Free HPE Network Security Associate Exam Practice Questions

Sample Practice Questions

Try these 10 sample questions from the HPE Network Security Associate Exam practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1Which description best defines a security vulnerability in an information system?

   1. A.A weakness that a threat source can exploitCorrect answer: A
   2. B.An event that can cause harm to a system
   3. C.The expected impact of a harmful event
   4. D.A control that limits access to a system

   Explanation: NIST defines the term as "Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source." This identifies the correct description.

   Reference: Vulnerability - NIST Computer Security Resource Center — Definitions, first definition

2. 2In the Aruba Central on-premises WIDS Events table, how can an administrator view details for a particular event?

   1. A.Click the arrow against that event's rowCorrect answer: A
   2. B.Select the Rogues tab for the AP summary
   3. C.Change the WIDS Events time-range filter
   4. D.Customize the WIDS Events columns

   Explanation: "To view the details of each event that is generated, click the arrow against each row in the table." Expanding the event row displays its details.

   Reference: RAPIDS — Monitoring IDS WIDS Events

3. 3When preserving network logs as evidence, what concern can comparing original, centralized, and interpreted copies help resolve?

   1. A.Whether copying or interpretation changed the log dataCorrect answer: A
   2. B.Whether unlogged events occurred before logging began
   3. C.Whether a device's clock was accurate before logging
   4. D.How long the system will retain future logs

   Explanation: "collect copies of the original log files, the centralized log files, and interpreted log data, in case there are any questions regarding the fidelity of the copying and interpretation processes." The copies can help resolve questions about fidelity.

   Reference: Guide to Integrating Forensic Techniques into Incident Response — Network Traffic, Preservation of Original Logs

4. 4Which characteristic makes a denial-of-service attack a distributed attack?

   1. A.Attack traffic originates from many hostsCorrect answer: A
   2. B.Attack traffic originates from a single host
   3. C.The attack affects many targets but uses one host
   4. D.The attack runs repeatedly from one host

   Explanation: NIST defines the term as "A denial of service technique that uses numerous hosts to perform the attack." This identifies the correct description.

   Reference: DDoS - NIST Computer Security Resource Center — Definitions, first definition

5. 5What does the Detect Valid SSID Misuse option detect?

   1. A.Fake AP beacons flooding a wireless network
   2. B.Interfering or neighboring APs using a protected SSIDCorrect answer: B
   3. C.An AP beacon advertising the wrong channel
   4. D.Weak or repeating WEP initialization vectors

   Explanation: "Detect Valid SSID Misuse—Enables detection of interfering or neighbor APs using valid or protected SSIDs" The option detects use of valid or protected SSIDs by neighboring or interfering APs.

   Reference: Configuring IDS Parameters on Access Points — Infrastructure Detection

6. 6What does NIST recommend using to verify the integrity of log files acquired during forensic activity?

   1. A.Compare the log's filename before and after collection
   2. B.Compare a message digest of the acquired dataCorrect answer: B
   3. C.Compare the display order of log entries
   4. D.Compare the location of the log file in a directory

   Explanation: "Message digests should be used to ensure the integrity of all data that is acquired during forensic activity, including log files and logical backups." A digest supports integrity checking.

   Reference: Guide to Integrating Forensic Techniques into Incident Response — Data Collection, Message Digests

7. 7An attacker places itself between two communicating parties to intercept or alter their traffic. Which attack does this describe?

   1. A.A man-in-the-middle attackCorrect answer: A
   2. B.A distributed denial-of-service attack
   3. C.A zero-day attack
   4. D.A password spraying attack

   Explanation: NIST defines the term as "An attack in which an attacker is positioned between two communicating parties in order to intercept and/or alter data traveling between them." This identifies the correct description.

   Reference: Man-in-the-middle attack - NIST Computer Security Resource Center — Definitions, first definition

8. 8After an administrator manually acknowledges an Aruba Central on-premises alert, what happens to its event count data?

   1. A.The count is reset to zero immediately
   2. B.The count is deleted and no more events are collected
   3. C.The count is retained and event aggregation continuesCorrect answer: C
   4. D.The count is archived and can never trigger another alert

   Explanation: "As manually acknowledging an alert does not reset the count data, the alert service continues to aggregate events." Acknowledgement does not reset the count.

   Reference: Viewing Alerts in List View — Viewing Alerts in List View

9. 9What should a chain-of-custody log record for physical evidence?

   1. A.Custodians and evidence location without handling times
   2. B.Transfer times and device details without custodian names
   3. C.Each custodian, their actions, and the timesCorrect answer: C
   4. D.The manufacturer and asset owner for each device

   Explanation: "keeping a log of every person who had physical custody of the evidence, documenting the actions that they performed on the evidence and at what time" The record documents custody and handling actions.

   Reference: Guide to Integrating Forensic Techniques into Incident Response — Data Collection, Chain of Custody

10. 10An attacker tries to gain system access by posing as an authorized user. What type of attack is this?

    1. A.A distributed denial-of-service attack
    2. B.A zero-day attack
    3. C.A password spraying attack
    4. D.A spoofing attackCorrect answer: D

    Explanation: NIST defines this attack as "An attempt to gain access to a system by posing as an authorized user." The defining feature is reflected in the correct option.

    Reference: Spoofing - NIST Computer Security Resource Center — Definitions, first definition