Free ETA Information Technology Security (ITS) examination Practice Questions

Sample Practice Questions

Try these 10 sample questions from the ETA Information Technology Security (ITS) examination practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A stateless router firewall must permit only specified source addresses, destinations and transport ports. What directly expresses those permit/deny decisions?

   1. A.A connection-state table
   2. B.A certificate revocation list
   3. C.A packet-filter rulesetCorrect answer: C
   4. D.A malware signature database

   Explanation: NIST calls the directives a “ruleset.” A state table records active connections; a revocation list records certificate status; malware signatures identify known code patterns. None substitutes for the stated address-and-port policy.

   Reference: NIST SP 800-41 Rev. 1: Guidelines on Firewalls and Firewall Policy — Section 2.1.1, Packet Filtering

2. 2Which entrance control is specifically designed to prevent an unauthorized person from following an authorized person through a secure entrance?

   1. A.A camera recording the exterior sidewalk
   2. B.A visitor book at reception
   3. C.An access-control vestibule with interlocking doorsCorrect answer: C
   4. D.A badge printer in the security office

   Explanation: NIST states vestibules prevent people from “following authorized individuals.” Recording and sign-in aid detection or accountability; printing a badge creates a credential. The interlocked entrance directly controls passage to address tailgating.

   Reference: NIST SP 800-53 Rev. 5: Security and Privacy Controls — PE-3(8), Access Control Vestibules

3. 3A laptop leaves the corporate network and connects to an untrusted network. Which firewall continues to enforce controls on that laptop's own incoming and outgoing traffic?

   1. A.The firewall remaining at the corporate Internet edge
   2. B.A host-based firewall running on the laptopCorrect answer: B
   3. C.A firewall protecting a remote server only
   4. D.A firewall between two unrelated corporate subnets

   Explanation: NIST describes host-based firewalls as “residing on the hosts they are protecting.” The laptop's own firewall travels with it. Corporate-edge and other hosts' firewalls do not necessarily sit on the laptop's current traffic path.

   Reference: NIST SP 800-41 Rev. 1: Guidelines on Firewalls and Firewall Policy — Section 2.2.1, Host-Based Firewalls and Personal Firewalls

4. 4Which IEEE 802.11i confidentiality and integrity protocol uses AES rather than the legacy WEP/TKIP core cipher?

   1. A.WEP
   2. B.TKIP
   3. C.CCMPCorrect answer: C
   4. D.PAP

   Explanation: NIST SP 800-97 Guide to IEEE 802.11i states, "Of WEP, TKIP, and CCMP, only CCMP uses a core cryptographic algorithm that is FIPS-approved, the Advanced Encryption Standard (AES)." CCMP uses AES. WEP and TKIP use legacy RC4-based protection; PAP is an authentication protocol, not the requested WLAN cipher protocol.

   Reference: NIST SP 800-97 Guide to IEEE 802.11i — Executive Summary

5. 5An IoT sensor downloads a firmware update. Which preinstallation check directly protects against a forged update?

   1. A.Verify the update's signature using an authorized manufacturer keyCorrect answer: A
   2. B.Match its digest to a checksum from the same unauthenticated download
   3. C.Confirm that its version number is newer than the installed version
   4. D.Confirm that its filename matches the expected product and release

   Explanation: NISTIR 8259A IoT Device Cybersecurity Capability Core Baseline states, "The ability to verify and authenticate any update before installing it" A: A trusted signature verifies update authenticity and integrity. B: An attacker could replace both package and unauthenticated checksum. C: A higher version number is not proof of origin or integrity. D: Product and release names can be copied onto a forged package.

   Reference: NISTIR 8259A IoT Device Cybersecurity Capability Core Baseline — Table 1, Software Update

6. 6Which behavior characterizes the self-contained network service worm described in NIST malware guidance?

   1. A.Replicating by attaching malicious code to an existing executable file
   2. B.Replicating by inserting malicious macros into an existing document
   3. C.Replicating through remote-service exploitation without needing to infect a host fileCorrect answer: C
   4. D.Concealing a nonreplicating malicious function inside an apparently benign utility

   Explanation: NIST SP 800-83 Revision 1 states, "A worm is a self-replicating, self-contained program that usually executes itself without user intervention." A: Attaching code to a host file describes file-infecting behavior. B: Document macro infection is not the self-contained service-worm mechanism. C: Self-contained service worms exploit service flaws to propagate. D: A nonreplicating disguised utility describes a Trojan.

   Reference: NIST SP 800-83 Revision 1 — Section 2, Worms

7. 7A team needs a catalog from which it can select and tailor security and privacy controls. Which publication serves that purpose?

   1. A.NIST SP 800-53, security and privacy controlsCorrect answer: A
   2. B.NIST SP 800-37, the Risk Management Framework
   3. C.NIST SP 800-30, guidance for risk assessments
   4. D.NIST SP 800-61, incident-response recommendations

   Explanation: NIST SP 800-53 Revision 5 states, "This publication provides a catalog of security and privacy controls for information systems and organizations" A: 800-53 provides the control catalog. B: 800-37 organizes risk management and authorization. C: 800-30 addresses risk assessment. D: 800-61 addresses incident response rather than the control catalog.

   Reference: NIST SP 800-53 Revision 5 — Abstract

8. 8Under FIPS 199, which criterion should drive an information type's security category?

   1. A.The amount of storage allocated to hold the information
   2. B.The potential harm from losing confidentiality, integrity, or availabilityCorrect answer: B
   3. C.The number of people who routinely access the information
   4. D.The purchase cost of hardware that processes the information

   Explanation: FIPS PUB 199 states, "The security categories are based on the potential impact on an organization" A: Storage quantity alone does not determine security-loss impact. B: Potential impact on the security objectives drives categorization. C: Headcount alone does not determine impact. D: Hardware price alone does not capture mission, legal, or individual consequences.

   Reference: FIPS PUB 199 — Section 3

9. 9A user selects a password already present in a verifier's compromised-password blocklist. What should the verifier require?

   1. A.Accept the same compromised secret after enforcing an uppercase-character rule
   2. B.Accept the same compromised secret if it satisfies the minimum length
   3. C.Accept the same compromised secret after a successful CAPTCHA
   4. D.Require a different secret and explain why the blocked choice was rejectedCorrect answer: D

   Explanation: NIST SP 800-63B-4 states, "If the chosen password is found on the blocklist, the CSP SHALL require the subscriber to select a different secret and SHALL provide the reason for rejection." A: Composition does not cure known compromise. B: Length does not cure known compromise. C: A CAPTCHA does not make the compromised password safe. D: A blocklist match requires selecting a different secret.

   Reference: NIST SP 800-63B-4 — Password Verifiers / blocklist comparison

10. 10A fraudulent delivery notification arrives by SMS and asks the recipient to enter payment details at a link. What is this social-engineering technique called?

    1. A.SmishingCorrect answer: A
    2. B.Vishing
    3. C.Spear phishing by email
    4. D.Watering-hole attack

    Explanation: CISA Avoiding Social Engineering and Phishing Attacks states, "Smishing is a form of social engineering that exploits SMS, or text, messages." A: Smishing uses SMS text messages for phishing. B: Vishing uses voice communications, which this delivery does not. C: This notification is delivered by SMS rather than email. D: A watering hole compromises a site frequented by selected targets, rather than delivering this SMS lure.

    Reference: CISA Avoiding Social Engineering and Phishing Attacks — What is a smishing attack?