WGU C836 Fundamentals of Information Security Final Exam | 300 Practice Questions with Answers & Rationale

1|Page




WGU C836 Fundamentals of Information
Security Final Exam | 300 Practice Questions
with Answers & Rationale
Question 1
What is the primary purpose of the CIA triad in information security?
A) To ensure regulatory compliance
B) To balance security with business operations
C) To define the core objectives of protecting information
D) To classify data based on sensitivity
Answer: C) To define the core objectives of protecting information
Rationale: The CIA triad—Confidentiality, Integrity, and Availability—is the
foundational model that defines the primary security objectives for protecting
information assets.




Question 2
Which of the following best describes confidentiality?
A) Ensuring data is accurate and untampered
B) Guaranteeing systems are accessible when needed
C) Preventing unauthorized access to sensitive data
D) Verifying the identity of users
Answer: C) Preventing unauthorized access to sensitive data
Rationale: Confidentiality focuses on restricting access to authorized individuals
only, protecting data from disclosure.




Question 3
A hospital's electronic health records system must always be accessible to doctors
during emergencies. Which CIA principle is most relevant?
A) Confidentiality
B) Integrity
C) Availability
D) Non-repudiation
Answer: C) Availability
Rationale: Availability ensures that systems and data are accessible when
needed, which is critical in emergency healthcare scenarios.

,2|Page




Question 4
An attacker modifies a financial transaction record. Which CIA principle has been
violated?
A) Confidentiality
B) Integrity
C) Availability
D) Authentication
Answer: B) Integrity
Rationale: Integrity ensures that data remains accurate and unaltered;
unauthorized modification directly violates this principle.




Question 5
Which of the following is an example of a confidentiality control?
A) RAID storage
B) Data backups
C) Encryption
D) Load balancing
Answer: C) Encryption
Rationale: Encryption transforms data into an unreadable format, ensuring that
only authorized parties with the decryption key can access it.




Question 6
What does the "A" in the Parkerian Hexad represent?
A) Accountability
B) Authentication
C) Availability
D) Authorization
Answer: C) Availability
Rationale: The Parkerian Hexad expands the CIA triad to include authenticity,
possession/control, and utility, while retaining availability.

,3|Page


Question 7
Which principle ensures that a user cannot deny having performed an action?
A) Confidentiality
B) Integrity
C) Availability
D) Non-repudiation
Answer: D) Non-repudiation
Rationale: Non-repudiation provides proof of origin and delivery, preventing
users from denying actions they have taken.




Question 8
What is the principle of least privilege?
A) Users are granted all permissions by default
B) Users are granted the minimum access necessary to perform their role
C) Users are granted access based on seniority
D) Users must re-authenticate every hour
Answer: B) Users are granted the minimum access necessary to perform their
role
Rationale: Least privilege reduces risk by limiting user permissions to only what
is essential for their job functions.




Question 9
Which access control model uses security labels and clearances?
A) DAC
B) MAC
C) RBAC
D) ABAC
Answer: B) MAC (Mandatory Access Control)
Rationale: MAC enforces access based on system-assigned labels and user
clearances, commonly used in government/military settings.




Question 10
In Discretionary Access Control (DAC), who determines access permissions?
A) The system administrator
B) The data owner

, 4|Page


C) The security policy
D) The operating system
Answer: B) The data owner
Rationale: DAC allows the owner of a resource to decide who can access it and
at what level.




Question 11
Which type of control is a firewall?
A) Administrative
B) Physical
C) Technical
D) Deterrent
Answer: C) Technical
Rationale: Firewalls are technical (logical) controls implemented through
hardware or software to enforce network security policies.




Question 12
Security awareness training for employees is what type of control?
A) Technical
B) Physical
C) Administrative
D) Detective
Answer: C) Administrative
Rationale: Administrative controls include policies, procedures, and training
that guide user behavior and support security.




Question 13
A security guard at a building entrance is an example of which control type?
A) Technical
B) Administrative
C) Physical
D) Corrective
Answer: C) Physical
Rationale: Physical controls include guards, locks, and fences that protect
physical assets and facilities.