Sample Questions and Answers
What is the key benefit of using multi-factor authentication (MFA)?
A) Faster logins
B) Additional security by requiring multiple verification factors
C) Simplifies password recovery
D) Eliminates the need for passwords
Answer: B
Explanation: MFA requires more than one authentication factor, making unauthorized access harder.
What kind of malware is typically used to demand ransom in exchange for access to data?
A) Virus
B) Worm
C) Ransomware
D) Adware
Answer: C
Explanation: Ransomware encrypts data and demands payment for decryption.
What is a “honeypot” in cybersecurity?
A) A type of firewall
B) A decoy system used to detect and analyze attacks
C) A password cracking tool
D) An encryption protocol
Answer: B
Explanation: Honeypots attract attackers to study their methods and gather intelligence.
Which layer of the OSI model is responsible for end-to-end communication?
A) Physical
B) Data Link
C) Transport
D) Application
Answer: C
Explanation: The Transport layer manages data transmission between hosts.
What is “brute force” attack?
A) Guessing passwords by systematically trying all possible combinations
B) Social engineering attack
C) Exploiting software vulnerabilities
D) Sending phishing emails
Answer: A
Explanation: Brute force attacks try every possible password until the correct one is found.
What tool is commonly used for vulnerability scanning?
A) Nmap
B) Nessus
C) Metasploit
D) Wireshark
Answer: B
Explanation: Nessus scans systems for known vulnerabilities.
What is the purpose of encryption in cybersecurity?
A) To make data unreadable to unauthorized users
B) To compress data
C) To scan for malware
D) To backup data
Answer: A
Explanation: Encryption protects confidentiality by converting data into unreadable formats.
Which of the following is NOT a common type of firewall?
A) Packet filtering
B) Stateful inspection
C) Proxy firewall
D) Anti-malware firewall
Answer: D
Explanation: There is no specific “anti-malware firewall”; anti-malware is a separate security measure.
What is an advantage of a cloud-based SOC?
A) Limited access
B) Scalability and remote monitoring capabilities
C) Requires more on-premises hardware
D) No internet dependency
Answer: B
Explanation: Cloud SOCs provide scalable resources and can be accessed remotely.
What is “social engineering” in cybersecurity?
A) Using software to engineer security solutions
B) Manipulating people to divulge confidential information
C) Writing secure code
D) Developing firewall rules
Answer: B
Explanation: Social engineering exploits human psychology rather than technical vulnerabilities.
What is the function of a “sandbox” in malware analysis?
A) To block all network traffic
B) To isolate and safely analyze suspicious files
C) To backup files
D) To encrypt data
Answer: B
Explanation: Sandboxes provide a controlled environment for testing malware without risk to the system.
What is a “zero-day” vulnerability?
A) A vulnerability that is publicly known and patched
B) A vulnerability unknown to the vendor and without a patch
C) A vulnerability only affecting old software
D) A vulnerability in hardware only
Answer: B
Explanation: Zero-day vulnerabilities are unknown and unpatched, posing high risk.
Which tool can be used for automated penetration testing?
A) Wireshark
B) Metasploit
C) Nmap
D) Snort
Answer: B
Explanation: Metasploit automates exploitation of vulnerabilities.
Which term describes the ability to track and identify the source of a cyberattack?
A) Attribution
B) Authentication
C) Authorization
D) Auditing
Answer: A
Explanation: Attribution involves identifying who conducted a cyberattack.
What does “patch management” involve?
A) Installing updates to fix security vulnerabilities
B) Monitoring network traffic
C) Writing secure code
D) Deleting old files
Answer: A
Explanation: Patch management ensures systems are updated to mitigate vulnerabilities.
What type of malware hides its presence and activities on a system?
A) Worm
B) Rootkit
C) Trojan
D) Ransomware
Answer: B
Explanation: Rootkits hide malware or processes to avoid detection.
What is the purpose of a firewall?
A) To scan for viruses
B) To filter incoming and outgoing network traffic based on security rules
C) To encrypt data
D) To perform backups
Answer: B
Explanation: Firewalls enforce security policies by controlling network traffic flow.
What is the meaning of “least privilege”?
A) Users have unrestricted access
B) Users have minimum access required to perform their tasks
C) Everyone is an administrator
D) Passwords never expire
Answer: B
Explanation: Minimizing access reduces the risk of misuse or compromise.
Which of the following is a commonly used tool for network traffic capture?
A) Wireshark
B) Nessus
C) Metasploit
D) Burp Suite
Answer: A
Explanation: Wireshark captures and analyzes live network data packets.
What is “data integrity”?
A) Ensuring data is protected from unauthorized changes
B) Encrypting data
C) Backing up data
D) Deleting old data
Answer: A
Explanation: Data integrity means data remains accurate and unaltered unless authorized.
What is the primary purpose of network segmentation in security?
A) To increase network speed
B) To isolate and limit the spread of attacks within a network
C) To simplify network architecture
D) To reduce the number of devices
Answer: B
Explanation: Network segmentation confines attacks to smaller parts of the network, limiting damage.
Which of the following is a type of endpoint detection and response (EDR) capability?
A) Real-time monitoring of endpoint activity
B) Only virus signature scanning
C) Firewall rule management
D) VPN configuration
Answer: A
Explanation: EDR tools continuously monitor endpoints for suspicious behavior.
What does “IOC” stand for in cybersecurity?
A) Internet of Computing
B) Indicator of Compromise
C) Internal Operating Code
D) Input/Output Controller
Answer: B
Explanation: IOCs are artifacts observed on a network or system that indicate a potential intrusion.
What is the primary difference between IDS and IPS?
A) IDS detects and alerts; IPS detects and blocks
B) IDS blocks traffic; IPS monitors logs
C) IDS encrypts data; IPS decrypts data
D) IDS is hardware; IPS is software only
Answer: A
Explanation: IDS is passive detection, IPS actively blocks threats.
What is a typical sign of a Distributed Denial of Service (DDoS) attack?
A) Slow network response or complete outage due to overwhelming traffic
B) Unauthorized file deletion
C) Malware installation
D) Data leakage
Answer: A
Explanation: DDoS floods resources causing service disruption.
Which log type is most useful for detecting login attempts?
A) Network traffic logs
B) Authentication logs
C) Application logs
D) DNS logs
Answer: B
Explanation: Authentication logs record successful and failed login attempts.
What is the main goal of vulnerability management?
A) To develop new software features
B) To identify, assess, and remediate security weaknesses
C) To monitor employee productivity
D) To encrypt data
Answer: B
Explanation: Vulnerability management reduces risk by addressing security flaws.
Which of the following is an example of reconnaissance phase in the cyber kill chain?
A) Scanning open ports
B) Data exfiltration
C) Deploying malware
D) Covering tracks
Answer: A
Explanation: Reconnaissance involves gathering information, such as scanning for open ports.
What does “sandboxing” help prevent?
A) Unauthorized network access
B) Execution of malicious code on the main system
C) Data corruption during backup
D) User password reuse
Answer: B
Explanation: Sandboxing isolates suspicious code to prevent harm.
Which of the following tools is primarily used for packet crafting and network probing?
A) Metasploit
B) Nmap
C) Netcat
D) Wireshark
Answer: C
Explanation: Netcat is often called the “Swiss Army knife” for network testing.
What is the function of a Security Information and Event Management (SIEM) system?
A) It collects and analyzes security logs in real-time to detect threats.
B) It installs security patches automatically.
C) It scans for malware.
D) It manages user passwords.
Answer: A
Explanation: SIEM aggregates data and provides actionable alerts.
Which attack involves intercepting communication between two parties without their knowledge?
A) Man-in-the-Middle (MITM)
B) Phishing
C) SQL Injection
D) Brute Force
Answer: A
Explanation: MITM attackers secretly relay or alter communication.
What is the difference between symmetric and asymmetric encryption?
A) Symmetric uses one key; asymmetric uses two keys (public/private)
B) Symmetric uses two keys; asymmetric uses one key
C) Symmetric is slower than asymmetric
D) They are the same
Answer: A
Explanation: Symmetric encryption uses a shared key; asymmetric uses key pairs.
What kind of attack exploits software bugs to gain unauthorized control?
A) Buffer overflow
B) Phishing
C) Social engineering
D) DDoS
Answer: A
Explanation: Buffer overflow attacks overwrite memory to execute arbitrary code.
What is the main goal of data exfiltration in cyberattacks?
A) Encrypt files
B) Steal confidential information
C) Block network access
D) Crash the system
Answer: B
Explanation: Exfiltration means unauthorized data transfer out of a system.
Which phase in incident response involves identifying the scope and impact of an incident?
A) Preparation
B) Detection and Analysis
C) Containment
D) Recovery
Answer: B
Explanation: Detection and analysis define what happened and the extent.
What is the term for unauthorized access to computer systems or data?
A) Authentication
B) Intrusion
C) Backup
D) Firewall
Answer: B
Explanation: Intrusion is unauthorized access or breach.
What does the term “pharming” refer to?
A) Redirecting users to fake websites to steal credentials
B) Brute force password guessing
C) Malware installation through email
D) Denial of Service attack
Answer: A
Explanation: Pharming manipulates DNS or hosts files to mislead users.
Which security control is preventive?
A) Antivirus software
B) Log analysis
C) Incident response
D) Forensics
Answer: A
Explanation: Preventive controls stop attacks before they occur.
What is the most secure method for storing passwords?
A) Plain text
B) Hashed and salted
C) Encrypted with a reversible key
D) In a spreadsheet
Answer: B
Explanation: Hashing with salt protects passwords even if the database is compromised.
What is the purpose of a Demilitarized Zone (DMZ) in network architecture?
A) To host internal-only resources
B) To provide a buffer zone between an internal network and the internet
C) To store backups
D) To encrypt data
Answer: B
Explanation: DMZs isolate external-facing services from internal networks.
What is “privilege escalation”?
A) Gaining unauthorized higher-level access on a system
B) Logging in as a normal user
C) Installing antivirus
D) Updating software
Answer: A
Explanation: Attackers exploit vulnerabilities to increase privileges.
What is the purpose of two-factor authentication (2FA)?
A) To speed up login
B) To require two distinct authentication methods for increased security
C) To share passwords
D) To encrypt files
Answer: B
Explanation: 2FA adds an extra layer beyond just passwords.
What is the first step in the Cyber Kill Chain?
A) Weaponization
B) Reconnaissance
C) Delivery
D) Exploitation
Answer: B
Explanation: Reconnaissance involves gathering information about the target.
Which of the following best describes a “logic bomb”?
A) Malware that triggers when specific conditions are met
B) Hardware failure
C) A network protocol
D) A firewall rule
Answer: A
Explanation: Logic bombs activate upon certain triggers, causing harm.
What does the “CIA Triad” stand for in cybersecurity?
A) Confidentiality, Integrity, Availability
B) Control, Identify, Authenticate
C) Connect, Intercept, Attack
D) Create, Implement, Analyze
Answer: A
Explanation: The CIA triad is a foundational security model.
Which protocol is used to securely transfer files over the internet?
A) FTP
B) HTTP
C) SFTP
D) SMTP
Answer: C
Explanation: SFTP provides secure file transfer over SSH.
What is a common sign of malware infection on a host?
A) Slow performance, unexpected crashes, unknown processes
B) Increased disk space
C) New hardware detected
D) Faster internet speeds
Answer: A
Explanation: Malware often degrades system performance and stability.
What is the role of a SOC analyst during an incident?
A) Monitor alerts, investigate anomalies, and coordinate response
B) Develop new software features
C) Manage backups only
D) Approve financial transactions
Answer: A
Explanation: SOC analysts are key responders in security incidents.
What technique is used to evade signature-based detection in malware?
A) Polymorphism
B) Encryption only
C) Using strong passwords
D) Firewall rules
Answer: A
Explanation: Polymorphic malware changes its code to avoid detection.
Reviews
There are no reviews yet.