Cyber Security MCQs
Cyber Security MCQs
Answer these 100+ Cyber Security MCQs and see how sharp is your knowledge of Cyber Security.
Scroll down and let's start!
1: The u.s. anticybersquatting consumer protection act of 1999 makes ____ cybersquatting illegal.
A. URL
B. Domain name
C. Web site name
D. IP address
2: The us anticybersquatting act makes ____ cybersquatting illegal
A. URL
B. Domain name
C. Web site name
D. IP address
3: A security awareness program includes ________
A. Motivating users to comply with security policies
B. Informing users about trends and threats in society
C. Teaching employees about security objectives
D. All of the above
4: After a programmer plans the logic of a program, the next step is ____.
A. Understand the problem
B. Test the program
C. Translate the program
D. Code the program
5: In ________ filtering, the firewall examines packets entering the network from the outside.
A. Ingress
B. Egress
C. Both A and B
D. Neither A nor B
6: Static packet filtering is sometimes used ________.
A. Both as secondary filtering mechanism on an application proxy firewall and on border routers
B. On border routers
C. Both A and B
D. Neither A nor B
7: Proxy servers perform operations on ____-level data.
A. Application
B. Header
C. Data link
D. Transport
8: The increased use of data mining can be attributed to the ________.
A. Decentralization of data
B. Absence of advanced algorithms
C. Increased availability of data
D. Increased storage costs
9: The foundation of integrity is your __________ system.
A. Cycle of success
B. Learning preferences
C. Personal values
D. Course correction
10: If a competitor reverse engineers a trade secret, then the competitor is ________.
A. Allowed to use the trade secret but not the original trademark
B. The location of the return address
C. Whether the nonprinting characters are visible
D. How parts of the letter are indented from the left margin
11: According to the shared responsibility model, which cloud computing model places the most responsibility on the cloud service provider (CSP)?
A. Hybrid Cloud
B. Software as a Service (SaaS)
C. Platform as a Service (PaaS)
D. Infrastructure as a Service (IaaS)
12: Which option removes the risk of multitenancy in cloud computing?
A. PaaS
B. Public cloud
C. Private cloud
D. IaaS
13: Your organization recently implemented a unified messaging solution and VoIP phones on every desktop. You are responsible for researching the vulnerabilities of the VoIP system. Which type of attack are VoIP phones most vulnerable to experiencing?
A. Denial-of-service
B. Brute force attacks
C. Malware
D. Buffer overflow
14: Which security control cannot produce an active response to a security event?
A. Cloud access security broker (CASB)
B. Intrusion prevention system (IPS)
C. Intrusion detection system (IDS)
D. Next generation firewall
15: Packet sniffer is also called _.
A. SIEM
B. UTM
C. Protocol analyzer
D. Data sink
16: Which option tests code while it is in operation?
A. Code review
B. Code analysis
C. Static analysis
D. Dynamic analysis
17: Which option describes testing that individual software developers can conduct on their own code?
A. Gray box testing
B. Integration testing
C. White box testing
D. Unit testing
18: In black box penetration testing, what information is provided to the tester about the target environment?
A. None
B. Limited details of server and network infrastructure
C. All information
D. Limited details of server infrastructure
19: Which security control can best protect against shadow IT by identifying and preventing use of unsanctioned cloud apps and services?
A. Intrusion prevention system (IPS)
B. Next generation firewall
C. Cloud access security broker (CASB)
D. Intrusion detection system (IDS)
20: Which option describes the best defense against collusion?
A. Monitoring of normal employee system and data access patterns
B. Applying system and application updates regularly
C. Fault tolerant infrastructure and data redundancy
D. Separation of duties and job rotation
21: During a penetration test, you find a file containing hashed passwords for the system you are attempting to breach. Which type of attack is most likely to succeed in accessing the hashed passwords in a reasonable amount of time?
A. Rainbow table attack
B. Pass-the-hash attack
C. Password spray attack
D. Brute force attack
22: You configure an encrypted USB drive for a user who needs to deliver a sensitive file at an in-person meeting. What type of encryption is typically used to encrypt the file?
A. File hash
B. Asymmetric encryption
C. Digital signature
D. Symmetric encryption
23: What is the difference between DRP and BCP
A. DRP works to keep a business up and running despite a disaster. BCP works to restore the original business capabilities.
B. BCP works to keep a business up and running despite a disaster. DRP works to restore the original business capabilities.
C. BCP is part of DRP.
D. DRP is part of BCP.
24: Which aspect of cybersecurity do Distributed Denial of Service (DDoS) attacks affect the most?
A. Non-repudiation
B. Integrity
C. Availability
D. Confidentiality
25: You need to recommend a solution to automatically assess your cloud-hosted VMs against CIS benchmarks to identify deviations from security best practices. What type of solution should you recommend?
A. Cloud Security Posture Management (CSPM)
B. Intrusion Detection and Prevention System (IDPS)
C. Cloud Workload Protection Platforms (CWPP)
D. Cloud Access Security Brokers (CASBs)
26: _ validates the integrity of data files.
A. Compression
B. Hashing
C. Symmetric encryption
D. Stenography
27: Which is an example of privacy regulation at the state government level in the U.S.?
A. CCPA
B. GDPR
C. NIST Privacy Framework
D. OSPF
28: What is the term for the policies and technologies implemented to protect, limit, monitor, audit, and govern identities with access to sensitive data and resources?
A. Identity and access management (IAM)
B. Privileged account management (PAM)
C. Authentication and authorization
D. Least privilege
29: You have configured audit settings in your organization's cloud services in the event of a security incident. What type of security control is an audit trail?
A. Preventive control
B. Detective control
C. Directive control
D. Corrective control
30: What is the name for a short-term interruption in electrical power supply?
A. Grayout
B. Blackout
C. Brownout
D. Whiteout
31: Your security team recommends adding a layer of defense against emerging persistent threats and zero-day exploits for all endpoints on your network. The solution should offer protection from external threats for network-connected devices, regardless of operating system. Which solution is best suited to meet this requirement?
A. Security Information Event Management (SIEM)
B. Extended Detection and Response (XDR)
C. Next generation firewall (NGFW)
D. Cloud App Security Broker (CASB)
32: Which is not a threat modeling methodology?
A. TRIKE
B. TOGAF
C. STRIDE
D. MITRE ATT&CK
33: You organization is conducting a pilot deployment of a new e-commerce application being considered for purchase. You need to recommend a strategy to evaluate the security of the new software. Your organization does not have access to the application's source code. Which strategy should you choose?
A. Dynamic application security testing
B. Unit testing
C. White box testing
D. Static application security testing
34: You need to disable the camera on corporate devices to prevent screen capture and recording of sensitive documents, meetings, and conversations. Which solution would be be suited to the task?
A. Mobile Device Management (MDM)
B. Data Loss Prevention (DLP)
C. Intrusion Detection and Prevention System (IDPS)
D. Cloud access security broker (CASB)
35: How many keys would be necessary to accomodate 100 users in an asymmetric cryptography system?
A. 200
B. 400
C. 100
D. 300
36: Two competing online retailers process credit card transactions for customers in countries on every continent. One organization is based in the United States. The other is based in the Netherlands. With which regulation must both countries comply while ensuring the security of these transactions?
A. Federal Information Security Managment Act (FISMA)
B. Payment Card Industry Data Security Standard (PCI-DSS)
C. General Data Protection Regulation (GDPR)
D. International Organization for Standardization and Internation Electronical Commission (ISO/IEC 27018)
37: What provides a common language for describing security incidents in a structures and repeatable manner?
A. Common event format
B. Common weakness enumeration
C. Common vulnerabilties and exposures
D. Common vulnerability scoring system
38: Which type of application can intercept sensative information such as passwoprds on a network segment?
A. Log server
B. Network scanner
C. Firewall
D. Protocol analyzer
39: An attacker has discovered that they can deduce a sensitive piece of confidential information by analyzing multiple pieces of less sensitive public data. What type of security issue exists?
A. Aggregation
B. Inference
C. SQL injection
D. Cross-origin resouce sharing
40: What act grants an authenticated party permission to perform an action or access a resource?
A. Zero Trust Security
B. Role-Based Access Control (RBAC)
C. Authorization
D. Single Sign-On
41: According to GDPR, a data _ is the person about whom data is being collected.
A. Processor
B. Object
C. Subject
D. Controller
42: Which is not a principle of zero trust security?
A. Use least privilege access
B. Verify explicitly
C. Trust but verify
D. Assume breach
43: Which attack exploits input validation vulnerabilities?
A. ARP spoofing
B. Pharming attacks
C. Cross-site scripting (XSS)
D. DNS poisoning
44: You are a security analyst, and you receive a text message alerting you of a possible attack. Which security control is the least likely to produce this type of alert?
A. IDS
B. SIEM
C. Packet sniffer
D. IPS
45: SQL injection inserts a code fragment that makes a database statement universally true, like _.
A. SELECT * FROM users WHERE username =
B. SELECT * FROM users WHERE username =
C. SELECT * FROM users WHERE username =
D. SELECT * FROM users WHERE username =
46: Which type of security assessment requires access to source code?
A. Static analysis
B. Black box testing
C. Dynamic analysis
D. Penetration testing
47: Which option is an open-source solution to scanning a network for active hosts and open ports?
A. Autopsy
B. Snort
C. Nmap
D. Wireshark
48: When implementing a data loss prevention (DLP) strategy, what is the first step in the process?
A. Evaluate the features of available DLP products to determine which best meet your organizations's needs.
B. Examine the flow of sensitive data in your organization to better understand usage patterns.
C. Conduct an inventory of all the data in your organization to establish classifications based on sensitivity.
D. Conduct a risk assessment to determine the best data labeling strategy for your organization.
49: Which malware changes an operating system and conceals its tracks?
A. Virus
B. Worm
C. Rootkit
D. Trojan horse
50: Virtual Private Networks (VPNs) use _ to create a secure connection between two networks.
A. Encryption
B. A metropolitan area network
C. A virtual local area network
D. A wide area network
List of Cyber Security MCQs Mu...
Available in:
Cyber Security MCQs
Вопросы кибербезопасности на русском языке
Preguntas de seguridad cibernética en español
日本語でのサイバーセキュリティの質問
Domande di Cyber Security in lingua italiana
Questions de cybersécurité en langues françaises
Perguntas de segurança cibernética em idiomas portugueses
Fragen zur Cybersicherheit in deutschen Sprachen
中文（简体）语言的网络安全问题
أسئلة الأمن السيبراني باللغات العربية
Pertanyaan Cyber Security dalam bahasa Indonesia
Türkçe Siber Güvenlik soruları
