Question 1
Which part of the CIA triad is compromised when a user gains unauthorized access to sensitive data?
A. Confidentiality
B. Integrity
C. Availability
D. Authentication

Correct Answer: A
Explanation: Unauthorized access compromises confidentiality.

Question 2
Which tool is typically used to analyze network traffic at the packet level?
A. Nessus
B. Wireshark
C. Nmap
D. Metasploit

Correct Answer: B
Explanation: Wireshark is a packet analyzer used for deep inspection of network traffic.

Question 3
Which type of attack involves injecting malicious SQL queries into user input fields?
A. DoS
B. XSS
C. SQL Injection
D. DNS Spoofing

Correct Answer: C
Explanation: SQL Injection allows attackers to manipulate backend databases via unsanitized input.

Question 4
What does the whoami command display in Windows?
A. IP address
B. User’s login history
C. Username of the current user
D. Hostname of the system

Correct Answer: C
Explanation: The whoami command shows the current user’s name.

Question 5
Which of the following protocols is used to secure email communication?
A. SMTP
B. IMAP
C. POP3
D. SMTPS

Correct Answer: D
Explanation: SMTPS is the secure version of SMTP using SSL/TLS.

Question 6
What does a SIEM system do?
A. Manages patches
B. Monitors physical access
C. Collects and analyzes security logs
D. Encrypts sensitive files

Correct Answer: C
Explanation: SIEM systems aggregate and analyze logs for threat detection and compliance.

Question 7
Which tool is best suited to scan a network for open ports?
A. Nmap
B. Autopsy
C. Splunk
D. John the Ripper

Correct Answer: A
Explanation: Nmap is a network mapper used for port scanning and discovery.

Question 8
Which file system artifact might indicate malware persistence on a Windows system?
A. .bash_history
B. Registry Run keys
C. syslog
D. ARP cache

Correct Answer: B
Explanation: Malware often uses Windows Registry Run keys to maintain persistence.

Question 9
What kind of information would a PCAP file contain?
A. Email messages
B. Registry settings
C. Captured network packets
D. Firewall rules

Correct Answer: C
Explanation: PCAP (Packet Capture) files store raw packet data from the network.

Question 10
Which Linux command shows running processes?
A. ifconfig
B. ps
C. mkdir
D. rm

Correct Answer: B
Explanation: ps lists running processes on Linux systems.

Question 11
Which log file would you examine to find Windows security events?
A. messages.log
B. syslog
C. Security.evtx
D. auth.log

Correct Answer: C
Explanation: Security.evtx contains Windows security event logs.

Question 12
Which of the following best describes a logic bomb?
A. Malware disguised as a normal program
B. Code that triggers under specific conditions
C. Worm that spreads via USB
D. Virus that encrypts files

Correct Answer: B
Explanation: A logic bomb activates when predefined conditions are met.

Question 13
Which protocol uses port 443 by default?
A. HTTP
B. HTTPS
C. FTP
D. SSH

Correct Answer: B
Explanation: HTTPS (secure HTTP) uses port 443.

Question 14
Which part of incident response involves identifying and confirming a security event?
A. Containment
B. Recovery
C. Identification
D. Lessons Learned

Correct Answer: C
Explanation: The identification phase detects and validates an incident.

Question 15
Which term refers to an attack where the attacker tricks a user into clicking a malicious link?
A. DoS
B. Social Engineering
C. Phishing
D. Man-in-the-middle

Correct Answer: C
Explanation: Phishing is a form of social engineering via deceptive emails or messages.

Question 16
Which Linux command shows the system’s network interfaces?
A. ps
B. netstat
C. ifconfig
D. df

Correct Answer: C
Explanation: ifconfig displays network interface configurations.

Question 17
What type of malware locks a user’s data and demands payment?
A. Adware
B. Rootkit
C. Ransomware
D. Spyware

Correct Answer: C
Explanation: Ransomware encrypts data and demands ransom for access.

Question 18
In which type of attack does a threat actor impersonate a legitimate server to intercept traffic?
A. Brute Force
B. SQLi
C. DNS Spoofing
D. Credential Stuffing

Correct Answer: C
Explanation: DNS Spoofing tricks users into visiting a malicious site.

Question 19
Which is NOT a common indicator of compromise (IOC)?
A. Unusual network traffic
B. Unauthorized logins
C. High CPU usage
D. Monthly backup reports

Correct Answer: D
Explanation: Backup reports are not IOCs; the others indicate potential compromise.

Question 20
What is the purpose of a playbook in incident response?
A. Store credentials
B. List user permissions
C. Define repeatable steps during an incident
D. Monitor server uptime

Correct Answer: C
Explanation: A playbook is a standardized response plan for specific types of incidents.