Question 1

A security analyst notices several failed login attempts from the same IP address within a short period. What is the most likely explanation?
A. Phishing attack
B. DDoS attack
C. Brute-force attack
D. SQL injection
Correct Answer: C
Explanation: Multiple failed logins from the same source indicate a brute-force attempt to guess credentials.

Question 2

Which of the following tools would best help identify open ports and services running on a remote server?
A. Wireshark
B. Nessus
C. Nmap
D. Snort
Correct Answer: C
Explanation: Nmap is used for network discovery and scanning, revealing open ports and services.

Question 3

What does the term SIEM stand for?
A. Security Internet Email Management
B. Security Information and Event Management
C. Secure Integrated Enterprise Monitoring
D. Security Intelligence and External Monitoring
Correct Answer: B
Explanation: SIEM tools collect, analyze, and correlate logs for threat detection and response.

Question 4

A company wants to reduce the attack surface of a web server. Which of the following would best support that goal?
A. Enabling unnecessary services
B. Disabling default accounts
C. Running vulnerability scans
D. Increasing bandwidth
Correct Answer: B
Explanation: Disabling unused or default accounts helps reduce the attack surface.

Question 5

Which of the following best describes a zero-day vulnerability?
A. A vulnerability found in outdated software
B. A known vulnerability with a patch
C. A vulnerability exploited before the vendor is aware
D. A misconfigured firewall rule
Correct Answer: C
Explanation: A zero-day is an undisclosed vulnerability that attackers exploit before a fix is available.

Question 6

A security analyst is reviewing logs and sees traffic to command-and-control (C2) servers. What type of attack is most likely in progress?
A. Ransomware
B. DDoS
C. Rootkit
D. Botnet
Correct Answer: D
Explanation: Botnets communicate with C2 servers for instructions and updates.

Question 7

What is the primary purpose of threat intelligence in cybersecurity?
A. Perform data backups
B. Monitor employee activity
C. Understand adversaries and predict future attacks
D. Configure routers
Correct Answer: C
Explanation: Threat intelligence provides insights on attacker tactics and trends to strengthen defenses.

Question 8

Which of the following techniques is used in a man-in-the-middle (MITM) attack?
A. Packet sniffing
B. Port scanning
C. SQL injection
D. Firewall misconfiguration
Correct Answer: A
Explanation: MITM attackers often use packet sniffing to intercept communication.

Question 9

What is the function of a sandbox environment in malware analysis?
A. Launch cyberattacks
B. Deploy software patches
C. Isolate malware for safe analysis
D. Monitor network traffic
Correct Answer: C
Explanation: Sandboxes are isolated environments where analysts run malware to observe its behavior safely.

Question 10

A user reports their system is unusually slow. You notice encrypted file extensions and a ransom note. What’s the likely issue?
A. Rootkit infection
B. Worm propagation
C. Ransomware
D. Trojan
Correct Answer: C
Explanation: Encrypted files and ransom notes are classic symptoms of ransomware.

Question 11

Which metric in a vulnerability scan indicates the urgency to remediate?
A. Asset value
B. Exploit availability
C. CVSS score
D. Uptime
Correct Answer: C
Explanation: CVSS scores help prioritize remediation based on severity.

Question 12

Which of the following is a false positive in a security alert?
A. A missed attack
B. A legitimate threat identified
C. A benign activity flagged as a threat
D. An unlogged incident
Correct Answer: C
Explanation: False positives are non-malicious events mistakenly identified as threats.

Question 13

What is the primary goal of incident response?
A. Punish attackers
B. Notify the press
C. Restore normal operations and mitigate impact
D. Replace security software
Correct Answer: C
Explanation: Incident response aims to reduce damage and restore normal operations quickly.

Question 14

Which of the following describes log aggregation?
A. Monitoring CPU usage
B. Encrypting log files
C. Collecting and centralizing logs from multiple sources
D. Blocking IP addresses
Correct Answer: C
Explanation: Log aggregation is used in SIEMs to centralize logs for analysis.

Question 15

Which framework emphasizes detect, respond, and recover phases?
A. MITRE ATT&CK
B. NIST Cybersecurity Framework
C. ISO 27001
D. COBIT
Correct Answer: B
Explanation: NIST CSF includes identify, protect, detect, respond, and recover.

Question 16

A system shows signs of compromise. What is the first step in incident handling?
A. Containment
B. Eradication
C. Identification
D. Recovery
Correct Answer: C
Explanation: Identifying the incident is the first step before containment or eradication.

Question 17

A user is added to a privileged group without approval. What should the analyst check first?
A. DNS logs
B. Firewall rules
C. Audit logs
D. Email headers
Correct Answer: C
Explanation: Audit logs will show who made the change and when.

Question 18

What’s the best method to analyze large volumes of real-time security data?
A. Packet capture
B. Excel spreadsheets
C. Manual review
D. SIEM correlation
Correct Answer: D
Explanation: SIEMs provide real-time log analysis and correlation to detect threats.

Question 19

Which type of attack uses fraudulent websites to steal credentials?
A. Brute-force
B. Phishing
C. MITM
D. Spoofing
Correct Answer: B
Explanation: Phishing often involves fake websites to trick users into revealing sensitive data.

Question 20

Which report would most likely be shared with executive leadership during an incident?
A. Deep packet inspection report
B. Executive summary of impact and response
C. Raw firewall log dump
D. Vulnerability scan output
Correct Answer: B
Explanation: Executives prefer summaries focused on business impact and response measures.