Free PCES – Certified Entry-Level Security Specialist with Python Practice Questions

Sample Practice Questions

Try these 10 sample questions from the PCES – Certified Entry-Level Security Specialist with Python practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1Which security objective is violated when an unauthorized person reads a confidential customer file?

   1. A. Availability
   2. B. Confidentiality
   3. C. Accountability
   4. D. Integrity

   Answer: B

   Explanation: FIPS 199 states, "A loss of confidentiality is the unauthorized disclosure of information." Reading the restricted file exposes its contents to an unauthorized person; no modification or service outage is required.

   Reference: Standards for Security Categorization of Federal Information and Information Systems (FIPS 199) — Security Objectives, p. 2, Confidentiality

2. 2A firewall uses a deny-by-default inbound ruleset. How is an incoming connection handled if no rule expressly permits it?

   1. A. It is allowed if the source claims to be an internal administrator
   2. B. It is allowed until an intrusion detection alert is generated
   3. C. It is forwarded with a warning attached to the packet
   4. D. It is denied by the firewall

   Answer: D

   Explanation: NIST explains that deny-by-default rulesets mean "the firewalls deny all incoming traffic that is not expressly permitted." A claimed identity, absent IDS alert, or warning does not create a permitting firewall rule.

   Reference: Guide to Malware Incident Prevention and Handling for Desktops and Laptops (SP 800-83 Rev. 1) — Section 3.4.3, Firewalls

3. 3A junior analyst has written permission to scan a specified test subnet. The analyst discovers a related production subnet outside that permission. What is required before including production in the scan?

   1. A. A successful ping from any address in production
   2. B. A slower scan rate that avoids triggering alerts
   3. C. Confirmation that the same organization owns both subnets
   4. D. Written authorization covering the additional targets and activities

   Answer: D

   Explanation: The syllabus emphasizes "obtaining written permission before scanning." Existing permission covers the specified test subnet. Reachability, scan speed, and common ownership do not extend the authorization to production.

   Reference: PCES-30-01 Exam Syllabus — Objective 3.1.1, authorized testing

4. 4What makes Pylint a static analysis tool rather than a runtime security monitor?

   1. A. It observes application behavior while the program handles live requests
   2. B. It analyzes Python source without actually executing the program
   3. C. It requires a production incident trace before analyzing Python code
   4. D. It evaluates operating-system events instead of examining Python source

   Answer: B

   Explanation: Pylint states, "Pylint analyses your code without actually running it." Static source analysis does not require a live execution or production incident trace and differs from evaluating operating-system event logs.

   Reference: Pylint Documentation — What Is Pylint? — What is Pylint?

5. 5A stored payment amount is changed without authorization. Which CIA objective directly addresses this alteration?

   1. A. Preventing unauthorized disclosure of information
   2. B. Providing timely and reliable access to information
   3. C. Preventing unauthorized modification of information
   4. D. Tracing actions uniquely to the responsible entity

   Answer: C

   Explanation: FIPS 199 states, "A loss of integrity is the unauthorized modification or destruction of information." The changed payment amount is an unauthorized modification, even if the file remains accessible.

   Reference: Standards for Security Categorization of Federal Information and Information Systems (FIPS 199) — Security Objectives, p. 2, Integrity

6. 6What distinguishes intrusion prevention from intrusion detection in the basic roles described by NIST?

   1. A. IPS can attempt to block malicious activity; IDS identifies activity and alerts
   2. B. IDS attempts to block malicious activity; IPS only records alerts for later review
   3. C. Both systems are limited to alerts and neither can attempt to stop malicious activity
   4. D. The systems differ only in installation location, not in whether they attempt blocking

   Answer: A

   Explanation: NIST states that "IPSs can attempt to stop malicious activity, whereas IDSs cannot." The distinction is prevention capability in addition to detection. Reversing the roles, limiting both to alerts, or reducing the difference to deployment location misstates those basic roles.

   Reference: Guide to Malware Incident Prevention and Handling for Desktops and Laptops (SP 800-83 Rev. 1) — Section 3.4.2, footnote 9

7. 7In an authorized TCP check, sock.connect_ex((host, port)) returns 0. What does this result mean?

   1. A. The connection operation succeeded
   2. B. The service is confirmed free of vulnerabilities
   3. C. The remote application returned an empty banner
   4. D. The connection was rejected by the remote host

   Answer: A

   Explanation: Python documents connect_ex(): "The error indicator is 0 if the operation succeeded". A successful connection indicates that the TCP connection was established; it does not certify application security or specify the banner contents.

   Reference: Python 3.13 Documentation: socket — Low-level Networking Interface — Socket Objects — connect_ex(address)

8. 8In a Python sqlite3 application, which approach safely supplies a user's name as a data value in a SELECT query?

   1. A. Insert the name into SQL with an f-string
   2. B. Concatenate the name between manually added SQL quotes
   3. C. Apply HTML escaping to the name before SQL concatenation
   4. D. Use an SQL placeholder and pass the name separately as a bound parameter

   Answer: D

   Explanation: Python directs developers to "Always use placeholders instead of string formatting to bind Python values to SQL statements". Parameter binding keeps the supplied name a data value. Concatenation and f-strings assemble SQL text, and HTML escaping is not SQL parameterization.

   Reference: Python 3.13 Documentation: sqlite3 — DB-API 2.0 Interface for SQLite Databases — Tutorial — binding values and avoiding SQL injection

9. 9Which security objective concerns authorized users being able to retrieve information reliably when needed?

   1. A. Integrity
   2. B. Authenticity
   3. C. Confidentiality
   4. D. Availability

   Answer: D

   Explanation: FIPS 199 defines availability as "Ensuring timely and reliable access to and use of information". The question concerns access when needed, rather than secrecy, origin, or alteration.

   Reference: Standards for Security Categorization of Federal Information and Information Systems (FIPS 199) — Security Objectives, p. 2, Availability

10. 10A reporting task needs to read one application log and write a summary file. Which permission assignment follows least privilege?

    1. A. Administrator rights over all application servers
    2. B. Read access to the required log and write access to the summary destination
    3. C. Write access to the source log and read access to all employee files
    4. D. A shared root account used by every reporting task

    Answer: B

    Explanation: NIST states that "each task, process, or user is granted the minimum rights required to perform its job." The stated read and write permissions satisfy the task without granting unrelated access or administrator control.

    Reference: Guide to General Server Security (SP 800-123) — Section 2.4, Least Privilege