ISC2 CISSP-ISSAP Practice Questions with Explanations

Correct answer: D

The usage gap specifically measures the difference between the total potential market size (what could theoretically be consumed) and the actual current consumption by all consumers in that market. This identifies untapped market opportunity due to underutilization of products or services that exist.

Why the other options are wrong:

• A. Project gap refers to the difference between forecasted and actual results, not market potential versus actual usage.
• B. Product gap measures the difference between existing products and desired products, not market potential.
• C. Competitive gap refers to the difference between competitors' performance and a company's own performance.

Correct answer: B

Packet filtering is the core firewall technique that examines individual packets and allows or blocks them based on predefined rules (source/destination IP, port numbers, protocols). It operates at the network layer to control traffic crossing the firewall.

Why the other options are wrong:

• A. Hacking is unauthorized access to systems, not a firewall security method.
• C. Web caching improves performance by storing web content locally, unrelated to firewall packet control.
• D. Spoofing is a type of attack where attackers falsify source addresses, not a firewall filtering method.

Correct answer: A

PGP (Pretty Good Privacy) is specifically designed for encrypting emails and is the standard choice for email encryption. It provides both encryption and digital signatures for email messages.

Why the other options are wrong:

• B. PPTP is a tunneling protocol for VPN connections, not email encryption.
• C. IPSec operates at the network layer for VPN tunnels, not at the application layer for email.
• D. NTFS is a file system format, completely unrelated to email encryption.

Correct answer: A

IPSec is the standard encryption protocol used with L2TP to provide security for VPN connections over the Internet. L2TP handles tunneling while IPSec encrypts the data traveling through that tunnel.

Why the other options are wrong:

• B. MPPE is associated with PPTP, not L2TP, though it provides encryption.
• C. PGP is for email encryption, not for VPN tunnel encryption.
• D. DES is an encryption algorithm but not a protocol; IPSec is the proper protocol choice for L2TP security.

Correct answer: D

IGMP (Internet Group Management Protocol) is specifically designed to manage IP multicast group membership. It allows devices to join and leave multicast groups and enables routers to identify which devices want to receive multicast traffic.

Why the other options are wrong:

• A. ARP (Address Resolution Protocol) maps IP addresses to MAC addresses, not related to multicast.
• B. ICMP is for error reporting and diagnostics (ping, tracert), not multicast messaging.
• C. TCP is a unicast protocol providing reliable point-to-point communication, not multicast.

Correct answer: D

A badge is a physical security device that serves multiple purposes: it demonstrates authorization, indicates status or accomplishment, symbolizes legitimate employment or student status, and provides a means of identification. It is presented visibly to grant or deny access.

Why the other options are wrong:

• A. A sensor detects physical phenomena like motion or temperature, not a credential device.
• B. An alarm alerts to security events but does not serve as a credential or identification device.
• C. A motion detector senses movement but does not function as identification or authorization credential.

Correct answer: A

A cipher is precisely defined as a method for transforming plaintext into masked/encrypted form and then reversing that transformation to recover the original message. This is the fundamental definition of encryption and decryption.

Why the other options are wrong:

• B. CrypTool is a software application for cryptography education and analysis, not the method itself.
• C. Steganography hides information within other data (like images) rather than transforming messages through encryption.
• D. MIME is a standard for encoding email messages and attachments, not for message transformation via encryption.

Correct answer: D

Role-Based Access Control (RBAC) is designed to grant users access only to resources required for their specific role or job function. It restricts access based on assigned roles, ensuring users have only necessary permissions.

Why the other options are wrong:

• A. Policy Access Control is not a standard access control model terminology.
• B. Mandatory Access Control enforces system-wide policies set by administrators with no user discretion.
• C. Discretionary Access Control allows resource owners to decide who gets access, not restricting to role-required resources.

Correct answer: A

Digital signatures are the primary mechanism for authenticating asymmetric keys. A digital signature proves that a message or key was signed by the holder of a private key, establishing authenticity and non-repudiation. The signature is created using the private key and verified using the corresponding public key, making it the standard authentication method for asymmetric cryptography.

Why the other options are wrong:

• B. MAC addresses are hardware identifiers used for local network communication and have no role in asymmetric key authentication.
• C. A demilitarized zone is a network architecture component for security segmentation, not a key authentication method.
• D. Passwords are symmetric secrets used for simple authentication but cannot authenticate asymmetric keys, which require cryptographic proof.

Correct answer: A

This describes a Denial-of-Service (DoS) attack, where an attacker sends a large volume of protocol packets to overwhelm network resources and disrupt communications. By saturating bandwidth or consuming server resources, the attacker prevents legitimate users from accessing services, which is the defining characteristic of a DoS attack.

Why the other options are wrong:

• B. Vulnerability attacks target specific software or system weaknesses, not resource saturation through packet flooding.
• C. Social engineering attacks manipulate people into divulging information or performing actions, unrelated to network packet flooding.
• D. Impersonation attacks involve masquerading as another entity, not sending large volumes of packets to saturate resources.

Correct answer: A

Circuit-level firewalls operate at the Session layer (Layer 5) of the OSI model. They establish and monitor the validity of TCP/IP sessions, making forwarding decisions based on session state rather than individual packets. These firewalls are transparent to end users and provide protection by verifying that sessions are legitimate before allowing traffic through.

Why the other options are wrong:

• B. Application-level firewalls operate at Layer 7 (Application layer), inspecting application data and protocols.
• C. Packet filtering firewalls operate at Layer 3 (Network layer) and sometimes Layer 4 (Transport layer), examining individual packets.
• D. Switch-level firewalls do not represent a standard OSI layer classification and are not recognized as a primary firewall type.

Correct answer: A

Social engineering attacks can circumvent even the strongest physical and logical security mechanisms by exploiting human psychology and trust. Through manipulation, deception, and psychological tactics, attackers can trick authorized personnel into granting access, revealing credentials, or bypassing security controls without triggering any technical security measures.

Why the other options are wrong:

• B. Cross-site scripting (XSS) is a web application vulnerability targeting users in a browser, not a method to bypass physical security.
• C. Mail bombing is a spam-based attack that overwhelms email systems and does not bypass physical or logical security mechanisms.
• D. Password guessing attacks target specific authentication credentials and are limited by security policies, lockouts, and other defenses.

Correct answer: C

A man-trap (also called a mantrap or access control vestibule) is the most effective control for this scenario. It creates a secure physical barrier where only one person can enter at a time, preventing an unauthorized person from following an authorized employee through a door or escaping with equipment. This dual-door security mechanism ensures controlled access and prevents the type of grab-and-run theft that occurred in the breach.

Why the other options are wrong:

• A. Not using laptops is impractical for most organizations and does not address the underlying security need.
• B. Locked doors and guards alone do not prevent a determined individual from running out if they bypass the guard or door is briefly opened.
• D. A sign-in log only creates a record after the fact and provides no physical barrier to prevent someone from grabbing equipment and leaving.

Correct answer: D

A partially meshed topology provides the optimal balance for regional WAN networks by combining elements of both star and fully meshed topologies. It offers redundancy through multiple paths between key sites while avoiding the excessive cost and complexity of a fully meshed network where every site connects to every other site. This approach maximizes performance and reliability while controlling virtual circuits and costs.

Why the other options are wrong:

• A. Bus topology is outdated, lacks redundancy, and is not suitable for WAN regional configurations.
• B. Fully meshed topology, while providing maximum redundancy, is prohibitively expensive and creates unnecessary virtual circuits for regional topologies.
• C. Star topology provides poor redundancy since all traffic flows through a central hub; failure of the center point disrupts the entire network.

Correct answer: C

OCSP (Online Certificate Status Protocol) is a real-time alternative to CRLs that allows immediate verification of certificate validity by querying an OCSP responder. Unlike CRLs which must be downloaded and parsed, OCSP provides instant confirmation of whether a certificate has been revoked, making it more efficient for validating certificate authenticity.

Why the other options are wrong:

• A. RSTP is Rapid Spanning Tree Protocol, a network bridging protocol unrelated to certificate revocation.
• B. SKIP is a key exchange protocol, not a certificate revocation mechanism.
• D. HTTP is a general-purpose transport protocol that does not provide certificate status verification.

Correct answer: D

Non-repudiation is the cryptographic service that proves the sender actually sent a particular message and cannot deny having sent it later. This is typically achieved through digital signatures, which bind the sender's identity to the message content, providing undeniable proof of origin.

Why the other options are wrong:

• A. Integrity ensures data has not been altered but does not prove who sent it.
• B. Confidentiality protects data from unauthorized disclosure but does not prove message origin.
• C. Authentication verifies identity but does not prevent the sender from denying they sent a message.

Correct answer: D

A security token is a hardware device that generates one-time passwords or stores cryptographic credentials and can be combined with a PIN for two-factor authentication. This fulfills the requirement of a hardware device used in tandem with a PIN, making it the cost-effective alternative to smart cards while providing equivalent two-factor authentication.

Why the other options are wrong:

• A. Biometric devices authenticate based on physical characteristics but do not generate codes; they are not typically paired with PINs in the traditional two-factor sense.
• B. One Time Password is a software-based approach, not a hardware device as specified in the requirements.
• C. Proximity cards authenticate presence but typically do not use PIN combinations for two-factor authentication.

Correct answer: D

AES (Advanced Encryption Standard) is a symmetric key block cipher that is modern, secure, and widely adopted for encrypting network traffic. It operates on fixed-size blocks and uses the same key for both encryption and decryption, meeting all the specified requirements.

Why the other options are wrong:

• A. IDEA is a symmetric block cipher but is less commonly used and not the preferred choice for modern network encryption.
• B. PGP is an asymmetric encryption system (public-key cryptography), not a symmetric block cipher.
• C. DES is a symmetric block cipher but is considered cryptographically weak and obsolete for modern security requirements.

Correct answer: A

SSH (Secure Shell) uses public-key cryptography to authenticate remote computers and users, establishing encrypted tunnels for secure remote access. It supports key-based authentication where the server's public key is verified, providing a cryptographically secure mechanism for remote computer authentication.

Why the other options are wrong:

• B. Telnet transmits credentials in cleartext and uses no cryptography for authentication.
• C. SCP (Secure Copy) relies on SSH for its authentication; it is not the protocol itself that performs the authentication.
• D. SSL/TLS uses public-key cryptography for key exchange but typically authenticates servers via certificates rather than using public-key cryptography in the primary authentication step.

Correct answer: D

Confidentiality is the cryptographic service that ensures information remains undisclosed to unauthorized persons on a local network. It protects data from being read or intercepted by preventing unauthorized access to sensitive information through encryption and access controls.

Why the other options are wrong:

• A. Authentication verifies identity but does not protect against disclosure of information.
• B. Non-repudiation proves message origin but does not prevent unauthorized disclosure.
• C. Integrity ensures data has not been altered but does not prevent unauthorized persons from viewing it.

Correct answer: A

Social engineering attacks cannot be prevented by technical measures alone because they exploit human psychology and trust rather than technical vulnerabilities. While firewalls, intrusion detection systems, and other technical controls can mitigate brute force, Smurf DoS, and ping flood attacks, social engineering requires non-technical defenses such as user awareness training, organizational policies, and human vigilance.

Why the other options are wrong:

• B. Brute force attacks can be prevented or mitigated through technical measures like rate limiting and account lockouts.
• C. Smurf DoS attacks can be prevented through technical filtering and proper network configuration.
• D. Ping flood attacks can be prevented using technical controls like rate limiting and firewall rules.

Correct answer: C

Sniffing attacks, where an attacker captures unencrypted network traffic to eavesdrop on communications, can be overcome by applying cryptography. Encryption transforms data into an unreadable format, preventing attackers from understanding intercepted traffic. Web ripping, DoS attacks, and buffer overflows are not directly addressed by cryptography alone, as they involve different attack vectors.

Why the other options are wrong:

• A. Web ripping is prevented through access controls and robots.txt restrictions, not cryptography.
• B. DoS attacks cannot be overcome by cryptography; they require rate limiting and traffic filtering.
• D. Buffer overflow attacks are prevented through secure coding practices and memory protections, not cryptography.

Correct answer: B

Secure RPC (S-RPC) is designed to provide authentication and secure communication for remote procedure calls, helping prevent unauthorized execution of code on remote systems. S-RPC includes authentication mechanisms that verify the identity of callers before executing remote code. TACACS, RADIUS, and CHAP are authentication protocols but are primarily designed for network access authentication rather than preventing unauthorized remote code execution.

Why the other options are wrong:

• A. TACACS is an authentication protocol for network access, not specifically for preventing unauthorized remote code execution.
• C. RADIUS is primarily used for centralized authentication and authorization but does not specifically address remote code execution prevention.
• D. CHAP is a challenge-response authentication protocol for PPP connections and does not prevent unauthorized remote code execution.

Correct answer: D

Diffie-Hellman is a key exchange algorithm that is vulnerable to man-in-the-middle attacks because the basic protocol does not authenticate the participants in the key exchange. An attacker can intercept the exchange and substitute their own values, allowing them to decrypt communications. While Blowfish, Twofish, and RSA may have their own vulnerabilities, Diffie-Hellman is specifically known for this authentication gap in key exchange.

Why the other options are wrong:

• A. Blowfish is a symmetric encryption algorithm and is not primarily used for key exchange.
• B. Twofish is a symmetric block cipher and does not involve the same key exchange vulnerability.
• C. RSA includes authentication in its key exchange mechanism through digital signatures and certificates.

Correct answer: C

A power sag is a sudden, temporary drop in voltage from the power source, typically lasting milliseconds to seconds. Power sags can cause system instability, data loss, and hardware damage. A blackout is a complete loss of power, a power spike is a sudden increase in voltage, and a power surge is a sustained overvoltage. The question specifically asks about a sudden drop, which defines a power sag.

Why the other options are wrong:

• A. A blackout is a complete loss of power, not a drop in voltage.
• B. A power spike is a sudden increase in voltage, not a drop.
• D. A power surge is a sustained overvoltage condition, not a temporary voltage drop.

Correct answer: B

RTO (Recovery Time Objective) is defined as the maximum duration of time and service level within which a business process must be restored after a disaster to avoid unacceptable consequences. It specifies the acceptable downtime for a critical system or process. RCO is not a standard acronym, RPO refers to Recovery Point Objective (data loss tolerance), and RTA is not a recognized disaster recovery metric.

Why the other options are wrong:

• A. RCO is not a standard disaster recovery acronym.
• C. RPO (Recovery Point Objective) measures the maximum acceptable data loss, not the time to restore service.
• D. RTA is not a recognized disaster recovery or business continuity metric.

Correct answer: A

After identification of an incident (in this case, a DOS attack has been identified), the next phase in the incident handling process is Containment. This phase involves stopping the attack, limiting its scope, and preventing further damage. Preparation comes before identification, recovery comes after containment, and identification has already occurred.

Why the other options are wrong:

• B. Preparation occurs before incidents are detected and identified.
• C. Recovery is a later phase that occurs after containment and eradication.
• D. Identification has already been completed; the DOS attack has been identified.

Correct answer: D

A Certificate Server implements PKI and manages public key and private key pairs for secure communication. It issues, stores, and manages digital certificates that enable asymmetric encryption for secure intranet communications. IIS is a web server, VPN is a tunneling protocol, and FTP servers handle file transfer but do not manage certificate pairs.

Why the other options are wrong:

• A. IIS (Microsoft Internet Information Server) is a web server and does not manage public/private key pairs.
• B. VPN is a tunneling technology for secure connections but does not manage certificate infrastructure.
• C. FTP servers transfer files and do not implement public key infrastructure or certificate management.

Correct answer: A

CHAP (Challenge-Handshake Authentication Protocol) uses MD5 hashing to compare calculated values during the authentication process. It sends a challenge and the peer responds with an MD5 hash of the challenge combined with a password, allowing comparison without transmitting the actual password. PEAP, EAP, and EAP-TLS use other authentication mechanisms and do not specifically rely on MD5 hash comparison.

Why the other options are wrong:

• B. PEAP (Protected EAP) uses TLS encryption but does not use MD5 hashing for value comparison.
• C. EAP (Extensible Authentication Protocol) is a framework that supports multiple methods but does not specifically use MD5 comparison.
• D. EAP-TLS uses certificate-based authentication with TLS, not MD5 hash comparison.

Correct answer: C

Cryptography is the technique of modifying messages through encryption and encoding to provide confidentiality, integrity, and authentication, thereby reducing the risk of hacking attacks during internet communications. Risk analysis assesses threats but does not modify messages; OODA loop is a decision-making framework; and firewalls filter traffic but do not modify messages through encoding.

Why the other options are wrong:

• A. Risk analysis identifies and evaluates threats but does not modify messages for security.
• B. OODA loop is a decision-making cycle and does not involve message modification for security.
• D. Firewall security filters and blocks traffic but does not modify messages themselves.

Correct answer: D

Halon 1211 is the halon type found in portable fire extinguishers and stored as a liquid under pressure. It is commonly used in portable extinguishers for Class B and C fires. Halon 1301 is typically used in fixed suppression systems, Halon 11 is not a standard designation, and Halon-f is not a recognized type.

Why the other options are wrong:

• A. Halon-f is not a recognized or standard halon type.
• B. Halon 1301 is used in fixed suppression systems, not portable extinguishers.
• C. Halon 11 is not a standard halon designation used in fire suppression.

Correct answer: C

PAP (Password Authentication Protocol) transmits passwords in clear text without encryption, making it the protocol that should be disabled to ensure password encryption. MSCHAP and MSCHAP v2 both provide encrypted authentication, while SPAP is a Shiva proprietary protocol. To ensure encrypted passwords, PAP must be disabled.

Why the other options are wrong:

• A. SPAP is a proprietary protocol that does encrypt credentials, so it doesn't need to be disabled for encryption.
• B. MSCHAP provides encrypted authentication and is considered secure for remote access.
• D. MSCHAP v2 is an improved version of MSCHAP that provides enhanced security and encrypted authentication.

Correct answer: A

Ring topology is characterized by data traveling in a single direction around a loop, passing through each device sequentially. Each device has exactly two neighbors, and data moves from device to device in a circular path until reaching its destination.

Why the other options are wrong:

• B. Tree topology is a hierarchical structure with a root node and branching, not a single- direction loop.
• C. Star topology has all devices connected to a central hub, with data traveling from device to hub to destination device.
• D. Mesh topology connects multiple devices directly to multiple other devices, not in a single-direction loop.

Correct answer: B

SHA (Secure Hash Algorithm) is a widely used and highly secure cryptographic hashing algorithm. It produces fixed-length hash values and is resistant to collision attacks, making it suitable for secure applications like data integrity verification and digital signatures.

Why the other options are wrong:

• A. AES is an encryption algorithm, not a hashing algorithm.
• C. EAP (Extensible Authentication Protocol) is an authentication framework, not a hashing algorithm.
• D. CRC32 is a checksum algorithm used for error detection, not a cryptographic hash function; it is not secure against intentional manipulation.

Correct answer: A

A man trap (also called a mantrap or sally port) is a physical security device consisting of two doors that create a small enclosed space. When an alarm is activated, both doors lock, trapping a suspect or intruder between the doors in the dead space until authorities arrive.

Why the other options are wrong:

• B. A biometric device is an access control system that verifies identity through biological characteristics, not a physical containment system.
• C. HIDS (Host Intrusion Detection System) is a software-based security tool that monitors a single computer, not a physical security mechanism.
• D. NIDS (Network Intrusion Detection System) is a network-based security tool that monitors network traffic, not a physical containment system.

Correct answer: B

Off-site storage refers to a location geographically separated from the primary computer center where copies of documents and backup media are stored. This provides protection against local disasters such as fires, floods, or theft that could destroy both primary and on-site backup systems.

Why the other options are wrong:

• A. Storage Area Network is a high-speed network storage infrastructure, typically located on-site or in data centers.
• C. On-site storage is located at the same facility as the computer center, not away from it.
• D. Network Attached Storage is a storage device connected to a network for data access and sharing, typically located on-site.

Correct answer: D

Steganography is the technique of hiding secret information within other data or files in a way that the hidden content is not visible or detectable. John embedded a secret file within an image file of Jennifer Lopez, which is the classic definition of steganography-using a carrier medium (the image) to conceal sensitive data.

Why the other options are wrong:

• A. Email spoofing involves forging the sender's email address, which is not what John is doing here.
• B. Social engineering involves manipulating people into divulging confidential information, not embedding data in images.
• C. Web ripping refers to downloading or extracting content from websites, not hiding information within image files.

Correct answer: B

Anomaly-based IDS monitors network traffic and compares it against an established baseline of normal behavior to detect deviations that may indicate intrusions. This approach identifies unusual patterns rather than matching known signatures. Network- based refers to where the IDS operates (on the network), signature-based matches known attack patterns, and file-based is not a standard IDS classification.

Why the other options are wrong:

• A. Network-based describes the location/scope of IDS, not the detection method used.
• C. File-based is not a recognized IDS detection methodology.
• D. Signature-based IDS matches known attack patterns, not baseline deviations.

Correct answer: A

IPSec (Internet Protocol Security) uses the Internet Key Exchange (IKE) protocol to establish and manage security associations (SAs). IKE is the key management protocol specifically designed for IPSec. While ISAKMP is related, it is the framework/standard that IKE is based on, not the protocol that uses IKE. L2TP and LEAP are tunneling/authentication protocols that operate differently.

Why the other options are wrong:

• B. L2TP (Layer 2 Tunneling Protocol) does not use IKE for SA establishment.
• C. LEAP (Lightweight Extensible Authentication Protocol) is an authentication protocol, not one that uses IKE.
• D. ISAKMP is the Internet Security Association and Key Management Protocol framework; IKE is the actual implementation/protocol that implements ISAKMP.

Correct answer: A

Asymmetric encryption is ideal for e-commerce because it does not require customers to have individual pre-shared keys. Using public-key cryptography, the website publishes its public key and customers can encrypt data with it without prior key exchange. This enables secure communication with many users without managing individual keys. Symmetric encryption requires shared secret keys, while S/MIME and PGP are specific implementations requiring additional infrastructure.

Why the other options are wrong:

• B. Symmetric encryption requires both parties to share a secret key beforehand, which is impractical for numerous customers.
• C. S/MIME is an email protocol that still requires key management infrastructure.
• D. PGP requires users to manage their own key pairs and is not a simple solution for typical e-commerce.

Correct answer: C

Cryptography is the technique of modifying messages through encryption and decryption to provide information and cybersecurity, and to reduce the risk of hacking attacks during communications over the Internet. It is the foundational security method for protecting data in transit. Risk analysis is a process, firewall security is network-level protection, and the OODA loop is a decision-making framework, none of which directly address message modification for security.

Why the other options are wrong:

• A. Risk analysis is a methodology for identifying and assessing risks, not a message modification technique.
• B. Firewall security operates at the network perimeter, not on individual messages.
• D. The OODA loop (Observe, Orient, Decide, Act) is a decision-making framework, not a cryptographic technique.

Correct answer: A

Key escrow is the process where a trusted third party (such as a certificate authority) holds a copy of users' private keys or decryption keys. This allows the CA to decrypt data encrypted with the user's public key and create digital signatures on behalf of the user when necessary. Key storage is general safekeeping, key revocation removes compromised keys, and key recovery restores lost keys, none of which match the specific requirement of authorized third-party access.

Why the other options are wrong:

• B. Key storage is the general safeguarding of keys, not the specific process of granting third-party access.
• C. Key revocation is the process of invalidating compromised or expired keys.
• D. Key recovery is the restoration of lost or inaccessible keys, not granting CA access to decrypt data.

Correct answer: D

Electronic Codebook (ECB) mode is the most susceptible to replay attacks because each plaintext block is encrypted in exactly the same way with the same key, producing identical ciphertext for identical plaintext blocks. This deterministic nature makes it vulnerable to pattern analysis and replay attacks, especially when integrity protection is absent. The other modes (CFB, CBC, OFB) use feedback or chaining mechanisms that prevent identical blocks from producing identical ciphertexts.

Why the other options are wrong:

• A. Cipher Feedback mode uses feedback from the previous ciphertext block, preventing identical plaintext blocks from producing identical ciphertext.
• B. Cipher Block Chaining mode chains blocks together, ensuring that identical plaintext blocks produce different ciphertext due to the chaining dependency.
• C. Output Feedback mode uses feedback from the cipher output, preventing deterministic encryption of identical blocks.

Correct answer: B

Key fobs generate time-based or event-based one-time passwords (OTP) that serve as a third authentication factor beyond username and password. They provide a physical token that users must possess, making them ideal for implementing three-factor authentication (something you know + something you have + OTP).

Why the other options are wrong:

• A. Smart cards require specialized card readers and infrastructure, making them less practical for web access than key fobs.
• C. VPN is a network security protocol that encrypts connections but does not add a third authentication factor.
• D. Biometrics can serve as multi-factor authentication but are not typically referred to as a 'third key' and involve different implementation challenges.

Correct answer: A

The Host-to-Host layer in the TCP/IP model corresponds to the Transport layer (Layer 4) of the OSI model. Both handle end-to-end communication, flow control, and protocols like TCP and UDP.

Why the other options are wrong:

• B. The presentation layer handles data formatting and encryption, not host-to-host communication.
• C. The session layer manages dialog control and session establishment, distinct from transport functions.
• D. The application layer (Layer 7) corresponds to the Application layer of TCP/IP, not the Host-to-Host layer.

Correct answer: B

Laptop locks are the most cost-effective physical security measure to prevent theft. They are inexpensive to purchase and deploy, require minimal maintenance, and directly secure the asset without ongoing operational expenses like smart card infrastructure, surveillance systems, or security personnel.

Why the other options are wrong:

• A. Smart card access systems require significant infrastructure investment, card readers, and ongoing administration.
• C. Video surveillance requires extensive camera installation, monitoring systems, and ongoing maintenance; it also doesn't prevent theft, only provides evidence after the fact.
• D. Employing security guards is expensive due to ongoing salary and benefits, making it far less cost-effective than simple laptop locks.

Correct answer: D

CCTV cameras provide visual recording that can be used for both verification of who committed the robbery and historical analysis of the incident. They capture video evidence that can be reviewed to identify perpetrators and understand how the robbery occurred.

Why the other options are wrong:

• A. Key cards control access but do not provide visual evidence or documentation of the actual robbery event.
• B. Biometric devices verify identity but cannot capture video evidence of the robbery or identify attackers.
• C. Intrusion detection systems alert to breaches but do not provide visual evidence or historical analysis of physical attacks on the ATM itself.

Correct answer: C

MD5 produces a 128-bit hash value and is designed for file integrity verification. While MD5 has known cryptographic weaknesses and is not recommended for security-critical applications today, it is the only option listed that produces a 128-bit hash as specified in the requirement.

Why the other options are wrong:

• A. AES is a symmetric encryption algorithm, not a hash algorithm.
• B. SHA (particularly SHA-1 and SHA-256) produces hash values of 160 bits or more, not 128 bits.
• D. DES is a symmetric encryption algorithm, not a hash algorithm.

Correct answer: D

A brownout is a condition where electrical voltage is reduced but power remains available; there is sufficient power on the grid to prevent complete loss, but insufficient power to meet current demand, resulting in lower voltage delivery.

Why the other options are wrong:

• A. A power surge is a brief increase in voltage, not a sustained under-voltage condition.
• B. A power spike is a very brief, high-voltage transient event, not a sustained power shortage.
• C. A blackout is a complete loss of power, whereas a brownout is a reduction in available power.

Correct answer: C

Frame Relay is designed to efficiently handle high-speed data transmission over wide area networks. It uses variable-length frames and statistical multiplexing to provide cost- effective, high-performance WAN connectivity with better efficiency than older protocols.

Why the other options are wrong:

• A. PPP (Point-to-Point Protocol) is designed for point-to-point connections, not efficient high-speed WAN data handling.
• B. X.25 is an older protocol with lower efficiency and higher latency, designed for lower- speed connections.
• D. SLIP (Serial Line Internet Protocol) is an older, simpler protocol used primarily for dial-up connections, not high-speed WAN data.