Topics

Cybersecurity

27 free questions with worked answers, and 599 more in the full bank.

Free questions

More Cybersecurity questions (page 7 of 10)

Answers and explanations are in the full bank.

• A PC with an out-of-date browser becomes infected simply by visiting a compromised news website, without the user clicking or downloading anything. What is this called? · 2 marks
• Criminals buy advertising space on popular, legitimate websites and use the adverts to send visitors to pages that install malware. What is this called? · 1 mark
• Which Windows setting should be disabled so that malware on a USB drive cannot start automatically as soon as the drive is plugged in? · 1 mark
• Which of these is one of the most common ways that malware reaches home and office computers? · 1 mark
• A news website shows a banner: “Your Chrome is out of date. Download the update now.” The download is a file called Chrome_Update.js. What should the user do? · 2 marks
• Why is it risky to charge a phone from a free USB port at a bus station or airport? · 2 marks
• Which of the following is a common sign that a computer may be infected with malware? · 1 mark
• On a staff laptop, the antivirus has been switched off, Windows Update will not run, and the websites of security vendors fail to load while other sites work. What does this pattern suggest? · 2 marks
• On one PC, typing the bank's correct web address opens a fake copy of the bank's site, while other PCs reach the real one. DNS servers are fine. Which local file has malware most likely modified? · 3 marks
• Firewall logs show that one workstation contacts the same unknown internet address every 60 seconds, day and night, even when nobody is using it. What does this most likely indicate? · 3 marks
• Just before encrypting files, a ransomware program runs a command to delete the Windows Volume Shadow Copies. Why? · 3 marks
• After infecting one workstation, attackers extract the password hash of a domain administrator who had recently logged on to it, and use it to reach servers across the network. What does this show about admin practice? · 3 marks
• Colleagues and partners start receiving emails with an attachment from a staff member's account, which the staff member never sent. The malware on their PC is sending itself to everyone in the address book. What type is it? · 2 marks
• A message from a colleague's real email address says “Please review the attached payment file urgently” in a style the colleague never uses, with a macro-enabled spreadsheet attached. What is the safest action? · 2 marks
• A technician needs to install a common free tool such as 7-Zip on office PCs. Where should it be downloaded from? · 1 mark
• While opening what should be a simple invoice document, a Windows User Account Control prompt asks to allow an unknown program to make changes to the device. What should the user do? · 2 marks
• Several PCs in a district office still run Windows 7, which no longer receives security updates. Why is this a malware risk? · 1 mark
• After an infection, the security team shares the malware's file hashes, the domains it contacted and the IP addresses it used, so other organisations can search their own systems. What are these called? · 2 marks
• A server is confirmed to be infected with a rootkit that had administrator-level control for weeks. What is the most reliable remediation? · 3 marks
• A keylogger is found on an officer's laptop. From which device should the officer change their passwords? · 2 marks
• A colleague says the finance team should switch to Macs because “Macs and Linux cannot get malware”. What is the correct response? · 1 mark
• A factory's control network is completely disconnected from the internet (air-gapped), yet malware still infects it. What is the most likely route? · 3 marks
• Criminal developers build ransomware and rent it to “affiliates” who carry out the attacks and share the ransom with them. What is this business model called? · 3 marks
• In malware terminology, what is the “payload”? · 1 mark
• What is the difference between a vulnerability and an exploit? · 1 mark
• A vendor releases a security patch on Tuesday. By Friday, attackers are exploiting the same flaw on organisations that have not yet installed it. How did they develop the attack so quickly? · 3 marks
• A journalist's phone is infected with spyware through a specially crafted message that the phone processed automatically, although the journalist never opened it or tapped anything. What is this kind of attack called? · 3 marks
• In the Cyber Kill Chain model, after a vulnerability has been exploited, attackers place a backdoor so they can return. Which stage is this? · 2 marks
• Investigators find that a well-resourced group had quietly been inside a ministry's network for months, carefully avoiding detection while copying sensitive documents. What is this type of threat called? · 2 marks
• Blocking the malware's control server domain works only for a day, because the malware calculates a new list of hundreds of domain names every day and tries each one until it reaches its operator. What technique is this? · 3 marks
• A firewall blocks all outbound traffic except DNS, yet an infected server is still sending data out, hidden inside large numbers of unusual DNS queries for random-looking subdomains. What technique is this? · 3 marks
• During a global worm outbreak, a researcher notices that the malware checks whether a certain unregistered domain exists and stops spreading if it does. The researcher registers the domain. What is this defensive action called? · 3 marks
• What is the person who controls a botnet commonly called? · 1 mark
• The internet provider warns a district office that its public IP address is sending thousands of spam emails. Logs show one workstation connecting directly to mail servers on port 25 all day. What is the likely explanation? · 2 marks
• Task Manager shows a process named “svch0st.exe” (with a zero) running from a user's AppData\Temp folder. Why is this suspicious? · 3 marks
• Where in Windows 10 or 11 can a technician quickly see and disable the programs that start automatically when a user signs in? · 1 mark
• An analyst examines a suspicious file's hash, embedded text strings and imported functions without ever running it. What kind of analysis is this? · 2 marks
• To see what a suspicious attachment really does, an analyst runs it inside a virtual machine that is cut off from the office network and watches the files, registry changes and connections it makes. Why must the machine be isolated? · 2 marks
• A malware sample does nothing at all when an analyst runs it in a virtual machine, yet it infects real PCs immediately. What is the most likely reason? · 2 marks
• Which kind of virus infects both the boot sector of a disk and executable files, so that cleaning only one of the two leaves the computer infected? · 2 marks
• A laptop is reinfected with the same malware even after its hard disk is replaced and Windows reinstalled from clean media. Where is the malware most likely hiding? · 3 marks
• WannaCry was described as a “ransomware worm”. What do the two words describe? · 2 marks
• A PC shows a full-screen message, claiming to be from the police, that locks the desktop and demands a fine, but the files on the disk are not encrypted. What kind of ransomware is this? · 1 mark
• Ransomware on one clerk's PC encrypts not only that PC's files but also thousands of files on the department's shared drive. Why could it reach the share? · 2 marks
• After cleaning up a ransomware attack, a team restores last night's backup, and the attack starts again within hours. What is the most likely reason? · 2 marks
• Two antivirus products report the same suspicious file under completely different malware names. How can analysts confirm it is the same sample? · 2 marks
• Before considering anything else, a victim of an older ransomware family wants to know whether a free decryption tool already exists. Where can this be checked? · 2 marks
• Why is Windows System Restore not a reliable way to remove malware? · 1 mark
• A user copies a supplier's account number and pastes it into a payment form, but the money goes to a different account. The pasted number had been silently changed. What kind of malware does this? · 3 marks
• During an inspection, a small plug-like device is found between a finance PC's keyboard cable and the computer's USB port. No software problem has been detected. What is it most likely to be? · 2 marks
• A “free PDF tools” browser extension asks for permission to “read and change all your data on all websites”. Why is this a concern? · 2 marks
• An email claims a hacker has filmed the recipient through their webcam and demands payment in cryptocurrency. As “proof”, it quotes an old password the recipient once used. What is the most likely truth? · 1 mark
• A caller claiming to be from a bank's “security department” asks a customer to install AnyDesk so they can “protect the account”. What is the danger? · 2 marks
• Microsoft Office now blocks macros by default in documents downloaded from the internet or received as email attachments. How does Office know where a file came from? · 3 marks
• A WhatsApp message urges everyone to forward it to all contacts, warning that a “new virus” will destroy phones that open a certain video tonight. What is the best response? · 1 mark
• A job candidate plans to log in to their email and online banking from a computer in a busy cyber café. What is the main malware-related risk? · 2 marks
• An email attachment is called “holiday_photos.scr”. Why should it not be opened? · 2 marks
• Which combination of signs suggests that a smartphone may be infected with malware? · 1 mark
• Why does rooting an Android phone or jailbreaking an iPhone increase the risk from malware? · 3 marks
• Attackers send an email with a link to a well-known cloud storage service, where the malware file is hosted. Why does this help them? · 2 marks