IT 200 Fundamentals of Information Technology
Comprehensive Final Exam Practice Questions and Detailed
Solutions Latest Update 2026/2027 | Computer Systems,
Networking, Security, Verified Answers - 180 Questions
Comprehensive examination on IT 200 Fundamentals of Information Technology Comprehensive Final Exam
Practice Questions and Detailed Solutions Latest Update 2026/2027 | Computer Systems, Networking, Security,
Verified Answers. It contains 180 multiple-choice questions, each with four distractors and a fully worked
rationale that explains why the keyed answer is correct. Questions are organized into clearly labelled sections
that mirror the major content areas of the course. Targeted learning outcomes include: Demonstrate mastery of
core concepts. Every item has been reviewed for clinical accuracy, current guidelines, and clarity so that students
can study with confidence and self-correct as they work through the bank. Use it as a high-yield review
immediately before the exam, or as a structured practice tool during the unit - the rationales double as concise
teaching notes. The recommended writing time is 3 hours, with a passing score of 70%. Aligned with Aligned with
US university standards. standards and reflects the question style commonly seen on accredited program
examinations. Students consistently achieving above the cut score on this bank have historically gone on to earn
A+ on the corresponding course exam. Read every stem carefully - distractors are written to look plausible, and
the best answer is sometimes the one that addresses the patient's most immediate physiological or safety need.
Where multiple options appear correct, prioritize airway, breathing, circulation, safety, and Maslow's hierarchy
before psychosocial interventions. Treat each rationale as a mini-lecture: don't just confirm the right letter, study
Section 1: General (Questions 1-180)
1 In a modern CPU, speculative execution may leave traces in
microarchitectural structures. Which mitigation strategy is most
effective at the architectural level to prevent exploitation via cache
timing side channels?
A) Increasing the CPU clock frequency to reduce timing resolution
B) Flushing the branch target buffer (BTB) on every privilege-level
change
C) Serializing instruction execution with memory fences after every
branch
D) Disabling hyper-threading on all logical cores
Answer: B
Rationale: Flushing the BTB on privilege transitions prevents an
attacker from poisoning branch predictions used in speculative
execution, a key vector for Spectre-type attacks. Increasing frequency
does not eliminate the timing channel; fences only mitigate specific
variants; disabling hyper-threading reduces but does not fully resolve
,the issue.
2 A network engineer must design a subnetting scheme for a campus
network that requires 5 subnets with a maximum of 30 hosts each,
while leaving room for 20% growth. Which subnet mask and
address allocation meet these requirements with minimal waste?
A) /27 mask, allocating 5 subnets from a /24 block
B) /26 mask, allocating 5 subnets from a /24 block
C) /28 mask, allocating 5 subnets from a /24 block
D) /25 mask, allocating 2 subnets from a /24 block
Answer: B
Rationale: A /26 mask provides 62 usable host addresses per subnet,
which accommodates 30 hosts plus 20% growth (36 needed) with
room to spare. /27 offers only 30 usable addresses, exactly at the limit
with no growth; /28 provides only 14; /25 yields only 2 subnets,
insufficient. Thus /26 is the correct balance.
3 Which of the following is the primary purpose of the TCP Vegas
congestion control algorithm compared to TCP Reno?
A) To increase the initial congestion window size to speed up slow
start
B) To use packet loss as the primary signal for congestion detection
C) To detect congestion before packet loss occurs by observing RTT
changes
D) To reduce the maximum segment size to improve throughput on
high-latency links
Answer: C
Rationale: TCP Vegas uses changes in RTT to predict congestion and
adjusts the window proactively, avoiding the packet loss that Reno
requires. It does not increase initial window (that's a different
proposal) nor reduce segment size; it is based on delay, not loss.
,4 An organization uses a SIEM to aggregate logs. They need to detect
a slow, low-and-slow data exfiltration that occurs over weeks.
Which detection approach is most effective?
A) Signature-based detection on individual packets
B) Anomaly detection using machine learning on long-term traffic
baselines
C) Real-time correlation of firewall logs with IDS alerts
D) Manual review of weekly netflow summaries
Answer: B
Rationale: Low-and-slow exfiltration is subtle and spread over time,
evading signature and real-time correlation. Machine learning on
long-term baselines can establish normal behavior and flag deviations
that indicate gradual data transfer. Manual review is impractical and
error-prone.
5 In a zero-trust architecture, which of the following components is
primarily responsible for enforcing access decisions based on
dynamic risk?
A) Network segmentation firewall
B) Policy decision point (PDP) integrated with identity and context
C) Intrusion prevention system (IPS)
D) Virtual private network (VPN) concentrator
Answer: B
Rationale: Zero-trust relies on a policy decision point that evaluates
identity, device posture, and other context to make dynamic access
decisions. Firewalls, IPS, and VPNs enforce or inspect, but they do
not make risk-based decisions; the PDP is the brain.
6 Which of the following is the most significant limitation of using a
traditional stateful firewall in a modern cloud-native environment
with ephemeral containers?
A) Inability to inspect encrypted traffic
B) Scalability issues due to limited connection state table size
, C) Lack of integration with identity providers
D) High latency introduced by deep packet inspection
Answer: B
Rationale: Ephemeral containers create and destroy connections
rapidly, overwhelming the state table of a stateful firewall, which is
designed for finite, stable connections. While encrypted traffic and
identity are concerns, the state table scalability is the primary
limitation in dynamic environments.
7 A security analyst discovers that an attacker used a pass-the-hash
attack to move laterally. Which of the following is the most
effective mitigation to prevent this type of attack?
A) Enforcing strong password complexity policies
B) Implementing credential guard and restricting local account token
privileges
C) Deploying a network-based intrusion detection system
D) Regularly patching operating systems and applications
Answer: B
Rationale: Pass-the-hash attacks exploit cached credentials; Credential
Guard isolates and protects these hashes, and restricting local token
privileges limits the ability to reuse them. Password complexity helps
but does not prevent hash reuse; IDS and patching are not direct
mitigations.
8 Which of the following is the most appropriate use case for a
content delivery network (CDN) in a global enterprise application?
A) To provide a single point of entry for all API traffic
B) To cache static assets at edge locations, reducing origin load
C) To enforce security policies on incoming requests
D) To replace the need for load balancers in the data center
Answer: B
Rationale: CDNs excel at caching static content close to users,
reducing latency and origin server load. They are not primarily for
Comprehensive Final Exam Practice Questions and Detailed
Solutions Latest Update 2026/2027 | Computer Systems,
Networking, Security, Verified Answers - 180 Questions
Comprehensive examination on IT 200 Fundamentals of Information Technology Comprehensive Final Exam
Practice Questions and Detailed Solutions Latest Update 2026/2027 | Computer Systems, Networking, Security,
Verified Answers. It contains 180 multiple-choice questions, each with four distractors and a fully worked
rationale that explains why the keyed answer is correct. Questions are organized into clearly labelled sections
that mirror the major content areas of the course. Targeted learning outcomes include: Demonstrate mastery of
core concepts. Every item has been reviewed for clinical accuracy, current guidelines, and clarity so that students
can study with confidence and self-correct as they work through the bank. Use it as a high-yield review
immediately before the exam, or as a structured practice tool during the unit - the rationales double as concise
teaching notes. The recommended writing time is 3 hours, with a passing score of 70%. Aligned with Aligned with
US university standards. standards and reflects the question style commonly seen on accredited program
examinations. Students consistently achieving above the cut score on this bank have historically gone on to earn
A+ on the corresponding course exam. Read every stem carefully - distractors are written to look plausible, and
the best answer is sometimes the one that addresses the patient's most immediate physiological or safety need.
Where multiple options appear correct, prioritize airway, breathing, circulation, safety, and Maslow's hierarchy
before psychosocial interventions. Treat each rationale as a mini-lecture: don't just confirm the right letter, study
Section 1: General (Questions 1-180)
1 In a modern CPU, speculative execution may leave traces in
microarchitectural structures. Which mitigation strategy is most
effective at the architectural level to prevent exploitation via cache
timing side channels?
A) Increasing the CPU clock frequency to reduce timing resolution
B) Flushing the branch target buffer (BTB) on every privilege-level
change
C) Serializing instruction execution with memory fences after every
branch
D) Disabling hyper-threading on all logical cores
Answer: B
Rationale: Flushing the BTB on privilege transitions prevents an
attacker from poisoning branch predictions used in speculative
execution, a key vector for Spectre-type attacks. Increasing frequency
does not eliminate the timing channel; fences only mitigate specific
variants; disabling hyper-threading reduces but does not fully resolve
,the issue.
2 A network engineer must design a subnetting scheme for a campus
network that requires 5 subnets with a maximum of 30 hosts each,
while leaving room for 20% growth. Which subnet mask and
address allocation meet these requirements with minimal waste?
A) /27 mask, allocating 5 subnets from a /24 block
B) /26 mask, allocating 5 subnets from a /24 block
C) /28 mask, allocating 5 subnets from a /24 block
D) /25 mask, allocating 2 subnets from a /24 block
Answer: B
Rationale: A /26 mask provides 62 usable host addresses per subnet,
which accommodates 30 hosts plus 20% growth (36 needed) with
room to spare. /27 offers only 30 usable addresses, exactly at the limit
with no growth; /28 provides only 14; /25 yields only 2 subnets,
insufficient. Thus /26 is the correct balance.
3 Which of the following is the primary purpose of the TCP Vegas
congestion control algorithm compared to TCP Reno?
A) To increase the initial congestion window size to speed up slow
start
B) To use packet loss as the primary signal for congestion detection
C) To detect congestion before packet loss occurs by observing RTT
changes
D) To reduce the maximum segment size to improve throughput on
high-latency links
Answer: C
Rationale: TCP Vegas uses changes in RTT to predict congestion and
adjusts the window proactively, avoiding the packet loss that Reno
requires. It does not increase initial window (that's a different
proposal) nor reduce segment size; it is based on delay, not loss.
,4 An organization uses a SIEM to aggregate logs. They need to detect
a slow, low-and-slow data exfiltration that occurs over weeks.
Which detection approach is most effective?
A) Signature-based detection on individual packets
B) Anomaly detection using machine learning on long-term traffic
baselines
C) Real-time correlation of firewall logs with IDS alerts
D) Manual review of weekly netflow summaries
Answer: B
Rationale: Low-and-slow exfiltration is subtle and spread over time,
evading signature and real-time correlation. Machine learning on
long-term baselines can establish normal behavior and flag deviations
that indicate gradual data transfer. Manual review is impractical and
error-prone.
5 In a zero-trust architecture, which of the following components is
primarily responsible for enforcing access decisions based on
dynamic risk?
A) Network segmentation firewall
B) Policy decision point (PDP) integrated with identity and context
C) Intrusion prevention system (IPS)
D) Virtual private network (VPN) concentrator
Answer: B
Rationale: Zero-trust relies on a policy decision point that evaluates
identity, device posture, and other context to make dynamic access
decisions. Firewalls, IPS, and VPNs enforce or inspect, but they do
not make risk-based decisions; the PDP is the brain.
6 Which of the following is the most significant limitation of using a
traditional stateful firewall in a modern cloud-native environment
with ephemeral containers?
A) Inability to inspect encrypted traffic
B) Scalability issues due to limited connection state table size
, C) Lack of integration with identity providers
D) High latency introduced by deep packet inspection
Answer: B
Rationale: Ephemeral containers create and destroy connections
rapidly, overwhelming the state table of a stateful firewall, which is
designed for finite, stable connections. While encrypted traffic and
identity are concerns, the state table scalability is the primary
limitation in dynamic environments.
7 A security analyst discovers that an attacker used a pass-the-hash
attack to move laterally. Which of the following is the most
effective mitigation to prevent this type of attack?
A) Enforcing strong password complexity policies
B) Implementing credential guard and restricting local account token
privileges
C) Deploying a network-based intrusion detection system
D) Regularly patching operating systems and applications
Answer: B
Rationale: Pass-the-hash attacks exploit cached credentials; Credential
Guard isolates and protects these hashes, and restricting local token
privileges limits the ability to reuse them. Password complexity helps
but does not prevent hash reuse; IDS and patching are not direct
mitigations.
8 Which of the following is the most appropriate use case for a
content delivery network (CDN) in a global enterprise application?
A) To provide a single point of entry for all API traffic
B) To cache static assets at edge locations, reducing origin load
C) To enforce security policies on incoming requests
D) To replace the need for load balancers in the data center
Answer: B
Rationale: CDNs excel at caching static content close to users,
reducing latency and origin server load. They are not primarily for
