Free Practice Questions for the WGU Courses and Certificates Network-and-Security-Foundation Exam (2026 Updated)

A man-in-the-middle (MITM) attack occurs when an attacker secretly intercepts and relays communication between two parties. This allows the attacker to steal data, modify messages, or inject malicious content without the victims' knowledge.

Credential stuffing reuses stolen login credentials but does not involve interception.

Social engineering manipulates users rather than intercepting messages.

Pharming redirects users to fraudulent websites, but it does not intercept communication.

Infrastructure as a Service (IaaS) provides virtualized computing resources, including virtual machines, storage, and networking, while allowing users full control over operating systems and applications. Examples include AWS EC2 and Google Compute Engine.

SaaS provides ready-to-use applications (e.g., Google Docs).

FaaS runs code in response to events (e.g., AWS Lambda).

PaaS provides development environments but not full infrastructure control.

Configuring switch port tracing helps detect unauthorized devices, such as rogue access points, that are connected to the network. Network administrators can use port security and intrusion detection systems (IDS) to monitor and block unauthorized access points.

Decreasing wireless range may limit exposure but does not actively detect rogue APs.

Disabling unnecessary services improves security but does not prevent rogue APs.

Monitoring traffic patterns helps detect anomalies but does not directly stop rogue APs.

A Ring topology is a network setup where each device is connected to two adjacent devices, forming a circular path for data transmission. This topology ensures that data travels in a single or bidirectional loop.

Point-to-point topology refers to a direct connection between two devices without forming a larger network structure.

Bus topology has all devices connected to a single central cable, rather than forming a ring.

Star topology features a central hub or switch that connects all devices, rather than direct device-to-device links.

IP address spoofing is a cyberattack where an attacker disguises their system by falsifying its IP address, making it appear as a trusted device in a network. This technique is used for bypassing security controls, launching denial-of-service (DoS) attacks, or impersonating legitimate users.

Pharming redirects users to fake websites to steal credentials.

Man-in-the-middle attack intercepts communications between two parties.

Session hijacking takes over an active session but does not involve falsifying an IP address.

Psychological acceptability states that security measures should be user-friendly and not overly burdensome . If security controls are too complex, users may bypass them, leading to weaker security. In this case, employees used personal email because authentication procedures were too cumbersome.

Zero-trust model enforces strict access control, not usability.

Least common mechanism limits shared resources.

Fail-safe ensures secure failure handling, not usability.

Session hijacking occurs when an attacker takes over an established connection between two devices, often by stealing session tokens or manipulating network traffic. This allows the attacker to impersonate a legitimate user and gain unauthorized access.

Dictionary attack involves password guessing, not hijacking active connections.

Social engineering tricks users into providing information but does not hijack sessions.

IP address spoofing disguises the attacker's identity but does not necessarily take over a session.

Server-side validation helps prevent SQL injection, command injection, and other input-based attacks by ensuring that user input is properly sanitized before being processed by the system. Parameterized queries and input validation should also be implemented to further reduce risk.

Detecting code vulnerabilities is helpful but not a direct mitigation technique.

Decreasing wireless range does not affect injection attacks.

Using WPA2 secures wireless networks but does not prevent injection attacks.

The Network or Internet layer of the TCP/IP model is responsible for addressing, routing, and delivering packets across networks. The Internet Protocol (IP) operates at this layer, ensuring that data is correctly routed from the source to the destination.

Physical or network access layer deals with hardware transmission (e.g., Ethernet, Wi-Fi).

Application layer includes end-user services (e.g., HTTP, FTP).

Transport layer manages data flow using protocols like TCP and UDP but does not handle IP addressing.

The ping command in Linux is used to check network connectivity to a specific hostname or IP address. It sends ICMP Echo Request packets and measures response times.

nslookup is used for DNS lookups, not connectivity testing.

ifconfig displays network interface configurations but does not test connectivity.

dig is used for detailed DNS queries.

This describes a ransomware attack , which falls under denial of availability because it prevents users from accessing their data or systems until a ransom is paid. Attackers use encryption to lock files, disrupting operations.

Data modification refers to unauthorized changes to information.

Data export involves stealing data rather than disabling access.

Launch point describes an attacker's use of a compromised system to attack others.

Authorization is the process of granting specific access rights and permissions based on user roles. By implementing Role-Based Access Control (RBAC) , organizations ensure that users only have access to resources necessary for their job functions, reducing the risk of insider threats.

Authentication verifies identity but does not control access.

Accounting logs activities but does not restrict access.

Availability ensures system uptime but is unrelated to permissions.

Platform as a Service (PaaS) provides a pre-configured computing environment that includes an operating system, runtime, and development tools, making it ideal for developers who want a ready-to-use platform. Examples include Google App Engine and Microsoft Azure App Services.

SaaS provides fully hosted applications, not just pre-configured virtual machines.

IaaS provides infrastructure without pre-installed software.

FaaS executes specific functions without persistent infrastructure.

Enhancing physical resource security ensures that servers, networking devices, and data storage facilities are protected from unauthorized physical access, theft, or tampering. This includes measures like biometric authentication, surveillance, and restricted access zones.

Using a variable network topology does not directly protect data.

Increasing wireless access point range may improve connectivity but does not enhance security.

WEP is weak and should not be used for data protection.

Phishing is a cyberattack where attackers impersonate legitimate entities (e.g., banks, companies) and send fraudulent emails or messages designed to trick recipients into revealing sensitive information, such as usernames, passwords, or financial details. The fake link in the email directs victims to a malicious site that captures their credentials.

IP address spoofing disguises a system’s identity but does not involve email deception.

Session hijacking takes over an active session but does not involve email scams.

Man-in-the-middle attack intercepts communication rather than tricking users via emails.