The Ultimate and Complete WGU C836 Fundamentals of Information Security Study
Guide, Covering Information Security Principles and Best Practices, the CIA Triad,
Parkerian Hexad, Threats and Vulnerabilities, Attack Types, Risk Management,
Incident Response, Identification Authentication and Authorization, Least Privilege,
Access Control Models, Network ACLs, Accountability and Auditing, Intrusion
Detection and Prevention, Symmetric and Asymmetric Cryptography, Hash Functions,
Digital Signatures, Certificates, SSL and TLS, IPsec and VPNs, Data at Rest Data in
Motion and Data in Use, DDoS and Man-in-the-Middle Attacks, Security Policies and
Compliance, FISMA, FERPA, HIPAA, HITECH, SOX, GLBA and PCI DSS, Phishing and
Social Engineering, Physical Security, Defense in Depth, RAID, Network Segmentation,
Firewalls, Proxy Servers, DMZs, Nmap, Wireshark, Tcpdump, Honeypots, Burp Suite,
Nessus, Operating-System Hardening, Application Security, SQL Injection, Race
Conditions, Security Scenarios, Practice Questions With Detailed Rationales, and
Comprehensive Preparation for the WGU Fundamentals of Information Security
Assessment
Question 1: Which of the following is the most accurate definition of the "CIA Triad" in the
context of information security?
A. Confidentiality, Identification, and Authorization
B. Control, Integrity, and Availability
C. Confidentiality, Integrity, and Availability
D. Classification, Inspection, and Assessment
CORRECT ANSWER: C. Confidentiality, Integrity, and Availability
Rationale: The CIA Triad is the foundational model for information security policy.
Confidentiality ensures that data is not accessed by unauthorized individuals; Integrity ensures
that data is accurate and has not been tampered with; and Availability ensures that authorized
users have reliable access to data and systems when needed .
Question 2: A database administrator discovers that a user has altered financial records
without authorization. Which component of the CIA Triad has been directly compromised?
A. Confidentiality
B. Integrity
C. Availability
D. Non-repudiation
CORRECT ANSWER: B. Integrity
Rationale: Integrity involves protecting data from improper modification or destruction by
unauthorized parties. When a user makes an unauthorized data alteration, the trustworthiness
,and accuracy of the information are compromised, directly violating the Integrity principle of
the CIA triad .
Question 3: An organization's e-commerce website experiences a sudden surge in traffic that
renders it inaccessible to legitimate customers. Which tenet of the CIA Triad is under attack?
A. Confidentiality
B. Non-repudiation
C. Integrity
D. Availability
CORRECT ANSWER: D. Availability
Rationale: Availability ensures that information and systems are accessible to authorized users
when needed. A Denial of Service (DoS) attack, which overwhelms a system with traffic to make
it unavailable, directly targets the availability of the service or resource .
Question 4: An attacker intercepts data being transmitted over a network and reads sensitive
information. This is a violation of which security principle?
A. Availability
B. Integrity
C. Confidentiality
D. Authentication
CORRECT ANSWER: C. Confidentiality
Rationale: Confidentiality is the principle of ensuring that information is not disclosed to
unauthorized individuals, entities, or processes. Eavesdropping or intercepting network traffic
to read private data is a direct breach of confidentiality .
Question 5: A user downloads a file from the internet, and it is later discovered that the file
was modified by a malicious actor after its original creation. What security property was
violated?
A. Confidentiality
B. Integrity
C. Availability
D. Authentication
CORRECT ANSWER: B. Integrity
Rationale: Integrity guards against improper information modification or destruction. If a file
has been altered without authorization, its integrity has been compromised, and it can no
longer be trusted .
,Question 6: A financial services firm uses digital signatures on all its official documents. This
practice is primarily intended to support which security goal?
A. Confidentiality
B. Availability
C. Non-repudiation
D. Authorization
CORRECT ANSWER: C. Non-repudiation
Rationale: Non-repudiation provides proof of the origin and integrity of data and prevents an
individual from denying having performed a specific action related to the data . Digital
signatures are a key technology for ensuring non-repudiation .
Question 7: What is a "vulnerability" in the context of information security?
A. A potential source of harm to a system
B. An event that could cause damage to an asset
C. A weakness in a system that can be exploited
D. The likelihood that a threat will cause harm
CORRECT ANSWER: C. A weakness in a system that can be exploited
Rationale: A vulnerability is a flaw or weakness in a system's design, implementation, or
operation that could be exploited by a threat to cause harm. It represents a gap in security
controls .
Question 8: A "threat" is best defined as:
A. A weakness in a system's security
B. Any potential danger to information or systems
C. The monetary value of a potential loss
D. A measure of the likelihood of a security breach
CORRECT ANSWER: B. Any potential danger to information or systems
Rationale: A threat is any event, action, or actor that has the potential to cause harm to an
information system or the data it processes. This includes malicious actors, natural disasters,
and system failures .
Question 9: Which of the following formulas best represents the concept of "risk"?
A. Risk = Threat × Vulnerability
B. Risk = Threat × Vulnerability × Impact
C. Risk = Vulnerability × Impact
D. Risk = Asset Value × Threat
, CORRECT ANSWER: B. Risk = Threat × Vulnerability × Impact
Rationale: Risk is the potential for loss or damage. The most comprehensive view of risk is the
likelihood of a threat exploiting a vulnerability (Threat × Vulnerability) and the potential
consequences of that exploit (Impact) . This formula is more complete than the simpler Threat ×
Vulnerability model.
Question 10: A company has identified a vulnerability in its software but decides to accept
the risk because the cost of fixing the issue is higher than the potential loss. This is an
example of which risk response strategy?
A. Avoid
B. Transfer
C. Mitigate
D. Accept
CORRECT ANSWER: D. Accept
Rationale: Risk acceptance is a valid risk response strategy where an organization acknowledges
the risk and decides to bear the potential loss without implementing additional controls. This is
often done when the cost of mitigation exceeds the potential impact .
Question 11: Purchasing a cybersecurity insurance policy is an example of which risk response
strategy?
A. Accept
B. Avoid
C. Transfer
D. Mitigate
CORRECT ANSWER: C. Transfer
Rationale: Risk transfer involves shifting the financial burden of a potential loss to a third party,
such as an insurance company. While the risk still exists, the financial impact is transferred .
Question 12: What is the primary purpose of a security policy?
A. To outline technical configurations for all systems
B. To define the strategic security goals, assign responsibilities, and establish the organization's
stance on security
C. To provide a detailed step-by-step guide for responding to every type of incident
D. To document the procedures for installing new software
CORRECT ANSWER: B. To define the strategic security goals, assign responsibilities, and
establish the organization's stance on security
Guide, Covering Information Security Principles and Best Practices, the CIA Triad,
Parkerian Hexad, Threats and Vulnerabilities, Attack Types, Risk Management,
Incident Response, Identification Authentication and Authorization, Least Privilege,
Access Control Models, Network ACLs, Accountability and Auditing, Intrusion
Detection and Prevention, Symmetric and Asymmetric Cryptography, Hash Functions,
Digital Signatures, Certificates, SSL and TLS, IPsec and VPNs, Data at Rest Data in
Motion and Data in Use, DDoS and Man-in-the-Middle Attacks, Security Policies and
Compliance, FISMA, FERPA, HIPAA, HITECH, SOX, GLBA and PCI DSS, Phishing and
Social Engineering, Physical Security, Defense in Depth, RAID, Network Segmentation,
Firewalls, Proxy Servers, DMZs, Nmap, Wireshark, Tcpdump, Honeypots, Burp Suite,
Nessus, Operating-System Hardening, Application Security, SQL Injection, Race
Conditions, Security Scenarios, Practice Questions With Detailed Rationales, and
Comprehensive Preparation for the WGU Fundamentals of Information Security
Assessment
Question 1: Which of the following is the most accurate definition of the "CIA Triad" in the
context of information security?
A. Confidentiality, Identification, and Authorization
B. Control, Integrity, and Availability
C. Confidentiality, Integrity, and Availability
D. Classification, Inspection, and Assessment
CORRECT ANSWER: C. Confidentiality, Integrity, and Availability
Rationale: The CIA Triad is the foundational model for information security policy.
Confidentiality ensures that data is not accessed by unauthorized individuals; Integrity ensures
that data is accurate and has not been tampered with; and Availability ensures that authorized
users have reliable access to data and systems when needed .
Question 2: A database administrator discovers that a user has altered financial records
without authorization. Which component of the CIA Triad has been directly compromised?
A. Confidentiality
B. Integrity
C. Availability
D. Non-repudiation
CORRECT ANSWER: B. Integrity
Rationale: Integrity involves protecting data from improper modification or destruction by
unauthorized parties. When a user makes an unauthorized data alteration, the trustworthiness
,and accuracy of the information are compromised, directly violating the Integrity principle of
the CIA triad .
Question 3: An organization's e-commerce website experiences a sudden surge in traffic that
renders it inaccessible to legitimate customers. Which tenet of the CIA Triad is under attack?
A. Confidentiality
B. Non-repudiation
C. Integrity
D. Availability
CORRECT ANSWER: D. Availability
Rationale: Availability ensures that information and systems are accessible to authorized users
when needed. A Denial of Service (DoS) attack, which overwhelms a system with traffic to make
it unavailable, directly targets the availability of the service or resource .
Question 4: An attacker intercepts data being transmitted over a network and reads sensitive
information. This is a violation of which security principle?
A. Availability
B. Integrity
C. Confidentiality
D. Authentication
CORRECT ANSWER: C. Confidentiality
Rationale: Confidentiality is the principle of ensuring that information is not disclosed to
unauthorized individuals, entities, or processes. Eavesdropping or intercepting network traffic
to read private data is a direct breach of confidentiality .
Question 5: A user downloads a file from the internet, and it is later discovered that the file
was modified by a malicious actor after its original creation. What security property was
violated?
A. Confidentiality
B. Integrity
C. Availability
D. Authentication
CORRECT ANSWER: B. Integrity
Rationale: Integrity guards against improper information modification or destruction. If a file
has been altered without authorization, its integrity has been compromised, and it can no
longer be trusted .
,Question 6: A financial services firm uses digital signatures on all its official documents. This
practice is primarily intended to support which security goal?
A. Confidentiality
B. Availability
C. Non-repudiation
D. Authorization
CORRECT ANSWER: C. Non-repudiation
Rationale: Non-repudiation provides proof of the origin and integrity of data and prevents an
individual from denying having performed a specific action related to the data . Digital
signatures are a key technology for ensuring non-repudiation .
Question 7: What is a "vulnerability" in the context of information security?
A. A potential source of harm to a system
B. An event that could cause damage to an asset
C. A weakness in a system that can be exploited
D. The likelihood that a threat will cause harm
CORRECT ANSWER: C. A weakness in a system that can be exploited
Rationale: A vulnerability is a flaw or weakness in a system's design, implementation, or
operation that could be exploited by a threat to cause harm. It represents a gap in security
controls .
Question 8: A "threat" is best defined as:
A. A weakness in a system's security
B. Any potential danger to information or systems
C. The monetary value of a potential loss
D. A measure of the likelihood of a security breach
CORRECT ANSWER: B. Any potential danger to information or systems
Rationale: A threat is any event, action, or actor that has the potential to cause harm to an
information system or the data it processes. This includes malicious actors, natural disasters,
and system failures .
Question 9: Which of the following formulas best represents the concept of "risk"?
A. Risk = Threat × Vulnerability
B. Risk = Threat × Vulnerability × Impact
C. Risk = Vulnerability × Impact
D. Risk = Asset Value × Threat
, CORRECT ANSWER: B. Risk = Threat × Vulnerability × Impact
Rationale: Risk is the potential for loss or damage. The most comprehensive view of risk is the
likelihood of a threat exploiting a vulnerability (Threat × Vulnerability) and the potential
consequences of that exploit (Impact) . This formula is more complete than the simpler Threat ×
Vulnerability model.
Question 10: A company has identified a vulnerability in its software but decides to accept
the risk because the cost of fixing the issue is higher than the potential loss. This is an
example of which risk response strategy?
A. Avoid
B. Transfer
C. Mitigate
D. Accept
CORRECT ANSWER: D. Accept
Rationale: Risk acceptance is a valid risk response strategy where an organization acknowledges
the risk and decides to bear the potential loss without implementing additional controls. This is
often done when the cost of mitigation exceeds the potential impact .
Question 11: Purchasing a cybersecurity insurance policy is an example of which risk response
strategy?
A. Accept
B. Avoid
C. Transfer
D. Mitigate
CORRECT ANSWER: C. Transfer
Rationale: Risk transfer involves shifting the financial burden of a potential loss to a third party,
such as an insurance company. While the risk still exists, the financial impact is transferred .
Question 12: What is the primary purpose of a security policy?
A. To outline technical configurations for all systems
B. To define the strategic security goals, assign responsibilities, and establish the organization's
stance on security
C. To provide a detailed step-by-step guide for responding to every type of incident
D. To document the procedures for installing new software
CORRECT ANSWER: B. To define the strategic security goals, assign responsibilities, and
establish the organization's stance on security
