WGU D315 Network and Security Foundations Exam - 150
Questions and Answers with Detailed Rationales
About This Exam Bank
This comprehensive 150-question exam bank is designed to prepare candidates for WGU D315 Network and
Security Foundations Exam. Every question is aligned with the latest official content outline and includes a detailed,
evidence-based rationale, an explanation of why each remaining option is incorrect, and a supporting reference.
Keywords
WGU D315 Network and Security Foundations Exam, exam bank, practice questions, verified answers, detailed
rationales, test prep, study guide, review questions, certification exam, latest update, WGU D315 Network and
Security Foundations Exam, exam bank, practice questions, verified answers, detailed rationales, WGU D315
Network and Security Foundations Exam, exam bank, practice questions, verified answers, detailed rationales, test
prep, study guide, review questions
PART 1: ANALYZE NETWORK TRAFFIC AND TOPOLOGY TO IDENTIFY
MISCONFIGURATIONS AND VULNERABILITIES
1. A network engineer captures traffic and observes that TCP segments are being retransmitted frequently, but the
congestion window (cwnd) remains small and does not grow. Which condition best explains this behavior?
A) The receiver's advertised window is zero, causing the sender to stop transmitting.
B) The sender is in slow start and has not yet reached the slow start threshold.
C) The network is experiencing persistent congestion, triggering fast retransmit and fast recovery.
D) The sender is using Nagle's algorithm, which limits the number of outstanding small segments.
' Correct Answer: C
Rationale: Persistent retransmissions with a small cwnd indicate that the sender is repeatedly reducing cwnd due to
congestion signals (e.g., duplicate ACKs or timeouts), consistent with fast retransmit/fast recovery under sustained
congestion. A zero window would halt transmission until a window update, not cause frequent retransmissions. Slow
start would show exponential growth, and Nagle's algorithm affects small segment coalescing, not retransmission
frequency.
2. An organization uses WPA3-Enterprise with 192-bit security mode. Which statement accurately describes a key
requirement of this mode?
A) It mandates the use of AES-128 in GCMP for management frame protection.
B) It requires SHA-384 for key derivation and AES-256 for encryption.
C) It allows the use of TKIP for backward compatibility with older devices.
D) It relies on SAE for authentication instead of 802.1X/EAP.
' Correct Answer: B
Rationale: WPA3-Enterprise 192-bit mode mandates AES-256-GCMP for encryption and SHA-384 for key
derivation, providing stronger cryptographic protection. AES-128 and TKIP are not permitted in this mode. SAE is
used in WPA3-Personal, while WPA3-Enterprise uses 802.1X/EAP.
3. A security analyst must choose an encryption mode for a database that requires both confidentiality and integrity,
and where ciphertext expansion must be minimized. Which mode best meets these requirements?
A) AES-CBC with HMAC-SHA256
B) AES-GCM
Page 1
, C) AES-CTR with a separate MAC
D) AES-ECB
' Correct Answer: B
Rationale: AES-GCM provides authenticated encryption with minimal overhead, combining confidentiality and
integrity in a single pass. CBC with HMAC adds significant overhead and requires separate keys. CTR with a
separate MAC is similar but less efficient. ECB lacks integrity and is insecure for multi-block data.
4. Which of the following best describes the function of a stateful firewall when processing an inbound TCP packet
that is not part of an existing connection?
A) It allows the packet if the destination port is open, regardless of connection state.
B) It drops the packet unless a rule explicitly permits new inbound connections.
C) It forwards the packet to the DMZ for further inspection.
D) It logs the packet and allows it if it matches a previous outbound session.
' Correct Answer: B
Rationale: Stateful firewalls track connection state and by default block unsolicited inbound packets unless a rule
permits new connections. Allowing based solely on open ports is stateless behavior. Forwarding to DMZ is not
automatic, and logging/allowing based on previous sessions applies only to established connections.
5. A company deploys a VPN using IPsec in tunnel mode. Which statement accurately describes the packet
structure?
A) The original IP header is encrypted, and a new IP header is prepended.
B) Only the payload is encrypted, and the original IP header remains intact.
C) Both the original IP header and payload are encrypted, and a new IP header is added.
D) The original IP header is authenticated but not encrypted, and the payload is encrypted.
' Correct Answer: C
Rationale: In IPsec tunnel mode, the entire original IP packet (header and payload) is encrypted and encapsulated
with a new IP header. Transport mode encrypts only the payload and leaves the original IP header intact.
Authentication-only modes do not encrypt the payload.
6. An administrator configures a switch port with port security, specifying a maximum of two MAC addresses and
violation mode 'restrict'. What happens when a third MAC address attempts to connect?
A) The port is shut down and generates a syslog message.
B) The port drops packets from the new MAC and increments a violation counter.
C) The port allows the new MAC but sends an SNMP trap.
D) The port disables port security and learns the new MAC.
' Correct Answer: B
Rationale: In 'restrict' mode, the switch drops packets from unauthorized MAC addresses and increments the
security violation counter, optionally sending SNMP traps. 'Shutdown' mode disables the port. 'Protect' mode drops
silently without logging. The port does not disable security or learn the new MAC.
7. A security team is implementing a defense-in-depth strategy. Which control is an example of a preventive
physical control?
A) Security awareness training
B) Biometric access control for a data center
C) Intrusion detection system
D) Security audit logs
' Correct Answer: B
Page 2
,Rationale: Biometric access control is a preventive physical control that restricts physical access to sensitive areas.
Security awareness training is administrative, IDS is detective, and audit logs are detective/administrative.
8. Which DNS record type is used to prevent email spoofing by specifying authorized mail servers for a domain?
A) MX
B) SPF
C) DKIM
D) DMARC
' Correct Answer: B
Rationale: SPF (Sender Policy Framework) is a DNS TXT record that lists authorized sending hosts for a domain,
helping prevent email spoofing. MX records specify mail exchangers. DKIM adds a digital signature, and DMARC
builds on SPF and DKIM to define policy.
9. A company uses a SIEM system and notices a high number of false positives. Which tuning approach best reduces
false positives while maintaining detection efficacy?
A) Disable all rules that generate false positives.
B) Increase the severity level of all alerts.
C) Implement correlation rules and threat intelligence feeds.
D) Reduce the log retention period to limit data volume.
' Correct Answer: C
Rationale: Correlation rules and threat intelligence improve context and accuracy, reducing false positives without
losing detection. Disabling rules may miss threats. Increasing severity does not reduce false positives. Reducing
retention harms forensic analysis.
10. Which of the following is the primary purpose of a network access control (NAC) system?
A) To encrypt all network traffic using IPsec.
B) To enforce endpoint compliance before granting network access.
C) To provide secure remote access via VPN.
D) To monitor network traffic for anomalies.
' Correct Answer: B
Rationale: NAC enforces security policies by checking endpoint compliance (e.g., antivirus, patches) before
allowing network access. VPN provides remote access, IPsec encrypts traffic, and monitoring is typically done by
IDS/IPS.
11. A company deploys a stateful firewall between its internal network and the internet. An administrator notices
that an inbound TCP segment with the SYN flag set and a destination port of 443 is permitted, but a subsequent
inbound segment with only the ACK flag set and no matching connection entry is dropped. Which firewall behavior
best explains this observation?
A) The firewall is performing stateless packet filtering based on access control lists.
B) The firewall is maintaining a state table and only allowing return traffic for established sessions.
C) The firewall is acting as a circuit-level proxy that validates the three-way handshake at the application layer.
D) The firewall is applying deep packet inspection to detect application-layer protocol anomalies.
' Correct Answer: B
Rationale: A stateful firewall tracks active connections in a state table; it permits the initial SYN to initiate a
session but drops unsolicited ACK packets that do not correspond to an established connection. Stateless filtering
would evaluate each packet independently against ACLs and could allow the ACK if a rule permits it. Circuit-level
proxies and DPI operate at higher layers and are not required to explain basic stateful filtering behavior.
Page 3
, 12. An organization uses a PKI with a two-tier hierarchy: an offline root CA and an online issuing CA. A security
auditor finds that a subordinate CA certificate was issued with the same key pair as the root CA. Which security
property is most directly compromised?
A) Certificate revocation list (CRL) freshness
B) Domain separation and key usage constraints
C) Subject alternative name (SAN) validation
D) OCSP stapling efficiency
' Correct Answer: B
Rationale: Reusing the root CA's key pair for a subordinate CA violates domain separation and key usage
constraints, as the same key is now used for both root and issuing functions, increasing the impact of key
compromise. CRL freshness, SAN validation, and OCSP stapling are unrelated to key reuse across CA tiers.
13. A network engineer must choose between TACACS+ and RADIUS for centralized administrative access to
routers and switches. Which statement correctly distinguishes the two protocols in this context?
A) TACACS+ encrypts the entire payload and separates authentication, authorization, and accounting, while
RADIUS encrypts only the password and combines authentication and authorization.
B) RADIUS encrypts the entire payload and separates AAA functions, while TACACS+ encrypts only the
password and combines authentication and authorization.
C) TACACS+ uses UDP ports 1812/1813, while RADIUS uses TCP port 49.
D) RADIUS provides command-level authorization for router CLI, while TACACS+ does not support
per-command authorization.
' Correct Answer: A
Rationale: TACACS+ encrypts the full packet body and separates authentication, authorization, and accounting,
making it well-suited for granular command authorization on network devices. RADIUS encrypts only the password
field and merges authentication and authorization. The port and transport statements in options C and D are factually
reversed or incorrect.
14. A web application uses JSON Web Tokens (JWTs) for session management. An attacker captures a token and
notices the header specifies "alg":"none". What is the most likely vulnerability if the server accepts this token?
A) The token is vulnerable to a brute-force attack on the HMAC secret.
B) The server fails to verify the token signature, allowing forged tokens.
C) The token uses RSA encryption instead of HMAC, enabling key recovery.
D) The token's expiration claim is ignored, causing indefinite session validity.
' Correct Answer: B
Rationale: The "alg":"none" header indicates an unsigned JWT; if the server accepts it, an attacker can forge
arbitrary claims without a valid signature. Brute-forcing an HMAC secret applies only when a secret is used, and
RSA encryption or expiration handling are separate issues not implied by the "none" algorithm.
15. An IDS sensor is placed on a SPAN port that mirrors all traffic to a DMZ switch. The sensor begins dropping
packets during peak hours, missing alerts. Which change best preserves detection fidelity without altering the
production network?
A) Deploy the IDS inline as a transparent bridge to eliminate packet loss.
B) Enable port mirroring on multiple ports and load-balance across multiple IDS sensors.
C) Reduce the SPAN session's sampling rate to lower the packet volume.
D) Convert the IDS to an IPS and enable blocking mode to prioritize traffic.
' Correct Answer: B
Rationale: Load-balancing mirrored traffic across multiple IDS sensors increases aggregate capture capacity while
keeping the IDS passive and the production network unchanged. Inline deployment (A) alters the network path and
introduces risk, sampling (C) reduces visibility, and converting to IPS (D) changes the device's role and may disrupt
Page 4
Questions and Answers with Detailed Rationales
About This Exam Bank
This comprehensive 150-question exam bank is designed to prepare candidates for WGU D315 Network and
Security Foundations Exam. Every question is aligned with the latest official content outline and includes a detailed,
evidence-based rationale, an explanation of why each remaining option is incorrect, and a supporting reference.
Keywords
WGU D315 Network and Security Foundations Exam, exam bank, practice questions, verified answers, detailed
rationales, test prep, study guide, review questions, certification exam, latest update, WGU D315 Network and
Security Foundations Exam, exam bank, practice questions, verified answers, detailed rationales, WGU D315
Network and Security Foundations Exam, exam bank, practice questions, verified answers, detailed rationales, test
prep, study guide, review questions
PART 1: ANALYZE NETWORK TRAFFIC AND TOPOLOGY TO IDENTIFY
MISCONFIGURATIONS AND VULNERABILITIES
1. A network engineer captures traffic and observes that TCP segments are being retransmitted frequently, but the
congestion window (cwnd) remains small and does not grow. Which condition best explains this behavior?
A) The receiver's advertised window is zero, causing the sender to stop transmitting.
B) The sender is in slow start and has not yet reached the slow start threshold.
C) The network is experiencing persistent congestion, triggering fast retransmit and fast recovery.
D) The sender is using Nagle's algorithm, which limits the number of outstanding small segments.
' Correct Answer: C
Rationale: Persistent retransmissions with a small cwnd indicate that the sender is repeatedly reducing cwnd due to
congestion signals (e.g., duplicate ACKs or timeouts), consistent with fast retransmit/fast recovery under sustained
congestion. A zero window would halt transmission until a window update, not cause frequent retransmissions. Slow
start would show exponential growth, and Nagle's algorithm affects small segment coalescing, not retransmission
frequency.
2. An organization uses WPA3-Enterprise with 192-bit security mode. Which statement accurately describes a key
requirement of this mode?
A) It mandates the use of AES-128 in GCMP for management frame protection.
B) It requires SHA-384 for key derivation and AES-256 for encryption.
C) It allows the use of TKIP for backward compatibility with older devices.
D) It relies on SAE for authentication instead of 802.1X/EAP.
' Correct Answer: B
Rationale: WPA3-Enterprise 192-bit mode mandates AES-256-GCMP for encryption and SHA-384 for key
derivation, providing stronger cryptographic protection. AES-128 and TKIP are not permitted in this mode. SAE is
used in WPA3-Personal, while WPA3-Enterprise uses 802.1X/EAP.
3. A security analyst must choose an encryption mode for a database that requires both confidentiality and integrity,
and where ciphertext expansion must be minimized. Which mode best meets these requirements?
A) AES-CBC with HMAC-SHA256
B) AES-GCM
Page 1
, C) AES-CTR with a separate MAC
D) AES-ECB
' Correct Answer: B
Rationale: AES-GCM provides authenticated encryption with minimal overhead, combining confidentiality and
integrity in a single pass. CBC with HMAC adds significant overhead and requires separate keys. CTR with a
separate MAC is similar but less efficient. ECB lacks integrity and is insecure for multi-block data.
4. Which of the following best describes the function of a stateful firewall when processing an inbound TCP packet
that is not part of an existing connection?
A) It allows the packet if the destination port is open, regardless of connection state.
B) It drops the packet unless a rule explicitly permits new inbound connections.
C) It forwards the packet to the DMZ for further inspection.
D) It logs the packet and allows it if it matches a previous outbound session.
' Correct Answer: B
Rationale: Stateful firewalls track connection state and by default block unsolicited inbound packets unless a rule
permits new connections. Allowing based solely on open ports is stateless behavior. Forwarding to DMZ is not
automatic, and logging/allowing based on previous sessions applies only to established connections.
5. A company deploys a VPN using IPsec in tunnel mode. Which statement accurately describes the packet
structure?
A) The original IP header is encrypted, and a new IP header is prepended.
B) Only the payload is encrypted, and the original IP header remains intact.
C) Both the original IP header and payload are encrypted, and a new IP header is added.
D) The original IP header is authenticated but not encrypted, and the payload is encrypted.
' Correct Answer: C
Rationale: In IPsec tunnel mode, the entire original IP packet (header and payload) is encrypted and encapsulated
with a new IP header. Transport mode encrypts only the payload and leaves the original IP header intact.
Authentication-only modes do not encrypt the payload.
6. An administrator configures a switch port with port security, specifying a maximum of two MAC addresses and
violation mode 'restrict'. What happens when a third MAC address attempts to connect?
A) The port is shut down and generates a syslog message.
B) The port drops packets from the new MAC and increments a violation counter.
C) The port allows the new MAC but sends an SNMP trap.
D) The port disables port security and learns the new MAC.
' Correct Answer: B
Rationale: In 'restrict' mode, the switch drops packets from unauthorized MAC addresses and increments the
security violation counter, optionally sending SNMP traps. 'Shutdown' mode disables the port. 'Protect' mode drops
silently without logging. The port does not disable security or learn the new MAC.
7. A security team is implementing a defense-in-depth strategy. Which control is an example of a preventive
physical control?
A) Security awareness training
B) Biometric access control for a data center
C) Intrusion detection system
D) Security audit logs
' Correct Answer: B
Page 2
,Rationale: Biometric access control is a preventive physical control that restricts physical access to sensitive areas.
Security awareness training is administrative, IDS is detective, and audit logs are detective/administrative.
8. Which DNS record type is used to prevent email spoofing by specifying authorized mail servers for a domain?
A) MX
B) SPF
C) DKIM
D) DMARC
' Correct Answer: B
Rationale: SPF (Sender Policy Framework) is a DNS TXT record that lists authorized sending hosts for a domain,
helping prevent email spoofing. MX records specify mail exchangers. DKIM adds a digital signature, and DMARC
builds on SPF and DKIM to define policy.
9. A company uses a SIEM system and notices a high number of false positives. Which tuning approach best reduces
false positives while maintaining detection efficacy?
A) Disable all rules that generate false positives.
B) Increase the severity level of all alerts.
C) Implement correlation rules and threat intelligence feeds.
D) Reduce the log retention period to limit data volume.
' Correct Answer: C
Rationale: Correlation rules and threat intelligence improve context and accuracy, reducing false positives without
losing detection. Disabling rules may miss threats. Increasing severity does not reduce false positives. Reducing
retention harms forensic analysis.
10. Which of the following is the primary purpose of a network access control (NAC) system?
A) To encrypt all network traffic using IPsec.
B) To enforce endpoint compliance before granting network access.
C) To provide secure remote access via VPN.
D) To monitor network traffic for anomalies.
' Correct Answer: B
Rationale: NAC enforces security policies by checking endpoint compliance (e.g., antivirus, patches) before
allowing network access. VPN provides remote access, IPsec encrypts traffic, and monitoring is typically done by
IDS/IPS.
11. A company deploys a stateful firewall between its internal network and the internet. An administrator notices
that an inbound TCP segment with the SYN flag set and a destination port of 443 is permitted, but a subsequent
inbound segment with only the ACK flag set and no matching connection entry is dropped. Which firewall behavior
best explains this observation?
A) The firewall is performing stateless packet filtering based on access control lists.
B) The firewall is maintaining a state table and only allowing return traffic for established sessions.
C) The firewall is acting as a circuit-level proxy that validates the three-way handshake at the application layer.
D) The firewall is applying deep packet inspection to detect application-layer protocol anomalies.
' Correct Answer: B
Rationale: A stateful firewall tracks active connections in a state table; it permits the initial SYN to initiate a
session but drops unsolicited ACK packets that do not correspond to an established connection. Stateless filtering
would evaluate each packet independently against ACLs and could allow the ACK if a rule permits it. Circuit-level
proxies and DPI operate at higher layers and are not required to explain basic stateful filtering behavior.
Page 3
, 12. An organization uses a PKI with a two-tier hierarchy: an offline root CA and an online issuing CA. A security
auditor finds that a subordinate CA certificate was issued with the same key pair as the root CA. Which security
property is most directly compromised?
A) Certificate revocation list (CRL) freshness
B) Domain separation and key usage constraints
C) Subject alternative name (SAN) validation
D) OCSP stapling efficiency
' Correct Answer: B
Rationale: Reusing the root CA's key pair for a subordinate CA violates domain separation and key usage
constraints, as the same key is now used for both root and issuing functions, increasing the impact of key
compromise. CRL freshness, SAN validation, and OCSP stapling are unrelated to key reuse across CA tiers.
13. A network engineer must choose between TACACS+ and RADIUS for centralized administrative access to
routers and switches. Which statement correctly distinguishes the two protocols in this context?
A) TACACS+ encrypts the entire payload and separates authentication, authorization, and accounting, while
RADIUS encrypts only the password and combines authentication and authorization.
B) RADIUS encrypts the entire payload and separates AAA functions, while TACACS+ encrypts only the
password and combines authentication and authorization.
C) TACACS+ uses UDP ports 1812/1813, while RADIUS uses TCP port 49.
D) RADIUS provides command-level authorization for router CLI, while TACACS+ does not support
per-command authorization.
' Correct Answer: A
Rationale: TACACS+ encrypts the full packet body and separates authentication, authorization, and accounting,
making it well-suited for granular command authorization on network devices. RADIUS encrypts only the password
field and merges authentication and authorization. The port and transport statements in options C and D are factually
reversed or incorrect.
14. A web application uses JSON Web Tokens (JWTs) for session management. An attacker captures a token and
notices the header specifies "alg":"none". What is the most likely vulnerability if the server accepts this token?
A) The token is vulnerable to a brute-force attack on the HMAC secret.
B) The server fails to verify the token signature, allowing forged tokens.
C) The token uses RSA encryption instead of HMAC, enabling key recovery.
D) The token's expiration claim is ignored, causing indefinite session validity.
' Correct Answer: B
Rationale: The "alg":"none" header indicates an unsigned JWT; if the server accepts it, an attacker can forge
arbitrary claims without a valid signature. Brute-forcing an HMAC secret applies only when a secret is used, and
RSA encryption or expiration handling are separate issues not implied by the "none" algorithm.
15. An IDS sensor is placed on a SPAN port that mirrors all traffic to a DMZ switch. The sensor begins dropping
packets during peak hours, missing alerts. Which change best preserves detection fidelity without altering the
production network?
A) Deploy the IDS inline as a transparent bridge to eliminate packet loss.
B) Enable port mirroring on multiple ports and load-balance across multiple IDS sensors.
C) Reduce the SPAN session's sampling rate to lower the packet volume.
D) Convert the IDS to an IPS and enable blocking mode to prioritize traffic.
' Correct Answer: B
Rationale: Load-balancing mirrored traffic across multiple IDS sensors increases aggregate capture capacity while
keeping the IDS passive and the production network unchanged. Inline deployment (A) alters the network path and
introduces risk, sampling (C) reduces visibility, and converting to IPS (D) changes the device's role and may disrupt
Page 4
