Topics

Cybersecurity

27 free questions with worked answers, and 599 more in the full bank.

Free questions

More Cybersecurity questions (page 5 of 10)

Answers and explanations are in the full bank.

• A ministry wants to be able to prove that an approval letter was sent by a particular official, so that the official cannot later deny having sent it. Which technology provides this? · 3 marks
• A system asks users for a password and then a 4-digit PIN. Why is this not true multi-factor authentication? · 2 marks
• A bank sends one-time codes by SMS. Criminals persuade a mobile operator's agent to move a customer's number to a new SIM card and then receive the codes. What is a stronger second factor? · 3 marks
• A district is updating its password policy. Which rule does current guidance, such as NIST's, recommend? · 2 marks
• What is the main security benefit of a password manager for a busy ICT officer? · 1 mark
• Shortly after a popular shopping site was breached, many staff accounts on a ministry portal are logged into successfully from unfamiliar countries. The staff had used the same passwords on both sites. What attack is this? · 3 marks
• Logs show one failed login for each of 300 staff accounts in an hour, all using the same password, “Welcome@123”. No account reaches the lockout limit. What attack is this? · 3 marks
• An account lockout policy locks a user out for 30 minutes after 5 wrong passwords. What does it protect against, and what is its drawback? · 2 marks
• For a fingerprint reader guarding a data centre door, which error rate matters most for security? · 3 marks
• A district introduces single sign-on so staff log in once to reach email, HR and finance systems. What is the main security risk, and how is it reduced? · 2 marks
• How should a web application store its users' passwords? · 3 marks
• A technician downloads an installer and compares its SHA-256 value with the one published on the vendor's website. What does a match show? · 1 mark
• Why should MD5 and SHA-1 no longer be used for digital signatures or certificates? · 2 marks
• An encryption method uses the same secret key to encrypt and to decrypt the data. What type of encryption is it? · 1 mark
• An auditor wants to send a confidential report to a colleague using public-key encryption, so that only the colleague can read it. Which key should the report be encrypted with? · 2 marks
• TLS uses public-key cryptography only to agree on a shared secret, then encrypts the actual data with a symmetric cipher such as AES. Why? · 3 marks
• When an official digitally signs a document, which key is used to create the signature, and which key do others use to check it? · 2 marks
• A staff member receives an email saying their mailbox will be closed today unless they log in through a link. The sender's address is from an unfamiliar domain. What should they do? · 1 mark
• An email to a district's procurement officer uses the officer's name, mentions a tender the officer is managing and a supplier the office really works with, and asks for the “revised quotation” to be opened. What is this? · 2 marks
• Attackers craft a convincing fake court summons and send it only to a ministry's Permanent Secretary and directors general. What is this kind of phishing called? · 2 marks
• A caller claims to be from a mobile money provider and says a payment was sent to you by mistake. To “reverse” it, they ask for your mobile money PIN. What is happening? · 1 mark
• A finance officer receives an email, apparently from a long-standing supplier, saying the supplier's bank account has changed and asking that this month's payment go to the new account. What should be done before paying? · 3 marks
• Someone phones a ministry secretary, claims to be from the ICT help desk working on an urgent upgrade, and asks for the secretary's password to “migrate the mailbox”. Which social-engineering technique is this? · 2 marks
• An unknown person without a badge follows an employee through a card-controlled door into a records office before it closes. What is this called? · 1 mark
• Several USB flash drives labelled “Staff salaries – confidential” are found in the car park of a district office. What should staff do with them? · 2 marks
• At a busy service counter, someone standing behind a clerk watches the screen and keyboard to learn the clerk's password. What is this? · 1 mark
• Printed lists of citizens' ID numbers and phone numbers from a sector office are found in a rubbish bin outside. Which control would have prevented this exposure? · 1 mark
• Which measure does most to reduce the success of social-engineering attacks across an organisation? · 1 mark
• On a public feedback page, an attacker posts a comment containing a JavaScript snippet. Everyone who later views the page runs the script, which sends their session cookie to the attacker. What vulnerability is this? · 3 marks
• Typing ' OR '1'='1 into the username box of a portal's login form lets an attacker in without a password. What is the correct fix in the application? · 2 marks
• While logged into the payroll system, an officer opens a malicious web page that silently submits a form to the payroll system to change a bank account. The system accepts it because the officer's session is active. Which defence stops this? · 3 marks
• A web server log shows requests such as /download?file=../../../../etc/passwd. What is the attacker attempting? · 3 marks
• A program copies user input into a fixed-size memory area without checking its length. An attacker sends a much longer input that overwrites nearby memory and runs their own code. What is this? · 3 marks
• On an office LAN, a laptop starts replying to ARP requests claiming to own the gateway's IP address, so other PCs send their traffic through it. What is this attack and which switch feature blocks it? · 3 marks
• At a hotel in Kigali, a laptop connects to a Wi-Fi network with exactly the hotel's name, but it is actually run by an attacker sitting in the lobby. What is this fake network called? · 2 marks
• An attacker records the network messages a user sends to log in and later sends the same messages again to be accepted as that user, without knowing the password. How do protocols defend against this? · 3 marks
• A university's admissions portal is knocked offline by traffic arriving from tens of thousands of different IP addresses around the world at once. Why is this harder to stop than an attack from one source? · 2 marks
• Attackers exploit a flaw in a widely used office program that the vendor did not know about, so no patch exists yet. What is this called? · 2 marks
• Hundreds of organisations are compromised after installing a routine, digitally signed update from a trusted software vendor whose build system had been hacked. What type of attack is this? · 3 marks
• Staff receive links to a login page at a domain that differs from the ministry's real domain by a single letter. What is this technique called? · 2 marks
• An attacker who has logged in as an ordinary user exploits a flaw in a system service to gain administrator rights on the server. What is this step called? · 2 marks
• An employee who has resigned copies a large part of the client database to a personal cloud account during their last week. What category of threat is this, and which control helps detect it? · 2 marks
• Attackers who want to reach district accountants compromise the website of a professional association those accountants visit regularly, so that it infects their computers. What is this called? · 3 marks
• Which order matches the phases of an incident response life cycle, such as NIST's? · 2 marks
• Monitoring shows a finance PC communicating with a server known to be used by attackers. What is the best first containment step? · 2 marks
• An investigator must collect evidence from a compromised server that is still running. Which should be captured first? · 3 marks
• A laptop seized in a fraud investigation is passed between ICT staff, auditors and the police. What record shows who held it, when and why, so it can be used as evidence? · 1 mark
• What is the main purpose of the review meeting held after a security incident has been closed? · 1 mark
• A ministry wants one system that gathers logs from firewalls, servers and workstations and raises an alert when related events, such as failed logins followed by a new admin account, happen together. What is this? · 2 marks
• Why should servers send their security logs to a separate central log server, rather than keeping them only locally? · 3 marks
• What is the main difference between a vulnerability scan and a penetration test? · 2 marks
• A scan of a district's servers reports 140 vulnerabilities, each with a CVSS score. Which should be fixed first? · 2 marks
• Before rolling out a new batch of operating-system updates to 400 PCs in a ministry, what should the ICT team do? · 1 mark
• An engineer wants to change the rules on the ministry's main firewall. Under a proper change-management process, what must happen first? · 2 marks
• A new server will only host the district's website. Which step reduces its attack surface? · 1 mark
• A new IP camera arrives with the username admin and password admin. What should be done before connecting it to the network? · 1 mark
• What does the 3-2-1 backup rule recommend? · 2 marks
• Ransomware encrypts a district's file server and also the backups stored on a network share that the server could write to. What would have protected the backups? · 3 marks
• A hospital's records system is backed up every night at midnight. It fails at 5 p.m., and staff must re-enter everything since the last backup. Which recovery measure describes this maximum amount of lost data? · 3 marks
• Management decides that after any failure the payroll system must be working again within 4 hours. What is this target called? · 2 marks