1 $Which part of the internet is not indexed by standard search engines and requires specific software, configurations, or authorization to access?$

A.

Deep Web

B.

Surface Web

C.

Transparent Web

D.

Dark Web

2 $What is the primary routing mechanism used by the Tor network to maintain user anonymity?$

A.

Tomato Routing

B.

Packet Switching

C.

Garlic Routing

D.

Onion Routing

3 $Which Top-Level Domain (TLD) is specifically associated with sites hosted on the Tor network?$

A.

.com

B.

.exe

C.

.onion

D.

.tor

4 $In the context of email basics, what does SMTP stand for?$

A.

Secure Mail Transmission Protocol

B.

Standard Mail Text Protocol

C.

Simple Mail Transfer Protocol

D.

System Mail Transfer Protocol

5 $Which protocol is primarily used by email clients to retrieve messages from a mail server?$

A.

FTP

B.

SNMP

C.

IMAP

D.

SMTP

6 $What is the most critical section of an email for forensic analysis when tracing the origin of a message?$

A.

The Email Body

B.

The Email Header

C.

The Signature Block

D.

The Subject Line

7 $Which specific field in an email header usually reveals the IP address of the sender?$

A.

Received

B.

From

C.

To

D.

Return-Path

8 $What is the term for an email attack where the sender manipulates the address to make it appear as if it came from a trusted source?$

A.

Email Spoofing

B.

Email Spiking

C.

Email Bombing

D.

Email Sniffing

9 $In a phishing investigation, what is 'Typosquatting'?$

A.

Encrypting the email body

B.

Deleting email logs

C.

Using all caps in the subject line

D.

Registering a domain name extremely similar to a legitimate one

10 $Which type of phishing attack specifically targets high-profile executives like CEOs or CFOs?$

A.

Smishing

B.

Vishing

C.

Whaling

D.

Spear Phishing

11 $What is the primary function of an Intrusion Detection System (IDS)?$

A.

To encrypt network data

B.

To block all network traffic

C.

To act as a web server

D.

To monitor network traffic for suspicious activity

12 $How does an Intrusion Prevention System (IPS) differ mainly from an IDS?$

A.

IPS takes active action to stop the threat

B.

IPS only logs data

C.

IPS is slower

D.

IPS cannot detect viruses

13 $Which type of IDS detection method relies on a database of known attack patterns?$

A.

Signature-based detection

B.

Heuristic detection

C.

Behavior-based detection

D.

Anomaly-based detection

14 $What is a 'False Positive' in the context of IDS/IPS?$

A.

A system crash

B.

A legitimate activity flagged as malicious

C.

A malicious attack that is missed

D.

A successful virus removal

15 $What does WAF stand for in web security?$

A.

Web Application Firewall

B.

Wireless Access Firewall

C.

Windows Authentication File

D.

Wide Area Firewall

16 $At which layer of the OSI model does a Web Application Firewall (WAF) primarily operate?$

A.

Layer 2 (Data Link)

B.

Layer 7 (Application)

C.

Layer 4 (Transport)

D.

Layer 3 (Network)

17 $Which attack involves injecting malicious SQL queries into input fields to manipulate a database?$

A.

Cross-Site Scripting (XSS)

B.

SQL Injection

C.

CSRF

D.

Buffer Overflow

18 $What type of web attack involves injecting malicious scripts into trusted websites viewed by other users?$

A.

SQL Injection

B.

Brute Force

C.

Directory Traversal

D.

Cross-Site Scripting (XSS)

19 $Which attack forces an end user to execute unwanted actions on a web application in which they are currently authenticated?$

A.

SQL Injection

B.

Packet Sniffing

C.

Man-in-the-Middle

D.

Cross-Site Request Forgery (CSRF)

20 $What is a 'Directory Traversal' attack?$

A.

Overloading the server with requests

B.

Stealing cookies

C.

Accessing restricted directories and files by manipulating file paths

D.

Injecting SQL commands

21 $In Email Forensics, what is the role of an MTA (Mail Transfer Agent)?$

A.

To route and transfer emails between servers

B.

To attach files

C.

To display emails to the user

D.

To read emails

22 $What is the standard port number for SMTP traffic?$

A.

21

B.

443

C.

80

D.

25

23 $Which component of an IDS is responsible for collecting data from the network?$

A.

Database

B.

Console

C.

Sensor

D.

Analyzer

24 $What is the main disadvantage of Anomaly-based IDS?$

A.

It cannot detect new attacks

B.

It is only for wireless networks

C.

It has a high rate of false positives

D.

It requires virus signatures

25 $Which web attack aims to make a machine or network resource unavailable to its intended users?$

A.

SQL Injection

B.

DoS (Denial of Service)

C.

Privilege Escalation

D.

Phishing

26 $What does a 'Logic Bomb' generally refer to in cyber crime?$

A.

Malicious code set to execute when specific conditions are met

B.

A type of firewall

C.

A failed hacking attempt

D.

A physical explosive

27 $Which of the following is a tool often used for network intrusion detection?$

A.

Word

B.

Photoshop

C.

Excel

D.

Snort

28 $In the context of the Dark Web, what is an 'Exit Node'?$

A.

The server where traffic leaves the Tor network to reach the open internet

B.

An offline server

C.

The first server you connect to

D.

A firewall rule

29 $What is the first step in an email crime investigation?$

A.

Acquiring and preserving the email evidence

B.

Seizing the suspect's computer

C.

Arresting the suspect

D.

Deleting the spam

30 $Which email protocol leaves the original email on the server by default?$

A.

POP3

B.

HTTP

C.

IMAP

D.

FTP

31 $What is 'Session Hijacking'?$

A.

Breaking a password

B.

Taking over a user's active web session by stealing the session ID

C.

Stealing a laptop

D.

Phishing for credit cards

32 $Which of the following is a passive security device?$

A.

Proxy Server

B.

IPS

C.

Firewall

D.

IDS

33 $In a SQL injection attack, what does the input' OR '1'='1 typically achieve?$

A.

It deletes the database

B.

It shuts down the server

C.

It evaluates to True, bypassing authentication

D.

It encrypts the data

34 $Which type of XSS attack stores the malicious script permanently on the target server (e.g., in a forum post)?$

A.

Reflected XSS

B.

Stored (Persistent) XSS

C.

DOM-based XSS

D.

Local XSS

35 $What is the purpose of 'DKIM' in email security?$

A.

To archive emails

B.

To verify that an email message was not forged or altered

C.

To block spam

D.

To encrypt the email body

36 $A 'Zero-day' attack refers to:$

A.

An attack that takes zero seconds

B.

An attack exploiting a vulnerability unknown to the software vendor

C.

An attack on a closed network

D.

An attack that happens at midnight

37 $Which part of the email header is easiest to spoof?$

A.

From address

B.

Received-By IP

C.

Message-ID

D.

DKIM Signature

38 $What does a Host-based IDS (HIDS) monitor?$

A.

Activity and logs on a specific individual device

B.

Wireless signals only

C.

Traffic on the entire subnet

D.

Traffic at the ISP level

39 $What is 'Bitcoin's' primary role in the Dark Web?$

A.

It is a common method for anonymous payment

B.

It is the software used to browse

C.

It is the hosting provider

D.

It acts as a firewall

40 $Which attack involves an attacker intercepting communication between two parties?$

A.

DDoS

B.

Man-in-the-Middle (MITM)

C.

Phishing

D.

Logic Bomb

41 $What is 'Business Email Compromise' (BEC)?$

A.

A virus that deletes emails

B.

Spam advertising

C.

Email server maintenance

D.

A scam compromising legitimate business email accounts to conduct unauthorized transfers

42 $The 'Deep Web' includes:$

A.

Google search results

B.

Only social media

C.

Anything not indexed by search engines (e.g., medical records, academic databases)

D.

Only illegal content

43 $Which mechanism in a WAF allows only pre-approved traffic and blocks everything else?$

A.

Blacklisting

B.

Greylisting

C.

Whitelisting

D.

Redlisting

44 $In web attacks, what is a 'Brute Force' attack?$

A.

Guessing passwords by trying every possible combination

B.

Physically breaking the server

C.

Injecting SQL code

D.

Sending a virus via email

45 $What distinguishes a Distributed Denial of Service (DDoS) from a standard DoS?$

A.

DDoS is slower

B.

DDoS uses multiple compromised systems (botnet) to attack

C.

DDoS targets emails only

D.

DDoS uses a single attacker machine

46 $Which file on a web server determines which parts of the site crawlers are permitted to access?$

A.

robots.txt

B.

style.css

C.

config.php

D.

index.html

47 $What is the primary utility of 'Packet Sniffing' in forensics?$

A.

To encrypt hard drives

B.

To clean viruses

C.

To edit files remotely

D.

To capture and analyze data traffic moving across a network

48 $In email forensics, 'MUA' stands for:$

A.

Mail User Agent

B.

Mail Unified Access

C.

Master User Authorization

D.

Mail Upload Agent

49 $Which vulnerability allows an attacker to include a file, usually exploiting a 'dynamic file inclusion' mechanism implemented in the target application?$

A.

Syn Flood

B.

Brute Force

C.

Dictionary Attack

D.

Local File Inclusion (LFI)

50 $The 'Silk Road' was a famous marketplace located on:$

A.

A private LAN

B.

The Dark Web

C.

Facebook

D.

The Surface Web

Unit 5 - Practice Quiz