1Which component of the CIA Triad ensures that data is not altered or tampered with by unauthorized individuals?
A.Confidentiality
B.Integrity
C.Availability
D.Authentication
Correct Answer: Integrity
Explanation:Integrity ensures that information remains accurate and complete over its entire lifecycle and is not altered by unauthorized entities.
Incorrect! Try again.
2In the context of cybersecurity, what does the term Confidentiality primarily guarantee?
A.Data is accessible whenever needed
B.Data is protected from unauthorized access or disclosure
C.Data is accurate and reliable
D.Data transfer speed is optimized
Correct Answer: Data is protected from unauthorized access or disclosure
Explanation:Confidentiality prevents sensitive information from reaching wrong people, while ensuring that the right people can in fact get it.
Incorrect! Try again.
3Which of the following scenarios best represents an Insider Threat?
A.A hacker from another country targeting the firewall
B.A disgruntled employee stealing proprietary code before quitting
C.A phishing email sent by a cybercriminal group
D.A Zero-day vulnerability in the operating system
Correct Answer: A disgruntled employee stealing proprietary code before quitting
Explanation:An Insider Threat comes from people within the organization, such as employees, former employees, contractors, or business associates, who have inside information concerning the organization's security practices, data, and computer systems.
Incorrect! Try again.
4What distinguishes a Worm from a Virus?
A.A worm requires a host file to execute, while a virus does not
B.A virus replicates itself across a network without user interaction
C.A worm is a standalone program that replicates without a host file
D.There is no difference; they are synonyms
Correct Answer: A worm is a standalone program that replicates without a host file
Explanation:Unlike a virus, which attaches itself to a host file and requires human action to spread, a worm is a standalone malware that replicates itself to spread to other computers, often relying on security failures on the target computer.
Incorrect! Try again.
5Which type of cyber-attack involves an attacker sending fraudulent emails that appear to come from a reputable source?
A.DDoS
B.Phishing
C.SQL Injection
D.Man-in-the-Middle
Correct Answer: Phishing
Explanation:Phishing is a method of trying to gather personal information using deceptive e-mails and websites.
Incorrect! Try again.
6In a Brute-force attack, how does the attacker attempt to gain access to a system?
A.By infecting the system with a Trojan
B.By systematically checking all possible keys or passwords
C.By deceiving the user into revealing the password
D.By intercepting the Wi-Fi signal
Correct Answer: By systematically checking all possible keys or passwords
Explanation:A Brute-force attack consists of an attacker submitting many passwords or passphrases with the hope of eventually guessing correctly. Mathematically, if a password space is , the attacker tries elements until success.
Incorrect! Try again.
7What is the primary goal of a Denial of Service (DoS) attack?
A.To steal confidential data
B.To encrypt data and demand ransom
C.To make a machine or network resource unavailable to its intended users
D.To inject malicious SQL commands
Correct Answer: To make a machine or network resource unavailable to its intended users
Explanation:DoS attacks are designed to overwhelm a system's resources so that it cannot respond to service requests.
Incorrect! Try again.
8What defines a Zero-day attack?
A.An attack that takes zero seconds to execute
B.An attack exploiting a vulnerability that is unknown to the vendor and has no patch
C.An attack that resets the system clock to zero
D.An attack that occurs on the first day of the month
Correct Answer: An attack exploiting a vulnerability that is unknown to the vendor and has no patch
Explanation:A Zero-day attack occurs when hackers exploit a flaw before developers have a chance to address it (zero days of awareness).
Incorrect! Try again.
9Which tool is widely used for network discovery and security auditing, often referred to as a port scanner?
A.Photoshop
B.Nmap
C.Visual Studio Code
D.MS Excel
Correct Answer: Nmap
Explanation:Nmap (Network Mapper) is a free and open-source utility for network discovery and security auditing, used to identify devices running on a system and discovering hosts and services.
Incorrect! Try again.
10What is the primary function of Wireshark in cybersecurity?
A.Password cracking
B.Packet analysis and network protocol capturing
C.Virus removal
D.Firewall configuration
Correct Answer: Packet analysis and network protocol capturing
Explanation:Wireshark is a network protocol analyzer that lets you see what's happening on your network at a microscopic level (packet level).
Incorrect! Try again.
11Which of the following is a form of Social Engineering?
A.Exploiting a buffer overflow
B.Pretexting
C.Port scanning
D.Packet sniffing
Correct Answer: Pretexting
Explanation:Pretexting is a form of social engineering where an attacker creates a fabricated scenario (a pretext) to manipulate a victim into providing information.
Incorrect! Try again.
12Ransomware is a type of malware that:
A.Records keystrokes
B.Encrypts the victim's data and demands payment for the decryption key
C.Floods a network with traffic
D.Mines cryptocurrency in the background
Correct Answer: Encrypts the victim's data and demands payment for the decryption key
Explanation:Ransomware restricts access to the computer system that it infects, usually by encryption, and demands a ransom paid to the creator of the malware for the restriction to be removed.
Incorrect! Try again.
13What does the protocol HTTPS indicate compared to HTTP?
A.The website loads faster
B.The communication between the browser and the server is encrypted
C.The website is hosted on a private server
D.The website uses HTML5
Correct Answer: The communication between the browser and the server is encrypted
Explanation:HTTPS stands for Hypertext Transfer Protocol Secure. It uses TLS/SSL to encrypt normal HTTP requests and responses.
Incorrect! Try again.
14Which of the following creates a Digital Footprint?
A.Posting photos on social media
B.Visiting a website
C.Sending an email
D.All of the above
Correct Answer: All of the above
Explanation:A Digital Footprint is the trail of data you create while using the Internet, including websites you visit, emails you send, and information you submit online.
Incorrect! Try again.
15In the context of the CIA Triad, Availability ensures:
A.Data is encrypted
B.Data is accurate
C.Systems and data are accessible to authorized users when needed
D.Users are who they say they are
Correct Answer: Systems and data are accessible to authorized users when needed
Explanation:Availability ensures that systems, applications, and data are up and running for authorized users when they require them.
Incorrect! Try again.
16What is a Dictionary Attack?
A.An attack on a database containing a dictionary
B.A brute-force method using a list of common words and passwords
C.Stealing a physical dictionary
D.An attack that changes the language settings of a PC
Correct Answer: A brute-force method using a list of common words and passwords
Explanation:A Dictionary Attack attempts to defeat an authentication mechanism by trying to determine its decryption key or passphrase by trying hundreds or sometimes millions of likely possibilities, such as words in a dictionary.
Incorrect! Try again.
17The WannaCry attack in 2017 is a famous example of:
A.Spyware
B.Ransomware
C.Adware
D.Hardware failure
Correct Answer: Ransomware
Explanation:WannaCry was a worldwide cyberattack by the WannaCry ransomware cryptoworm, which targeted computers running the Microsoft Windows operating system by encrypting data and demanding ransom payments in Bitcoin.
Incorrect! Try again.
18Which job role is primarily responsible for testing a system to find vulnerabilities before malicious hackers do?
Explanation:A Penetration Tester or Ethical Hacker simulates cyberattacks on a computer system, network, or web application to find security vulnerabilities that an attacker could exploit.
Incorrect! Try again.
19What is the purpose of Two-Factor Authentication (2FA)?
A.To use two different passwords
B.To require two different people to log in
C.To add a second layer of security beyond just a password
D.To encrypt the hard drive twice
Correct Answer: To add a second layer of security beyond just a password
Explanation:2FA provides an extra layer of security by requiring a user to provide two distinct forms of identification (e.g., a password and a code sent to a mobile device).
Incorrect! Try again.
20AI-based threat detection systems primarily utilize which technology to identify cyber threats?
A.Manual log review
B.Machine Learning algorithms
C.Static code analysis
D.Basic firewall rules
Correct Answer: Machine Learning algorithms
Explanation:AI-based systems use Machine Learning to analyze patterns and behaviors in network traffic to detect anomalies that deviate from the norm, indicating a potential threat.
Incorrect! Try again.
21What is Tailgating in the context of physical cybersecurity?
A.Following a car too closely
B.Following an authorized person into a secure area without consent
C.Sending a tailing email
D.Attaching a file to the end of an email
Correct Answer: Following an authorized person into a secure area without consent
Explanation:Tailgating (or piggybacking) is a physical security breach where an unauthorized person follows an authorized individual to enter a secured premise.
Incorrect! Try again.
22Which of the following is a strong password practice?
A.Using "password123"
B.Using your birthdate
C.Using a mix of uppercase, lowercase, numbers, and symbols
D.Writing the password on a sticky note on the monitor
Correct Answer: Using a mix of uppercase, lowercase, numbers, and symbols
Explanation:Strong passwords should be complex and unpredictable. Mathematically, increasing the character set size () and length () increases entropy ().
Incorrect! Try again.
23What is a Botnet?
A.A robot network used for manufacturing
B.A network of private computers infected with malicious software and controlled as a group
C.A secure network for bots
D.An AI chatbot
Correct Answer: A network of private computers infected with malicious software and controlled as a group
Explanation:A Botnet is a number of Internet-connected devices, each of which is running one or more bots. Botnets can be used to perform Distributed Denial-of-Service (DDoS) attacks.
Incorrect! Try again.
24Which regulation focuses on the protection of personal data and privacy for individuals within the European Union?
A.HIPAA
B.GDPR
C.PCI-DSS
D.SOX
Correct Answer: GDPR
Explanation:GDPR (General Data Protection Regulation) is a regulation in EU law on data protection and privacy in the European Union and the European Economic Area.
Incorrect! Try again.
25What is Spear Phishing?
A.Fishing with a spear
B.A random phishing email sent to millions
C.A targeted phishing attempt aimed at a specific individual or organization
D.Phishing done via SMS
Correct Answer: A targeted phishing attempt aimed at a specific individual or organization
Explanation:Spear Phishing is an email-spoofing attack that targets a specific organization or individual, seeking unauthorized access to confidential data.
Incorrect! Try again.
26Which malware masquerades as legitimate software to mislead users of its true intent?
A.Worm
B.Trojan Horse
C.Adware
D.Logic Bomb
Correct Answer: Trojan Horse
Explanation:A Trojan Horse is a type of malware that is often disguised as legitimate software. Unlike viruses and worms, Trojans do not reproduce by infecting other files nor do they self-replicate.
Incorrect! Try again.
27What does DDoS stand for?
A.Direct Denial of Service
B.Distributed Denial of Service
C.Digital Data of Security
D.Domain Denial of System
Correct Answer: Distributed Denial of Service
Explanation:DDoS stands for Distributed Denial of Service. It involves multiple compromised computer systems attacking a target, such as a server, website, or other network resource.
Incorrect! Try again.
28A Keylogger is a type of spyware that:
A.Logs into keys automatically
B.Records every keystroke made by the user
C.Generates encryption keys
D.Locks the keyboard
Correct Answer: Records every keystroke made by the user
Explanation:Keyloggers allow attackers to monitor the keys struck on a keyboard, usually in a covert manner, to steal passwords and other sensitive information.
Incorrect! Try again.
29Which of the following is an example of a Man-in-the-Middle (MitM) attack?
A.An attacker guessing a password
B.An attacker secretly intercepting and relaying messages between two parties
C.An attacker flooding a server
D.An attacker installing a virus via USB
Correct Answer: An attacker secretly intercepting and relaying messages between two parties
Explanation:In a MitM attack, the attacker secretly relays and possibly alters the communications between two parties who believe they are directly communicating with each other.
Incorrect! Try again.
30The SolarWinds hack is a prime example of a:
A.Supply Chain Attack
B.Physical Theft
C.DDoS Attack
D.Brute Force Attack
Correct Answer: Supply Chain Attack
Explanation:The SolarWinds incident was a massive supply chain attack where hackers inserted malicious code into the Orion software updates, affecting thousands of organizations.
Incorrect! Try again.
31To secure web browsing, one should avoid:
A.Updating the browser
B.Using a pop-up blocker
C.Clicking on suspicious links or ads
D.Using HTTPS websites
Correct Answer: Clicking on suspicious links or ads
Explanation:Clicking on suspicious links (Malvertising or Phishing links) is a primary vector for browser-based infections.
Incorrect! Try again.
32What is the function of a Firewall?
A.To extinguish fires in the server room
B.To monitor and control incoming and outgoing network traffic based on security rules
C.To speed up the internet connection
D.To act as an antivirus
Correct Answer: To monitor and control incoming and outgoing network traffic based on security rules
Explanation:A Firewall acts as a barrier between a trusted internal network and untrusted external networks (like the Internet).
Incorrect! Try again.
33Which cybersecurity role involves overseeing the entire security posture of an organization?
A.Chief Information Security Officer (CISO)
B.Python Developer
C.Help Desk Support
D.Graphic Designer
Correct Answer: Chief Information Security Officer (CISO)
Explanation:The CISO is a senior-level executive responsible for establishing and maintaining the enterprise vision, strategy, and program to ensure information assets and technologies are adequately protected.
Incorrect! Try again.
34What is SQL Injection?
A.Injecting a virus into the hardware
B.Inserting malicious SQL code into input fields to manipulate a database
C.A medical procedure for computers
D.Spamming an email inbox
Correct Answer: Inserting malicious SQL code into input fields to manipulate a database
Explanation:SQL Injection is a code injection technique used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution.
Incorrect! Try again.
35Which compliance standard applies specifically to the payment card industry?
A.HIPAA
B.PCI-DSS
C.GDPR
D.FERPA
Correct Answer: PCI-DSS
Explanation:PCI-DSS (Payment Card Industry Data Security Standard) is an information security standard for organizations that handle branded credit cards.
Incorrect! Try again.
36What is the concept of Least Privilege?
A.Giving users the maximum access possible
B.Giving users only the access rights they need to perform their job
C.Giving everyone administrator rights
D.Not giving anyone any access
Correct Answer: Giving users only the access rights they need to perform their job
Explanation:The Principle of Least Privilege states that a subject should be given only those privileges needed for it to complete its task.
Incorrect! Try again.
37Which of the following helps in Email Security?
A.Opening all attachments immediately
B.Disabling spam filters
C.Using email encryption (PGP/S/MIME) and verifying sender identity
D.Sharing your email password with colleagues
Correct Answer: Using email encryption (PGP/S/MIME) and verifying sender identity
Explanation:Encryption ensures message confidentiality, and sender verification prevents spoofing/phishing.
Incorrect! Try again.
38In the context of passwords, what is Entropy?
A.The length of the password
B.The randomness or unpredictability of the password
C.The time it takes to type the password
D.The number of times a password has been used
Correct Answer: The randomness or unpredictability of the password
Explanation:Entropy measures the unpredictability of a password. Higher entropy () means the password is harder to guess or brute-force.
Incorrect! Try again.
39What is Scareware?
A.Hardware that looks scary
B.Malware that tricks users into visiting malware-infested sites by claiming their computer is infected
C.A Halloween themed website
D.A virus that makes the computer scream
Correct Answer: Malware that tricks users into visiting malware-infested sites by claiming their computer is infected
Explanation:Scareware is a form of malware which uses social engineering to cause shock, anxiety, or the perception of a threat in order to manipulate users into buying unwanted software.
Incorrect! Try again.
40Using public Wi-Fi without a VPN exposes you to:
A.Lower battery life
B.Packet sniffing and MitM attacks
C.Screen burnout
D.Keyboard failure
Correct Answer: Packet sniffing and MitM attacks
Explanation:Public Wi-Fi networks are often unencrypted, allowing attackers on the same network to intercept data (Packet Sniffing) or position themselves between you and the router (MitM).
Incorrect! Try again.
41What does a Security Operations Center (SOC) Analyst do?
A.Develops marketing strategies
B.Monitors and responds to security alerts and incidents
C.Fixes hardware printers
D.Writes the company code of conduct
Correct Answer: Monitors and responds to security alerts and incidents
Explanation:A SOC Analyst is responsible for monitoring an organization's IT infrastructure to detect and respond to cybersecurity threats in real-time.
Incorrect! Try again.
42Which of the following is a Soft Skill required for cybersecurity professionals?
A.Python Programming
B.TCP/IP Networking
C.Problem Solving and Communication
D.Linux Administration
Correct Answer: Problem Solving and Communication
Explanation:While technical skills are vital, Soft Skills like communication, problem-solving, and adaptability are crucial for explaining threats to non-technical stakeholders.
Incorrect! Try again.
43What is Rootkit?
A.A kit for planting trees
B.A collection of software tools that enables unauthorized access to a computer while hiding its presence
C.An administrator password
D.A type of antivirus
Correct Answer: A collection of software tools that enables unauthorized access to a computer while hiding its presence
Explanation:A Rootkit is designed to provide continued privileged access to a computer while actively hiding its presence from administrators.
Incorrect! Try again.
44What is the main purpose of Patch Management?
A.To fix clothes
B.To apply updates to software to correct security vulnerabilities and bugs
C.To organize network cables
D.To manage user passwords
Correct Answer: To apply updates to software to correct security vulnerabilities and bugs
Explanation:Patch management is the process of distributing and applying updates to software to prevent vulnerabilities (like those used in Zero-day attacks) from being exploited.
Incorrect! Try again.
45Which attack involves an attacker listening to network traffic to capture sensitive information like passwords?
A.Sniffing
B.Phishing
C.Spamming
D.Jamming
Correct Answer: Sniffing
Explanation:Sniffing (or packet sniffing) involves capturing and analyzing data packets flowing through a network.
Incorrect! Try again.
46What is Baiting in social engineering?
A.Leaving a malware-infected physical device (like a USB) for a victim to find
B.Sending a phishing email
C.Calling the victim
D.Hacking the server directly
Correct Answer: Leaving a malware-infected physical device (like a USB) for a victim to find
Explanation:Baiting relies on the curiosity or greed of the victim. An example is leaving a USB drive labeled "Confidential" or "Payroll" in a parking lot.
Incorrect! Try again.
47Which is NOT a valid phase in the NIST Cybersecurity Framework?
A.Identify
B.Protect
C.Recover
D.Retaliate
Correct Answer: Retaliate
Explanation:The NIST Framework consists of Identify, Protect, Detect, Respond, and Recover. Retaliation (Hack Back) is generally illegal and not a standard framework component.
Incorrect! Try again.
48What is Cross-Site Scripting (XSS)?
A.Injecting malicious scripts into trusted websites viewed by other users
B.Crossing cables in the server room
C.Writing a script to cross-reference data
D.Blocking a site
Correct Answer: Injecting malicious scripts into trusted websites viewed by other users
Explanation:XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user.
Incorrect! Try again.
49HIPAA compliance is primarily concerned with:
A.Credit card data
B.Student records
C.Protected Health Information (PHI)
D.Government secrets
Correct Answer: Protected Health Information (PHI)
Explanation:HIPAA (Health Insurance Portability and Accountability Act) sets the standard for protecting sensitive patient data.
Incorrect! Try again.
50If a password has $8$ characters and uses only lowercase letters ($26$ possibilities), the number of possible combinations is:
A.
B.
C.
D.
Correct Answer:
Explanation:The formula for password combinations is , where is the number of possible characters and is the length. Here, .
Incorrect! Try again.
Give Feedback
Help us improve by sharing your thoughts or reporting issues.