You should prepare questions around: • CIA triad (confidentiality, integrity, availability) • Authentication vs authorization vs accounting • Non-repudiation and hashing • Risk management concepts • Threat actors (APT, insider, hacktivist, script kiddie, state-sponsored) • Zero trust architecture • Physical security controls (guards, bollards, mantraps, Faraday cage) • Security control types (administrative, technical, physical) • Qualitative vs quantitative risk analysis Type of exam questions • Identify the security principle being violated. • Choose the best control to implement for a given scenario.

You should prepare questions around: • CIA triad (confidentiality, integrity, availability) • Authentication vs authorization vs accounting • Non-repudiation and hashing • Risk management concepts • Threat actors (APT, insider, hacktivist, script kiddie, state-sponsored) • Zero trust architecture • Physical security controls (guards, bollards, mantraps, Faraday cage) • Security control types (administrative, technical, physical) • Qualitative vs quantitative risk analysis Type of exam questions • Identify the security principle being violated. • Choose the best control to implement for a given scenario. | Quizalize

120 questions

Which of the following best describes a Zero Trust architecture?

30 sec

What is the primary purpose of hashing in cybersecurity?

30 sec

Which type of risk analysis relies on numerical data to assess potential losses?

30 sec

In the context of the CIA triad, what does 'availability' refer to?

30 sec

Which of the following best describes the role of authentication in cybersecurity?

30 sec

Which type of threat actor typically seeks to disrupt or protest against an organization for political or social reasons?

30 sec

Which of the following is an example of a physical security control?

30 sec

What is the main concept behind non-repudiation in cybersecurity?

30 sec

Which of the following controls is an example of an administrative security control?

30 sec

In a risk management framework, what does the term 'threat' refer to?

30 sec

Which type of malware often encrypts a user's files and demands payment for the decryption key?

30 sec

What social engineering technique involves manipulating someone over the phone to obtain sensitive information?

30 sec

Which type of software vulnerability occurs when a program reads more data than it can handle, leading to potential exploitation?

30 sec

Which MITRE ATT&CK tactic involves gaining initial access to a target system?

30 sec

What is a common secure coding practice that helps prevent security vulnerabilities by ensuring that input is checked before processing?

30 sec

Which type of attack targets the software supply chain to compromise systems by inserting malicious code into legitimate software?

30 sec

What differentiates penetration testing from vulnerability scans?

30 sec

Which technique involves obscuring the true intent of a communication to build trust and obtain sensitive information?

30 sec

What is the primary purpose of application sandboxing?

30 sec

What security practice involves regularly updating software to fix vulnerabilities and improve security?

30 sec

Which type of malware is designed to establish remote control over a system, often used for espionage?

30 sec

Which technique involves exploiting a vulnerability that allows access to protected resources by manipulating input parameters?

30 sec

What social engineering tactic involves gaining unauthorized access by following an authorized person into a restricted area?

30 sec

Which practice involves regularly reviewing and applying updates to software to mitigate security vulnerabilities?

30 sec

What is a key characteristic of advanced persistent threats (APTs)?

30 sec

What technique involves sending deceptive SMS or voice messages to manipulate individuals into giving up personal information?

30 sec

Which coding practice is aimed at ensuring that user inputs are checked to prevent malicious data from being processed?

30 sec

What type of malware encrypts a victim's files and demands payment for the decryption key?

30 sec

Which type of attack targets vulnerabilities in a supply chain, often affecting third-party vendors?

30 sec

Which vulnerability is typically exploited by sending more data to a buffer than it can handle, leading to unintended behavior?

30 sec

Which of the following protocols provides a secure channel over an insecure network and is commonly used for remote administration?

30 sec

What is the primary purpose of a Web Application Firewall (WAF)?

30 sec

Which of the following correctly describes micro-segmentation in network security?

30 sec

In the context of cloud security, what is the shared responsibility model?

30 sec

Which networking technology is primarily used to ensure the secure transmission of IP packets over a public network?

30 sec

What is the primary function of Public Key Infrastructure (PKI) in network security?

30 sec

Which protocol should be used instead of Telnet for secure remote command-line access?

30 sec

What does SASE stand for in the context of network security and architecture?

30 sec

What is the main purpose of a Next-Generation Firewall (NGFW)?

30 sec

Which technology is used in container orchestration for automating the deployment, scaling, and management of containerized applications?

30 sec

Which network security zone serves as an isolated area that allows external access to specific services while protecting the internal network?

30 sec

Which protocol provides a secure communication channel over the internet using encryption and is commonly used for web traffic?

30 sec

What is the main purpose of using Network Access Control (NAC) in an organization?

30 sec

Which technology provides security by distributing network traffic across multiple virtual networks, each isolated from the others?

30 sec

Which cloud service model provides complete control over the underlying infrastructure and is primarily used for deploying custom software applications?

30 sec

What is the role of a Web Application Firewall (WAF) in network security?

30 sec

What is the primary advantage of using SSH over Telnet for remote access to servers?

30 sec

What does OCSP stapling provide in the context of PKI (Public Key Infrastructure)?

30 sec

What is the primary function of Intrusion Detection Systems (IDS)?

30 sec

What is the main purpose of using VPN technology in network security?

30 sec

What does the acronym DMARC stand for in email security?

30 sec

Which role in a Security Operations Center (SOC) is primarily responsible for investigating and responding to security incidents?

30 sec

Which of the following is NOT a primary component of the incident response lifecycle?

30 sec

Which protocol helps to prevent email spoofing by specifying which mail servers are permitted to send emails on behalf of a domain?

30 sec

What is the primary purpose of implementing Data Loss Prevention (DLP) solutions in an organization?

30 sec

What is the main purpose of a correlation rule in a SIEM (Security Information and Event Management) system?

30 sec

Which log source would you primarily analyze to track user authentication and access within a network?

30 sec

What is a critical step to ensure the integrity of digital evidence during an investigation?

30 sec

During disaster recovery planning, what does RPO stand for?

30 sec

What is the main objective of endpoint hardening?

30 sec

What is the primary purpose of a Business Continuity Plan (BCP)?

30 sec

Which regulation focuses on the protection of health information in the United States?

30 sec

What type of risk does a Security Assessment primarily evaluate?

30 sec

Which of the following is a key component of Third-Party Risk Management?

30 sec

What is the main goal of security awareness training?

30 sec

What does GDPR stand for and what is its primary focus?

30 sec

Which of the following is considered a Key Risk Indicator (KRI)?

30 sec

What is the primary purpose of an Acceptable Use Policy (AUP)?

30 sec

What is a primary benefit of conducting regular security audits?

30 sec

What does Business Continuity Planning (BCP) primarily focus on?

30 sec

What type of attack, characterized by repeated authentication attempts using various usernames from foreign IP ranges, was observed in this scenario?

30 sec

Which security mechanism is responsible for automatically quarantining devices that attempt to disable antivirus and modify registry startup keys?

30 sec

What type of solution would provide the BEST prevention for an insider threat scenario where patient records were exported via USB drives without triggering alerts?

30 sec

What backup concept was missing when the off-site backup also became encrypted during a ransomware attack due to timing of the replication job?

30 sec

Which security control would have most likely prevented the phishing attack that harvested employee credentials by mimicking the HR portal?

30 sec

What security principle prevented the attacker from escalating privileges or accessing sensitive files after exploiting a vulnerability in a web application?

30 sec

Which attack is described when users' email apps redirect to a fraudulent login page after connecting to a rogue access point that mimics a legitimate network?

30 sec

What is the MOST likely explanation for a workstation making encrypted outbound connections to unknown IP addresses every 15 minutes, bypassing the proxy server?

30 sec

Which technologies together satisfy the requirement for a supplier onboarding system that needs to ensure confidential CAD files remain encrypted both during uploading and while stored in cloud storage?

30 sec

What attack is characterized by repeated attempts using various usernames to gain unauthorized access to a system, particularly noted in connection attempts from foreign IP addresses?

30 sec

In the context of SQL injection, what input could allow you to bypass authentication and extract user data from the database when given a vulnerable SQL query structure?

30 sec

Which Nmap command would you use to perform a stealth scan (SYN scan) on the target IP 192.168.1.30 and output the results to a file named nmap_output.txt?

30 sec

When performing a brute force attack against an SSH server, what command would you use with the tool Hydra to attempt to crack the password for the user 'admin' using a password list located at '/path/to/passwords.txt'?

30 sec

Which step would you take first in Burp Suite to capture a request sent from a browser before it reaches the web server?

30 sec

In a SQL injection scenario, the following input in the email field was provided: ' OR '1'='1'; --. What is the primary function of this input in bypassing authentication?

30 sec

During a security assessment, what Nmap option would you use to include service version detection along with OS detection during your scan?

30 sec

When using the Social Engineering Toolkit (SEToolkit) to perform credential harvesting, which option should you select to clone a website for phishing purposes?

30 sec

In Burp Suite, after intercepting a request, how can you modify the request parameters before sending it to the server?

30 sec

What command would you issue in Nmap to perform a basic ping scan to check if the host at 172.16.0.10 is online?

30 sec

What type of scan in Nmap is typically used to check for open ports without establishing a full TCP connection, thereby remaining stealthy?

30 sec

What is the primary purpose of configuring Group Policy Objects (GPO) in a Windows environment?

30 sec

Which security control is best suited for detecting and responding to suspicious activity on a network in real-time?

30 sec

What is the primary purpose of employing Multi-Factor Authentication (MFA) in an organization?

30 sec

Which command would you use to perform a dictionary attack on SHA-512 salted hashes contained in hashes.txt using a wordlist located in wordlist.txt?

30 sec

What command should you use in Netcat to listen on port 5555 and log all received connections?

30 sec

Which display filter would you use in Wireshark to capture only HTTP POST requests containing clear-text credentials?

30 sec

What command should you run in Aircrack-ng to attempt password cracking on a WPA2 handshake file 'capture.cap' using the wordlist 'rockyou.txt'?

30 sec

Which command would you use in Nmap to detect the operating system, identify service versions, and avoid alerting an IDS when scanning the target 172.16.5.44?

30 sec

In Metasploit, which sequence of commands should you execute to exploit a vulnerable FTP server, starting from searching the exploit to running it?

30 sec

What is the correct command to filter and show only outbound traffic to the IP address 198.51.100.44 using TCPDump?

100

30 sec

What is the appropriate command to encrypt a file named 'salaries.csv' using GPG with the recipient's public key stored in 'finance_pub.gpg'?

101

30 sec

Which command should you use to check for critical TLS vulnerabilities on a public web server and generate a report that includes only CVSS scores greater than or equal to 9?

102

30 sec

What is the correct command to initialize the AIDE database for file integrity monitoring and then verify the system integrity?

103

30 sec

Which of the following is considered a principle of information security?

104

30 sec

What does the acronym 'CIA' stand for in the context of information security?

105

30 sec

What is the primary purpose of a firewall in network security?

106

30 sec

Which of the following is an example of social engineering?

107

30 sec

What is the purpose of encryption in data security?

108

30 sec

What does 'two-factor authentication' (2FA) enhance in terms of security?

109

30 sec

Which type of malware is designed to replicate itself and spread to other computers?

110

30 sec

What is the primary goal of intrusion detection systems (IDS)?

111

30 sec

What does a 'zero-day vulnerability' refer to in cybersecurity?

112

30 sec

What is the main purpose of a Security Information and Event Management (SIEM) system?

113

30 sec

What is the primary purpose of a subnet mask in networking?

114

30 sec

Which protocol is used for securely transmitting data over the Internet?

115

30 sec

What device is used to connect multiple networks and route packets between them?

116

30 sec

Which layer of the OSI model is responsible for establishing, maintaining, and terminating communication sessions?

117

30 sec

What is the main function of DNS in networking?

118

30 sec

What is the maximum transmission unit (MTU) in networking?

119

30 sec

Which of the following is a common network topology that connects all devices to a central hub?

120

30 sec

Related quizzes

Related quizzes