Free DSST Fundamentals of Cybersecurity Practice Questions

Sample Practice Questions

Try these 10 sample questions from the DSST Fundamentals of Cybersecurity practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1Which security triad property concerns restricting information disclosure to authorized parties?

   1. A.ConfidentialityCorrect answer: A
   2. B.Integrity
   3. C.Availability
   4. D.Accountability

   Explanation: NIST defines confidentiality as "Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information." This definition identifies Confidentiality as the property described.

   Reference: NIST Computer Security Resource Center Glossary: confidentiality — Definitions, FIPS 200

2. 2Which of the following login combinations uses two different authentication factors?

   1. A.A password and a PIN
   2. B.A password and a hardware tokenCorrect answer: B
   3. C.Two different passwords
   4. D.Two different security questions

   Explanation: The NIST glossary states: "Authentication using two or more different factors to achieve authentication. Factors include something you know (e.g., PIN, password); something you have (e.g., cryptographic identification device, token); or something you are (e.g., biometric)." This supports the answer for the process or control described.

   Reference: NIST CSRC Glossary: multi factor authentication — Definitions, CNSSI 4009-2022

3. 3Which description captures the security design of a system across its security domains?

   1. A.The security elements, their placement and their trust relationshipsCorrect answer: A
   2. B.The security elements, without their connections across domains
   3. C.The system components, with every domain assumed equally trusted
   4. D.The domain boundaries, without the security elements enforcing them

   Explanation: NIST states that "The security architecture reflects security domains, the placement of security-relevant elements within the security domains, the interconnections and trust relationships between the security-relevant elements, and the behavior and interaction between the security-relevant elements." The architecture includes the placement and relationships of the security elements.

   Reference: NIST CSRC Glossary: Security architecture — Definitions, NIST SP 800-37 Rev. 2

4. 4What is the purpose of configuration monitoring in a production environment?

   1. A.Identify differences from the approved configuration baseline.Correct answer: A
   2. B.Approve proposed changes before they are implemented.
   3. C.Define the initial configuration baseline for a new system.
   4. D.Replace the approved baseline with each observed configuration.

   Explanation: The source states: "Configuration monitoring involves activities to determine whether systems are configured in accordance with the organization’s agreed-upon baseline configurations, and whether the components identified within the system are consistent with the component inventory being maintained by the organization." This supports the answer in the stated context.

   Reference: Guide for Security-Focused Configuration Management of Information Systems — Section 2.3.10, Configuration Monitoring

5. 5Which service translates domain names into IP addresses?

   1. A.Network time synchronization
   2. B.Domain name serviceCorrect answer: B
   3. C.Dynamic host configuration
   4. D.Certificate revocation service

   Explanation: The source states: "It maintains a directory of domain names, as defined by the Domain Name System, and translates them to Internet Protocol addresses." This supports the selected response.

   Reference: NIST CSRC Glossary: Domain Name Server — Definitions, NIST SP 1800-16B

6. 6What is the principal aim of a penetration test?

   1. A.Mimic attacks to find ways to bypass security controls.Correct answer: A
   2. B.Review security policy documents without simulating an attack.
   3. C.List open ports without attempting to validate weaknesses.
   4. D.Estimate business impacts of outages without testing systems.

   Explanation: The source states: "Penetration testing is security testing in which assessors mimic real-world attacks to identify methods for circumventing the security features of an application, system, or network." This supports the answer in the scenario or concept described.

   Reference: Technical Guide to Information Security Testing and Assessment — Section 5.2, Penetration Testing

7. 7A visitor presents a badge at a controlled facility. What should be checked to determine whether the visitor is permitted to enter?

   1. A.The visitor's authorization for the facilityCorrect answer: A
   2. B.The badge's expiration date alone
   3. C.The visitor's permission to use a network account
   4. D.The visitor's recorded time of arrival

   Explanation: The source states: "Verifying individual access authorizations before granting access to the facility" This supports the response for the access-control scenario.

   Reference: Security and Privacy Controls for Information Systems and Organizations — PE-3, Physical Access Control

8. 8Which backup type is defined to capture all files in its selected scope regardless of change history?

   1. A.A full backup operationCorrect answer: A
   2. B.An incremental backup
   3. C.A differential backup
   4. D.A transaction-log backup

   Explanation: The source states: "A full backup captures all files on the disk or within the folder selected for backup." This supports the response for the stated recovery objective or activity.

   Reference: Contingency Planning Guide for Federal Information Systems — Section 5.1.2, Backup Methods

9. 9Which security triad property addresses improper modification or destruction of information?

   1. A.Availability
   2. B.Confidentiality
   3. C.IntegrityCorrect answer: C
   4. D.Privacy

   Explanation: NIST defines integrity as "Guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity." This definition identifies Integrity as the property described.

   Reference: NIST Computer Security Resource Center Glossary: integrity — Definitions, FIPS 200

10. 10When a system verifies a user's claimed identity before access, what process is it performing?

    1. A.Authorization
    2. B.Accounting
    3. C.AuthenticationCorrect answer: C
    4. D.Provisioning

    Explanation: The NIST glossary states: "Verifying the identity of a user, process, or device, often as a prerequisite to allowing access to resources in an information system." This supports the answer for the process or control described.

    Reference: NIST CSRC Glossary: authentication — Definitions, FIPS 200