Past ExamsRwanda ICT preparation

Cybersecurity Analyst calculations with worked answers

Updated 16 September 2026 · 2 min read

Security work involves more numbers than people expect. Analysts judge password policies by their real strength, work out which addresses fall inside a subnet during an investigation, and read values in hexadecimal when examining packets and file signatures. The examples below show each calculation step by step, with every figure checked by independent code before publication.

How this guide was made

Written for this site with AI assistance, then checked automatically before publishing. The topic table, sample questions, worked examples and study plan are generated from this site’s question bank: each worked example is recalculated by separate code, and each sample answer says where it came from.

The guide deliberately states no salaries, grades, pass marks or exam dates. Those change, and they could not be checked here, so take them from the advert itself.

This site is independent and is not affiliated with MIFOTRA or any employer.

Worked examples

Try each one on paper first. Every figure is generated and then recalculated by separate code before it is published.

  1. Keyspace and entropy of a password policy

    A password of 8 characters is chosen at random from upper- and lowercase letters (52 possible symbols). How many bits of entropy does it have, and how long would trying every combination take at 10 billion guesses a second?

    Show the working
    1. Entropy = length × log₂(symbols) = 8 × log₂(52) = 8 × 5.7
    2. = 45.6 bits
    3. Combinations = 52^8 ≈ 5.35e+13
    4. Time to try them all = combinations ÷ 10¹⁰ ≈ 1.48 hours. On average an attacker finds it in half that.
    5. This only holds for truly random passwords. A human-chosen word with a digit on the end falls to a dictionary attack far sooner.

    Answer: 45.6 bits; about 1.48 hours to exhaust

  2. Subnet details for a /24 address

    A host is configured as 10.149.231.37/24. Find the subnet mask, network address, broadcast address, usable host range and number of usable hosts.

    Show the working
    1. /24 means 24 network bits, so the mask is 255.255.255.0.
    2. The interesting octet is the third, where the mask is 255. Block size = 256 − 255 = 1.
    3. The network address is the multiple of 1 at or below the address in that octet: 10.149.231.0.
    4. The broadcast is one below the next network: 10.149.231.255.
    5. Usable hosts run from 10.149.231.1 to 10.149.231.254: 2^8 − 2 = 254 addresses.

    Answer: Mask 255.255.255.0, network 10.149.231.0, broadcast 10.149.231.255, hosts 10.149.231.1–10.149.231.254 (254 usable)

  3. Converting hexadecimal to decimal and binary

    Convert 0x1804 to decimal and to binary.

    Show the working
    1. Expand by place value: 1×16^3 + 8×16^2 + 0×16^1 + 4×16^0
    2. = 4096 + 2048 + 0 + 4 = 6148
    3. For binary, write each hex digit as four bits: 0001 1000 0000 0100

    Answer: 6148 decimal, 0001 1000 0000 0100 binary

  4. Converting an octet from binary to decimal

    Convert the binary octet 01110110 to decimal.

    Show the working
    1. Write the place values under each bit: 128 64 32 16 8 4 2 1.
    2. Add the place values where the bit is 1: 64 + 32 + 16 + 4 + 2
    3. = 118

    Answer: 118

  5. Keyspace and entropy of a password policy

    A password of 14 characters is chosen at random from lowercase letters (26 possible symbols). How many bits of entropy does it have, and how long would trying every combination take at 10 billion guesses a second?

    Show the working
    1. Entropy = length × log₂(symbols) = 14 × log₂(26) = 14 × 4.7
    2. = 65.8 bits
    3. Combinations = 26^14 ≈ 6.45e+19
    4. Time to try them all = combinations ÷ 10¹⁰ ≈ 204.4 years. On average an attacker finds it in half that.
    5. This only holds for truly random passwords. A human-chosen word with a digit on the end falls to a dictionary attack far sooner.

    Answer: 65.8 bits; about 204.4 years to exhaust

  6. Subnet details for a /29 address

    A host is configured as 192.168.22.78/29. Find the subnet mask, network address, broadcast address, usable host range and number of usable hosts.

    Show the working
    1. /29 means 29 network bits, so the mask is 255.255.255.248.
    2. The interesting octet is the fourth, where the mask is 248. Block size = 256 − 248 = 8.
    3. The network address is the multiple of 8 at or below the address in that octet: 192.168.22.72.
    4. The broadcast is one below the next network: 192.168.22.79.
    5. Usable hosts run from 192.168.22.73 to 192.168.22.78: 2^3 − 2 = 6 addresses.

    Answer: Mask 255.255.255.248, network 192.168.22.72, broadcast 192.168.22.79, hosts 192.168.22.73–192.168.22.78 (6 usable)

  7. Converting hexadecimal to decimal and binary

    Convert 0xDA6 to decimal and to binary.

    Show the working
    1. Expand by place value: D×16^2 + A×16^1 + 6×16^0
    2. = 3328 + 160 + 6 = 3494
    3. For binary, write each hex digit as four bits: 1101 1010 0110

    Answer: 3494 decimal, 1101 1010 0110 binary

  8. Converting an octet from binary to decimal

    Convert the binary octet 01111111 to decimal.

    Show the working
    1. Write the place values under each bit: 128 64 32 16 8 4 2 1.
    2. Add the place values where the bit is 1: 64 + 32 + 16 + 8 + 4 + 2 + 1
    3. = 127

    Answer: 127

Why these calculations matter to an analyst

Password keyspace and entropy turn a policy into a measurable strength, which helps you argue for longer passphrases and multi-factor authentication. Subnet details tell you whether a suspicious address belongs to your network, a partner or the internet, and they define the scope of a scan or a firewall rule. Hexadecimal and binary conversion appear in packet captures, file headers and encoded payloads.

Keeping numbers in context

A large keyspace only helps if passwords are truly random, which human-chosen ones rarely are; attackers use dictionaries and leaked password lists, not pure brute force. When you present a strength calculation, say what it assumes. Numbers used honestly make security advice more persuasive to managers.

Common questions

Why does password length matter more than complexity?

Each extra character multiplies the number of possible passwords by the size of the character set, while forced complexity rules often lead to predictable patterns. A long passphrase is usually stronger and easier to remember.

Where do analysts meet hexadecimal?

In packet captures, memory and disk analysis, MAC addresses, file signatures and hashes, which are normally displayed in hexadecimal.

More Cybersecurity Analyst guides