Network Security Foundations and Threat Landscape

Introduction

Network security is the discipline of protecting networked systems, communications, services, and information from unauthorized access, misuse, disruption, modification, and destruction. It combines technical controls—such as cryptography, authentication, segmentation, secure protocols, and monitoring—with governance, risk management, human factors, and incident response.

Modern organizations operate interconnected environments that include data centres, cloud platforms, mobile devices, operational technology, Internet of Things devices, software-as-a-service applications, and third-party connections. This connectivity creates business value but also expands the number of pathways through which an attacker may reach sensitive assets. Network security therefore cannot be reduced to installing a firewall. It is a continuing process of identifying assets and threats, reducing exposure, detecting abnormal activity, responding to incidents, and restoring trustworthy operations.

This chapter establishes the conceptual foundation for later study of cryptography, secure network architecture, identity management, intrusion detection, cloud security, and incident response.

Learning Objectives

After completing this chapter, the learner should be able to:

1. Explain confidentiality, integrity, availability, authenticity, accountability, and non-repudiation.

2. Analyse trust boundaries and attack surfaces in networked environments.

3. Relate security controls to the OSI and TCP/IP models.

4. Distinguish major threat actors, motivations, capabilities, and resources.

5. Explain malware categories and common social-engineering techniques.

6. Apply an attack-lifecycle model to a realistic incident.

7. Evaluate contemporary cyber-risk trends and their governance implications.

8. Recommend foundational security practices for organizations.

1. The Security Objectives of Networked Systems

1.1 The CIA triad

The CIA triad is the central model for information security.

Confidentiality means that information is disclosed only to authorized subjects. Encryption, access control, data classification, network segmentation, and secure key management support confidentiality. A confidentiality failure may occur when an attacker steals credentials, intercepts unencrypted traffic, or accesses a database through excessive privileges.

Integrity means that information and systems remain accurate, complete, and protected from unauthorized alteration. Hashes, digital signatures, authenticated protocols, write controls, versioning, and integrity-monitoring tools support integrity. Integrity is concerned not only with data but also with configuration, software, logs, and commands. An attacker who changes a payroll file or modifies routing rules creates an integrity failure even if no information is disclosed.

Availability means that authorized users can access systems and information when required. Redundancy, capacity planning, backups, patching, resilient architecture, denial-of-service protection, and disaster recovery contribute to availability. Availability has a business context: a system may be technically online yet unavailable to its intended users because of congestion, authentication failure, or insufficient capacity.

The three objectives can conflict. Strong encryption may increase processing overhead; extensive inspection may reduce performance; and strict access controls may impede legitimate emergency work. Security engineering therefore seeks an acceptable balance based on risk, business requirements, legal duties, and service-level expectations.

1.2 Authenticity, accountability, and non-repudiation

Authenticity is confidence that an entity, message, device, or service is genuine. Authentication establishes identity, while authorization determines what an authenticated subject may do. Passwords, certificates, hardware tokens, biometrics, and multifactor authentication are authentication mechanisms. A message can also be authenticated through a message authentication code or digital signature.

Accountability is the ability to associate actions with responsible identities or processes. It depends on unique accounts, reliable time synchronization, tamper-resistant logging, access reviews, and monitoring. Shared administrator accounts weaken accountability because an event cannot be confidently attributed to one person.

Non-repudiation provides evidence that can support the claim that a particular party performed an action or approved a message, so that the party cannot credibly deny it later. Digital signatures can provide strong technical evidence when private keys are controlled and certificate validity is established. However, non-repudiation is not created by a signature algorithm alone. Legal rules, identity assurance, key custody, system records, and procedural controls determine whether evidence is acceptable in a particular jurisdiction.

These properties are related but not identical. A password may authenticate a user but provide weak non-repudiation if it could have been shared. A log may support accountability but be unreliable if administrators can alter it. A digitally signed message may have integrity and origin authentication without proving that the person who controlled the signing key was acting voluntarily.

1.3 Additional security properties

Security requirements often include:

• Authorization: enforcement of permitted actions after identity or service verification.
• Traceability: ability to reconstruct events across systems and time.
• Privacy: appropriate control over the collection, use, disclosure, and retention of personal information.
• Resilience: ability to absorb disruption and continue or rapidly restore essential services.
• Safety: protection of people and the physical environment, especially in industrial and medical systems.

A useful requirements analysis identifies the assets, stakeholders, harm scenarios, and required properties rather than assuming that every system has the same priority order.

2. Trust Boundaries and Attack Surfaces

2.1 Trust boundaries

A trust boundary is a logical or physical transition across which security assumptions change. Examples include the boundary between the public Internet and a corporate network, between a user workstation and a server, between a production network and an administration network, and between an organization and a cloud or software supplier.

Crossing a trust boundary should require explicit validation. A secure design does not assume that internal traffic is trustworthy merely because it originates inside a perimeter. This principle is reflected in zero-trust architectures, which continuously evaluate identity, device state, requested resource, context, and policy.

Trust is not binary in practice. A service may be trusted to provide availability but not trusted to handle sensitive data. A device may be authenticated but considered high risk because it is unpatched. Trust decisions should therefore be specific to an action, resource, time, and context.

2.2 Attack surface

The attack surface is the collection of points through which an unauthorized party might influence, access, or disrupt a system. It includes:

• Internet-facing hosts, ports, APIs, and web applications;
• user accounts, credentials, remote-access services, and administrative interfaces;
• endpoints, mobile devices, wireless networks, and removable media;
• cloud identities, storage buckets, application programming interfaces, and management planes;
• software dependencies, supply-chain relationships, and third-party connections;
• physical facilities and social processes such as help-desk password resets.

Attack surface is dynamic. New software releases, temporary firewall rules, exposed development systems, mergers, remote workers, and newly discovered vulnerabilities can change it rapidly. Attack-surface management should therefore combine asset inventory, vulnerability assessment, configuration monitoring, external exposure discovery, and ownership information.

2.3 Threat, vulnerability, exploit, and risk

A threat is a potential cause of harm. A vulnerability is a weakness that can be exploited. An exploit is a method, code, or action that takes advantage of a vulnerability. Risk is the possibility of loss or adverse impact resulting from a threat exploiting a vulnerability in a particular context.

Risk is often communicated using the conceptual relationship:

Risk = likelihood × impact

This is not a universal physical law or a precise probability equation. It is a risk-analysis model. Likelihood may incorporate threat capability, exposure, exploitability, and control effectiveness; impact may include financial, operational, legal, safety, privacy, and reputational consequences. Organizations should define their scales and assumptions before multiplying scores. Numerical scores should not create false precision.

Controls may be preventive, detective, corrective, deterrent, or compensating. For example, multifactor authentication is primarily preventive; security monitoring is detective; backups are corrective; warning banners may be deterrent; and a restricted network path may compensate for a legacy system that cannot support modern authentication.

3. Security Across the OSI and TCP/IP Models

Layered models help engineers identify where a control operates and what it can and cannot protect. They are conceptual tools rather than exact descriptions of every modern protocol stack.

3.1 Physical and data-link concerns

At the physical layer, threats include cable tapping, equipment theft, electromagnetic interference, and environmental damage. Controls include restricted facilities, locked cabinets, surveillance, redundant power, and environmental safeguards.

At the data-link layer, threats include rogue wireless access points, address-resolution manipulation, switch attacks, and unauthorized access to local segments. Controls include secure wireless authentication, network access control, switch configuration hardening, segmentation, port security, and monitoring of abnormal local traffic.

3.2 Network and transport concerns

At the network layer, routing manipulation, address spoofing, scanning, and denial-of-service attacks are important concerns. Firewalls, routing protections, filtering, anti-spoofing controls, and network monitoring operate here.

At the transport layer, attackers may exploit exposed services, weak session handling, or resource exhaustion. Stateful firewalls, rate limiting, secure service configurations, and transport encryption help reduce risk.

3.3 Session, presentation, and application concerns

Although the traditional OSI layers are useful for analysis, many security failures occur at the application layer. Examples include injection, broken access control, insecure deserialization, vulnerable dependencies, poor input validation, and insecure API design. Secure software development, code review, application testing, strong authorization, and secure defaults are essential.

Transport Layer Security (TLS) can protect confidentiality and integrity of communications between endpoints, but it does not automatically make endpoints trustworthy. A compromised endpoint can read information before encryption or after decryption. Similarly, a firewall may block an unwanted connection but cannot correct malicious activity conducted through an authorized application channel.

3.4 The TCP/IP perspective

The TCP/IP model commonly groups functions into link, Internet, transport, and application layers. Internet Protocol provides addressing and routing but does not by itself guarantee confidentiality, integrity, or authentication. These properties must be supplied by additional mechanisms such as IPsec, TLS, secure shell, application-layer authentication, or cryptographic protocols.

Security controls should be selected according to the threat and the protected asset. Encrypting a link may protect traffic on one network segment but not after it leaves that segment. Application-level authorization may protect a business function even when the network path is already trusted. Defence in depth uses complementary controls at multiple layers so that failure of one control does not expose the entire system.

4. Threat Actors and Motivations

Threat actors differ in goals, resources, persistence, legal status, and tolerance for detection. Categories overlap, and attribution is difficult; labels should be treated as analytical hypotheses rather than assumptions.

• Cybercriminals generally seek financial gain through fraud, credential theft, ransomware, extortion, or sale of stolen data.
• Nation-state and state-sponsored groups may pursue espionage, strategic influence, military advantage, intellectual-property theft, or preparation for disruption.
• Insiders may be malicious, negligent, coerced, or compromised. They often possess legitimate access that bypasses perimeter controls.
• Hacktivists use cyber operations to promote political or social causes, commonly through defacement, data disclosure, or denial of service.
• Terrorist and extremist groups may seek publicity, disruption, or psychological impact, although technical capability varies considerably.
• Competitors or industrial-espionage actors may target trade secrets, business strategies, or research.
• Script users and opportunistic attackers use publicly available tools with limited understanding and may cause substantial damage accidentally.
• Supply-chain actors compromise a vendor, dependency, update mechanism, or service provider to reach downstream victims.

A mature threat assessment considers capability, intent, opportunity, access, persistence, and likely impact. It also recognizes that an attacker may outsource parts of an operation, purchase access, or combine social engineering with technical exploitation.

5. Malware and Malicious Techniques

Malware is software or code designed to perform unauthorized or harmful actions. Important categories include:

• Virus: code that attaches to a host file or program and typically requires execution of the host to spread.
• Worm: self-propagating malware that spreads across systems or networks, often by exploiting vulnerable services.
• Trojan: malicious software presented as legitimate or useful software; it does not require the defining self-replication of a worm.
• Ransomware: malware that denies access to data or systems, commonly to demand payment. Modern campaigns may also steal data and threaten disclosure.
• Spyware: software that covertly collects information.
• Keylogger: a tool that records keystrokes or equivalent input.
• Rootkit: tools intended to conceal malicious presence or maintain privileged access.
• Bot or botnet agent: malware that allows remote control of an infected system as part of a larger collection.
• Remote-access trojan: malware providing covert remote control.
• Wiper: destructive malware intended to erase or corrupt systems rather than provide recoverable extortion.

Malware may use persistence mechanisms, privilege escalation, command-and-control channels, lateral movement, credential dumping, and data exfiltration. Fileless techniques may abuse legitimate interpreters or administrative tools and therefore challenge signature-based detection. Defenders increasingly combine endpoint telemetry, application control, behaviour analysis, identity monitoring, network detection, and threat intelligence.

Malware prevention is not limited to antivirus software. Effective practice includes patch management, least privilege, application allow-listing where appropriate, secure email controls, network segmentation, offline or immutable backups, multifactor authentication, user education, and tested recovery procedures.

6. Social Engineering and the Human Attack Surface

Social engineering manipulates people into revealing information, performing an unsafe action, transferring funds, or weakening a control. It exploits trust, urgency, authority, fear, curiosity, helpfulness, and cognitive overload.

Phishing uses deceptive messages to obtain credentials or induce actions. Spear phishing is tailored to a particular person or organization. Whaling targets senior executives or high-value personnel. Business email compromise commonly uses impersonation or compromised accounts to request payments or sensitive information. Vishing uses voice communication, while smishing uses text messages. Pretexting constructs a false scenario to obtain cooperation. Baiting offers an attractive object or opportunity, such as a supposedly useful file or device. Tailgating obtains physical access by following an authorized person.

Defence requires both technical and organizational measures: phishing-resistant multifactor authentication, secure email gateways, domain-authentication mechanisms, payment-verification procedures, separation of duties, call-back verification using trusted contact details, reporting channels, realistic exercises, and a culture that avoids blaming employees for reporting mistakes. Awareness training alone is insufficient because attackers continuously adapt and legitimate workflows can resemble fraudulent ones.

7. Attack Lifecycles and Defensive Reasoning

An attack lifecycle describes the stages through which an intrusion may progress. The Cyber Kill Chain is a well-known model with the stages reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. Other frameworks, such as MITRE ATT&CK, describe adversary tactics and techniques in greater operational detail. These models are complementary rather than interchangeable.

A typical intrusion may proceed as follows:

1. Reconnaissance: identify employees, domains, technologies, exposed services, and business relationships.

2. Initial access: exploit a vulnerability, use stolen credentials, or persuade a user to open a malicious link.

3. Execution and persistence: run code and establish continued access.

4. Privilege escalation and credential access: obtain stronger permissions or additional credentials.

5. Discovery and lateral movement: map systems and move toward valuable assets.

6. Collection and exfiltration: gather and transfer information.

7. Impact: encrypt, destroy, alter, expose, or disrupt assets.

Defenders should map controls and evidence to each stage. External attack-surface monitoring can reveal reconnaissance exposure. Email controls and multifactor authentication reduce initial access. Endpoint detection identifies execution and persistence. Identity analytics can detect unusual privilege use. Segmentation restricts lateral movement. Data-loss prevention and egress monitoring may identify exfiltration. Backups and recovery plans reduce impact.

The lifecycle must not be interpreted as a rigid sequence. Attackers may begin with purchased access, skip stages, repeat stages, or operate simultaneously in several environments. The model is valuable because it supports threat hunting, control coverage analysis, and incident prioritization.

8. Contemporary Cyber-Risk Trends

8.1 Cloud and identity concentration

Cloud adoption shifts security responsibility among the customer, provider, and other service parties. Misconfigured storage, excessive permissions, exposed management interfaces, stolen tokens, and insecure APIs are frequent concerns. Identity has become a central security boundary because access to cloud resources is often mediated through accounts, roles, tokens, and service principals rather than network location.

8.2 Ransomware and extortion

Ransomware operations increasingly combine data theft, encryption, service disruption, and public pressure. Resilience requires asset prioritization, privileged-access controls, segmentation, tested restoration, offline or immutable backups, incident communications, and legal coordination. Paying an extortion demand does not guarantee deletion of stolen data or restoration of systems.

8.3 Supply-chain and software dependency risk

Organizations depend on commercial software, open-source packages, managed services, hardware, and update channels. A weakness in one supplier can affect many customers. Controls include supplier due diligence, software bills of materials where useful, code-signing verification, dependency governance, segmented vendor access, vulnerability disclosure processes, and contingency planning.

8.4 Artificial intelligence

AI can improve detection, triage, malware analysis, and security operations, but it also creates risks. Attackers may use generative systems to produce persuasive messages, automate reconnaissance, or modify malicious code. Defenders must manage false positives, model manipulation, data leakage, insecure integrations, and overreliance on automated conclusions. AI outputs require validation, especially when they trigger account suspension, containment, or legal action.

8.5 Internet of Things and operational technology

Many embedded and industrial devices have long lifecycles, limited computing resources, and safety implications. Patching may be difficult or impossible during operation. Compensating measures include asset visibility, network isolation, allow-listing, strict remote access, passive monitoring, vendor coordination, and safety-aware recovery procedures.

8.6 Regulatory and governance expectations

Organizations increasingly face obligations concerning privacy, breach notification, critical infrastructure, resilience, records, and executive oversight. Requirements vary by jurisdiction and sector. Security leaders must translate technical exposure into business risk, maintain evidence of control operation, define incident responsibilities, and ensure that procurement and product design include security requirements.

9. Applied Case: Illustrative Ransomware Incident in a University

Background

A fictional university operates student information systems, research servers, learning platforms, administrative offices, and a remote-access service. Many staff members work remotely, and a third-party supplier maintains parts of the environment.

Problem

An attacker sends a convincing message to a finance employee. The employee enters credentials into a counterfeit login page. The attacker bypasses password-only access, connects through the remote-access service, discovers shared administrative credentials, and reaches a file server containing research and administrative data. Data are copied, systems are encrypted, and a ransom demand is issued.

Analysis

The incident affects all three CIA objectives. Confidentiality is affected by data theft; integrity is affected by unauthorized changes and encryption; availability is affected by loss of access. Authenticity and accountability are weakened because shared accounts obscure the actor’s actions. The remote-access service and shared credentials represent important trust-boundary failures. The attack surface included the exposed login service, user accounts, excessive privileges, and insufficiently segmented file servers.

The attacker’s lifecycle included social-engineering reconnaissance, initial access through credential theft, persistence through remote access, discovery, lateral movement, collection, exfiltration, and impact. Warning signs could have included impossible-travel logins, unusual authentication times, new forwarding rules, abnormal administrative activity, and large outbound transfers.

Approach and solution

The university should first activate its incident-response plan, isolate affected systems without destroying evidence, protect critical safety and continuity functions, and engage legal, privacy, executive, and law-enforcement contacts as appropriate. Credentials and tokens should be revoked and reissued through a controlled process. Forensic analysis should identify the initial access route, persistence, affected assets, and exfiltrated data.

Longer-term measures include phishing-resistant multifactor authentication, elimination of shared accounts, privileged-access management, segmentation between administrative and research systems, tested immutable backups, endpoint detection, centralized logs with reliable time synchronization, restricted supplier access, and rehearsed recovery procedures. Data classification and retention reduction can limit the consequences of future theft.

Outcome and learning points

The university restores prioritized services from clean backups, notifies affected parties where required, and conducts a post-incident review. The most important lesson is that a single technical control would not have been sufficient. Authentication, segmentation, monitoring, least privilege, backup integrity, and practiced response must work together. The case also demonstrates that cyber risk is an institutional governance issue involving finance, academic operations, privacy, procurement, and leadership—not solely an IT problem.

10. Foundational Best Practices

A practical baseline for network security includes:

1. Maintain an accurate inventory of hardware, software, identities, data, services, and owners.

2. Classify information and apply controls according to sensitivity and business impact.

3. Use least privilege, separation of duties, and periodic access review.

4. Require multifactor authentication, prioritizing phishing-resistant methods for privileged and remote access.

5. Patch and securely configure operating systems, applications, network devices, and dependencies.

6. Segment networks and restrict administrative paths.

7. Encrypt sensitive data in transit and at rest, with disciplined key management.

8. Centralize relevant logs, protect their integrity, synchronize time, and monitor meaningful events.

9. Test backups by restoring them; do not assume that a successful backup job proves recoverability.

10. Conduct vulnerability assessment and authorized penetration testing based on risk.

11. Establish incident-response, business-continuity, and disaster-recovery plans and exercise them.

12. Assess suppliers and control third-party access.

13. Train users while designing workflows that make secure behaviour practical.

14. Measure outcomes such as remediation age, privileged-account coverage, restoration time, and control effectiveness rather than relying only on tool counts.

Challenges and Limitations

No security model eliminates risk. Confidentiality controls may obstruct legitimate collaboration; monitoring may create privacy concerns; segmentation can increase operational complexity; and patching can disrupt safety-critical systems. Risk assessments depend on incomplete information and changing adversary behaviour. Threat-intelligence labels may be uncertain, and automated detection can produce false positives or miss novel attacks. Security controls also fail through poor configuration, expired certificates, unmanaged exceptions, inadequate staffing, and organizational incentives that prioritize speed over resilience.

Professional judgement is therefore essential. Security decisions should be proportionate, documented, tested, reviewed, and aligned with legal and ethical obligations. Organizations should avoid treating compliance as proof of security and should consider the effects of controls on privacy, accessibility, employee dignity, and public safety.

Chapter Summary

Network security protects information, systems, and services against unauthorized disclosure, alteration, misuse, and disruption. The CIA triad provides the basic objectives of confidentiality, integrity, and availability, while authenticity, authorization, accountability, privacy, resilience, and non-repudiation refine security requirements. Trust boundaries identify transitions where assumptions change, and attack-surface analysis identifies possible paths to harm. Threat, vulnerability, exploit, and risk are distinct concepts that must be analysed together.

Security operates across physical, data-link, network, transport, and application layers. Layered defence, secure protocols, strong identity controls, segmentation, monitoring, and resilient recovery are more effective than reliance on a single perimeter control. Threat actors vary in motivation and capability, while malware and social engineering exploit both technical weaknesses and human processes. Attack-lifecycle models support defensive coverage from reconnaissance through impact.

Cloud dependence, identity concentration, ransomware, supply-chain exposure, AI-enabled attacks, and vulnerable connected devices are contemporary risk trends. Effective practice combines technology with governance, trained personnel, supplier management, incident response, tested recovery, and ethical consideration. The university case demonstrates that cyber security is an organizational risk-management responsibility requiring coordinated controls and continuous improvement.

Key Terms

Confidentiality: Protection of information from unauthorized disclosure.

Integrity: Protection of information and systems from unauthorized alteration or destruction.

Availability: Accessibility of systems and information to authorized users when required.

Authenticity: Confidence that an entity, message, or service is genuine.

Accountability: Ability to associate actions with responsible identities or processes.

Non-repudiation: Evidence supporting the claim that a party performed or approved an action.

Trust boundary: A transition across which security assumptions change.

Attack surface: The set of points through which a system may be attacked.

Threat: A potential cause of harm.

Vulnerability: A weakness that may be exploited.

Exploit: A method or action that takes advantage of a vulnerability.

Risk: Possibility of loss or adverse impact arising from threats and vulnerabilities.

Malware: Malicious software or code.

Phishing: Deceptive communication intended to induce disclosure or unsafe action.

Ransomware: Malware used to deny access or extort an organization.

Least privilege: Granting only the access necessary for an authorized task.

Defence in depth: Use of multiple complementary security controls.

Network segmentation: Dividing a network to restrict movement and limit exposure.

Zero trust: Security approach that continuously verifies access rather than trusting location by default.

Attack lifecycle: A model describing stages of an intrusion from preparation to objectives.

Review Questions

Short Answer Questions

1. Define confidentiality, integrity, and availability.

2. What is the difference between authentication and authorization?

3. Explain the meaning of a trust boundary.

4. Distinguish a threat, vulnerability, and exploit.

5. Identify two controls that reduce ransomware impact.

Long Answer Questions

1. Explain why accountability and non-repudiation are related but different security properties.

2. Discuss how security controls operate across the OSI or TCP/IP layers, including their limitations.

3. Compare the motivations and capabilities of cybercriminals, insiders, and nation-state actors.

4. Explain how social engineering exploits organizational processes as well as individual psychology.

5. Evaluate the role of defence in depth in a cloud-connected enterprise.

Analytical / Application Questions

1. A company exposes a remote administration portal, permits shared administrator accounts, and stores backups online with the production network. Identify the principal trust boundaries, attack-surface weaknesses, and likely attack-lifecycle stages. Recommend priorities for remediation.

2. An organization has strong endpoint antivirus but no multifactor authentication, weak supplier controls, and untested backups. Analyse which CIA objectives are most exposed and design a risk-based improvement sequence.

3. A hospital proposes an AI system that automatically disables accounts when it detects anomalous behaviour. Evaluate the security benefits, privacy and safety risks, false-positive consequences, and governance controls required before deployment.

Multiple Choice Questions with Answers

Question 1

Which property ensures that information is not disclosed to unauthorized parties?

A. Availability

B. Confidentiality

C. Integrity

D. Accountability

Correct Answer: B. Confidentiality

Question 2

What is the primary purpose of authorization?

A. To determine which actions an authenticated subject may perform

B. To encrypt all network traffic

C. To prove that a device has no vulnerabilities

D. To restore data after an incident

Correct Answer: A. To determine which actions an authenticated subject may perform

Question 3

Which statement best describes an attack surface?

A. The total financial impact of a breach

B. The collection of possible points through which a system may be attacked

C. A list of authorized users only

D. A cryptographic key used for authentication

Correct Answer: B. The collection of possible points through which a system may be attacked

Question 4

A weakness in a system that may be exploited is called a:

A. Threat

B. Vulnerability

C. Control

D. Payload

Correct Answer: B. Vulnerability

Question 5

Which malware type is designed primarily to deny access to data or systems for extortion?

A. Rootkit

B. Spyware

C. Ransomware

D. Worm

Correct Answer: C. Ransomware

Question 6

Which control most directly reduces the risk of stolen passwords being sufficient for remote access?

A. Multifactor authentication

B. Data compression

C. Screen brightness control

D. File naming conventions

Correct Answer: A. Multifactor authentication

Question 7

What is a principal benefit of network segmentation?

A. It guarantees that all software is vulnerability-free

B. It limits unauthorized movement between systems

C. It eliminates the need for identity management

D. It prevents all phishing messages

Correct Answer: B. It limits unauthorized movement between systems

Question 8

Which attack-lifecycle activity involves mapping internal systems after initial access?

A. Discovery

B. Weaponization

C. Recovery

D. Classification

Correct Answer: A. Discovery

Question 9

Why are shared administrator accounts a security weakness?

A. They make encryption impossible

B. They prevent systems from being patched

C. They weaken accountability and make actions difficult to attribute

D. They automatically expose all traffic to the Internet

Correct Answer: C. They weaken accountability and make actions difficult to attribute

Question 10

Which statement about TLS is most accurate?

A. TLS guarantees that both endpoints are free of malware

B. TLS can protect communications in transit but does not secure compromised endpoints

C. TLS replaces the need for application authorization

D. TLS prevents all denial-of-service attacks

Correct Answer: B. TLS can protect communications in transit but does not secure compromised endpoints