Cybersecurity
27 free questions with worked answers, and 599 more in the full bank.
Free questions
The hospital management system is experiencing issues with data encryption and security due to a compromised encryption key. What is the best approach to resolve this issue while ensuring data protection and minimizing downtime?
1 mark · Easy
A user reports that they are unable to access the hospital management system due to a certificate expiration issue. What steps would you take to troubleshoot and resolve the issue while ensuring system availability?
1 mark · Easy
The hospital management system is experiencing issues with user authentication due to a compromised authentication token. What is the best approach to resolve this issue while minimizing disruption to patient care?
1 mark · Easy
What is the main purpose of a firewall?
1 mark · Easy
What type of malware disguises itself as legitimate software?
3 marks · Medium
What is a common method for securing user passwords?
3 marks · Medium
A user reports that they are unable to access the hospital management system due to a denial-of-service (DoS) attack. What steps would you take to mitigate the attack and restore system availability?
3 marks · Medium
What is the main purpose of antivirus software?
3 marks · Medium
Which of the following is an example of two-factor authentication?
3 marks · Medium
When setting up a new user account, what is an important first step?
3 marks · Medium
Which of the following is considered a strong password?
3 marks · Medium
Which of the following is an example of a phishing attack?
4 marks · Hard
A receptionist receives a call from someone claiming to be the CEO, demanding a password reset immediately because they are about to start a critical board meeting. This BEST describes which attack?
1 mark · Easy
An employee receives an SMS on their corporate phone stating their multi-factor authentication app needs a critical update, including a link to download an APK. What type of attack is occurring?
3 marks · Medium
A contractor holding a large box of networking equipment waits by the secure datacenter door until an authorized employee scans their badge and opens it, then follows them inside. This is known as...
3 marks · Medium
The CFO of a logistics company receives a highly customized email claiming a wire transfer for a known vendor has failed. The email contains a link to a fake banking portal. This attack is an example of...
1 mark · Easy
An attacker leaves several USB drives labeled "Q3 Layoffs & Bonuses" in the company parking lot, hoping curious employees will plug them into corporate workstations. This technique is called...
3 marks · Medium
A threat actor creates a fake LinkedIn profile claiming to be an IT recruiter. They spend weeks chatting with a systems administrator before asking them to run a "skills assessment" executable. This scenario heavily utilizes...
4 marks · Hard
During a penetration test, an assessor sits in the break room and watches an employee type their complex password into a laptop. The assessor then uses these credentials later. What occurred?
3 marks · Medium
A hospital's patient records system suddenly displays a red screen demanding payment in Bitcoin within 48 hours to decrypt the database. What type of malware has infected the system?
1 mark · Easy
A security analyst discovers that a compromised workstation has software installed that allows an attacker to remotely open the CD-ROM tray, turn on the webcam, and browse the filesystem without user knowledge. This is a...
3 marks · Medium
After a suspected breach, administrators notice that standard operating system commands like 'ls' and 'ps' are not showing a malicious process that is consuming CPU resources. The malware has likely installed a...
4 marks · Hard
An employee unknowingly downloads a malicious browser extension that records every keystroke made on banking websites and sends the text to an external server. This malware is a...
3 marks · Medium
Users complain that their web browsers are constantly redirecting to search engines they did not set, and pop-up ads appear even when the browser is closed. The systems are likely infected with...
3 marks · Medium
A piece of malware exploits a vulnerability in SMBv1 to spread rapidly across a corporate network without any user interaction, infecting hundreds of machines in minutes. This behavior characterizes a...
1 mark · Easy
An end-user downloads what appears to be a legitimate free PDF editor from a third-party site. Once installed, it edits PDFs but also silently installs a backdoor. This is an example of a...
3 marks · Medium
An endpoint detection system flags unusual PowerShell activity. Investigation reveals a malicious script running entirely in RAM, heavily obfuscated, leaving no executable footprint on the hard drive. This is...
4 marks · Hard
More Cybersecurity questions (page 9 of 10)
Answers and explanations are in the full bank.
- The same PC reports the same malware detection almost every day, and each time the antivirus quarantines it successfully. What should the ICT team do? · 3 marks
- What is the most reliable way to make sure antivirus is installed and configured on every new PC that joins a ministry's domain? · 1 mark
- A technician turns off Microsoft Defender real-time protection in Windows Security to troubleshoot an installation, then forgets about it. What happens? · 2 marks
- What does endpoint detection and response (EDR) add beyond a traditional antivirus product? · 2 marks
- The security console shows an active attack on a laptop at a sector office two hours away. Which EDR action contains it immediately? · 2 marks
- An endpoint product stops a ransomware process after it has already encrypted 30 files on a laptop. Which capability can return those files to their earlier state without a separate backup restore? · 3 marks
- A phishing email, a suspicious sign-in and a malicious process on a PC all belong to one attack, but three separate tools raised three unrelated alerts. What does an XDR platform aim to do? · 3 marks
- A district's two-person ICT team works office hours only, yet security alerts arrive at night and at weekends. Which service fits this gap? · 2 marks
- A vendor describes its product as an “endpoint protection platform” (EPP). What does that usually mean? · 2 marks
- Criminals release dozens of slightly modified builds of the same malware each week, yet one antivirus signature catches almost all of them. What kind of signature is this? · 3 marks
- An administrator raises the heuristic sensitivity of the antivirus from “normal” to “aggressive”. What should they expect? · 2 marks
- A PC is infected with spyware, yet a full scan reports “No threats found”. What is this called? · 1 mark
- A user clicks a link in a message and the browser shows a warning page from the security product instead of the site. Which feature did this? · 1 mark
- A developer's application fails to connect to a cloud database with the error “self-signed certificate in certificate chain”, but only on PCs where a consumer antivirus has its HTTPS-scanning “web shield” switched on. What is happening? · 3 marks
- SmartScreen in Microsoft Edge blocks dangerous sites, but staff also use other browsers and malware can connect out on its own. Which Microsoft Defender feature extends reputation-based blocking to connections made by any application? · 3 marks
- Which Windows Security setting, under App & browser control, applies mitigations such as DEP and ASLR system-wide or per program to make memory-corruption attacks harder? · 3 marks
- During an investigation, the team finds that a script ran “Add-MpPreference -ExclusionPath C:\Users\Public” on a server the day before ransomware appeared there. Why is this significant? · 3 marks
- An administrator wants to force Microsoft Defender to download the latest security intelligence at once, from a PowerShell prompt. Which cmdlet does this? · 2 marks
- Microsoft Defender Antivirus receives security intelligence updates, engine updates and platform updates. Which statement about them is correct? · 3 marks
- Antivirus clients check a digital signature on every definition package before installing it. What does this protect against? · 2 marks
- Most definition updates are only a few hundred kilobytes, even though the full definition database is hundreds of megabytes. Why? · 2 marks
- A weekly full scan is scheduled for 13:00 on Wednesdays, but many laptops are shut in bags at that time and the console shows they have not been fully scanned for months. What setting helps most? · 2 marks
- The ministry's developers build internal Windows tools that keep triggering heuristic detections and SmartScreen warnings. What long-term fix addresses the cause? · 3 marks
- A manager says, “We have antivirus, so we can stop installing Windows updates.” Why is this wrong? · 1 mark
- A procurement committee must choose an antivirus product for 2,000 PCs. Which evidence is the most objective for comparing detection, false positives and performance? · 2 marks
- To save money, an office installs a free home edition of an antivirus product on its 60 work PCs. What is the main problem? · 1 mark
- Some staff have local administrator rights on their laptops for legacy software. How can the ICT team stop them, or malware running under their accounts, from uninstalling the managed antivirus agent? · 2 marks
- An officer works for two weeks in a remote area with no internet connection. What protection does the laptop's antivirus still provide? · 2 marks
- Which free, open-source anti-malware engine is commonly installed on Linux mail and file servers? · 1 mark
- On a Linux mail server running ClamAV, which command downloads the latest virus signature databases? · 2 marks
- A Linux Samba server stores shared folders for 200 Windows PCs. Most Windows malware cannot run on Linux, so why scan the server's files? · 2 marks
- Which built-in Android service checks installed apps for harmful behaviour, including apps that did not come from the Play Store? · 1 mark
- Which statement about malware protection on macOS is correct? · 2 marks
- Why do modern antivirus products scan the memory of running processes, not only files stored on disk? · 2 marks
- Some anti-ransomware features place hidden files that no user or legitimate program should ever touch in common folders. What is their purpose? · 2 marks
- The ransomware protection page in Windows Security points users to OneDrive for data recovery. What can OneDrive offer after an attack encrypts synced files? · 2 marks
- Staff say their PCs become almost unusable during the scheduled scan. Apart from moving the schedule, which setting can reduce the impact? · 2 marks
- Three new alerts appear in the antivirus console. Which should the ICT officer handle first? · 1 mark
- The security console produces about 400 low-value alerts a day, mostly the same harmless tool flagged again and again, and staff have started ignoring the alert queue. What is the right response? · 3 marks
- The antivirus quarantined a file you downloaded for work, and you are sure it is fine. What should you do? · 1 mark
- To speed up a slow nightly script, a technician adds powershell.exe as a process exclusion in the antivirus. Why is this dangerous? · 3 marks
- Chrome shows “Failed – Virus detected” under a file the user just tried to download. What does this mean? · 1 mark
- How do anti-rootkit scanners typically discover files and registry keys that a rootkit is hiding from Windows? · 3 marks
- A ministry wants laptops whose antivirus is switched off or out of date to be refused access to email and shared files until they are fixed. Which approach achieves this? · 3 marks
- After a detection, Windows Security says “Restart required to finish removing the threat”. What should the user do? · 1 mark
- A data centre host runs 120 virtual desktops, and at exactly 12:00 every one of them starts its scheduled antivirus scan, overwhelming the host's storage. What is the recommended fix? · 3 marks
- Protection history shows “Threat detected – action failed” for an item on a PC. What does this mean? · 2 marks
- A quick scan found and removed a trojan from a PC. What is a sensible next step? · 1 mark
- A caller pretending to be from the bank persuades a clerk to read out a one-time code over the phone. Could the PC's antivirus have prevented this? · 1 mark
- Since a new web proxy that requires user sign-in was installed, definition updates fail on every office PC. What is the likely fix? · 2 marks
- Why do “security” apps on an iPhone not scan other apps for viruses the way antivirus does on Windows? · 3 marks
- How can a user check a single downloaded file with Microsoft Defender before opening it? · 1 mark
- In Protection history, a user selects “Allow on device” for a detected item. What is the effect? · 1 mark
- Switch logs show thousands of failed login attempts against administrative interfaces in a short window. Which type of activity does this indicate and what is the primary control? · 3 marks
- What is the principal security weakness of using RADIUS with the legacy PAP protocol for user authentication over the network? · 3 marks
- An administrator must determine which user account was used to exfiltrate data from a file server. Which log source provides that accountability evidence? · 4 marks
- NIDA detects a compromised workstation sending large volumes of traffic to an external address. Which response step comes first? · 3 marks
- Which action during incident response most improves the ability to determine how an attacker entered and moved through the network? · 3 marks
- An attacker is using stolen credentials to reach internal systems from outside the firewall. Which control most directly limits the damage of that single compromised account? · 4 marks
- NIDA requires that only authorised administrators reach device management interfaces. Which sequence best enforces this? · 3 marks