IS 5403 CYBERSECURITY WEEK 7 QUIZZES
QUESTIONS & CORRECT ANSWERS 2026
UPDATED 100% CORRECT TRINE UNIVERSITY
148 QUESTIONS
TABLE OF CONTENTS
# TOPIC
1 Evaluate and select appropriate cryptographic controls and network security architectures for complex
enterprise environments
2 Apply incident response and forensic principles to prioritize containment, eradication, and recovery
actions under regulatory constraints
3 Analyze access management, zero-trust, and risk governance trade-offs using current standards and
threat models
4 IS 5403 Cybersecurity Week 7 Quizzes Questions & Correct Answers 2026 Updated 100% Correct Trine
University
5 Foundations of Cybersecurity - Week 7: Network Security, Cryptographic Controls, Access Management,
Incident Response, and Risk Governance
6 Applied Cybersecurity - Week 7: Network Security, Cryptographic Controls, Access Management, Incident
Response, and Risk Governance
7 Advanced Cybersecurity - Week 7: Network Security, Cryptographic Controls, Access Management,
Incident Response, and Risk Governance
8 Cybersecurity - Week 7: Network Security, Cryptographic Controls, Access Management, Incident
Response, and Risk Governance Review
ABSTRACT
This study document brings together 148 carefully worded exam questions drawn from IS 5403
Cybersecurity Week 7 Quizzes Questions & Correct Answers 2026 Updated 100% Correct Trine
University, with the strongest emphasis placed on Evaluate and select appropriate cryptographic
controls and network security architectures for complex enterprise environments, Apply incident
response and forensic principles to prioritize containment, eradication, and recovery actions under
regulatory constraints, Analyze access management, zero-trust and and risk governance trade-offs
using current standards and threat models. Every item follows the wording style and level of
reasoning you meet in the real paper, and each one is paired with a clear rationale so the correct
choice is never a guess. Work through the set at your own pace, mark the questions that slow you
down, then come back to them until the reasoning feels automatic. Learners who revise this way
walk into the exam room recognising the pattern behind the questions instead of meeting them for
the first time. Keep going - steady, honest practice is what turns a difficult paper into a comfortable
pass.
Page 1
,Q1 EVALUATE AND SELECT APPROPRIATE CRYPTOGRAPHIC CONTROLS AND NETWORK
SECURITY ARCHITECTURES FOR COMPLEX ENTERPRISE ENVIRONMENTS
An enterprise deploys TLS 1.3 with mutual authentication for internal
microservices. A security architect proposes replacing session tickets with
stateless 0-RTT resumption to reduce latency. Which security consequence most
accurately reflects the current protocol design trade-off?
A. 0-RTT data is forward secret and safe from replay because TLS 1.3 binds early data to a
unique client nonce.
B. 0-RTT data lacks replay protection by default and should be restricted to idempotent
operations or disabled for sensitive transactions. CORRECT
C. Session tickets in TLS 1.3 are deprecated and cannot be used with mutual authentication,
making 0-RTT mandatory.
D. 0-RTT eliminates the need for certificate validation, since early data is encrypted with the prior
session key.
RATIONALE: TLS 1.3 0-RTT early data is replayable by design unless the application enforces
anti-replay; it is not safe for non-idempotent or sensitive operations. Forward secrecy for 0-RTT
is weaker than full handshake, and certificate validation still applies. Session tickets remain
supported with mutual auth, so options A, C, and D are incorrect.
Page 2
,Q2 EVALUATE AND SELECT APPROPRIATE CRYPTOGRAPHIC CONTROLS AND NETWORK
SECURITY ARCHITECTURES FOR COMPLEX ENTERPRISE ENVIRONMENTS
A SOC observes repeated Kerberos service ticket requests for SPNs that do not
exist, followed by successful authentication to a file server. Which attack
sequence and mitigation pairing is most accurate?
A. Kerberoasting followed by pass-the-hash; mitigate by disabling NTLM and enforcing AES-only
Kerberos.
B. AS-REP roasting followed by Golden Ticket; mitigate by requiring pre-authentication and
rotating krbtgt twice.
C. Kerberoasting reconnaissance followed by service account compromise; mitigate with long
random passwords, gMSAs, and AES encryption. CORRECT
D. Silver Ticket forgery followed by DCSync; mitigate by restricting replication permissions and
enabling LSA protection.
RATIONALE: Repeated requests for nonexistent SPNs indicate Kerberoasting reconnaissance,
and subsequent access suggests service account compromise; gMSAs and AES-only encryption
reduce crackability. AS-REP roasting targets accounts without pre-auth, Golden/Silver Tickets
involve forged tickets rather than SPN enumeration, and pass-the-hash uses NTLM hashes, not
Kerberos SPN probing.
Q3 EVALUATE AND SELECT APPROPRIATE CRYPTOGRAPHIC CONTROLS AND NETWORK
SECURITY ARCHITECTURES FOR COMPLEX ENTERPRISE ENVIRONMENTS
A forensic examiner must preserve volatile evidence on a running Linux server
suspected of compromise. Which acquisition order best aligns with RFC 3227 and
modern memory forensics practice?
A. Image the disk first, then capture RAM, because disk evidence is more legally defensible.
B. Capture RAM and network connections first, then disk, because volatile data is lost on
shutdown and may contain encryption keys. CORRECT
C. Power off immediately, then remove the disk for imaging to prevent malware from altering
evidence.
D. Run antivirus scan first, then capture RAM, to identify malware before acquisition.
RATIONALE: RFC 3227 and modern practice prioritize volatile data (RAM, network state, running
processes) before non-volatile disk because memory holds keys, malware artifacts, and
ephemeral connections. Powering off destroys volatile evidence, antivirus scanning alters state,
and disk-first ignores volatility order.
Page 3
, Q4 EVALUATE AND SELECT APPROPRIATE CRYPTOGRAPHIC CONTROLS AND NETWORK
SECURITY ARCHITECTURES FOR COMPLEX ENTERPRISE ENVIRONMENTS
An organization adopts a risk-based vulnerability management program. A CVSS
9.8 vulnerability exists on an internet-facing server but is not exploitable due to a
compensating WAF rule, while a CVSS 6.5 vulnerability on an internal HR system
is actively exploited. Which prioritization decision is most defensible under
current risk frameworks?
A. Patch the CVSS 9.8 first because severity score always determines priority regardless of
exploitability.
B. Patch the actively exploited internal vulnerability first, because exploitability and business
impact outweigh raw CVSS severity. CORRECT
C. Ignore both until the next quarterly patch cycle since the WAF mitigates the critical one.
D. Disable the HR system permanently to eliminate the vulnerability and reduce risk to zero.
RATIONALE: Modern risk-based VM (e.g., CISA KEV, EPSS, SSVC) prioritizes actively exploited
vulnerabilities with business impact over higher CVSS scores that are mitigated. CVSS alone is
insufficient, WAF mitigation does not eliminate all risk, and disabling a business system is
disproportionate.
Q5 EVALUATE AND SELECT APPROPRIATE CRYPTOGRAPHIC CONTROLS AND NETWORK
SECURITY ARCHITECTURES FOR COMPLEX ENTERPRISE ENVIRONMENTS
A company implements SAML SSO with an IdP and SP. An attacker with access to
the IdP signing key forges assertions. Which control most directly prevents
acceptance of forged assertions at the SP?
A. Enforcing HTTPS on the SP and HSTS headers.
B. Validating the XML signature against a trusted IdP certificate and rejecting unsigned or weakly
signed assertions. CORRECT
C. Requiring users to change passwords every 30 days.
D. Enabling CORS on the SP to restrict origins.
RATIONALE: SAML assertion integrity depends on validating the XML signature against the
trusted IdP certificate; key compromise requires certificate rotation/revocation. HTTPS and HSTS
protect transport, not assertion forgery; password rotation and CORS do not address signed
assertion validation.
Page 4
QUESTIONS & CORRECT ANSWERS 2026
UPDATED 100% CORRECT TRINE UNIVERSITY
148 QUESTIONS
TABLE OF CONTENTS
# TOPIC
1 Evaluate and select appropriate cryptographic controls and network security architectures for complex
enterprise environments
2 Apply incident response and forensic principles to prioritize containment, eradication, and recovery
actions under regulatory constraints
3 Analyze access management, zero-trust, and risk governance trade-offs using current standards and
threat models
4 IS 5403 Cybersecurity Week 7 Quizzes Questions & Correct Answers 2026 Updated 100% Correct Trine
University
5 Foundations of Cybersecurity - Week 7: Network Security, Cryptographic Controls, Access Management,
Incident Response, and Risk Governance
6 Applied Cybersecurity - Week 7: Network Security, Cryptographic Controls, Access Management, Incident
Response, and Risk Governance
7 Advanced Cybersecurity - Week 7: Network Security, Cryptographic Controls, Access Management,
Incident Response, and Risk Governance
8 Cybersecurity - Week 7: Network Security, Cryptographic Controls, Access Management, Incident
Response, and Risk Governance Review
ABSTRACT
This study document brings together 148 carefully worded exam questions drawn from IS 5403
Cybersecurity Week 7 Quizzes Questions & Correct Answers 2026 Updated 100% Correct Trine
University, with the strongest emphasis placed on Evaluate and select appropriate cryptographic
controls and network security architectures for complex enterprise environments, Apply incident
response and forensic principles to prioritize containment, eradication, and recovery actions under
regulatory constraints, Analyze access management, zero-trust and and risk governance trade-offs
using current standards and threat models. Every item follows the wording style and level of
reasoning you meet in the real paper, and each one is paired with a clear rationale so the correct
choice is never a guess. Work through the set at your own pace, mark the questions that slow you
down, then come back to them until the reasoning feels automatic. Learners who revise this way
walk into the exam room recognising the pattern behind the questions instead of meeting them for
the first time. Keep going - steady, honest practice is what turns a difficult paper into a comfortable
pass.
Page 1
,Q1 EVALUATE AND SELECT APPROPRIATE CRYPTOGRAPHIC CONTROLS AND NETWORK
SECURITY ARCHITECTURES FOR COMPLEX ENTERPRISE ENVIRONMENTS
An enterprise deploys TLS 1.3 with mutual authentication for internal
microservices. A security architect proposes replacing session tickets with
stateless 0-RTT resumption to reduce latency. Which security consequence most
accurately reflects the current protocol design trade-off?
A. 0-RTT data is forward secret and safe from replay because TLS 1.3 binds early data to a
unique client nonce.
B. 0-RTT data lacks replay protection by default and should be restricted to idempotent
operations or disabled for sensitive transactions. CORRECT
C. Session tickets in TLS 1.3 are deprecated and cannot be used with mutual authentication,
making 0-RTT mandatory.
D. 0-RTT eliminates the need for certificate validation, since early data is encrypted with the prior
session key.
RATIONALE: TLS 1.3 0-RTT early data is replayable by design unless the application enforces
anti-replay; it is not safe for non-idempotent or sensitive operations. Forward secrecy for 0-RTT
is weaker than full handshake, and certificate validation still applies. Session tickets remain
supported with mutual auth, so options A, C, and D are incorrect.
Page 2
,Q2 EVALUATE AND SELECT APPROPRIATE CRYPTOGRAPHIC CONTROLS AND NETWORK
SECURITY ARCHITECTURES FOR COMPLEX ENTERPRISE ENVIRONMENTS
A SOC observes repeated Kerberos service ticket requests for SPNs that do not
exist, followed by successful authentication to a file server. Which attack
sequence and mitigation pairing is most accurate?
A. Kerberoasting followed by pass-the-hash; mitigate by disabling NTLM and enforcing AES-only
Kerberos.
B. AS-REP roasting followed by Golden Ticket; mitigate by requiring pre-authentication and
rotating krbtgt twice.
C. Kerberoasting reconnaissance followed by service account compromise; mitigate with long
random passwords, gMSAs, and AES encryption. CORRECT
D. Silver Ticket forgery followed by DCSync; mitigate by restricting replication permissions and
enabling LSA protection.
RATIONALE: Repeated requests for nonexistent SPNs indicate Kerberoasting reconnaissance,
and subsequent access suggests service account compromise; gMSAs and AES-only encryption
reduce crackability. AS-REP roasting targets accounts without pre-auth, Golden/Silver Tickets
involve forged tickets rather than SPN enumeration, and pass-the-hash uses NTLM hashes, not
Kerberos SPN probing.
Q3 EVALUATE AND SELECT APPROPRIATE CRYPTOGRAPHIC CONTROLS AND NETWORK
SECURITY ARCHITECTURES FOR COMPLEX ENTERPRISE ENVIRONMENTS
A forensic examiner must preserve volatile evidence on a running Linux server
suspected of compromise. Which acquisition order best aligns with RFC 3227 and
modern memory forensics practice?
A. Image the disk first, then capture RAM, because disk evidence is more legally defensible.
B. Capture RAM and network connections first, then disk, because volatile data is lost on
shutdown and may contain encryption keys. CORRECT
C. Power off immediately, then remove the disk for imaging to prevent malware from altering
evidence.
D. Run antivirus scan first, then capture RAM, to identify malware before acquisition.
RATIONALE: RFC 3227 and modern practice prioritize volatile data (RAM, network state, running
processes) before non-volatile disk because memory holds keys, malware artifacts, and
ephemeral connections. Powering off destroys volatile evidence, antivirus scanning alters state,
and disk-first ignores volatility order.
Page 3
, Q4 EVALUATE AND SELECT APPROPRIATE CRYPTOGRAPHIC CONTROLS AND NETWORK
SECURITY ARCHITECTURES FOR COMPLEX ENTERPRISE ENVIRONMENTS
An organization adopts a risk-based vulnerability management program. A CVSS
9.8 vulnerability exists on an internet-facing server but is not exploitable due to a
compensating WAF rule, while a CVSS 6.5 vulnerability on an internal HR system
is actively exploited. Which prioritization decision is most defensible under
current risk frameworks?
A. Patch the CVSS 9.8 first because severity score always determines priority regardless of
exploitability.
B. Patch the actively exploited internal vulnerability first, because exploitability and business
impact outweigh raw CVSS severity. CORRECT
C. Ignore both until the next quarterly patch cycle since the WAF mitigates the critical one.
D. Disable the HR system permanently to eliminate the vulnerability and reduce risk to zero.
RATIONALE: Modern risk-based VM (e.g., CISA KEV, EPSS, SSVC) prioritizes actively exploited
vulnerabilities with business impact over higher CVSS scores that are mitigated. CVSS alone is
insufficient, WAF mitigation does not eliminate all risk, and disabling a business system is
disproportionate.
Q5 EVALUATE AND SELECT APPROPRIATE CRYPTOGRAPHIC CONTROLS AND NETWORK
SECURITY ARCHITECTURES FOR COMPLEX ENTERPRISE ENVIRONMENTS
A company implements SAML SSO with an IdP and SP. An attacker with access to
the IdP signing key forges assertions. Which control most directly prevents
acceptance of forged assertions at the SP?
A. Enforcing HTTPS on the SP and HSTS headers.
B. Validating the XML signature against a trusted IdP certificate and rejecting unsigned or weakly
signed assertions. CORRECT
C. Requiring users to change passwords every 30 days.
D. Enabling CORS on the SP to restrict origins.
RATIONALE: SAML assertion integrity depends on validating the XML signature against the
trusted IdP certificate; key compromise requires certificate rotation/revocation. HTTPS and HSTS
protect transport, not assertion forgery; password rotation and CORS do not address signed
assertion validation.
Page 4
