Cybersecurity
27 free questions with worked answers, and 599 more in the full bank.
Free questions
The hospital management system is experiencing issues with data encryption and security due to a compromised encryption key. What is the best approach to resolve this issue while ensuring data protection and minimizing downtime?
1 mark · Easy
A user reports that they are unable to access the hospital management system due to a certificate expiration issue. What steps would you take to troubleshoot and resolve the issue while ensuring system availability?
1 mark · Easy
The hospital management system is experiencing issues with user authentication due to a compromised authentication token. What is the best approach to resolve this issue while minimizing disruption to patient care?
1 mark · Easy
What is the main purpose of a firewall?
1 mark · Easy
What type of malware disguises itself as legitimate software?
3 marks · Medium
What is a common method for securing user passwords?
3 marks · Medium
A user reports that they are unable to access the hospital management system due to a denial-of-service (DoS) attack. What steps would you take to mitigate the attack and restore system availability?
3 marks · Medium
What is the main purpose of antivirus software?
3 marks · Medium
Which of the following is an example of two-factor authentication?
3 marks · Medium
When setting up a new user account, what is an important first step?
3 marks · Medium
Which of the following is considered a strong password?
3 marks · Medium
Which of the following is an example of a phishing attack?
4 marks · Hard
A receptionist receives a call from someone claiming to be the CEO, demanding a password reset immediately because they are about to start a critical board meeting. This BEST describes which attack?
1 mark · Easy
An employee receives an SMS on their corporate phone stating their multi-factor authentication app needs a critical update, including a link to download an APK. What type of attack is occurring?
3 marks · Medium
A contractor holding a large box of networking equipment waits by the secure datacenter door until an authorized employee scans their badge and opens it, then follows them inside. This is known as...
3 marks · Medium
The CFO of a logistics company receives a highly customized email claiming a wire transfer for a known vendor has failed. The email contains a link to a fake banking portal. This attack is an example of...
1 mark · Easy
An attacker leaves several USB drives labeled "Q3 Layoffs & Bonuses" in the company parking lot, hoping curious employees will plug them into corporate workstations. This technique is called...
3 marks · Medium
A threat actor creates a fake LinkedIn profile claiming to be an IT recruiter. They spend weeks chatting with a systems administrator before asking them to run a "skills assessment" executable. This scenario heavily utilizes...
4 marks · Hard
During a penetration test, an assessor sits in the break room and watches an employee type their complex password into a laptop. The assessor then uses these credentials later. What occurred?
3 marks · Medium
A hospital's patient records system suddenly displays a red screen demanding payment in Bitcoin within 48 hours to decrypt the database. What type of malware has infected the system?
1 mark · Easy
A security analyst discovers that a compromised workstation has software installed that allows an attacker to remotely open the CD-ROM tray, turn on the webcam, and browse the filesystem without user knowledge. This is a...
3 marks · Medium
After a suspected breach, administrators notice that standard operating system commands like 'ls' and 'ps' are not showing a malicious process that is consuming CPU resources. The malware has likely installed a...
4 marks · Hard
An employee unknowingly downloads a malicious browser extension that records every keystroke made on banking websites and sends the text to an external server. This malware is a...
3 marks · Medium
Users complain that their web browsers are constantly redirecting to search engines they did not set, and pop-up ads appear even when the browser is closed. The systems are likely infected with...
3 marks · Medium
A piece of malware exploits a vulnerability in SMBv1 to spread rapidly across a corporate network without any user interaction, infecting hundreds of machines in minutes. This behavior characterizes a...
1 mark · Easy
An end-user downloads what appears to be a legitimate free PDF editor from a third-party site. Once installed, it edits PDFs but also silently installs a backdoor. This is an example of a...
3 marks · Medium
An endpoint detection system flags unusual PowerShell activity. Investigation reveals a malicious script running entirely in RAM, heavily obfuscated, leaving no executable footprint on the hard drive. This is...
4 marks · Hard
More Cybersecurity questions (page 10 of 10)
Answers and explanations are in the full bank.
- Why must network device clocks be synchronised to an accurate time source? · 1 mark
- During a workshop assessment, the reported condition is: An email urges an employee to open an unexpected invoice attachment and threatens immediate account suspension. What is the safest response? · 1 mark
- During a workshop assessment, the reported condition is: Authentication logs show one common password tried against hundreds of different accounts. Which attack is most likely? · 3 marks
- During a workshop assessment, the reported condition is: Many login attempts use different username-and-password pairs known to have appeared in another breach. Which attack does this describe? · 1 mark
- During a workshop assessment, the reported condition is: A user account logs in from distant countries within a time interval that makes travel impossible. What should the analyst do? · 3 marks
- During a workshop assessment, the reported condition is: A user receives repeated unsolicited MFA approval prompts after an attacker obtained the password. Which attack is occurring? · 1 mark
- During a workshop assessment, the reported condition is: Multiple servers begin encrypting files while an unknown process disables backup agents. What is the priority action? · 3 marks
- During a workshop assessment, the reported condition is: A public service is overwhelmed by traffic from many distributed sources. Which availability attack is most likely? · 1 mark
- During a workshop assessment, the reported condition is: An application builds a database query by directly concatenating untrusted form input. Which vulnerability is created? · 3 marks
- During a workshop assessment, the reported condition is: A web application displays untrusted comments without output encoding, allowing scripts to run in other users' browsers. Which vulnerability is present? · 1 mark
- During a workshop assessment, the reported condition is: A vulnerability scanner reports a critical internet-facing flaw, but the asset owner and exploitability are not yet confirmed. What should happen next? · 3 marks
- During a workshop assessment, the reported condition is: A vendor releases a security patch for an actively exploited flaw in the organization's edge software. How should the organization respond? · 1 mark
- During a workshop assessment, the reported condition is: A service presents an expired TLS certificate to clients. What security property is affected most directly? · 3 marks
- During a workshop assessment, the reported condition is: A SIEM has no logs from domain controllers during the exact period of suspicious account creation. What should the analyst conclude? · 1 mark
- During a workshop assessment, the reported condition is: A forensic drive image is transferred between investigators without recording dates, handlers, or hashes. Which process has failed? · 3 marks
- During a workshop assessment, the reported condition is: A workstation sends unusually large encrypted uploads to an unfamiliar external destination late at night. What should be investigated? · 1 mark
- During a workshop assessment, the reported condition is: A DLP rule blocks a legitimate encrypted research file because its classification was incorrect. What is the best correction? · 3 marks
- During a workshop assessment, the reported condition is: Ransomware encrypted production data, but offline backups were restored successfully in a recent exercise. What should still be verified before recovery? · 1 mark
- During a workshop assessment, the reported condition is: An administrator accesses records unrelated to assigned duties and exports them to removable media. Which security principle and response apply? · 3 marks
- During a workshop assessment, the reported condition is: A third-party support account remains enabled months after the contract ended. What should be done? · 1 mark
- During a workshop assessment, the reported condition is: A security team wants to delete compromised hosts immediately, but investigators still need volatile evidence. How should the conflict be handled? · 3 marks
- NIDA must centrally authenticate and authorise administrators against a single identity source and record their sessions. Which AAA architecture describes this? · 1 mark
- Which protocol should be chosen for central AAA when the requirement includes accounting of user sessions and full session encryption? · 4 marks
- NIDA must limit a compromised workstation on the guest network from reaching internal servers even if an attacker is on that segment. Which control enforces this? · 3 marks
- A server that must be reachable by users must not be able to initiate connections to client workstations. Which control enforces this one way traffic rule? · 4 marks
- NIDA must publish several internal servers to the internet on a single public address. Which NAT configuration type serves this pattern correctly? · 3 marks
- A certification question asks about asymmetric encryption. Which answer is correct? · 4 marks
- A certification question asks about incident containment. Which answer is correct? · 4 marks
- In Cybersecurity (Threats and attacks), a supervisor tests your knowledge of ransomware. Which answer is best? · 3 marks
- A supervisor tests your knowledge of role-based access control. Which answer is best? · 4 marks
- A supervisor tests your knowledge of zero trust. Which answer is best? · 4 marks
- A supervisor tests your knowledge of cryptographic hashing. Which answer is best? · 4 marks
- A supervisor tests your knowledge of chain of custody. Which answer is best? · 1 mark
- A certification question asks about credential stuffing. Which answer is correct? · 3 marks
- In Cybersecurity (Identity and access), a certification question asks about least privilege. Which answer is correct? · 3 marks
- A certification question asks about virtual private network. Which answer is correct? · 3 marks
- Why is placing servers in a separate segment from user workstations a common control? · 3 marks
- An IPsec tunnel between a branch router and the NIDA data centre fails to form, and debug output shows phase 1 proposals do not match. Which phase must agree first before any traffic is protected? · 1 mark
- A GRE tunnel is built between two sites to carry a routing protocol, but the payload traffic is readable to anyone on the transit path. Which control closes this gap? · 3 marks
- A site-to-site IPsec tunnel drops whenever the internal host address falls into the carrier-grade NAT range of the ISP. Which combination of settings resolves this? · 4 marks
- NIDA needs branch routers to build on-demand tunnels directly to each other while using the hub only for control-plane lookups. Which Cisco technology provides this behaviour? · 4 marks
- When building a new firewall rule base, what must be understood about the order in which access control entries are evaluated? · 1 mark
- Which access control list placement is correct when filtering inbound internet traffic on the router interface facing the service provider? · 3 marks
- Which single change most reduces the risk of unauthorised CLI access to network devices across the campus? · 1 mark
- A DHCP rogue server on an access switch is handing out addresses to clients on a sensitive VLAN. Which feature prevents this at Layer 2? · 3 marks
- During routine technical work, which statement about an offline or immutable backup should guide the technician? · 3 marks
- An organisation replaces legacy WPA2-Personal with a centrally managed enterprise deployment. Which authentication and encryption combination is the correct target? · 3 marks
- An access point is configured to send management and user traffic in the clear so that captive portal users can log in. Which term describes this condition and what is the correct fix? · 1 mark
- An administrator adds a permit rule to a zone policy that is shadowed by an earlier deny rule, and traffic is still blocked. What is the correct response? · 3 marks
- Risk case C4-S1 values an asset at $50,000 with exposure factor 10%. What single loss expectancy is estimated? · 1 mark
- Risk model C4-A1 has SLE $5,000 and annualized rate of occurrence 0.2. What ALE is calculated? · 1 mark
- Control assessment C4-R1 begins with $100,000 expected loss and estimates 30% reduction. What residual expected loss remains? · 1 mark
- SIEM sizing C4-L1 receives 100 events/s averaging 400 bytes. Approximately how many decimal GB of raw logs arrive daily? · 1 mark
- Retention plan C4-T1 stores 12 GB/day for 30 days. Ignoring overhead, how many decimal TB are required? · 1 mark
- Detection review C4-F1 investigated 200 alerts and found 20 false positives. What false-positive percentage is this? · 1 mark
- Control test C4-D1 includes 40 known test incidents, of which 35 generate valid detections. What detection rate results? · 1 mark
- Patch dashboard C4-P1 lists 120 in-scope assets and 112 compliant assets. What compliance percentage is shown? · 1 mark
- Awareness exercise C4-H1 sends 500 simulations and records 20 unsafe clicks. What click rate is calculated? · 1 mark
- Recovery estimate C4-O1 captures data every 15 minutes while records change at 2 GB/hour. What maximum changed data could be lost between captures? · 1 mark