Absolutely. For your Scale 2 to Scale 3 promotion exam, I’ll keep the questions exam-oriented and cover the common concepts from CIA Triad, network attacks, IDS/IPS, segmentation, Zero Trust, and security best practices. The correct answer is highlighted directly inside the options, as you requested.

Network Security Basics: Promotion Exam MCQs

CIA Triad
What does CIA stand for in information security?

A. Control, Inspection, Authentication
B. Confidentiality, Integrity, Availability ✅
C. Confidentiality, Internet, Access
D. Control, Integrity, Authorization

Which principle ensures that information is accessible only to authorized persons?

A. Confidentiality ✅
B. Integrity
C. Availability
D. Authentication

Which principle ensures that data is not altered without authorization?

A. Confidentiality
B. Integrity ✅
C. Availability
D. Accountability

Which principle ensures that systems and information are available when required?

A. Integrity
B. Confidentiality
C. Availability ✅
D. Authorization

Encryption primarily helps protect which part of the CIA triad?

A. Availability
B. Confidentiality ✅
C. Integrity
D. Performance

A hacker modifies the amount in a banking transaction from ₹10,000 to ₹1,00,000. Which security principle is violated?

A. Confidentiality
B. Integrity ✅
C. Availability
D. Authentication

A DDoS attack makes an internet banking website unavailable. Which CIA principle is mainly affected?

A. Confidentiality
B. Integrity
C. Availability ✅
D. Authentication

An unauthorized person reads confidential customer information. Which principle is violated?

A. Confidentiality ✅
B. Integrity
C. Availability
D. Non-repudiation

Network Threats
What is the main objective of a DDoS attack?

A. Encrypt data
B. Modify database records
C. Make a service unavailable by overwhelming it with traffic ✅
D. Steal passwords directly

DDoS stands for:

A. Direct Denial of Service
B. Distributed Denial of Service ✅
C. Distributed Data Operating System
D. Digital Denial of Security

What is the main difference between DoS and DDoS?

A. DoS attacks only databases
B. DDoS attacks only routers
C. DDoS uses multiple systems to attack a target ✅
D. There is no difference

A collection of compromised computers used to launch a DDoS attack is called:

A. Firewall
B. VLAN
C. Botnet ✅
D. Proxy

In a Man-in-the-Middle attack, the attacker:

A. Deletes the server
B. Secretly intercepts communication between two parties ✅
C. Blocks all network traffic
D. Installs a firewall

Which technology is particularly important for protecting web traffic against interception?

A. FTP
B. HTTPS/TLS ✅
C. Telnet
D. HTTP

In IP spoofing, an attacker:

A. Forges the source IP address ✅
B. Deletes an IP address
C. Changes the DNS server permanently
D. Disables the firewall

Which of the following is an example of spoofing?

A. Increasing bandwidth
B. Pretending to be a trusted system or identity ✅
C. Taking a server backup
D. Installing antivirus

ARP spoofing is mainly associated with:

A. Disk encryption
B. Manipulating IP-to-MAC address mappings on a local network ✅
C. Database backup
D. Password hashing

IDS and IPS
IDS stands for:

A. Internet Detection Service
B. Intrusion Detection System ✅
C. Internal Defense System
D. Information Detection Security

IPS stands for:

A. Internet Protection Service
B. Internal Prevention System
C. Intrusion Prevention System ✅
D. Information Protection Security

What is the primary function of an IDS?

A. Block all traffic
B. Detect suspicious activity and generate alerts ✅
C. Encrypt network traffic
D. Create user accounts

What is the primary function of an IPS?

A. Only monitor traffic
B. Only generate reports
C. Detect and automatically block/prevent malicious activity ✅
D. Take database backups

What is the major difference between IDS and IPS?

A. IDS encrypts; IPS decrypts
B. IDS mainly detects and alerts, while IPS can actively prevent/block ✅
C. IDS is hardware only
D. IPS is used only for email

An IDS is commonly deployed in which mode?

A. Inline blocking mode
B. Passive monitoring/out-of-band mode ✅
C. Offline database mode
D. Backup mode

To automatically block malicious network traffic, which is more appropriate?

A. IDS
B. IPS ✅
C. DNS
D. DHCP

An IPS is commonly placed:

A. Inline with network traffic ✅
B. Only on backup servers
C. Outside the network without seeing traffic
D. Inside a database

Which technique identifies attacks by comparing activity against known attack patterns?

A. Signature-based detection ✅
B. Physical detection
C. Backup-based detection
D. Password detection

Which technique detects suspicious behavior by identifying deviations from normal behavior?

A. Signature-based detection
B. Anomaly-based detection ✅
C. Password-based detection
D. Port-based encryption

In IDS/IPS terminology, a "false positive" means:

A. A real attack is successfully detected
B. Normal activity is incorrectly identified as malicious ✅
C. An attack is missed
D. The IPS blocks an actual attacker

A "false negative" occurs when:

A. Normal traffic is blocked
B. A real attack is not detected ✅
C. An attack is correctly detected
D. The network is segmented

⭐ Remember for Exam

IDS = Detect + Alert
IPS = Detect + Prevent/Block

Secure Network Segmentation
What is network segmentation?

A. Connecting every system to the same network
B. Dividing a network into smaller isolated segments ✅
C. Removing firewalls
D. Increasing internet bandwidth

What is an important security benefit of network segmentation?

A. It removes the need for passwords
B. It limits the spread of an attack between network zones ✅
C. It prevents all malware
D. It automatically encrypts databases

Which technology is commonly used for logical network segmentation?

A. FTP
B. VLAN ✅
C. HTTP
D. SMTP

Why should critical banking servers be separated from general user networks?

A. To increase monitor resolution
B. To reduce unauthorized access and limit lateral movement ✅
C. To reduce password length
D. To eliminate backups

What is a DMZ in network security?

A. Database Management Zone
B. A separate network zone commonly used for public-facing services ✅
C. Data Monitoring Zero
D. Direct Management Zone

Where is a public-facing web server commonly placed?

A. Internal employee LAN
B. Database network
C. DMZ ✅
D. Backup network

Separating web, application and database servers into different security zones is an example of:

A. Spoofing
B. DDoS protection
C. Network segmentation ✅
D. Phishing

What does "lateral movement" mean in cybersecurity?

A. Moving server racks
B. An attacker moving from one compromised system to other systems inside the network ✅
C. Moving data to backup
D. Changing an IP address

Zero Trust
What is the basic principle of Zero Trust security?

A. Trust all internal users
B. Trust all employees
C. Never trust, always verify ✅
D. Block all internet access

In a traditional security model, users inside the corporate network were often considered:

A. More trusted than external users ✅
B. Always attackers
C. Completely blocked
D. Anonymous

Zero Trust assumes that:

A. Everything inside the network is safe
B. No user or device should be automatically trusted based only on network location ✅
C. Only external users are dangerous
D. Firewalls are unnecessary

Which concept is closely related to Zero Trust?

A. Maximum privilege
B. Least privilege ✅
C. No authentication
D. Shared passwords

What does least privilege mean?

A. Give users administrator privileges
B. Give users only the access required to perform their job ✅
C. Give everyone read/write access
D. Remove authentication

Which of the following supports a Zero Trust architecture?

A. Shared passwords
B. Unrestricted internal access
C. MFA and continuous access verification ✅
D. Disabling security logs

In Zero Trust, access decisions can consider:

A. User identity only
B. Device only
C. Location only
D. User identity, device security, context and access policy ✅

Network Security Best Practices
Which is considered a network security best practice?

A. Using default passwords
B. Allowing all ports
C. Applying security patches regularly ✅
D. Disabling logging

What is the purpose of a firewall?

A. Take backups
B. Control network traffic based on security rules ✅
C. Store passwords
D. Manage databases

Which is the strongest practice for administrator accounts?

A. Shared administrator ID
B. Password only
C. MFA with least-privilege access ✅
D. No password

Which protocol is more secure for remote administration?

A. Telnet
B. HTTP
C. SSH ✅
D. FTP

Which protocol should generally be preferred for secure website access?

A. HTTP
B. FTP
C. HTTPS ✅
D. Telnet

Why should unused ports and services be disabled?

A. To increase storage
B. To reduce the attack surface ✅
C. To increase password length
D. To increase CPU utilization

What is meant by "attack surface"?

A. The physical size of a server
B. The possible points through which an attacker can attempt to compromise a system ✅
C. Network bandwidth
D. Backup storage

Which practice helps protect accounts even if a password is stolen?

A. HTTP
B. FTP
C. Multi-Factor Authentication (MFA) ✅
D. DHCP

Security patches should be applied primarily because they:

A. Increase disk capacity
B. Fix known vulnerabilities and security weaknesses ✅
C. Create users
D. Change IP addresses

Which security principle says access should be granted only when necessary?

A. Maximum privilege
B. Least privilege ✅
C. Open access
D. Default access

Scenario-Based Questions

These are important for promotion exams because the question may give you a situation instead of asking the definition directly.

A company's website suddenly receives traffic from thousands of compromised devices and becomes unavailable. What is the most likely attack?

A. MITM
B. Spoofing
C. DDoS ✅
D. SQL backup

An attacker secretly positions himself between a customer and a server and intercepts their communication. This is:

A. DDoS
B. Man-in-the-Middle attack ✅
C. Segmentation
D. Port scanning

An organization wants a system that monitors malicious network traffic but does not automatically block it. Which should it use?

A. IDS ✅
B. IPS
C. DHCP
D. DNS

An organization requires malicious traffic to be automatically detected and blocked. Which should it use?

A. IDS
B. IPS ✅
C. DNS
D. Proxy only

A malware infection occurs in one department, but network controls prevent it from easily reaching critical servers in another zone. Which security concept helped?

A. Spoofing
B. DDoS
C. Network segmentation ✅
D. Phishing

An employee is connected to the organization's internal network but is still required to authenticate and satisfy security checks before accessing an application. This is an example of:

A. Traditional perimeter security
B. DDoS prevention
C. Zero Trust ✅
D. IP spoofing

🔥 Quick Revision Before Exam

⭐ 5 points you should definitely remember

CIA = Confidentiality + Integrity + Availability
IDS = Detect/Alert; IPS = Detect + Prevent/Block
DDoS mainly attacks Availability
Zero Trust = Never Trust, Always Verify
Network segmentation limits lateral movement and reduces the impact of compromise

Questions needs to be prepared

What does the CIA Triad stand for?
Which CIA principle prevents unauthorized access?
What is DDoS?
What is the role of IDS/IPS?

Threats and attacks

SYN flood
UDP flood
ICMP flood
Botnet and zombie systems
IP spoofing
ARP spoofing
DNS spoofing
Email spoofing
HTTPS spoofing
Session hijacking
Wi-Fi eavesdropping
Replay attack
Man-in-the-Browser
Port scanning
Packet sniffing

IDS/IPS

Network-based IDS/IPS
Host-based IDS/IPS
Signature-based detection
Anomaly-based detection
False positive
False negative
Inline and passive deployment
IPS blocking actions
IDS alerting actions
IPS tuning and signature updates
Encrypted traffic limitations
Fail-open and fail-close

Zero Trust

Never trust, always verify
Explicit verification
Least-privilege access
Assume breach
Continuous authentication
Device health and compliance
MFA
Conditional access
Micro-segmentation
Identity as the new security perimeter

Network Security: 100 Promotion Exam MCQs

Part 1: CIA Triad and Security Principles

CIA in information security stands for:

A. Control, Inspection and Authentication
B. Confidentiality, Integrity and Availability ✅
C. Confidentiality, Internet and Access
D. Control, Integrity and Authorization

Preventing unauthorized persons from viewing customer information primarily provides:

A. Confidentiality ✅
B. Integrity
C. Availability
D. Non-repudiation

Which principle ensures information has not been changed without authorization?

A. Availability
B. Integrity ✅
C. Confidentiality
D. Authentication

A server must remain accessible to authorized users when required. This relates to:

A. Integrity
B. Authorization
C. Availability ✅
D. Confidentiality

Encryption primarily protects:

A. Confidentiality ✅
B. Availability
C. Performance
D. Redundancy

Hashing is commonly used to help verify:

A. Availability
B. Integrity ✅
C. Network speed
D. User privilege

A ransomware attack makes important files inaccessible. Which CIA component is most directly affected?

A. Confidentiality
B. Integrity only
C. Availability ✅
D. Authentication

An attacker changes ₹5,000 to ₹50,000 in transaction data. What has been compromised?

A. Availability
B. Integrity ✅
C. Confidentiality
D. Authentication

Confidential Bank information is accidentally emailed to an unauthorized external recipient. What has been compromised?

A. Confidentiality ✅
B. Availability
C. Integrity
D. Performance

A web service is overloaded and legitimate customers cannot access it. Which property is affected?

A. Integrity
B. Confidentiality
C. Availability ✅
D. Non-repudiation

Exam memory:
C = Secret
I = Correct
A = Available

Part 2: DoS, DDoS and Botnets

The Bank promotion material specifically describes DDoS, botnets/zombies and their relationship.

DDoS stands for:

A. Direct Denial of Security
B. Distributed Denial of Service ✅
C. Digital Distribution of Services
D. Distributed Data Security

The main objective of a DDoS attack is generally to:

A. Encrypt passwords
B. Make a service unavailable ✅
C. Create user accounts
D. Improve bandwidth

Which CIA principle is primarily targeted by a DDoS attack?

A. Confidentiality
B. Integrity
C. Availability ✅
D. Non-repudiation

A major difference between DoS and DDoS is:

A. DoS is always harmless
B. DDoS uses multiple systems to attack the target ✅
C. DDoS cannot attack websites
D. DoS uses encryption

Multiple compromised machines controlled by an attacker are collectively known as:

A. VLAN
B. Botnet ✅
C. DMZ
D. Firewall

A compromised machine participating in a botnet may be called a:

A. Switch
B. Proxy
C. Zombie ✅
D. Gateway

A customer-facing website receives enormous amounts of malicious traffic from thousands of different systems and becomes unavailable. This is most likely:

A. MITM
B. ARP spoofing
C. DDoS ✅
D. Phishing

Which is commonly associated with launching large DDoS attacks?

A. VLAN
B. VPN
C. Botnet ✅
D. DHCP

The owner of a zombie system:

A. Must always know the computer is compromised
B. May be unaware that the system is being controlled ✅
C. Is necessarily the attacker
D. Must be a system administrator

The attacker infrastructure used to issue instructions to compromised botnet machines is commonly called:

A. DNS
B. Command and Control (C2/C&C) ✅
C. VLAN
D. DMZ

Part 3: Man-in-the-Middle and Spoofing

Bank promotion material specifically discusses MITM and types/related techniques such as IP spoofing, DNS spoofing, HTTPS spoofing, email hijacking/spoofing and Wi-Fi eavesdropping.

In a Man-in-the-Middle attack, the attacker:

A. Takes the server offline
B. Intercepts communication between two parties ✅
C. Deletes a firewall
D. Creates backups

MITM is especially dangerous because an attacker may:

A. Only increase bandwidth
B. Eavesdrop on or manipulate communications ✅
C. Physically destroy the network
D. Automatically take backups

Which technology helps protect web communications against interception and tampering?

A. HTTP
B. Telnet
C. HTTPS/TLS ✅
D. FTP

IP spoofing involves:

A. Faking the source IP address ✅
B. Encrypting an IP address
C. Deleting an IP address
D. Blocking DHCP

DNS spoofing can cause a user to:

A. Receive additional RAM
B. Be redirected toward a fraudulent destination/site ✅
C. Increase internet speed
D. Encrypt a hard drive

ARP spoofing involves manipulation of:

A. Username/password mappings
B. IP-to-MAC address mappings ✅
C. File permissions
D. Database tables

An attacker creates a Wi-Fi hotspot designed to intercept users' communications. This may enable:

A. Backup processing
B. Wi-Fi eavesdropping/MITM ✅
C. Database normalization
D. Network patching

An attacker sends an email that appears to originate from a trusted organization. This is:

A. Segmentation
B. Email spoofing ✅
C. DDoS
D. VLAN tagging

An attacker redirects users to a fake banking website by manipulating name resolution. Which attack is most relevant?

A. DDoS
B. DNS spoofing ✅
C. Disk failure
D. SQL backup

A Man-in-the-Browser attack commonly involves:

A. Firewall hardware
B. Malware/Trojan manipulating browser communications ✅
C. VLAN configuration
D. Server backup

Part 4: IDS and IPS

The Bank's SOP Trend Micro IPS Intrusion Prevention System.pdf describes the IPS as an inline active device through which traffic passes, capable of denying malicious traffic and sending alerts.

IDS stands for:

A. Intrusion Detection System ✅
B. Internet Defense Service
C. Internal Data Security
D. Intrusion Distribution Service

IPS stands for:

A. Internet Protection System
B. Intrusion Prevention System ✅
C. Internal Privacy Service
D. Internet Prevention Service

The primary function of IDS is to:

A. Detect suspicious activity and generate alerts ✅
B. Format hard disks
C. Create VLANs
D. Take backups

The primary advantage of IPS over a purely detection-focused IDS is that IPS can:

A. Only generate reports
B. Automatically take action to block malicious traffic ✅
C. Increase bandwidth
D. Replace authentication

Which statement is correct?

A. IDS and IPS are exactly the same
B. IDS detects/alerts, while IPS can detect and prevent/block ✅
C. IDS blocks everything
D. IPS only monitors logs

An IPS is commonly deployed:

A. Inline with network traffic ✅
B. In a printer
C. Only in offline mode
D. Only in the database

Why is an IPS placed inline?

A. So traffic bypasses it
B. So it can inspect and take action on traffic passing through it ✅
C. To increase disk space
D. To replace DNS

According to the ABC Bank IPS SOP, malicious traffic can be:

A. Ignored
B. Denied ✅
C. Converted to email
D. Backed up

According to the ABC Bank IPS SOP, an alert can be sent to the:

A. DHCP server only
B. Management station ✅
C. Printer
D. Customer browser

An organization wants only monitoring and alerts without an inline blocking function. Which is more appropriate conceptually?

A. IDS ✅
B. IPS
C. DHCP
D. NAT

Part 5: IDS/IPS Detection Techniques

Comparing traffic against known attack patterns is:

A. Signature-based detection ✅
B. Physical detection
C. Manual routing
D. Encryption

Identifying abnormal behavior compared with established normal patterns is:

A. Signature detection
B. Anomaly-based detection ✅
C. Port forwarding
D. NAT

Signature-based IDS/IPS is particularly effective against:

A. Known threats with recognizable signatures ✅
B. Every unknown attack without exception
C. Physical theft
D. Power failure

A potential strength of anomaly-based detection is its ability to:

A. Detect only already-known signatures
B. Identify unusual behavior that could represent an unknown threat ✅
C. Replace firewalls entirely
D. Stop power failures

Normal network activity is incorrectly classified as an attack. This is:

A. False positive ✅
B. False negative
C. True negative only
D. Failover

A genuine attack occurs but the security system fails to detect it. This is:

A. False positive
B. False negative ✅
C. Successful authentication
D. Segmentation

Which is generally more dangerous from the perspective of an undetected actual compromise?

A. False positive
B. False negative ✅
C. Successful detection
D. VLAN

Excessive false positives can cause:

A. Guaranteed improved performance
B. Alert fatigue ✅
C. More storage automatically
D. Stronger encryption automatically

IDS/IPS signatures should be:

A. Disabled permanently
B. Kept updated ✅
C. Deleted after installation
D. Shared publicly

Tuning IDS/IPS policies can help:

A. Remove all network security
B. Improve detection relevance and reduce unnecessary alerts ✅
C. Replace encryption
D. Disable monitoring

Must remember:
False Positive = Innocent traffic called BAD
False Negative = BAD traffic missed

Part 6: Firewall and Network Controls

A firewall primarily:

A. Stores databases
B. Controls traffic based on security rules ✅
C. Replaces backups
D. Creates passwords

A good firewall policy generally follows:

A. Permit everything permanently
B. Allow only required traffic/services ✅
C. Disable logging
D. Open every port

What is the security benefit of closing unused ports?

A. Increased monitor size
B. Reduced attack surface ✅
C. Increased passwords
D. Increased database size

Which device operates mainly at Layer 2 and forwards frames based on MAC addresses?

A. Router
B. Switch ✅
C. IPS only
D. Proxy

A router primarily forwards packets between:

A. Files
B. Networks ✅
C. Passwords
D. Databases

Stateful firewalls maintain information about:

A. Employee salary
B. Active network connections/sessions ✅
C. Disk partitions
D. Database backups

A Web Application Firewall is commonly abbreviated as:

A. WAP
B. WAF ✅
C. WAN
D. WPA

A WAF is specifically designed to help protect:

A. Physical doors
B. Web applications and HTTP/HTTPS traffic ✅
C. Power supplies
D. Printers

A firewall should ideally permit:

A. Every port
B. Only traffic required for legitimate business purposes ✅
C. All external access
D. Anonymous administrator access

Regular review of firewall rules helps identify:

A. Additional RAM
B. Obsolete or unnecessary access rules ✅
C. Employee attendance
D. Printer configurations

Part 7: Network Segmentation

Network segmentation means:

A. Connecting everything without restrictions
B. Dividing a network into separate controlled zones/segments ✅
C. Removing firewalls
D. Disabling authentication

A major objective of segmentation is to:

A. Increase attacker access
B. Limit lateral movement ✅
C. Remove logging
D. Allow every port

VLAN stands for:

A. Virtual Local Area Network ✅
B. Verified Local Access Network
C. Virtual Long Access Node
D. Variable LAN Access Number

VLANs are commonly used to provide:

A. Logical network segmentation ✅
B. Password hashing
C. Disk encryption
D. Database replication

DMZ stands for:

A. Demilitarized Zone ✅
B. Data Management Zone
C. Digital Monitoring Zone
D. Distributed Malware Zone

Which system is commonly located in a DMZ?

A. Highly sensitive internal database directly exposed to the internet
B. Public-facing web server ✅
C. Employee payroll database
D. Internal backup tape

Why shouldn't public-facing servers normally have unrestricted access to internal systems?

A. Because they don't need IP addresses
B. Their compromise could provide attackers a route into internal systems ✅
C. Because servers cannot communicate
D. Because HTTP cannot work

Separating the web server, application server and database into controlled zones provides:

A. Spoofing
B. Defense in depth/segmentation ✅
C. DDoS
D. Phishing

Malware compromises one workstation but cannot freely reach the database network because access between zones is restricted. This demonstrates:

A. DNS spoofing
B. Network segmentation ✅
C. Password reuse
D. DDoS

Micro-segmentation provides:

A. Less granular network controls
B. Fine-grained isolation and access controls between workloads ✅
C. Unrestricted internal access
D. No authentication

Part 8: Zero Trust

The simplest phrase describing Zero Trust is:

A. Trust everyone internally
B. Trust but never verify
C. Never trust, always verify ✅
D. Block every user

Zero Trust assumes:

A. Everyone inside the LAN is automatically safe
B. Network location alone should not establish trust ✅
C. Authentication is unnecessary internally
D. External users are always trustworthy

Which principle strongly supports Zero Trust?

A. Maximum privilege
B. Least privilege ✅
C. Shared passwords
D. Permanent administrator rights

Least privilege means:

A. Provide everyone administrator access
B. Provide only the access necessary to perform required duties ✅
C. Remove passwords
D. Allow all ports

Which authentication mechanism strengthens Zero Trust?

A. Shared password
B. MFA ✅
C. HTTP
D. Telnet

MFA stands for:

A. Multi-Factor Authentication ✅
B. Multiple Firewall Access
C. Managed File Authorization
D. Main Factor Access

Which is compatible with Zero Trust?

A. Authenticate once and trust forever
B. Continuously evaluate access based on appropriate security context ✅
C. Trust all employees automatically
D. Give all authenticated users administrator privileges

Zero Trust security decisions may consider:

A. User identity only
B. Device only
C. Location only
D. Identity, device, location/context, risk and policy ✅

"Assume breach" means:

A. Assume security incidents are impossible
B. Design controls assuming attackers may already gain or attempt access ✅
C. Trust every internal device
D. Disable security alerts

Which combination best represents Zero Trust?

A. Trust internal users + no MFA
B. Shared admin accounts + open network
C. Verify explicitly + least privilege + assume breach ✅
D. Password reuse + unrestricted VLANs

Remember these 3:
Verify explicitly
Least privilege
Assume breach

Part 9: Secure Protocols and Best Practices

Which protocol is preferred over Telnet for secure remote administration?

A. FTP
B. HTTP
C. SSH ✅
D. TFTP

Standard SSH port is:

A. 21
B. 22 ✅
C. 23
D. 80

Standard HTTPS port is:

A. 21
B. 22
C. 80
D. 443 ✅

Which protocol sends web traffic without HTTPS/TLS protection?

A. HTTP ✅
B. HTTPS
C. SSH
D. SFTP

HTTP commonly uses port:

A. 22
B. 80 ✅
C. 443
D. 3389

Telnet commonly uses port:

A. 21
B. 22
C. 23 ✅
D. 443

Why is Telnet generally avoided for sensitive administration?

A. It always requires MFA
B. It does not provide secure encrypted communication like SSH ✅
C. It only works on printers
D. It cannot use TCP

Which is preferred for transferring files securely?

A. FTP
B. SFTP ✅
C. Telnet
D. HTTP

Patch management primarily helps address:

A. Monitor resolution
B. Known software vulnerabilities ✅
C. Physical cable colours
D. Employee attendance

Strong security logging enables organizations to:

A. Hide attacks
B. Detect, investigate and respond to suspicious activity ✅
C. Disable authentication
D. Eliminate backups

Part 10: Promotion Exam Scenario Questions

These are the ones I want you to concentrate on because they test whether you understand the concept rather than memorize the definition.

A security system identifies suspicious traffic and generates an alert, but does not automatically stop the connection. It is most likely functioning as:

A. IDS ✅
B. IPS
C. DHCP
D. DNS

The organization wants malicious network traffic automatically denied before reaching the protected system. Which is most appropriate?

A. IDS only
B. IPS ✅
C. DHCP
D. NTP

An employee clicks a malicious link and the attacker gains access to one PC. Proper segmentation prevents the attacker from freely reaching critical servers. What has segmentation reduced?

A. Authentication
B. Lateral movement ✅
C. Encryption
D. Availability

A user receives what appears to be a legitimate Bank email, but examination shows the sender identity was forged. This is:

A. DDoS
B. Email spoofing ✅
C. Segmentation
D. Botnet

A user types the genuine website name but is redirected to a fraudulent site because name resolution was manipulated. This is:

A. IP fragmentation
B. DNS spoofing ✅
C. DDoS
D. VLAN hopping

Thousands of infected devices simultaneously send traffic to a web application until genuine users cannot connect. This is:

A. MITM
B. Phishing
C. DDoS ✅
D. Network segmentation

An attacker silently intercepts and alters information travelling between two systems. Which attack best fits?

A. DDoS
B. Man-in-the-Middle ✅
C. Port blocking
D. Segmentation

A legitimate application suddenly starts generating network behavior significantly different from its normal baseline. Which method may identify this?

A. Password policy
B. Anomaly-based detection ✅
C. Backup policy
D. VLAN naming

IDS generates an alert for legitimate application traffic. Investigation confirms that no attack occurred. This alert was:

A. False positive ✅
B. False negative
C. True attack
D. DDoS

Malware communication passes through a security control without being detected. This represents:

A. False positive
B. False negative ✅
C. Successful segmentation
D. MFA

🔥 Final Revision Sheet

⭐ 10 answers to memorize for your exam

CIA? → Confidentiality, Integrity, Availability
DDoS mainly affects? → Availability
DDoS uses? → Multiple systems/botnets
MITM? → Intercepts communication between parties
IDS? → Detect + Alert
IPS? → Detect + Prevent/Block
False Positive? → Normal activity wrongly flagged as malicious
False Negative? → Real attack missed
Segmentation? → Limits lateral movement
Zero Trust? → Never trust, always verify

My preparation advice for you

Don't just memorize"IDS detects, IPS blocks." In your Scale 2 → Scale 3 exam, if you see a situation like:

"A security device is placed inline and malicious traffic is denied..."

You should immediately think IPS. The Bank's IPS SOP itself describes the device as inline, with traffic passing through it and malicious traffic being denied.

Similarly:

Website down due to traffic from thousands of machines → DDoS
Communication intercepted → MITM
Fake source address/identity → Spoofing
User redirected using manipulated DNS → DNS Spoofing
One compromised machine cannot reach other zones → Segmentation
Internal employee still must prove identity/device trust → Zero Trust