Cybersecurity
27 free questions with worked answers, and 599 more in the full bank.
Free questions
The hospital management system is experiencing issues with data encryption and security due to a compromised encryption key. What is the best approach to resolve this issue while ensuring data protection and minimizing downtime?
1 mark · Easy
A user reports that they are unable to access the hospital management system due to a certificate expiration issue. What steps would you take to troubleshoot and resolve the issue while ensuring system availability?
1 mark · Easy
The hospital management system is experiencing issues with user authentication due to a compromised authentication token. What is the best approach to resolve this issue while minimizing disruption to patient care?
1 mark · Easy
What is the main purpose of a firewall?
1 mark · Easy
What type of malware disguises itself as legitimate software?
3 marks · Medium
What is a common method for securing user passwords?
3 marks · Medium
A user reports that they are unable to access the hospital management system due to a denial-of-service (DoS) attack. What steps would you take to mitigate the attack and restore system availability?
3 marks · Medium
What is the main purpose of antivirus software?
3 marks · Medium
Which of the following is an example of two-factor authentication?
3 marks · Medium
When setting up a new user account, what is an important first step?
3 marks · Medium
Which of the following is considered a strong password?
3 marks · Medium
Which of the following is an example of a phishing attack?
4 marks · Hard
A receptionist receives a call from someone claiming to be the CEO, demanding a password reset immediately because they are about to start a critical board meeting. This BEST describes which attack?
1 mark · Easy
An employee receives an SMS on their corporate phone stating their multi-factor authentication app needs a critical update, including a link to download an APK. What type of attack is occurring?
3 marks · Medium
A contractor holding a large box of networking equipment waits by the secure datacenter door until an authorized employee scans their badge and opens it, then follows them inside. This is known as...
3 marks · Medium
The CFO of a logistics company receives a highly customized email claiming a wire transfer for a known vendor has failed. The email contains a link to a fake banking portal. This attack is an example of...
1 mark · Easy
An attacker leaves several USB drives labeled "Q3 Layoffs & Bonuses" in the company parking lot, hoping curious employees will plug them into corporate workstations. This technique is called...
3 marks · Medium
A threat actor creates a fake LinkedIn profile claiming to be an IT recruiter. They spend weeks chatting with a systems administrator before asking them to run a "skills assessment" executable. This scenario heavily utilizes...
4 marks · Hard
During a penetration test, an assessor sits in the break room and watches an employee type their complex password into a laptop. The assessor then uses these credentials later. What occurred?
3 marks · Medium
A hospital's patient records system suddenly displays a red screen demanding payment in Bitcoin within 48 hours to decrypt the database. What type of malware has infected the system?
1 mark · Easy
A security analyst discovers that a compromised workstation has software installed that allows an attacker to remotely open the CD-ROM tray, turn on the webcam, and browse the filesystem without user knowledge. This is a...
3 marks · Medium
After a suspected breach, administrators notice that standard operating system commands like 'ls' and 'ps' are not showing a malicious process that is consuming CPU resources. The malware has likely installed a...
4 marks · Hard
An employee unknowingly downloads a malicious browser extension that records every keystroke made on banking websites and sends the text to an external server. This malware is a...
3 marks · Medium
Users complain that their web browsers are constantly redirecting to search engines they did not set, and pop-up ads appear even when the browser is closed. The systems are likely infected with...
3 marks · Medium
A piece of malware exploits a vulnerability in SMBv1 to spread rapidly across a corporate network without any user interaction, infecting hundreds of machines in minutes. This behavior characterizes a...
1 mark · Easy
An end-user downloads what appears to be a legitimate free PDF editor from a third-party site. Once installed, it edits PDFs but also silently installs a backdoor. This is an example of a...
3 marks · Medium
An endpoint detection system flags unusual PowerShell activity. Investigation reveals a malicious script running entirely in RAM, heavily obfuscated, leaving no executable footprint on the hard drive. This is...
4 marks · Hard
More Cybersecurity questions (page 8 of 10)
Answers and explanations are in the full bank.
- A candidate preparing for public-service exams receives an email offering a government job, with an attached “application form” called Form.exe. What should they conclude? · 1 mark
- After a flash drive is used to print documents at a busy printing shop, it is plugged into an office PC. What is the main risk? · 1 mark
- When a teacher opens a flash drive, all the folders appear as shortcuts with arrows, and the real folders seem to have disappeared. Clicking a shortcut opens the folder but also runs a program. What is this? · 2 marks
- After a USB drive (letter E:) is cleaned of a shortcut virus, the original files are still hidden with system attributes. Which Windows command makes them visible again? · 3 marks
- Searching for a popular free program, a user clicks the top result, which looks like the official site but is a copy offering an infected installer. How did the fake site get to the top? · 2 marks
- A developer at a Kigali software firm installs a library called “reqeusts” instead of the popular “requests”, and credentials start leaking from the build server. What happened? · 3 marks
- Visitors to a district's website start receiving browser warnings, and investigation shows the site was altered to serve malware through an outdated content-management plugin. What is the key preventive measure? · 3 marks
- An email contains only a harmless-looking HTML attachment. When opened in the browser, it assembles a malicious ZIP file from code inside the page and offers it as a download. Why do attackers use this trick? · 3 marks
- An ordinary staff member thinks their PC has just been infected after opening an attachment. What should they do first? · 1 mark
- Which email gateway rule most reduces malware delivered as attachments to staff? · 1 mark
- Someone who briefly had a person's unlocked phone may have installed an app that shares their location and messages. Which sign would most suggest this “stalkerware”? · 2 marks
- Which Android setting should normally stay turned off to reduce the risk of installing malicious apps? · 2 marks
- A PC's CPU jumps to 100% only while a particular free streaming website is open in a browser tab, and drops as soon as the tab is closed. Nothing new has been installed. What is the most likely cause? · 2 marks
- How does traditional signature-based antivirus detection identify malware? · 1 mark
- An antivirus flags a never-before-seen program because its code contains instructions typical of malware, such as self-copying routines and code that disables security settings. What detection method is this? · 2 marks
- A program that looked harmless when it was saved starts rapidly renaming and rewriting hundreds of documents, and the antivirus stops it mid-way. Which protection feature caught it? · 2 marks
- Why must antivirus definition (signature) files be updated automatically and frequently? · 1 mark
- What is the difference between real-time (on-access) protection and an on-demand scan? · 1 mark
- What does a quick scan check, compared with a full scan? · 1 mark
- When antivirus moves a detected file to quarantine, what happens to it? · 1 mark
- The antivirus flags a genuine accounting program that the ministry has used safely for years. What is this called? · 1 mark
- After confirming that a quarantined file really is a legitimate business application, what is the correct way to deal with the detection? · 2 marks
- An exclusion is unavoidable for a legitimate in-house tool that keeps being flagged. Which exclusion carries the least risk? · 3 marks
- An ICT officer wants to confirm that antivirus on new PCs actually detects and quarantines threats, without using real malware. What should be used? · 2 marks
- A user installs a second antivirus product alongside the one the ICT team deployed, thinking two will give double protection. What is the likely result? · 2 marks
- What does the “cloud-delivered protection” feature of a modern antivirus do? · 2 marks
- A hospital's antivirus is set to submit suspicious files automatically to the vendor. Why should the ICT team review this setting? · 3 marks
- Next-generation antivirus products often use machine-learning models. What do these models do? · 3 marks
- Some malware is packed or encrypted so its real code is hidden on disk. How can an antivirus engine see through this before letting the file run? · 3 marks
- An attacker runs a heavily obfuscated PowerShell script typed straight into memory. Which Windows feature lets the antivirus inspect the script's real content just before it executes? · 3 marks
- An antivirus detects a threat it cannot remove because the file is locked by a running process, and it offers a “boot-time scan”. What is the advantage? · 2 marks
- Malware has disabled the antivirus and blocks every security tool from starting in Windows. Which approach still allows the disk to be scanned? · 2 marks
- Why do technicians sometimes restart Windows in Safe Mode before running an antivirus scan? · 2 marks
- A 40 KB ZIP attachment expands to several terabytes when unpacked, and the mail server's scanner crashes while examining it. What is this attack called? · 3 marks
- Which antivirus setting blocks bundled toolbars, adware and “PC optimiser” programs that are not strictly malware? · 2 marks
- Microsoft Defender reports a detection named “Trojan:Win32/Emotet.A”. What do the parts of the name indicate? · 3 marks
- An antivirus finds a virus inside an important Word document and offers several actions. Which one tries to remove the malicious code while keeping the document? · 2 marks
- Staff often bring flash drives from printing shops. Which antivirus setting helps most? · 1 mark
- Which antivirus is built into Windows 10 and 11 and turns on automatically when no other antivirus is installed? · 1 mark
- An organisation installs a third-party antivirus suite on its Windows PCs. What happens to Microsoft Defender Antivirus? · 2 marks
- Which Microsoft Defender feature stops malware, or a user with ordinary tools, from switching off real-time protection by changing the registry or running PowerShell commands? · 2 marks
- An organisation wants to stop unknown programs from changing files in Documents and Desktop, as ransomware would, while still letting approved applications save work there. Which Windows Security feature does this? · 3 marks
- When a user runs a newly downloaded program, Windows shows “Windows protected your PC – Microsoft Defender SmartScreen prevented an unrecognised app from starting”. What is SmartScreen basing this on? · 2 marks
- An administrator wants to check from PowerShell whether real-time protection is on and how old the antivirus definitions are on a Windows PC. Which cmdlet shows this? · 2 marks
- In the Windows Security app, where can a user see when the antivirus definitions were last updated and check for new ones? · 1 mark
- Which Microsoft Defender feature can block behaviours commonly abused by malware, such as Office applications creating child processes or scripts launching downloaded executables? · 3 marks
- In Windows Security, what does “Core isolation – Memory integrity” help prevent? · 3 marks
- Windows Security also manages Microsoft Defender Firewall. On a staff laptop that is used both in the office and on hotel Wi-Fi, which firewall profiles should stay switched on? · 2 marks
- A user wants to know what the antivirus found and did yesterday, when a warning briefly appeared on screen. Where should they look in Windows Security? · 1 mark
- A full antivirus scan slows staff PCs for two hours. When is it best scheduled? · 1 mark
- Every PC in a ministry is set to scan mapped network drives in real time, and the file server slows badly. What is the better approach? · 2 marks
- A database vendor recommends excluding its live data and log files from real-time scanning on the database server. Why is such an exclusion sometimes justified? · 3 marks
- During a scheduled scan, Task Manager shows “Antimalware Service Executable” (MsMpEng.exe) using a lot of CPU. What is the most likely explanation? · 2 marks
- A district's paid antivirus subscription expired three months ago, but the icon is still in the taskbar. What is the main risk? · 1 mark
- New laptops arrive with a 30-day trial of a commercial antivirus pre-installed, while the ministry's standard is a different product. What should the ICT team do? · 1 mark
- An ICT team of three looks after antivirus on 350 PCs across a district's sector offices. What makes this manageable? · 2 marks
- In the antivirus console, the team creates separate policies for servers, office desktops and field laptops. Why? · 2 marks
- A rural sector office shares one slow internet link among 40 PCs, and every PC downloading its own antivirus updates saturates the link each morning. What is the usual solution? · 3 marks
- A laboratory network is deliberately kept off the internet. How should its antivirus definitions be kept current? · 3 marks
- The antivirus console reports twelve PCs whose definitions are more than ten days old. What should the ICT team conclude? · 2 marks