A hospital's patient record system must ensure that only authorized medical staff can view patient data. Which principle of the CIA triad is primarily addressed by this requirement?
Non-repudiation
Availability
Integrity
Confidentiality
✓
Correct Answer
Confidentiality
Confidentiality ensures that information is not disclosed to unauthorized individuals. Integrity ensures data has not been tampered with or altered. Availability ensures authorized users can access information when needed. Non-repudiation is a concept related to authenticity and accountability, not a core CIA triad principle.
Question 2
A user attempts to log into a system by providing their password and then scanning their fingerprint. This method of access control is an example of which authentication concept?
Biometric authentication
Multi-factor authentication
✓
Single-factor authentication
Two-way authentication
Correct Answer
Multi-factor authentication
Multi-factor authentication requires two or more distinct types of credentials from different categories (something you know, something you have, something you are). Single-factor authentication uses only one type of credential. Biometric authentication is a type of 'something you are' factor, but not the overall concept described. Two-way authentication is not a standard term for this concept, often confused with mutual authentication.
Question 3
Which of the following best describes the primary function of a digital certificate in the context of encryption and secure communication?
To ensure data integrity during transit.
To generate random numbers for cryptographic keys.
To verify the identity of the sender or server.
✓
To encrypt data symmetrically for fast transmission.
Correct Answer
To verify the identity of the sender or server.
Digital certificates bind a public key to an identity, allowing verification of the sender's or server's identity. Symmetric encryption uses a shared secret key for speed, which is not the primary function of a certificate. Certificates do not generate random numbers for keys; that is typically done by cryptographic libraries. While certificates are part of secure communication, their primary role is not solely to ensure data integrity, but rather identity verification which underpins trust for integrity and confidentiality.
Question 4
An attacker sends an email disguised as a legitimate bank notification, prompting the recipient to click a link and enter their login credentials on a fake website. This is a classic example of which attack type?
Phishing
✓
Cross-Site Scripting (XSS)
Denial-of-Service (DoS)
SQL Injection
Correct Answer
Phishing
Phishing is a social engineering attack where attackers attempt to trick users into revealing sensitive information, often via fake emails and websites. DoS attacks aim to make a service unavailable by overwhelming it. SQL Injection exploits vulnerabilities in database queries to gain unauthorized access or manipulate data. XSS attacks inject malicious scripts into trusted websites viewed by other users.
Question 5
A user downloads a free software utility that appears legitimate but secretly installs a backdoor on their system, allowing remote access to an attacker. This type of malware is known as a:
Worm
Rootkit
Trojan horse
✓
Adware
Correct Answer
Trojan horse
A Trojan horse disguises itself as legitimate software but contains malicious functionality. A worm is self-replicating malware that spreads across networks without user intervention. A rootkit is designed to hide its presence and the presence of other malicious software. Adware displays unwanted advertisements.
Question 6
Which network defense technology operates by examining incoming and outgoing network traffic against a set of predefined rules to permit or deny communication?
Intrusion Detection System (IDS)
Firewall
✓
Virtual Private Network (VPN)
Security Information and Event Management (SIEM)
Correct Answer
Firewall
A firewall filters network traffic based on predefined rules. An IDS monitors network or system activities for malicious activity or policy violations, but doesn't block traffic itself. A VPN creates a secure, encrypted connection over a public network. A SIEM system aggregates and analyzes security alerts and logs from various sources.
Question 7
An organization implements strict access controls to ensure that data is not accidentally or maliciously modified by unauthorized users. Which principle of the CIA triad is primarily being upheld?
Confidentiality
Availability
Authenticity
Integrity
✓
Correct Answer
Integrity
Integrity ensures that data remains accurate, complete, and unaltered by unauthorized means. Confidentiality prevents unauthorized disclosure of information. Availability ensures that systems and data are accessible when needed. Authenticity is about verifying identity, which supports integrity but is not the core principle described.
Question 8
A company requires employees to use a hardware token that generates a new one-time password every 60 seconds, in addition to their regular password, to log into the corporate network. This security measure primarily enhances:
Data encryption
Authorization
Authentication strength
✓
Physical security
Correct Answer
Authentication strength
Using a hardware token along with a password adds a 'something you have' factor to the 'something you know' factor, significantly strengthening authentication. Physical security relates to protecting physical assets. Authorization determines what an authenticated user can do. Data encryption protects data confidentiality, not the login process itself.
Question 9
In asymmetric encryption, what is the relationship between the public key and the private key?
The public key encrypts, and the private key decrypts; the private key is kept secret.
✓
Both keys are identical and shared among all authorized users.
Both keys can encrypt and decrypt data interchangeably.
The private key encrypts, and the public key decrypts; the public key is kept secret.
Correct Answer
The public key encrypts, and the private key decrypts; the private key is kept secret.
In asymmetric encryption, the public key is used to encrypt data, and the corresponding private key (which is kept secret by the owner) is used to decrypt it. The roles are distinct and not interchangeable for a given key pair. The private key must remain secret, while the public key is openly distributed. Both keys are mathematically linked but not identical.
Question 10
An attacker attempts to overwhelm a web server with a flood of traffic from multiple compromised computers, making the server unavailable to legitimate users. What type of attack is this?
Distributed Denial-of-Service (DDoS)
✓
Buffer Overflow
Man-in-the-Middle (MitM)
Zero-day exploit
Correct Answer
Distributed Denial-of-Service (DDoS)
A DDoS attack uses multiple compromised systems to flood a target with traffic, causing a denial of service. MitM attacks involve an attacker intercepting communication between two parties. A buffer overflow occurs when a program writes data beyond the allocated buffer, potentially leading to arbitrary code execution. A zero-day exploit targets a vulnerability unknown to the vendor.
Question 11
Which category of malware is designed to encrypt a victim's files and demand a payment, typically in cryptocurrency, for the decryption key?
Keylogger
Ransomware
✓
Botnet
Spyware
Correct Answer
Ransomware
Ransomware encrypts files and demands a ransom for their release. Spyware collects information about a user's activities without their knowledge. A keylogger records keystrokes. A botnet is a network of compromised computers controlled by an attacker, often used for DDoS attacks or sending spam, but not primarily for file encryption and ransom.
Question 12
A network administrator configures a device to inspect the content of network packets for known attack signatures and block them in real-time. Which network defense technology is being utilized?
Virtual Private Network (VPN)
Intrusion Prevention System (IPS)
✓
Data Loss Prevention (DLP)
Intrusion Detection System (IDS)
Correct Answer
Intrusion Prevention System (IPS)
An IPS actively blocks or drops malicious traffic based on detected signatures or anomalies. An IDS only detects and alerts without blocking. A VPN creates a secure tunnel for communication. DLP monitors and prevents sensitive information from leaving the organization's control.
Question 13
During a system upgrade, a database server experiences an unexpected power outage, leading to a temporary inability for users to access critical data. Which aspect of the CIA triad is primarily compromised?
Integrity
Availability
✓
Accountability
Confidentiality
Correct Answer
Availability
Availability ensures that authorized users can access systems and data when needed. Confidentiality is about preventing unauthorized disclosure. Integrity is about preventing unauthorized modification. Accountability refers to tracking actions to specific users.
Question 14
Which of the following scenarios best demonstrates a weakness in authentication rather than authorization?
An attacker guesses a weak password and gains access to a user's account.
✓
A firewall blocks an employee's access to external websites.
A user successfully logs in but cannot access a specific folder due to insufficient permissions.
A system administrator accidentally grants too many privileges to a new employee.
Correct Answer
An attacker guesses a weak password and gains access to a user's account.
Guessing a weak password compromises the authentication process, allowing an unauthorized entity to prove identity. The first option describes an authorization issue (permissions after login). The third option is an authorization configuration error. The fourth option is a network access control, not directly an authentication or authorization issue for a user.
Question 15
What is the primary purpose of a cryptographic hash function?
To encrypt data into a reversible ciphertext.
To create a fixed-size, unique digest of data for integrity verification.
✓
To digitally sign documents using a private key.
To securely exchange symmetric encryption keys.
Correct Answer
To create a fixed-size, unique digest of data for integrity verification.
A cryptographic hash function generates a fixed-size, unique output (hash or digest) from data, primarily used to verify data integrity because any change to the input data results in a different hash. Encryption is reversible. Key exchange protocols handle symmetric key exchange. Digital signatures use hash functions but also involve encryption with a private key for authentication and non-repudiation, which is a secondary use of the hash itself.
Question 16
An attacker exploits a vulnerability in a web application to inject malicious client-side scripts into web pages viewed by other users. This attack is known as:
Brute-force attack
SQL Injection
Cross-Site Scripting (XSS)
✓
Buffer Overflow
Correct Answer
Cross-Site Scripting (XSS)
XSS attacks inject malicious scripts into web pages viewed by other users, often to steal session cookies or deface websites. Buffer overflow exploits memory management vulnerabilities. SQL injection targets database queries. Brute-force attacks repeatedly try passwords or keys until the correct one is found.
Question 17
Which type of malware spreads by self-replicating and infecting other computers on a network without needing to attach to a host program or user action?
Worm
✓
Spyware
Virus
Trojan horse
Correct Answer
Worm
A worm is a standalone malware computer program that replicates itself in order to spread to other computers. A virus attaches itself to legitimate programs and requires user action to spread. A Trojan horse masquerades as legitimate software but contains malicious code. Spyware collects information without user consent and does not primarily self-replicate.
Question 18
A company wants to allow its remote employees to securely access the internal corporate network over the public internet. Which network defense technology is best suited for this purpose?
Intrusion Prevention System (IPS)
Firewall
Network Access Control (NAC)
Virtual Private Network (VPN)
✓
Correct Answer
Virtual Private Network (VPN)
A VPN creates an encrypted tunnel over a public network, allowing remote users to securely access internal resources as if they were physically on the network. A firewall filters traffic. NAC enforces policies on devices attempting to access the network. An IPS detects and prevents intrusions.
Question 19
A system administrator implements security measures to ensure that sensitive data, such as credit card numbers, cannot be accidentally or intentionally transmitted outside the organization's network. This is an application of:
Data Loss Prevention (DLP)
✓
Network Address Translation (NAT)
Intrusion Detection System (IDS)
Security Information and Event Management (SIEM)
Correct Answer
Data Loss Prevention (DLP)
DLP systems are designed to detect and prevent the unauthorized transmission of sensitive information. IDS detects suspicious activity. SIEM aggregates and analyzes security logs. NAT translates IP addresses and is not primarily for preventing data exfiltration.
Question 20
In the context of network security, what is the primary role of a Demilitarized Zone (DMZ)?
To filter all incoming and outgoing network traffic based on rules.
To provide a fully isolated network for internal corporate servers.
To create an encrypted tunnel for secure remote access.
To host public-facing services while isolating them from the internal network.
✓
Correct Answer
To host public-facing services while isolating them from the internal network.
A DMZ is a buffer network zone that hosts public-facing services (like web servers) and is separated from both the internet and the internal corporate network by firewalls, providing an extra layer of security. An isolated network is typically for highly sensitive internal systems. An encrypted tunnel is for VPNs. Filtering traffic is the role of a firewall.
Question 21
Which of the following best describes the 'something you are' factor in authentication?
A physical token or smart card.
A secret phrase or PIN.
A biometric characteristic like a fingerprint or iris scan.
✓
A unique personal identification number.
Correct Answer
A biometric characteristic like a fingerprint or iris scan.
The 'something you are' factor refers to biometric attributes, which are unique physical or behavioral characteristics. A secret phrase or PIN is 'something you know'. A physical token or smart card is 'something you have'. A unique personal identification number is typically 'something you know'.
Question 22
A developer writes code that fails to properly validate user input, allowing an attacker to insert malicious data into a query that is then executed by the database. This vulnerability is most commonly associated with:
Phishing
Cross-Site Request Forgery (CSRF)
Denial-of-Service (DoS)
SQL Injection
✓
Correct Answer
SQL Injection
Improper input validation leading to malicious database queries is the hallmark of a SQL Injection attack. DoS aims to make a service unavailable. CSRF tricks a user into unknowingly executing unwanted actions on a web application. Phishing is a social engineering attack for credential harvesting.