WGU Network Engineering and Security Foundation Network and Security Foundation (D315) Exam Questions

Page: 1 / 14
Total 62 questions
Question 1

A computer network has software that tracks successful and unsuccessful connection attempts to the network in order to better identify attacks.

Which network security concept does this scenario address?



Answer : A

Accounting (also known as auditing or logging) is a network security concept that tracks user activities, including successful and failed authentication attempts, system changes, and resource access. This helps in detecting and mitigating security breaches.

Authentication verifies user identity but does not track activity.

Availability ensures systems remain operational.

Authorization controls user permissions but does not log activities.


Question 2

Which layer of the OSI model includes HTTP?



Answer : A

The Application layer (Layer 7 of the OSI model) includes Hypertext Transfer Protocol (HTTP), which is used for web communication. This layer provides network services directly to applications and users.

Network layer deals with IP addressing and packet routing.

Session layer manages connections but does not include HTTP.

Transport layer ensures reliable data transmission but does not handle application protocols.


Question 3

An attacker uses a poisoned domain name on the domain name server to navigate users to the attacker's site.

Which malicious attack strategy is represented in the scenario?



Answer : A

Pharming is an attack that manipulates the Domain Name System (DNS) to redirect users to fraudulent websites without their knowledge. Attackers poison DNS records or compromise routers to reroute traffic to malicious sites designed to steal information.

Brute-force attack involves password guessing, not domain manipulation.

IP address spoofing disguises a device's identity but does not alter DNS records.

Session hijacking takes over active user sessions but does not redirect websites.


Question 4

An organization is updating its information security policies in order to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA).

What should this organization expect to be required under this legislation?



Answer : A

PIPEDA requires businesses in Canada to protect personal information through security measures and proper disposal practices. This includes secure deletion of personal data when no longer needed to prevent unauthorized access.

Compensating individuals for data sales is not a legal requirement.

Notifying individuals of each data access is unnecessary unless required by a breach.

Disclosing security software is not mandated by PIPEDA.


Question 5

A company is specifically worried about buffer overflow attacks.

Which strategy should be used as a mitigation against this type of attack?



Answer : A

Detecting code vulnerabilities through regular security audits, code reviews, and static analysis tools helps prevent buffer overflow attacks. Developers should implement bounds checking, memory-safe programming languages, and input validation to mitigate risks.

Disabling caching does not prevent buffer overflow attacks.

Server-side validation helps with input security but does not directly address buffer overflows.

Intrusion protection software may detect attacks but does not prevent vulnerabilities in code.


Question 6

An organization does not have controls in place to limit employee access to sensitive customer data.

What is a component of the CIA triad that is violated?



Answer : A

Confidentiality ensures that only authorized users have access to sensitive information. Without proper access controls, employees may be able to view or modify sensitive data without proper authorization, leading to a confidentiality breach.

Integrity involves protecting data from unauthorized modifications.

Availability ensures that systems remain operational.

Interpretation is not part of the CIA triad.


Question 7

An attacker uses a list of commonly used access credentials to attempt to gain access to an online account.

Which malicious attack strategy is represented in the scenario?



Answer : B

A dictionary attack is a password-cracking method that systematically tries common words, phrases, and predictable passwords (e.g., 'password123', 'admin2024') to gain access to an account. Attackers often compile large lists of weak or reused passwords.

Phishing tricks users into revealing passwords but does not systematically test multiple words.

Credential stuffing uses breached passwords rather than guessing from a list.

Social engineering manipulates users but does not rely on automated password attempts.


Page:    1 / 14   
Total 62 questions