1 $Which part of the internet is not indexed by standard search engines and requires specific software, configurations, or authorization to access?$

A.

Surface Web

B.

Dark Web

C.

Transparent Web

D.

Deep Web

2 $What is the primary routing mechanism used by the Tor network to maintain user anonymity?$

A.

Onion Routing

B.

Tomato Routing

C.

Garlic Routing

D.

Packet Switching

3 $Which Top-Level Domain (TLD) is specifically associated with sites hosted on the Tor network?$

A.

.onion

B.

.exe

C.

.com

D.

.tor

4 $In the context of email basics, what does SMTP stand for?$

A.

Standard Mail Text Protocol

B.

Secure Mail Transmission Protocol

C.

System Mail Transfer Protocol

D.

Simple Mail Transfer Protocol

5 $Which protocol is primarily used by email clients to retrieve messages from a mail server?$

A.

FTP

B.

SNMP

C.

IMAP

D.

SMTP

6 $What is the most critical section of an email for forensic analysis when tracing the origin of a message?$

A.

The Subject Line

B.

The Email Header

C.

The Signature Block

D.

The Email Body

7 $Which specific field in an email header usually reveals the IP address of the sender?$

A.

Return-Path

B.

To

C.

From

D.

Received

8 $What is the term for an email attack where the sender manipulates the address to make it appear as if it came from a trusted source?$

A.

Email Spiking

B.

Email Bombing

C.

Email Spoofing

D.

Email Sniffing

9 $In a phishing investigation, what is 'Typosquatting'?$

A.

Deleting email logs

B.

Encrypting the email body

C.

Using all caps in the subject line

D.

Registering a domain name extremely similar to a legitimate one

10 $Which type of phishing attack specifically targets high-profile executives like CEOs or CFOs?$

A.

Whaling

B.

Spear Phishing

C.

Smishing

D.

Vishing

11 $What is the primary function of an Intrusion Detection System (IDS)?$

A.

To act as a web server

B.

To encrypt network data

C.

To monitor network traffic for suspicious activity

D.

To block all network traffic

12 $How does an Intrusion Prevention System (IPS) differ mainly from an IDS?$

A.

IPS cannot detect viruses

B.

IPS takes active action to stop the threat

C.

IPS is slower

D.

IPS only logs data

13 $Which type of IDS detection method relies on a database of known attack patterns?$

A.

Signature-based detection

B.

Heuristic detection

C.

Behavior-based detection

D.

Anomaly-based detection

14 $What is a 'False Positive' in the context of IDS/IPS?$

A.

A legitimate activity flagged as malicious

B.

A successful virus removal

C.

A system crash

D.

A malicious attack that is missed

15 $What does WAF stand for in web security?$

A.

Windows Authentication File

B.

Wide Area Firewall

C.

Web Application Firewall

D.

Wireless Access Firewall

16 $At which layer of the OSI model does a Web Application Firewall (WAF) primarily operate?$

A.

Layer 4 (Transport)

B.

Layer 7 (Application)

C.

Layer 3 (Network)

D.

Layer 2 (Data Link)

17 $Which attack involves injecting malicious SQL queries into input fields to manipulate a database?$

A.

SQL Injection

B.

Cross-Site Scripting (XSS)

C.

Buffer Overflow

D.

CSRF

18 $What type of web attack involves injecting malicious scripts into trusted websites viewed by other users?$

A.

Cross-Site Scripting (XSS)

B.

Directory Traversal

C.

SQL Injection

D.

Brute Force

19 $Which attack forces an end user to execute unwanted actions on a web application in which they are currently authenticated?$

A.

Cross-Site Request Forgery (CSRF)

B.

Packet Sniffing

C.

Man-in-the-Middle

D.

SQL Injection

20 $What is a 'Directory Traversal' attack?$

A.

Injecting SQL commands

B.

Overloading the server with requests

C.

Accessing restricted directories and files by manipulating file paths

D.

Stealing cookies

21 $In Email Forensics, what is the role of an MTA (Mail Transfer Agent)?$

A.

To display emails to the user

B.

To route and transfer emails between servers

C.

To attach files

D.

To read emails

22 $What is the standard port number for SMTP traffic?$

A.

25

B.

21

C.

443

D.

80

23 $Which component of an IDS is responsible for collecting data from the network?$

A.

Sensor

B.

Database

C.

Analyzer

D.

Console

24 $What is the main disadvantage of Anomaly-based IDS?$

A.

It cannot detect new attacks

B.

It requires virus signatures

C.

It is only for wireless networks

D.

It has a high rate of false positives

25 $Which web attack aims to make a machine or network resource unavailable to its intended users?$

A.

Privilege Escalation

B.

SQL Injection

C.

DoS (Denial of Service)

D.

Phishing

26 $What does a 'Logic Bomb' generally refer to in cyber crime?$

A.

Malicious code set to execute when specific conditions are met

B.

A type of firewall

C.

A physical explosive

D.

A failed hacking attempt

27 $Which of the following is a tool often used for network intrusion detection?$

A.

Excel

B.

Word

C.

Photoshop

D.

Snort

28 $In the context of the Dark Web, what is an 'Exit Node'?$

A.

The first server you connect to

B.

The server where traffic leaves the Tor network to reach the open internet

C.

An offline server

D.

A firewall rule

29 $What is the first step in an email crime investigation?$

A.

Deleting the spam

B.

Seizing the suspect's computer

C.

Acquiring and preserving the email evidence

D.

Arresting the suspect

30 $Which email protocol leaves the original email on the server by default?$

A.

HTTP

B.

FTP

C.

IMAP

D.

POP3

31 $What is 'Session Hijacking'?$

A.

Breaking a password

B.

Stealing a laptop

C.

Phishing for credit cards

D.

Taking over a user's active web session by stealing the session ID

32 $Which of the following is a passive security device?$

A.

IPS

B.

Firewall

C.

IDS

D.

Proxy Server

33 $In a SQL injection attack, what does the input' OR '1'='1 typically achieve?$

A.

It deletes the database

B.

It shuts down the server

C.

It evaluates to True, bypassing authentication

D.

It encrypts the data

34 $Which type of XSS attack stores the malicious script permanently on the target server (e.g., in a forum post)?$

A.

Local XSS

B.

Reflected XSS

C.

Stored (Persistent) XSS

D.

DOM-based XSS

35 $What is the purpose of 'DKIM' in email security?$

A.

To verify that an email message was not forged or altered

B.

To archive emails

C.

To encrypt the email body

D.

To block spam

36 $A 'Zero-day' attack refers to:$

A.

An attack that happens at midnight

B.

An attack on a closed network

C.

An attack that takes zero seconds

D.

An attack exploiting a vulnerability unknown to the software vendor

37 $Which part of the email header is easiest to spoof?$

A.

Received-By IP

B.

From address

C.

Message-ID

D.

DKIM Signature

38 $What does a Host-based IDS (HIDS) monitor?$

A.

Traffic on the entire subnet

B.

Traffic at the ISP level

C.

Wireless signals only

D.

Activity and logs on a specific individual device

39 $What is 'Bitcoin's' primary role in the Dark Web?$

A.

It is a common method for anonymous payment

B.

It acts as a firewall

C.

It is the software used to browse

D.

It is the hosting provider

40 $Which attack involves an attacker intercepting communication between two parties?$

A.

DDoS

B.

Man-in-the-Middle (MITM)

C.

Logic Bomb

D.

Phishing

41 $What is 'Business Email Compromise' (BEC)?$

A.

Spam advertising

B.

Email server maintenance

C.

A virus that deletes emails

D.

A scam compromising legitimate business email accounts to conduct unauthorized transfers

42 $The 'Deep Web' includes:$

A.

Anything not indexed by search engines (e.g., medical records, academic databases)

B.

Only social media

C.

Only illegal content

D.

Google search results

43 $Which mechanism in a WAF allows only pre-approved traffic and blocks everything else?$

A.

Blacklisting

B.

Whitelisting

C.

Redlisting

D.

Greylisting

44 $In web attacks, what is a 'Brute Force' attack?$

A.

Sending a virus via email

B.

Guessing passwords by trying every possible combination

C.

Injecting SQL code

D.

Physically breaking the server

45 $What distinguishes a Distributed Denial of Service (DDoS) from a standard DoS?$

A.

DDoS is slower

B.

DDoS uses a single attacker machine

C.

DDoS uses multiple compromised systems (botnet) to attack

D.

DDoS targets emails only

46 $Which file on a web server determines which parts of the site crawlers are permitted to access?$

A.

config.php

B.

style.css

C.

index.html

D.

robots.txt

47 $What is the primary utility of 'Packet Sniffing' in forensics?$

A.

To clean viruses

B.

To capture and analyze data traffic moving across a network

C.

To edit files remotely

D.

To encrypt hard drives

48 $In email forensics, 'MUA' stands for:$

A.

Mail Unified Access

B.

Mail Upload Agent

C.

Mail User Agent

D.

Master User Authorization

49 $Which vulnerability allows an attacker to include a file, usually exploiting a 'dynamic file inclusion' mechanism implemented in the target application?$

A.

Local File Inclusion (LFI)

B.

Brute Force

C.

Syn Flood

D.

Dictionary Attack

50 $The 'Silk Road' was a famous marketplace located on:$

A.

The Dark Web

B.

The Surface Web

C.

A private LAN

D.

Facebook

Unit 5 - Practice Quiz