NETSEC-FUND Practice Test

NETSEC-FUND practice test: what's covered

• CIA Triad
• Firewalls
• Palo Alto Architecture
• Cisco Security
• Network Protocols & Governance

Free NETSEC-FUND sample questions

1. A chief information security officer (CISO) is establishing security governance principles for a new cloud financial service. The architecture requires data confidentiality, prevention of unauthorized alterations, and guaranteed system uptime. Which triad model encapsulates these foundational requirements?

   • A. Confidentiality, Integrity, Availability (CIA Triad)
   • B. Cybersecurity, Integrity, Authentication (CIA Model)
   • C. Confidentiality, Inspection, Authorization (CIA Core)
   • D. Control, Isolation, Availability (CIA Shield)
   Show answer

   Correct: A. The CIA Triad stands for Confidentiality (protecting data from unauthorized disclosure), Integrity (safeguarding data against unauthorized alteration), and Availability (ensuring timely access for authorized users). Distractors like Cybersecurity/Authentication or Control/Isolation misuse the acronym and do not represent the established cybersecurity framework.

2. During a host-based incident response investigation, a forensic analyst categorizes software assets found on a compromised endpoint. Which of the following components represents a legitimate network security control rather than a malicious payload or malware classification?

   • A. Ransomware encryption daemon
   • B. Keylogging spyware agent
   • C. Stateful packet inspection firewall
   • D. Remote access Trojan (RAT)
   Show answer

   Correct: C. A stateful packet inspection firewall is a defensive security device that filters network traffic, not malware. Ransomware (which encrypts victim files for ransom), spyware (which secretly monitors user activity), and Trojans (which disguise malicious functionality) are all classified as malicious software variants.

3. A senior network architect is deploying a border perimeter defense strategy between an enterprise internal network and the public internet. Which TWO primary defensive functions does a next-generation perimeter firewall fulfill? (Select TWO)

   • A. Inspecting traffic against stateful policy to block unauthorized ingress and egress traffic
   • B. Providing active threat inspection to detect and drop malicious application traffic
   • C. Performing primary DNS root domain resolution for external clients
   • D. Providing host-level local full-disk volume encryption for endpoint laptops
   Show answer

   Correct: A and B. Perimeter firewalls filter unauthorized network access using stateful packet inspection and inspect payload traffic for malicious threats. DNS root domain resolution is performed by public recursive DNS resolvers, and host-level full-disk encryption is managed by endpoint operating systems (e.g., BitLocker), making those choices incorrect for firewall functionality.

4. A security administrator is enforcing Multi-Factor Authentication (MFA) across all administrative access portals. Which combination of factors satisfies true MFA requirements under NIST SP 800-63B standards?

   • A. A static complex password combined with a secret security question response
   • B. A knowledge-based PIN combined with an employee biometric fingerprint scan
   • C. A user password combined with a secondary email account confirmation link
   • D. A domain account password combined with a web browser CAPTCHA prompt
   Show answer

   Correct: B. Multi-Factor Authentication requires two or more independent authentication factors from different categories: Something You Know (password/PIN), Something You Have (token/smartcard), or Something You Are (biometric fingerprint). Combining a PIN (knowledge) and fingerprint (biometrics) represents two distinct categories. Security questions, email links, and CAPTCHAs belong to the same factor category (Something You Know) or are validation challenges rather than separate authentication factors.

5. Following a critical datacenter outage caused by a ransomware infection, an enterprise executes its Disaster Recovery Plan (DRP). Which TWO core operational objectives define the primary role of a DRP? (Select TWO)

   • A. Restoring critical business IT infrastructure and data back to operational state post-disruption
   • B. Minimizing service downtime and establishing recovery point and time objectives (RPO/RTO)
   • C. Replacing all real-time intrusion prevention rules with passive alert logging
   • D. Executing legal prosecution proceedings against cybercrime threat actors
   Show answer

   Correct: A and B. A Disaster Recovery Plan (DRP) focuses on technical recovery of systems, application services, and data within target RPO and RTO thresholds following a disruptive disaster. DRP does not replace real-time security prevention with passive logging, nor does it conduct legal criminal prosecutions, which fall under law enforcement and incident management forensics.

Last updated: 2026-10-19

NETSEC-FUND practice test FAQ