode encrypts the entire original IP packet including headers, enabling secure routing
across untrusted networks but adding overhead; transport mode preserves the original IP
header, offering lower latency for host-to-host communications. CORRECT
B. Transport mode encrypts the entire IP packet including the original header, making it suitable
for gateway-to-gateway VPNs, while tunnel mode only encrypts the payload for end-to-end
security.
C. Tunnel mode is limited to TCP traffic because it cannot encapsulate UDP headers, whereas
transport mode supports all IP protocols natively.
D. Transport mode provides authentication only and never confidentiality, while tunnel mode
provides both confidentiality and authentication, making transport mode unsuitable for any VPN.
RATIONALE: Tunnel mode encapsulates the entire original IP packet (including headers) within a
new IP packet, which is essential for site-to-site VPNs where internal addresses must be hidden;
transport mode leaves the original IP header intact and encrypts only the payload, reducing
overhead for host-to-host tunnels. Options B and D invert the definitions, and C falsely restricts
tunnel mode's protocol support.
Page 2
,Q2 ANALYZE AND EVALUATE CRYPTOGRAPHIC PROTOCOL IMPLEMENTATIONS FOR
CONFIDENTIALITY, INTEGRITY, AND AUTHENTICITY GUARANTEES
In a role-based access control (RBAC) system, a user is assigned to two roles:
Role A grants read access to /finance, and Role B grants write access to /finance.
The system enforces static separation of duty (SSD) with a constraint that no user
may hold both roles simultaneously. What is the most precise outcome when the
user attempts to write to /finance?
A. The write succeeds because RBAC permissions are additive and SSD only restricts role
assignment, not permission inheritance.
B. The write is denied because the user cannot hold both roles, so the session cannot activate
Role B to obtain write permission. CORRECT
C. The write succeeds because the user already has read access, and write access is implied by
read access in hierarchical RBAC.
D. The write is denied only if the system also enforces dynamic separation of duty (DSD); SSD
alone does not affect active sessions.
RATIONALE: Static separation of duty prevents a user from being assigned to conflicting roles at
all, so the user cannot be assigned Role B and thus cannot activate it to gain write permission.
Options A and C misunderstand RBAC's additive nature and hierarchy; D confuses SSD with
DSD, which governs simultaneous activation rather than assignment.
Page 3
, Q3 ANALYZE AND EVALUATE CRYPTOGRAPHIC PROTOCOL IMPLEMENTATIONS FOR
CONFIDENTIALITY, INTEGRITY, AND AUTHENTICITY GUARANTEES
A zero trust architecture (ZTA) implementation replaces perimeter firewalls with
per-request policy decisions. Which design principle is most critical to prevent
lateral movement after an endpoint compromise?
A. Implicit trust based on network location (inside vs. outside the corporate LAN).
B. Continuous verification of device posture and user identity for every resource request, with
least-privilege access. CORRECT
C. Static VLAN segmentation that isolates departments but allows unrestricted east-west traffic
within each VLAN.
D. Single sign-on (SSO) with long-lived session tokens to reduce authentication friction.
RATIONALE: Zero trust requires no implicit trust; every access request must be continuously
authenticated and authorized based on device posture and user identity, enforcing least privilege
to limit lateral movement. Options A and C retain implicit trust within zones, and D's long-lived
tokens increase risk by enabling replay or misuse after compromise.
Page 4
