Question 1
A security architect is implementing a zero-trust model in an enterprise. Which of the following is MOST aligned with zero-trust principles?
A. Segmenting the network by IP range
B. Using perimeter firewalls to secure the DMZ
C. Requiring continuous authentication and least privilege
D. Enabling NAT for all internal clients

Correct Answer: C
Explanation: Zero-trust assumes no implicit trust and enforces continuous verification and least privilege.

Question 2
An organization wants to detect anomalies in network traffic in real time. Which of the following technologies is MOST suitable?
A. SIEM
B. IDS
C. DLP
D. UBA

Correct Answer: D
Explanation: User Behavior Analytics (UBA) detects anomalies by analyzing normal vs. abnormal behavior patterns.

Question 3
Which of the following encryption methods provides data-at-rest protection with minimal CPU impact?
A. AES-256
B. RSA
C. SHA-256
D. ECC

Correct Answer: A
Explanation: AES-256 is widely used for strong symmetric encryption of data-at-rest with high performance.

Question 4
You are designing a hybrid cloud environment. Which of the following is MOST important for maintaining secure communication between on-prem and cloud?
A. DLP integration
B. Network segmentation
C. VPN with IPsec
D. Third-party identity provider

Correct Answer: C
Explanation: A VPN with IPsec ensures encrypted communication between cloud and on-prem networks.

Question 5
Which regulation is focused specifically on the protection of EU citizens’ data?
A. HIPAA
B. SOX
C. PCI DSS
D. GDPR

Correct Answer: D
Explanation: GDPR governs data privacy and protection for EU citizens.

Question 6
What is the primary goal of threat hunting in a cybersecurity context?
A. Patch vulnerabilities
B. Detect and remove malware
C. Identify hidden or unknown threats
D. Prevent phishing

Correct Answer: C
Explanation: Threat hunting is a proactive activity to uncover unknown threats in an environment.

Question 7
A DevSecOps pipeline should include:
A. Manual QA testing
B. Static code analysis tools
C. Periodic security audits
D. Patch rollback scripts

Correct Answer: B
Explanation: Static Application Security Testing (SAST) tools automatically analyze code for vulnerabilities during the build phase.

Question 8
Which of the following can MOST effectively mitigate the risk of insider threats?
A. IDS
B. Data classification
C. Least privilege
D. Vulnerability scanning

Correct Answer: C
Explanation: Implementing least privilege ensures users have only the access they need, reducing insider threat risk.

Question 9
Which cryptographic attack exploits weaknesses in the algorithm’s math to find a key faster than brute-force?
A. Rainbow table attack
B. Side-channel attack
C. Birthday attack
D. Ciphertext-only attack

Correct Answer: C
Explanation: A birthday attack leverages hash collisions, making it faster than brute force for some algorithms.

Question 10
Which of the following protocols supports mutual TLS authentication?
A. SFTP
B. HTTPS
C. SSH
D. IPsec

Correct Answer: B
Explanation: HTTPS with client and server certificates enables mutual TLS authentication.

Question 11
A company wants to monitor real-time alerts and correlate security events. What solution should they implement?
A. Firewall
B. SIEM
C. NAC
D. DLP

Correct Answer: B
Explanation: A Security Information and Event Management (SIEM) system correlates and alerts on security events.

Question 12
Which cloud model gives an organization the most control over infrastructure?
A. SaaS
B. PaaS
C. IaaS
D. FaaS

Correct Answer: C
Explanation: In IaaS, you manage everything except the physical hardware.

Question 13
Which authentication protocol uses tickets to allow users access to services without resending passwords?
A. LDAP
B. Kerberos
C. RADIUS
D. TACACS+

Correct Answer: B
Explanation: Kerberos uses time-limited tickets to authenticate users securely.

Question 14
Which of the following frameworks focuses specifically on cybersecurity risk management?
A. ISO 9001
B. NIST CSF
C. COBIT
D. ITIL

Correct Answer: B
Explanation: NIST Cybersecurity Framework (CSF) provides a flexible approach to cybersecurity risk management.

Question 15
Which technique allows you to prevent lateral movement within a compromised network?
A. Role-based access control
B. Network segmentation
C. Antivirus
D. VLAN trunking

Correct Answer: B
Explanation: Network segmentation limits access between different parts of the network, preventing lateral movement.

Question 16
Which of the following describes a cold site?
A. Fully equipped and operational
B. Requires equipment and configuration
C. Mirror of the production site
D. Offers real-time failover

Correct Answer: B
Explanation: A cold site has infrastructure but needs to be configured during disaster recovery.

Question 17
Which of the following BEST enables accountability in an enterprise environment?
A. Multi-factor authentication
B. Role-based access control
C. Logging and auditing
D. Network segmentation

Correct Answer: C
Explanation: Logs and audits track who did what and when, ensuring accountability.

Question 18
Which type of control is encryption considered?
A. Detective
B. Preventive
C. Corrective
D. Compensating

Correct Answer: B
Explanation: Encryption is a preventive control, protecting data from unauthorized access.

Question 19
Which of the following BEST supports secure federated identity management?
A. LDAP
B. OAuth 2.0
C. Kerberos
D. CHAP

Correct Answer: B
Explanation: OAuth 2.0 supports federated identity and authorization between organizations.

Question 20
A penetration tester is using a MITM attack during an engagement. What tool is MOST likely being used?
A. Nessus
B. Burp Suite
C. Nikto
D. Netstat

Correct Answer: B
Explanation: Burp Suite is commonly used for MITM, web application testing, and proxy interception.