Question 1: Which of the following best describes the principle of least privilege?

A. Users should have the ability to access all systems in case of emergencies
B. Users are given access only to the resources required for their job
C. Users can modify all permissions on a network
D. Users should have admin access to speed up productivity

✅ Correct Answer: B
📝 Explanation:
The principle of least privilege ensures users are granted only the access they need to do their job. This reduces the attack surface and potential misuse of permissions.

Question 2: A company wants to ensure that employees can prove their identity before accessing sensitive systems. Which concept does this relate to?

A. Non-repudiation
B. Authorization
C. Identification
D. Authentication

✅ Correct Answer: D
📝 Explanation:
Authentication is the step where users prove their identity, typically via passwords, biometrics, or tokens. It comes after identification and before authorization.

Question 3: What type of attack involves intercepting communication between two systems without either party knowing?

A. Denial-of-Service (DoS)
B. Brute Force
C. Man-in-the-Middle (MitM)
D. SQL Injection

✅ Correct Answer: C
📝 Explanation:
A Man-in-the-Middle (MitM) attack happens when an attacker silently sits between two parties to eavesdrop or manipulate communication without detection.

Question 4: Which of the following security controls is an example of a detective control?

A. Security awareness training
B. Security camera footage
C. Firewall rules
D. Multi-factor authentication

✅ Correct Answer: B
📝 Explanation:
Detective controls identify and react to incidents. Security cameras don’t prevent access but help detect unauthorized or suspicious activity after the fact.

Question 5: What is the primary purpose of a DMZ in a network architecture?

A. Encrypt sensitive information before transmission
B. Prevent internal threats
C. Host public-facing services while protecting the internal network
D. Store all sensitive company data

✅ Correct Answer: C
📝 Explanation:
A DMZ (Demilitarized Zone) is a network segment that exposes services (e.g., web servers) to the internet while isolating them from the internal LAN, adding an extra layer of protection.

Question 6: Which of the following is a social engineering attack?

A. DNS poisoning
B. ARP spoofing
C. Phishing
D. Cross-site scripting (XSS)

✅ Correct Answer: C
📝 Explanation:
Phishing is a social engineering attack where attackers trick users into giving up sensitive information (like passwords) through deceptive emails, websites, or messages.

Question 7: What is the main goal of a vulnerability scan?

A. Exploit discovered vulnerabilities
B. Remove malware from the system
C. Identify and report security weaknesses
D. Block unauthorized access

✅ Correct Answer: C
📝 Explanation:
A vulnerability scan is used to identify and report potential weaknesses in systems, applications, or networks. It doesn’t exploit them—it only highlights what needs fixing.

Question 8: Which of the following helps ensure data integrity?

A. Encrypting the data
B. Using a hashing algorithm
C. Compressing the data
D. Segmenting the network

✅ Correct Answer: B
📝 Explanation:
Hashing algorithms like SHA-256 are used to ensure data integrity. If the data changes, the hash changes—alerting you to tampering or corruption.

Question 9: What is the purpose of multi-factor authentication (MFA)?

A. Encrypt all data on the system
B. Replace passwords with biometrics
C. Require multiple forms of identity verification
D. Limit access based on geographic location

✅ Correct Answer: C
📝 Explanation:
MFA adds an extra layer of security by requiring users to verify their identity in more than one way, like using a password + fingerprint or password + SMS code.

Question 10: A company wants to prevent data from being transferred to USB drives. Which security control should be implemented?

A. Email filtering
B. Host-based firewall
C. Data Loss Prevention (DLP)
D. Security information and event management (SIEM)

✅ Correct Answer: C
📝 Explanation:
Data Loss Prevention (DLP) tools help prevent sensitive data from being copied, transferred, or leaked—including blocking transfers to USB drives, email, or cloud apps.

Question 11: Which type of malware is designed to lock a user’s files until a ransom is paid?

A. Spyware
B. Worm
C. Ransomware
D. Rootkit

✅ Correct Answer: C
📝 Explanation:
Ransomware encrypts a victim’s data and demands payment for the decryption key. It’s a growing threat in both corporate and personal environments.

Question 12: Which of the following best describes risk mitigation?

A. Accepting the risk
B. Transferring the risk to another party
C. Reducing the impact or likelihood of a risk
D. Eliminating all risks

✅ Correct Answer: C
📝 Explanation:
Risk mitigation involves taking steps to reduce the impact or likelihood of a threat. It doesn’t necessarily eliminate the risk but makes it more manageable.

Question 13: What is the primary purpose of a digital certificate?

A. Provide data compression
B. Establish a secure VPN tunnel
C. Prove the ownership of a public key
D. Encrypt system logs

✅ Correct Answer: C
📝 Explanation:
A digital certificate binds a public key with an identity and is issued by a Certificate Authority (CA) to prove ownership of that key.

Question 14: What does the CIA triad stand for in cybersecurity?

A. Communication, Integrity, Access
B. Control, Identity, Accountability
C. Confidentiality, Integrity, Availability
D. Compliance, Information, Assurance

✅ Correct Answer: C
📝 Explanation:
The CIA triad is a foundational concept representing Confidentiality, Integrity, and Availability—the three core goals of cybersecurity.

Question 15: Which of the following would best help detect unauthorized changes to files?

A. Firewall
B. File integrity checker
C. IDS
D. Load balancer

✅ Correct Answer: B
📝 Explanation:
A File Integrity Checker (FIC) monitors critical system files for changes by comparing current versions to a known-good baseline (usually via hashing).

Question 16: What is the purpose of a honeypot in cybersecurity?

A. Increase data throughput
B. Prevent phishing emails
C. Lure attackers into a controlled environment
D. Scan internal networks

✅ Correct Answer: C
📝 Explanation:
A honeypot is a decoy system designed to attract attackers so their methods can be studied without endangering the real systems.

Question 17: What type of attack relies on exploiting the trust relationship between websites and users’ browsers?

A. Cross-Site Request Forgery (CSRF)
B. SQL Injection
C. Phishing
D. Man-in-the-Middle

✅ Correct Answer: A
📝 Explanation:
CSRF tricks a user’s browser into executing actions on a website without the user’s consent, exploiting trust established by cookies or sessions.

Question 18: Which security model is primarily concerned with preventing unauthorized disclosure of information?

A. Bell-LaPadula
B. Biba
C. Clark-Wilson
D. Brewer-Nash

✅ Correct Answer: A
📝 Explanation:
The Bell-LaPadula model focuses on maintaining confidentiality by controlling how information flows between security levels.

Question 19: Which port is used for HTTPS traffic?

A. 21
B. 22
C. 80
D. 443

✅ Correct Answer: D
📝 Explanation:
Port 443 is used for HTTPS, which encrypts web traffic using SSL/TLS, providing secure communication over the internet.

Question 20: What is the role of a Certificate Authority (CA)?

A. Protect web servers from malware
B. Store encryption keys
C. Issue and manage digital certificates
D. Provide VPN authentication

✅ Correct Answer: C
📝 Explanation:
A Certificate Authority (CA) is a trusted organization that issues digital certificates, which are used to authenticate identities and enable secure communication.

Question 21: What is a logic bomb?

A. A self-replicating malware
B. Malicious code that triggers on a condition
C. An exploit for web applications
D. A DoS attack against firewalls

✅ Correct Answer: B
📝 Explanation:
A logic bomb is malicious code that lies dormant until a specific condition is met, like a date or system event, after which it activates.

Question 22: What does an IDS do?

A. Prevent intrusions in real time
B. Monitor and detect unauthorized activity
C. Scan for malware on endpoints
D. Encrypt sensitive data

✅ Correct Answer: B
📝 Explanation:
An Intrusion Detection System (IDS) monitors traffic or system activity and alerts administrators of potential security incidents. It does not block them.

Question 23: What technique helps prevent brute-force attacks on login pages?

A. CAPTCHA
B. VLAN segmentation
C. DLP
D. NAT

✅ Correct Answer: A
📝 Explanation:
CAPTCHA helps prevent bots and automated tools from launching brute-force attacks by ensuring that login attempts are made by a human.

Question 24: Which cloud model gives the most control over hardware and software?

A. SaaS
B. PaaS
C. IaaS
D. XaaS

✅ Correct Answer: C
📝 Explanation:
Infrastructure as a Service (IaaS) offers the most flexibility and control, allowing users to manage virtual machines, storage, and networks.

Question 25: What is a zero-day vulnerability?

A. A known vulnerability without a fix
B. An outdated patch
C. A vulnerability disclosed before being exploited
D. An undisclosed vulnerability actively being exploited

✅ Correct Answer: D
📝 Explanation:
A zero-day vulnerability is a previously unknown flaw that’s discovered and exploited before a patch is available, making it very dangerous.

Question 26: Which of the following tools would be used to capture and analyze network traffic?

A. SIEM
B. IDS
C. Packet sniffer
D. DLP

✅ Correct Answer: C
📝 Explanation:
A packet sniffer (like Wireshark) captures and analyzes network packets in real time, useful for troubleshooting and detecting suspicious behavior.

Question 27: Which of the following helps prevent unauthorized access to a mobile device?

A. IMEI
B. Remote wipe
C. Lock screen with biometric authentication
D. VPN

✅ Correct Answer: C
📝 Explanation:
A biometric lock screen (like fingerprint or facial recognition) adds a strong, user-friendly barrier to unauthorized physical access.

Question 28: Which hashing algorithm is considered most secure today?

A. MD5
B. SHA-1
C. SHA-256
D. DES

✅ Correct Answer: C
📝 Explanation:
SHA-256, part of the SHA-2 family, is currently considered secure and collision-resistant, unlike MD5 and SHA-1, which are outdated and vulnerable.

Question 29: What is the purpose of a security baseline?

A. Configure firewall rules
B. Monitor system logs
C. Define minimum security standards
D. Encrypt all user traffic

✅ Correct Answer: C
📝 Explanation:
A security baseline is a set of minimum required security configurations to ensure consistency and compliance across systems.

Question 30: What is tokenization used for?

A. Encrypt network traffic
B. Replace sensitive data with non-sensitive equivalents
C. Convert public keys into private keys
D. Compress large files

✅ Correct Answer: B
📝 Explanation:
Tokenization replaces sensitive data (like credit card numbers) with non-sensitive placeholders (tokens), helping protect data in storage and transit.