Exam 98-367: Security Fundamentals Practice Test
Security Fundamentals covers the principles and controls used to protect accounts, systems, data, and facilities. The practice material addresses security properties such as confidentiality, integrity, availability, and nonrepudiation, along with authentication, access restrictions, account practices, physical safeguards, monitoring, patching, and resilience.
Exam overview
About the Exam 98-367: Security Fundamentals Exam
Security work requires matching a control to the risk it is meant to reduce. Distinguish authentication factors from authorization rules, and understand how unique accounts support accountability. Consider physical access controls alongside logical protections such as time-based restrictions, screen locking, and least-privilege service accounts. Security monitoring can help identify unusual data movement, while prompt application of vendor updates reduces exposure to known vulnerabilities. Availability decisions include designing for component failure, such as providing redundant power. Questions in this practice bank also ask you to identify the security property that applies to a situation, including whether a recorded action can be denied later. These concepts support everyday tasks such as protecting shared workstations, limiting access to sensitive resources, reviewing suspicious activity, and reducing the impact of compromised credentials or failed equipment.
Sample Practice Questions
Review a selection from this exam's published US Practice Tests practice bank.
A security team wants to make sure a user cannot claim that a transaction was submitted by someone else after the transaction has been recorded. Which security property is most directly relevant?
Show answer
Correct answer: ANon-repudiation provides evidence that supports attributing an action or transaction to its originator, making it harder for that party to deny it later. Availability concerns access to services, while fault tolerance concerns continued operation despite failures.
A user signs in with a password and then approves a prompt on a registered phone. What security approach is being used?
Show answer
Correct answer: AMultifactor authentication requires evidence from more than one factor category, such as something the user knows (a password) and something they possess (a registered phone).
A company assigns each employee a unique account rather than having staff share a common login. What security benefit does this most directly provide?
Show answer
Correct answer: BUnique accounts support accountability because activity can be associated with a specific user. They do not, by themselves, encrypt traffic, grant authorization, or eliminate password attacks.
A company wants to ensure that only approved users can enter a server room. Which control is most directly suited to this purpose?
Show answer
Correct answer: AA badge reader is a physical access control that can restrict entry to authorized people. The other options monitor networks, detect file changes, or define data handling practices rather than control room entry.
A service should continue operating even if one power supply fails. Which design choice most directly supports this requirement?
Show answer
Correct answer: ARedundant power supplies can keep equipment running when one supply or source fails, improving availability. The other choices address different concerns or can reduce detection.
A web server has a known security flaw for which the vendor has released an update. What action most directly reduces exposure to that flaw?
Show answer
Correct answer: AApplying a vendor security update addresses the known vulnerability. Testing before deployment helps reduce the risk of disrupting services while ensuring the fix is applied.
A company wants to detect whether an employee is sending unusually large amounts of sensitive data outside the organization. Which type of monitoring is most directly relevant?
Show answer
Correct answer: AData loss prevention monitoring can identify or help control sensitive information leaving organizational systems through monitored channels. The other activities are unrelated to detecting data exfiltration.
How to use this practice test
Access 50 published practice questions for free. Each session presents up to 20 questions selected at random from the bank, with results shown after the session. Use the results to identify concepts to revisit, such as authentication, access controls, monitoring, or availability.
Preparation tips
- For each scenario, identify the asset and risk first, then distinguish the control that prevents access from one that detects or records activity.
- Compare confidentiality, integrity, availability, and nonrepudiation using concrete examples, such as unauthorized disclosure, altered records, service outages, and disputed transactions.
- Practice separating authentication from authorization, and connect unique accounts, multifactor sign-in, time restrictions, and least privilege to their specific purposes.
- Review how patching known vulnerabilities, monitoring data transfers, locking unattended sessions, and redundant power address different security risks. Treat these as practice-bank examples, not a confirmed official topic list.