PREPIQ ILLINOIS NETWORK SECURITY CERTIFICATION
EXAM|QUESTIONS AND ANSWERS WITH
RATIONALE|GRADED A+|2026 UPDATE|100% CORRRECT
1. A security engineer is deploying a new wireless network for a hospital. The network must
support WPA2-Enterprise for client devices, but a legacy medical device only supports
WPA2-Personal. To comply with PCI DSS and HIPAA, the engineer decides to place the legacy
device on a separate VLAN. Which security principle is the engineer applying to reduce the risk
of lateral movement?
A. Network segmentation
B. Defense in depth
C. Least privilege
D. Fail secure
Answer: A. Network segmentation
2. A network administrator is configuring a firewall to allow inbound HTTPS traffic to a web
server. Which change to the firewall's access control list (ACL) correctly implements the rule
while maintaining security best practices?
A. Permit TCP 443 from any to any
B. Permit TCP 443 from any to the web server's IP
C. Permit TCP 443 from the web server's IP to any
D. Permit TCP 80 from any to the web server's IP
Answer: B. Permit TCP 443 from any to the web server's IP
3. An organization is implementing a security awareness program. The training should be most
effective at mitigating which type of attack?
A. SQL injection
B. Distributed denial of service (DDoS)
C. Social engineering
D. Malware propagation via unpatched software
Answer: C. Social engineering
4. A security analyst discovers that a user's account was used to log in from an unusual
location at an odd hour. Further investigation shows the user's password was weak and had
been reused across multiple sites. Which type of attack most likely occurred?
A. Credential stuffing
B. Man-in-the-middle
C. Session replay
D. Privilege escalation
Answer: A. Credential stuffing
5. A penetration tester is attempting to gain access to a network. After initial reconnaissance,
the tester sends a crafted packet to a vulnerable service, causing a buffer overflow that allows
arbitrary code execution. From the perspective of the Cyber Kill Chain, at which stage is the
tester currently operating?
, A. Reconnaissance
B. Weaponization
C. Delivery
D. Exploitation
Answer: D. Exploitation
6. A SOC analyst receives an alert for a user downloading a file from a suspicious domain. The
file hashes as a known Trojan, but the antivirus on the endpoint did not detect it because the
file is packed. Which type of malware analysis technique would best identify the malware's
behavior without executing it?
A. Static analysis
B. Dynamic analysis
C. Sandboxing
D. Memory forensics
Answer: A. Static analysis
7. An organization's certificate authority (CA) is compromised, forcing it to issue a new root
certificate. To minimize disruption, which process is used to revoke the old certificates?
A. Certificate signing request (CSR)
B. Certificate revocation list (CRL)
C. Online Certificate Status Protocol (OCSP)
D. Key escrow
Answer: B. Certificate revocation list (CRL)
8. Two parties need to communicate securely over an untrusted network. They agree on a
symmetric encryption algorithm and a shared secret. Which of the following best describes the
primary security goal achieved by using symmetric encryption?
A. Non-repudiation
B. Integrity
C. Confidentiality
D. Availability
Answer: C. Confidentiality
9. A digital signature is used to sign a software update. A user verifies the signature. What does
successful verification provide?
A. Confidentiality of the update content
B. Integrity and authentication of the update
C. Encryption of the update in transit
D. Availability of the update server
Answer: B. Integrity and authentication of the update
10. A system administrator is setting up a public key infrastructure (PKI) for an organization.
Which component is responsible for verifying the identity of a certificate requester before
issuing a certificate?
A. Registration authority (RA)
B. Certificate authority (CA)
C. Token
, D. Certificate revocation list (CRL)
Answer: A. Registration authority (RA)
11. A user attempts to access a sensitive file. The system checks the user's identity and then
determines if the user has the necessary permissions based on their role. Which two access
control processes are being used?
A. Authentication and authorization
B. Identification and accounting
C. Encryption and decryption
D. Authentication and accounting
Answer: A. Authentication and authorization
12. A company implements role-based access control (RBAC). An employee is transferred from
the sales department to marketing. To update the employee's access, what must the
administrator do?
A. Change the employee's role in the RBAC system
B. Change the employee's username
C. Delete the employee's account and recreate it
D. Update the employee's password
Answer: A. Change the employee's role in the RBAC system
13. An organization requires employees to use a smart card and a PIN to access the data
center. Which security principle is being enforced?
A. Single factor authentication
B. Multi-factor authentication
C. Single sign-on
D. Biometric authentication
Answer: B. Multi-factor authentication
14. A network engineer is configuring a next-generation firewall (NGFW) to replace a traditional
stateful firewall. Which feature of the NGFW would provide the most additional security beyond
what the traditional firewall offers?
A. Stateful packet inspection
B. Network address translation (NAT)
C. Intrusion prevention system (IPS) integration
D. Virtual private network (VPN) support
Answer: C. Intrusion prevention system (IPS) integration
15. To minimize the attack surface, a security administrator configures a network-based
intrusion detection system (IDS). Which deployment mode is appropriate for passive
monitoring without affecting traffic flow?
A. Inline mode
B. TAP mode
C. Bridge mode
D. Router mode
Answer: B. TAP mode
EXAM|QUESTIONS AND ANSWERS WITH
RATIONALE|GRADED A+|2026 UPDATE|100% CORRRECT
1. A security engineer is deploying a new wireless network for a hospital. The network must
support WPA2-Enterprise for client devices, but a legacy medical device only supports
WPA2-Personal. To comply with PCI DSS and HIPAA, the engineer decides to place the legacy
device on a separate VLAN. Which security principle is the engineer applying to reduce the risk
of lateral movement?
A. Network segmentation
B. Defense in depth
C. Least privilege
D. Fail secure
Answer: A. Network segmentation
2. A network administrator is configuring a firewall to allow inbound HTTPS traffic to a web
server. Which change to the firewall's access control list (ACL) correctly implements the rule
while maintaining security best practices?
A. Permit TCP 443 from any to any
B. Permit TCP 443 from any to the web server's IP
C. Permit TCP 443 from the web server's IP to any
D. Permit TCP 80 from any to the web server's IP
Answer: B. Permit TCP 443 from any to the web server's IP
3. An organization is implementing a security awareness program. The training should be most
effective at mitigating which type of attack?
A. SQL injection
B. Distributed denial of service (DDoS)
C. Social engineering
D. Malware propagation via unpatched software
Answer: C. Social engineering
4. A security analyst discovers that a user's account was used to log in from an unusual
location at an odd hour. Further investigation shows the user's password was weak and had
been reused across multiple sites. Which type of attack most likely occurred?
A. Credential stuffing
B. Man-in-the-middle
C. Session replay
D. Privilege escalation
Answer: A. Credential stuffing
5. A penetration tester is attempting to gain access to a network. After initial reconnaissance,
the tester sends a crafted packet to a vulnerable service, causing a buffer overflow that allows
arbitrary code execution. From the perspective of the Cyber Kill Chain, at which stage is the
tester currently operating?
, A. Reconnaissance
B. Weaponization
C. Delivery
D. Exploitation
Answer: D. Exploitation
6. A SOC analyst receives an alert for a user downloading a file from a suspicious domain. The
file hashes as a known Trojan, but the antivirus on the endpoint did not detect it because the
file is packed. Which type of malware analysis technique would best identify the malware's
behavior without executing it?
A. Static analysis
B. Dynamic analysis
C. Sandboxing
D. Memory forensics
Answer: A. Static analysis
7. An organization's certificate authority (CA) is compromised, forcing it to issue a new root
certificate. To minimize disruption, which process is used to revoke the old certificates?
A. Certificate signing request (CSR)
B. Certificate revocation list (CRL)
C. Online Certificate Status Protocol (OCSP)
D. Key escrow
Answer: B. Certificate revocation list (CRL)
8. Two parties need to communicate securely over an untrusted network. They agree on a
symmetric encryption algorithm and a shared secret. Which of the following best describes the
primary security goal achieved by using symmetric encryption?
A. Non-repudiation
B. Integrity
C. Confidentiality
D. Availability
Answer: C. Confidentiality
9. A digital signature is used to sign a software update. A user verifies the signature. What does
successful verification provide?
A. Confidentiality of the update content
B. Integrity and authentication of the update
C. Encryption of the update in transit
D. Availability of the update server
Answer: B. Integrity and authentication of the update
10. A system administrator is setting up a public key infrastructure (PKI) for an organization.
Which component is responsible for verifying the identity of a certificate requester before
issuing a certificate?
A. Registration authority (RA)
B. Certificate authority (CA)
C. Token
, D. Certificate revocation list (CRL)
Answer: A. Registration authority (RA)
11. A user attempts to access a sensitive file. The system checks the user's identity and then
determines if the user has the necessary permissions based on their role. Which two access
control processes are being used?
A. Authentication and authorization
B. Identification and accounting
C. Encryption and decryption
D. Authentication and accounting
Answer: A. Authentication and authorization
12. A company implements role-based access control (RBAC). An employee is transferred from
the sales department to marketing. To update the employee's access, what must the
administrator do?
A. Change the employee's role in the RBAC system
B. Change the employee's username
C. Delete the employee's account and recreate it
D. Update the employee's password
Answer: A. Change the employee's role in the RBAC system
13. An organization requires employees to use a smart card and a PIN to access the data
center. Which security principle is being enforced?
A. Single factor authentication
B. Multi-factor authentication
C. Single sign-on
D. Biometric authentication
Answer: B. Multi-factor authentication
14. A network engineer is configuring a next-generation firewall (NGFW) to replace a traditional
stateful firewall. Which feature of the NGFW would provide the most additional security beyond
what the traditional firewall offers?
A. Stateful packet inspection
B. Network address translation (NAT)
C. Intrusion prevention system (IPS) integration
D. Virtual private network (VPN) support
Answer: C. Intrusion prevention system (IPS) integration
15. To minimize the attack surface, a security administrator configures a network-based
intrusion detection system (IDS). Which deployment mode is appropriate for passive
monitoring without affecting traffic flow?
A. Inline mode
B. TAP mode
C. Bridge mode
D. Router mode
Answer: B. TAP mode
