Unit 1 - Practice Quiz

1 Which principle of the CIA triad ensures that information is not disclosed to unauthorized individuals, entities, or processes?

2 A Distributed Denial of Service (DDoS) attack is a direct assault on which element of the CIA triad?

3 Which component of the CIA triad guarantees that data is trustworthy and has not been altered by unauthorized persons?

4 Putting a lock on a server room door is an example of what type of security control?

5 An organization's information security policy, which outlines rules for employees, is what kind of security control?

6 A firewall that blocks unauthorized network traffic is an example of which type of control?

7 What type of malware disguises itself as a legitimate program but performs malicious activities once executed?

8 Which type of malicious software is specifically designed to self-replicate and spread across a network without needing to attach to a host file?

9 What is the term for an attacker who uses pre-made tools and scripts to conduct attacks, but lacks deep technical expertise?

10 Which threat actor is primarily motivated by a political agenda or social cause?

11 What does the term 'attack surface' refer to in cyber security?

12 What is the primary goal of a 'phishing' attack?

13 An attacker calls an employee pretending to be from the IT help desk to obtain their password. What is this attack called?

14 What is the primary purpose of cryptography in cyber security?

15 Which type of encryption uses a single key for both the encryption and decryption processes?

16 In asymmetric cryptography, also known as public-key cryptography, how many keys are used?

17 If you encrypt a message with someone's public key, what must be used to decrypt it?

18 What is the main role of a Certificate Authority (CA) in a Public Key Infrastructure (PKI)?

19 A digital certificate is used to bind a public key to a(n) ____.

20 Which cryptographic process is one-way (irreversible) and is used to verify data integrity by creating a unique, fixed-size output?

21 A database administrator discovers that a critical financial record was modified by an unauthorized user. This unauthorized modification represents a failure of which component of the CIA triad?

22 A company wants to prevent unauthorized personnel from entering a secure data center. They install a mantrap that only allows one person to pass through at a time after successful authentication. What are the primary types of security controls represented by the policy requiring authentication and the mantrap itself, respectively?

23 A sophisticated, long-term cyberattack is discovered on a major defense contractor. The attackers used a zero-day exploit, moved laterally through the network over several months, and exfiltrated sensitive research data. The attack shows signs of significant funding and organization. Which type of threat actor is most likely responsible?

24 An accountant receives an email that appears to be from the company's CEO, urgently requesting a wire transfer to a new vendor for a secret acquisition. The email uses a tone of authority and urgency, warning the accountant not to discuss the matter with anyone. This is a classic example of which social engineering technique?

25 A software development team needs to ensure that user passwords are not stored in plaintext. They need a cryptographic method that makes it impossible to reverse the process and retrieve the original password, but allows for verification. Which type of algorithm is most suitable for this purpose?

26 In a Public Key Infrastructure (PKI), what is the primary function of a Certificate Authority (CA)?

27 Which of the following best distinguishes a computer worm from a computer virus?

28 A company decides to allow employees to connect their personal mobile devices to the corporate Wi-Fi network to access email and internal documents. From a security perspective, this policy decision primarily increases the organization's:

29 Alice wants to send a message to Bob. She wants to ensure that only Bob can read the message (confidentiality) and that Bob can verify the message came from her (authenticity/non-repudiation). How can she achieve this using asymmetric cryptography?

30 A system is designed to log all user actions. In the event of a dispute, these logs can be used to prove that a specific user performed a specific action, and the user cannot deny it. This capability is known as:

31 A security audit reveals that a company's developers are using weak, default passwords for database service accounts. The security team implements a technical solution that enforces a strong password policy (minimum length, complexity, and history) for all service accounts. This solution is best described as which type of control?

32 An attacker installs malware on a victim's computer that encrypts all of their personal files. A message then appears on the screen demanding a payment in cryptocurrency in exchange for the decryption key. This type of malware is known as:

33 An application needs to encrypt large amounts of streaming video data in real-time. Performance and speed are critical. Which cryptographic algorithm would be the most appropriate choice for this task?

34 A web browser attempts to connect to an e-commerce site, but it displays a warning that the site's certificate is not trusted. The most likely reason for this is that the certificate was:

35 A developer hard-codes a database password directly into the source code of a mobile application. What kind of vulnerability does this create, and on which attack surface?

36 An attacker calls an employee, pretending to be from the IT help desk. The attacker tells the employee that their account has been flagged for suspicious activity and that they need the employee to confirm their username and password to secure the account. This tactic is an example of:

37 A disgruntled system administrator who is about to be fired uses their high-level privileges to delete critical backups and install a logic bomb set to erase servers a week after their departure. This individual is best classified as which type of threat actor?

38 What is the primary purpose of using a digital signature in an email communication?

39 What is the function of a Certificate Revocation List (CRL) or the Online Certificate Status Protocol (OCSP)?

40 Asymmetric cryptography, like RSA, uses a key pair. If a message is encrypted with a user's public key, what is the consequence?

41 A system uses digital signatures to ensure that a sender cannot deny sending a message (non-repudiation) and that the message has not been altered (integrity). If an attacker manages to compromise the sender's private key but does not alter any previously signed messages, which security concept is most directly and immediately compromised from the moment of the key theft, even before the attacker uses the key?

42 A company implements a policy requiring all developers to attend mandatory annual security training. During a code review, a senior developer spots a critical SQL injection vulnerability. What is the relationship between these two security controls in this scenario?

43 A security analyst is examining a new malware sample. They observe that the malware's decryption routine changes with each new infection, and the core malicious payload is rearranged and recompiled. However, the logical function of the payload remains identical. This malware would be most accurately classified as:

44 An attack is detected against a major energy grid. The TTPs (Tactics, Techniques, and Procedures) involve zero-day exploits for SCADA systems, custom-written C2 malware that uses steganography for communication, and a clear motivation to disrupt operations rather than steal data for financial gain. The operation is slow, methodical, and shows extreme patience over several months. This actor is most likely:

45 A company is migrating its monolithic application to a microservices architecture hosted in Kubernetes. The new architecture involves dozens of internal APIs, a public-facing API gateway, multiple databases, and a service mesh for inter-service communication. How does this migration primarily affect the company's attack surface?

46 An attacker first calls an employee pretending to be from IT, stating they've detected malware and need the employee's computer name. The employee provides it. An hour later, a different attacker calls the same employee, claiming to be a senior IT manager. This attacker says, "Hi [Employee Name], this is Bob from IT. I'm following up on the malware ticket for computer [Computer Name]. To clean the device, I need you to navigate to this site and enter the code I provide." This multi-stage attack is a sophisticated example of:

47 A hardware security module (HSM) implements AES-256. A researcher discovers that the time required to perform an encryption operation is slightly correlated with the number of '1' bits in the secret key. What type of attack could exploit this vulnerability?

48 A web server is configured to use OCSP Stapling. A client connects, and the server presents its certificate along with a time-stamped, CA-signed OCSP response indicating the certificate is 'good'. However, the Certificate Authority's OCSP responder has been offline for the past hour. Why would the client still accept the server's certificate?

49 A system uses a hybrid encryption scheme: it generates a random symmetric key (e.g., AES) to encrypt a large file, then encrypts the AES key using the recipient's public RSA key. The encrypted file and the encrypted AES key are sent to the recipient. If the recipient's private RSA key is compromised, what is the scope of the damage?

50 In a multi-tenant cloud environment, a flaw in the hypervisor allows a virtual machine in Tenant A's network to read memory belonging to a virtual machine in Tenant B's network. This represents a failure of which fundamental security principle from Tenant B's perspective?

51 A network's defense-in-depth strategy includes a firewall, an Intrusion Prevention System (IPS), and host-based anti-malware. An attacker uses a zero-day exploit encrypted with TLS to compromise a web server. The malicious payload then uses fileless techniques, operating only in memory to avoid detection by the anti-malware. Which statement best analyzes the failure of the security controls?

52 A security firm observes an ongoing attack that has persisted for 18 months. The attackers use a custom remote access trojan (RAT), move laterally through the network using legitimate credentials obtained via phishing, and slowly exfiltrate small, encrypted chunks of intellectual property. The command-and-control (C2) servers are rotated weekly. The primary goal appears to be long-term espionage. This is characteristic of:

53 An employee in the finance department clicks on a sophisticated spear-phishing email and their workstation becomes infected. The malware logs their keystrokes, capturing credentials for the accounting system, which are then used to initiate a fraudulent wire transfer. From the company's perspective, this employee is best classified as:

54 A developer exposes a new internal REST API endpoint (/api/v1/user/{id}/details) used by the front-end application to fetch user data. They forget to implement an authorization check, assuming that since the API is not public, it's safe. An authenticated but low-privileged user discovers they can change the {id} in the API call to view the details of any other user, including administrators. This vulnerability is best described as:

55 An individual posts on social media about losing their company ID badge. An attacker creates a fake ID with the individual's picture and company logo, then waits by a secure entrance. When an employee approaches, the attacker pretends to be on a call and fumbles with their fake badge, saying "Ugh, my badge isn't working again! Can you let me in?" This technique, where an attacker makes themselves appear to be the one in need of help to exploit the target's desire to be helpful, is known as:

56 The RSA algorithm relies on the mathematical difficulty of factoring the product of two large prime numbers. Let the public key be and the private key be , where . What would be the most direct consequence if an attacker discovered the value of Euler's totient function, , without discovering or themselves?

57 A mobile application uses HTTP Public Key Pinning (HPKP) to ensure it only connects to servers presenting a specific public key. The company's server certificate expires, and a new one is issued with a new key pair. Users with the old version of the app are now unable to connect. What is the core security concept that caused this operational failure?

58 Given the rise of practical quantum computing, which of the following cryptographic migration strategies is most logical and urgent for an organization that relies on TLS for data-in-transit security?

59 A hospital's electronic health record (EHR) system is targeted by two separate attacks in one week. Attack A is a DDoS attack that overwhelms the network, making the EHR system inaccessible to doctors. Attack B is a ransomware attack that encrypts all patient records, making them unreadable. Both attacks are a failure of which principle of the CIA triad, but for fundamentally different reasons?

60 A corporate merger requires trusting certificates issued by the new parent company's PKI. The parent company's Root CA is offline and should not be added to the client trust stores directly. The parent provides a cross-signed intermediate certificate: (Parent Intermediate CA cert, signed by Child Root CA). What is the primary purpose of this specific object in establishing a trust path from a 'child' company client to a server with a cert from the 'parent' company?