Unit 1: Summarize Fundamental Security Concepts, Compare Threat Types, Explain Cryptographic Solutions - Practice Quiz

1 In the CIA triad, what does the letter C stand for?

2 Which security goal ensures that data has not been altered by unauthorized parties?

3 The principle that users should be given only the access they need to do their job is called:

4 Which concept provides proof that a party cannot deny having performed an action?

5 A locked door and a security guard are examples of which type of security control?

6 A firewall configured to block traffic is best classified as which category of control?

7 A security control that is designed to discourage an attacker, such as a warning sign, is a:

8 Company security policies and employee training are examples of which type of control?

9 A threat actor motivated by political or social causes is best described as a:

10 An inexperienced attacker who uses existing tools and scripts written by others is called a:

11 Which threat actor typically has the most resources and government backing?

12 A current employee who misuses their legitimate access to harm the organization is an example of a(n):

13 What best describes an attack surface?

14 Which action most directly reduces a system's attack surface?

15 Sending a fraudulent email that pretends to be from a trusted source to steal credentials is called:

16 A targeted phishing attack aimed at a specific high-level executive is known as:

17 A social engineering attack carried out over a voice phone call is called:

18 Which type of encryption uses the same key for both encryption and decryption?

19 Which of the following is a widely used symmetric encryption algorithm?

20 In a Public Key Infrastructure (PKI), which entity is responsible for issuing digital certificates?

21 An organization implements a system where a user who sends an encrypted, digitally signed email cannot later deny having sent it. Which security concept does this directly support?

22 A hospital database must remain accessible to doctors during emergencies while ensuring patient records are not altered by unauthorized staff. Which two elements of the CIA triad are the primary focus?

23 After a breach, a company installs motion-activated lights and warning signage to discourage intruders from attempting entry. How are these controls best categorized?

24 A firewall rule set and an encryption algorithm are both examples of which control category based on how they are implemented?

25 An organization cannot patch a legacy server due to vendor limitations, so it isolates the server on a segmented network with strict access rules. Which control type best describes this isolation measure?

26 A threat actor possessing significant funding, advanced tools, and the goal of long-term espionage against a government agency is most accurately described as which type?

27 An attacker defaces a corporation's website to protest its environmental policies rather than for financial gain. Which attribute best characterizes this threat actor's motivation?

28 Which characteristic most clearly distinguishes an insider threat from an external threat actor?

29 A company moves several internal applications to the public cloud and exposes new APIs to partners. What is the most direct security consequence of this change?

30 A security team disables unused services, closes open ports, and removes default accounts on a server. What is the primary goal of these actions?

31 An employee receives a phone call from someone claiming to be from IT support, urgently requesting their password to "fix an account lockout." Which social engineering principle is being exploited most heavily?

32 A targeted phishing email is crafted specifically for a company's CFO, referencing a real recent acquisition to appear legitimate. What is this attack best classified as?

33 An attacker leaves USB drives labeled "Salary Data" in a company parking lot, hoping an employee plugs one into a work computer. Which technique does this represent?

34 A developer needs to encrypt a large file quickly and both parties already share a secret key securely. Which type of algorithm is most appropriate?

35 Two parties who have never met need to agree on a shared secret key over an insecure channel without transmitting the key itself. Which algorithm is designed for this purpose?

36 A system stores user passwords by applying SHA-256 along with a unique random value for each user before hashing. What is the primary purpose of adding this random value?

37 When a web browser validates a website's TLS certificate, what role does the Certificate Authority (CA) play?

38 An administrator needs to immediately invalidate a certificate because its private key was compromised. Which PKI mechanism allows clients to check whether a certificate is still valid?

39 In asymmetric cryptography, if Alice wants to send a confidential message that only Bob can read, which key should she use to encrypt it?

40 A company encrypts all data stored on its laptop hard drives so that information remains protected if a device is lost or stolen. Which cryptographic solution does this describe?

41 An organization implements a system where a user's actions are cryptographically signed and logged such that the user cannot later deny performing them. However, an auditor notes that the signing keys are stored in a shared location accessible by three administrators. Which core security goal is most undermined by this configuration?

42 A company deploys the following after a breach: an IDS alert rule, a disciplinary policy for the responsible employee, mandatory security awareness training, and a restored backup. Classify these four measures by control function in the order listed.

43 A threat actor exhibits the following profile: substantial funding, long dwell times, custom zero-day tooling, and objectives aligned with geopolitical intelligence gathering rather than financial gain. During analysis, which attribute best distinguishes this actor from an organized crime group with similar resources?

44 A microservices application exposes 12 internal APIs through a single API gateway, 3 of which are also published externally. A security team wants to minimize the attack surface without reducing functionality. Which action yields the greatest reduction?

45 An attacker calls an employee claiming to be from IT, references a real ongoing system migration, creates urgency about a deadline, and asks the employee to "verify" their credentials on a lookalike portal. Which combination of principles is the attacker primarily exploiting?

46 A developer must encrypt 500 GB of archived data at rest and wants both strong confidentiality and integrity verification with minimal key management overhead. Which choice is most appropriate?

47 A client receives a server certificate chain. The leaf certificate is valid and signed by an intermediate CA, but the intermediate's certificate was revoked by the root CA this morning. The client has a cached OCSP response for the intermediate from yesterday indicating "good." What is the correct security outcome?

48 Two parties want to establish a shared symmetric key over an insecure channel while ensuring that compromise of a long-term private key in the future does not expose past session keys. Which property and mechanism satisfy this?

49 A system uses a 128-bit symmetric cipher. An analyst claims that a quantum adversary running Grover's algorithm reduces its effective security. What is the resulting effective security strength, and what is the standard mitigation?

50 An organization adopts a Zero Trust model. A legacy application grants a user full database access for 8 hours after a single login. Which Zero Trust principle is most directly violated?

51 A regulated company cannot patch a vulnerable legacy server due to vendor constraints. To meet audit requirements, they isolate it on a segmented VLAN with strict ACLs and enhanced monitoring. In control terminology, how is this best described?

52 An insider with legitimate privileged access gradually exfiltrates data over months, matching normal access patterns to avoid detection. Which attribute pairing best characterizes the difficulty of defending against this actor compared to an external attacker?

53 A company moves on-prem workloads to IaaS. Which statement correctly reflects how the attack surface and responsibility change under the shared responsibility model?

54 An attacker compromises a popular niche industry forum that target-company engineers frequent, planting a drive-by exploit. No individual is directly contacted. Which attack type is this, and what makes it effective against security-aware targets?

55 A protocol designer wants to hash passwords for storage. They compare SHA-256, bcrypt, and MD5. Which choice and rationale is correct for resisting modern offline cracking?

56 An administrator wants certificate revocation checking that avoids the privacy leak of a client contacting the CA for every connection and avoids large CRL downloads. Which mechanism satisfies both goals?

57 A messaging app needs confidentiality, integrity, authentication of sender, and non-repudiation for each message. Which cryptographic construction set correctly provides all four?

58 A developer implements AES-CTR mode but reuses the same key and nonce for two different plaintext messages. What is the critical consequence?

59 A security architect must balance the CIA triad for a stock-trading platform where millisecond availability is critical but transaction integrity is legally mandated. During a DDoS attack, which design decision reflects the correct prioritization trade-off?

60 During certificate enrollment, a subscriber generates a key pair locally and submits a CSR. An auditor asks why the private key never appears in the CSR. Which explanation is correct?