CIW 1D0-671 Practice Exams
Last updated on Oct 22,2026- Exam Code: 1D0-671
- Exam Name: CIW Web Security Associate
- Certification Provider: CIW
- Latest update: Oct 22,2026
Irina has contracted with a company to provide Web design consulting services. The company has asked her to use several large files available via an HTTP server.
The IT department has provided Irina with user name and password, as well as the DNS name of the HTTP server. She then used this information to obtain the files she needs to complete her task using Mozilla Firefox.
Which of the following is a primary risk factor when authenticating with a standard HTTP server?
- A . HTTP uses cleartext transmission during authentication, which can lead to a man-in-the- middle attack.
- B . Irina has used the wrong application for this protocol, thus increasing the likelihood of a man-in- the-middle attack.
- C . A standard HTTP connection uses public-key encryption that is not sufficiently strong, inviting the possibility of a man-in-the-middle attack.
- D . Irina has accessed the Web server using a non-standard Web browser.
Which term is used to describe the activity of a hacker who enters a computer network and begins mapping the contents of the system?
- A . Virus planting
- B . Spoofing
- C . System snooping
- D . Trojan
A disgruntled employee has discovered that the company Web server is not protected against particular buffer overflow vulnerability.
The disgruntled employee has created an application to take advantage of this vulnerability and secretly obtain sensitive data from the Web server’s hard disk. This application sends a set of packets to the Web server that causes it to present an unauthenticated terminal with root privileges.
What is the name for this particular type of attack?
- A . Man-in-the-middle attack
- B . Trojan
- C . Denial of service
- D . Zero-day attack
Which term describes a dedicated system meant only to house firewall software?
- A . Firewall appliance
- B . Virtual Private Network (VPN)
- C . Kernel firewall
- D . Proxy server
What is the main purpose of reviewing a security incident after it has been resolved?
- A . To bring charges against the ISP that carries the hacker’s account
- B . To discover and report that a piece of hardware or software has purportedly failed
- C . To learn what can be changed or improved in your security policy
- D . To discover who within your company should be reprimanded
Which of the following is considered to be the most secure default firewall policy, yet usually causes the most work from an administrative perspective?
- A . Configuring the firewall to respond automatically to threats
- B . Blocking all access by default, then allowing only necessary connections
- C . Configuring the firewall to coordinate with the intrusion-detection system
- D . Allowing all access by default, then blocking only suspect network connections
Your organization has made a particularly unpopular policy decision. Your supervisor fears that a series of attacks may occur as a result. You have been assigned to increase automated auditing on a server.
When fulfilling this request, which of the following resources should you audit the most aggressively?
- A . Authentication databases, including directory servers
- B . Intrusion detection systems, especially those placed on sensitive networks
- C . Log files on firewall systems
- D . Firewall settings for desktop systems
Which of the following security services, as defined by the ISO 7498-2 Security Architecture document, protects against active threats by verifying or maintaining the consistency of information?
- A . Data confidentiality
- B . Authentication
- C . Non-repudiation
- D . Data integrity
Considering physical security, which of the following should you look for when identifying a room that will act as a server room?
- A . Electrical outlets
- B . Power over Ethernet (PoE) settings
- C . False ceilings
- D . Space for backup servers
Which of the following is a primary weakness of asymmetric-key encryption?
- A . It is slow because it requires extensive calculations by the computer.
- B . It can lead to the corruption of encrypted data during network transfer.
- C . It is reliant on the Secure Sockets Layer (SSL) standard, which has been compromised.
- D . It is difficult to transfer any portion of an asymmetric key securely.