E Lectures AIExplore
Information Security

Information Security MCQs with Answers

Information Security MCQs with Answers

Practice 300 Information Security MCQs with answers covering security mechanisms, cryptography, authentication, access control, database security, network security, software vulnerabilities, firewalls, IDS, policies, risk assessment, privacy, cybercrime law and ethics.

Information Security MCQs with Answers | 300 Questions | ElecturesAI
ElecturesAI

Information Security MCQs with Answers

A complete 300-question practice bank covering security mechanisms, design principles, cryptography, authentication, access control, database security, network security, software vulnerabilities, policies, risk assessment, privacy, cybercrime law and ethics.

Prepared with dedication by Engnr Dr. Muhammad Tahir Dlbar to help students learn smarter, practice better, and build strong information security concepts with confidence.
300MCQs with answers
15Topic sections
FAQQuestion schema
SEOReady HTML page

Study focus: This page is designed for exam preparation and concept revision. Each question includes visible answer markup and JSON-LD structured data for search engines.

Covered Topics

Topic 1

Foundations of Information Security & Security Mechanisms

Back to top ↑
Question 1Foundations of Information Security & Security Mechanisms

Q1. What is information security mainly concerned with?

  1. Only buying antivirus software
  2. Making every file public
  3. Removing all users from a system
  4. Protecting information confidentiality, integrity and availability
Show Answer

Correct Answer: D. Protecting information confidentiality, integrity and availability

Question 2Foundations of Information Security & Security Mechanisms

Q2. What does the CIA triad stand for in information security?

  1. Cipher, Input and Authentication
  2. Cybercrime, Identity and Audit
  3. Confidentiality, Integrity and Availability
  4. Control, Internet and Access
Show Answer

Correct Answer: C. Confidentiality, Integrity and Availability

Question 3Foundations of Information Security & Security Mechanisms

Q3. Confidentiality means:

  1. Data must always be deleted
  2. Passwords should be shared with everyone
  3. Systems should never be updated
  4. Only authorized people can access sensitive information
Show Answer

Correct Answer: D. Only authorized people can access sensitive information

Question 4Foundations of Information Security & Security Mechanisms

Q4. Integrity in information security means:

  1. Data is always hidden from administrators
  2. A server has the fastest processor
  3. Data remains accurate, complete and protected from unauthorized change
  4. A network cable is physically strong
Show Answer

Correct Answer: C. Data remains accurate, complete and protected from unauthorized change

Question 5Foundations of Information Security & Security Mechanisms

Q5. Availability means:

  1. All data must be encrypted twice
  2. Users cannot login during office hours
  3. Files must be stored only on paper
  4. Authorized users can access systems and data when needed
Show Answer

Correct Answer: D. Authorized users can access systems and data when needed

Question 6Foundations of Information Security & Security Mechanisms

Q6. In security, an asset is:

  1. Only a hacker tool
  2. A useless backup copy
  3. Only a firewall rule
  4. Anything valuable that needs protection
Show Answer

Correct Answer: D. Anything valuable that needs protection

Question 7Foundations of Information Security & Security Mechanisms

Q7. A threat is best described as:

  1. A type of database table
  2. A guaranteed improvement in security
  3. A possible cause of harm to an asset
  4. A password recovery email
Show Answer

Correct Answer: C. A possible cause of harm to an asset

Question 8Foundations of Information Security & Security Mechanisms

Q8. A vulnerability is:

  1. A perfect security design
  2. A legal user account only
  3. A weakness that can be exploited by a threat
  4. A completed backup schedule
Show Answer

Correct Answer: C. A weakness that can be exploited by a threat

Question 9Foundations of Information Security & Security Mechanisms

Q9. Information security risk is usually a combination of:

  1. Likelihood of a threat and the impact if it occurs
  2. Logo color and website font
  3. Screen size and keyboard layout
  4. Number of emails in the inbox only
Show Answer

Correct Answer: A. Likelihood of a threat and the impact if it occurs

Question 10Foundations of Information Security & Security Mechanisms

Q10. A security control or safeguard is used to:

  1. Remove all logs from the system
  2. Allow anonymous administrator access
  3. Reduce risk by preventing, detecting or correcting security problems
  4. Increase every possible risk
Show Answer

Correct Answer: C. Reduce risk by preventing, detecting or correcting security problems

Question 11Foundations of Information Security & Security Mechanisms

Q11. A security mechanism is:

  1. A shopping cart feature
  2. A random image in a webpage
  3. A rule that disables all authentication
  4. A technical or procedural method that supports security goals
Show Answer

Correct Answer: D. A technical or procedural method that supports security goals

Question 12Foundations of Information Security & Security Mechanisms

Q12. A preventive control is designed to:

  1. Recover deleted wallpaper
  2. Hide all audit trails
  3. Only print monthly reports
  4. Stop a security incident before it happens
Show Answer

Correct Answer: D. Stop a security incident before it happens

Question 13Foundations of Information Security & Security Mechanisms

Q13. A detective control helps to:

  1. Disable monitoring systems
  2. Guarantee no incident can ever happen
  3. Identify that a security event or violation has occurred
  4. Replace all encryption keys with weak keys
Show Answer

Correct Answer: C. Identify that a security event or violation has occurred

Question 14Foundations of Information Security & Security Mechanisms

Q14. A corrective control is used to:

  1. Delete security policies
  2. Avoid all software updates
  3. Make passwords visible
  4. Restore systems and reduce damage after an incident
Show Answer

Correct Answer: D. Restore systems and reduce damage after an incident

Question 15Foundations of Information Security & Security Mechanisms

Q15. The principle of least privilege means:

  1. Users get only the access needed to perform their job
  2. Every user should be a system administrator
  3. Access rights should never be reviewed
  4. No user should have any access ever
Show Answer

Correct Answer: A. Users get only the access needed to perform their job

Question 16Foundations of Information Security & Security Mechanisms

Q16. Defense in depth means:

  1. Ignoring physical security
  2. Using multiple layers of security controls
  3. Relying on a single firewall forever
  4. Using only one password for every account
Show Answer

Correct Answer: B. Using multiple layers of security controls

Question 17Foundations of Information Security & Security Mechanisms

Q17. Attack surface refers to:

  1. The color theme of a security dashboard
  2. A list of employee birthdays
  3. Only the size of a monitor
  4. All points where an attacker could try to enter or affect a system
Show Answer

Correct Answer: D. All points where an attacker could try to enter or affect a system

Question 18Foundations of Information Security & Security Mechanisms

Q18. A security policy is:

  1. A personal opinion without approval
  2. A replacement for all technical controls
  3. A formal statement of rules and expectations for protecting information
  4. A random password list
Show Answer

Correct Answer: C. A formal statement of rules and expectations for protecting information

Question 19Foundations of Information Security & Security Mechanisms

Q19. Security awareness training helps users to:

  1. Share passwords more quickly
  2. Avoid reporting incidents
  3. Bypass all policies
  4. Recognize threats and follow safe security practices
Show Answer

Correct Answer: D. Recognize threats and follow safe security practices

Question 20Foundations of Information Security & Security Mechanisms

Q20. Incident response is the process of:

  1. Preparing for, detecting, containing and recovering from security incidents
  2. Designing advertisements
  3. Formatting a spreadsheet
  4. Removing every log file immediately
Show Answer

Correct Answer: A. Preparing for, detecting, containing and recovering from security incidents

Topic 2

Security Design Principles

Back to top ↑
Question 21Security Design Principles

Q21. Fail-safe defaults means a system should:

  1. Deny access by default unless permission is explicitly granted
  2. Disable authentication for convenience
  3. Trust unknown users automatically
  4. Allow all access when an error occurs
Show Answer

Correct Answer: A. Deny access by default unless permission is explicitly granted

Question 22Security Design Principles

Q22. Complete mediation requires:

  1. Every access request to be checked before it is allowed
  2. Users to choose their own roles
  3. No permissions to be verified
  4. Only the first login of the year to be checked
Show Answer

Correct Answer: A. Every access request to be checked before it is allowed

Question 23Security Design Principles

Q23. Economy of mechanism means:

  1. Security code should be intentionally complex
  2. Systems should avoid documentation
  3. Policies should be impossible to read
  4. Security design should be simple and small enough to understand
Show Answer

Correct Answer: D. Security design should be simple and small enough to understand

Question 24Security Design Principles

Q24. Open design means:

  1. Passwords should be posted online
  2. Encryption keys should be shared
  3. Security should not depend on keeping the design secret
  4. Source code must always be public
Show Answer

Correct Answer: C. Security should not depend on keeping the design secret

Question 25Security Design Principles

Q25. Separation of privilege means:

  1. All users should share the same password
  2. Sensitive actions may require more than one condition or approval
  3. One person should control every security decision
  4. Access reviews should be skipped
Show Answer

Correct Answer: B. Sensitive actions may require more than one condition or approval

Question 26Security Design Principles

Q26. Least common mechanism recommends:

  1. Making every process use one shared administrator account
  2. Sharing temporary files with everyone
  3. Avoiding unnecessary shared components between users or processes
  4. Removing all isolation
Show Answer

Correct Answer: C. Avoiding unnecessary shared components between users or processes

Question 27Security Design Principles

Q27. Psychological acceptability means:

  1. Users should never receive guidance
  2. Interfaces should hide all warnings
  3. Security should confuse all users
  4. Security controls should be usable and understandable for legitimate users
Show Answer

Correct Answer: D. Security controls should be usable and understandable for legitimate users

Question 28Security Design Principles

Q28. Secure by default means:

  1. A system starts with all ports open
  2. A system gives guest administrator rights
  3. A system starts with safe settings before customization
  4. A system disables every log
Show Answer

Correct Answer: C. A system starts with safe settings before customization

Question 29Security Design Principles

Q29. Minimizing attack surface means:

  1. Using unsupported software intentionally
  2. Installing every possible plugin
  3. Removing unnecessary services, ports, accounts and features
  4. Publishing private keys
Show Answer

Correct Answer: C. Removing unnecessary services, ports, accounts and features

Question 30Security Design Principles

Q30. A secure design lifecycle includes security during:

  1. Requirements, design, implementation, testing and maintenance
  2. Only the final presentation
  3. Only after a breach
  4. Only when the system is deleted
Show Answer

Correct Answer: A. Requirements, design, implementation, testing and maintenance

Question 31Security Design Principles

Q31. A trust boundary is:

  1. A backup file name
  2. A point where data or control moves between different trust levels
  3. A keyboard shortcut
  4. A physical wall color
Show Answer

Correct Answer: B. A point where data or control moves between different trust levels

Question 32Security Design Principles

Q32. Input validation is important because it:

  1. Checks that data is expected, safe and correctly formatted
  2. Makes every query public
  3. Replaces authentication entirely
  4. Guarantees that passwords never expire
Show Answer

Correct Answer: A. Checks that data is expected, safe and correctly formatted

Question 33Security Design Principles

Q33. A secure configuration baseline is:

  1. An approved standard set of secure settings
  2. A random collection of screenshots
  3. A list of social media accounts
  4. A method for removing all patches
Show Answer

Correct Answer: A. An approved standard set of secure settings

Question 34Security Design Principles

Q34. Patch management is the process of:

  1. Avoiding every update forever
  2. Changing the logo of an application
  3. Testing and applying updates to fix weaknesses
  4. Using only outdated software
Show Answer

Correct Answer: C. Testing and applying updates to fix weaknesses

Question 35Security Design Principles

Q35. Logging and auditing support security by:

  1. Making attacks invisible
  2. Replacing access control
  3. Recording activity for monitoring, investigation and accountability
  4. Storing only entertainment data
Show Answer

Correct Answer: C. Recording activity for monitoring, investigation and accountability

Question 36Security Design Principles

Q36. Secure failure means:

  1. Crashes should reveal passwords
  2. Failures should disable all controls
  3. Users should get administrator rights after errors
  4. Errors should not expose sensitive data or give unsafe access
Show Answer

Correct Answer: D. Errors should not expose sensitive data or give unsafe access

Question 37Security Design Principles

Q37. A good security design balances:

  1. Only decoration and font size
  2. Protection, usability, cost and business requirements
  3. Only speed and ignoring risk
  4. Only number of menu items
Show Answer

Correct Answer: B. Protection, usability, cost and business requirements

Question 38Security Design Principles

Q38. Zero trust design assumes:

  1. No user or device is trusted automatically
  2. Passwords are unnecessary
  3. Everything inside the network is always safe
  4. Logs should be disabled
Show Answer

Correct Answer: A. No user or device is trusted automatically

Question 39Security Design Principles

Q39. Isolation in security design helps to:

  1. Mix all sensitive data in one folder
  2. Limit damage by separating systems, processes or data
  3. Expose internal services publicly
  4. Remove all permission checks
Show Answer

Correct Answer: B. Limit damage by separating systems, processes or data

Question 40Security Design Principles

Q40. Threat modeling is used to:

  1. Ignore security requirements
  2. Choose a website background image
  3. Create random account names
  4. Identify possible threats and design controls before deployment
Show Answer

Correct Answer: D. Identify possible threats and design controls before deployment

Topic 3

Symmetric & Asymmetric Cryptography

Back to top ↑
Question 41Symmetric & Asymmetric Cryptography

Q41. Symmetric encryption uses:

  1. A certificate without any algorithm
  2. A public key only
  3. The same secret key for encryption and decryption
  4. No key at all
Show Answer

Correct Answer: C. The same secret key for encryption and decryption

Question 42Symmetric & Asymmetric Cryptography

Q42. AES is commonly classified as:

  1. A digital signature certificate
  2. A password manager
  3. A symmetric block cipher
  4. A network cable type
Show Answer

Correct Answer: C. A symmetric block cipher

Question 43Symmetric & Asymmetric Cryptography

Q43. Asymmetric cryptography uses:

  1. Only a username
  2. One shared secret key only
  3. No keys or algorithms
  4. A mathematically related public key and private key pair
Show Answer

Correct Answer: D. A mathematically related public key and private key pair

Question 44Symmetric & Asymmetric Cryptography

Q44. RSA and ECC are examples of:

  1. Database backup plans
  2. Asymmetric cryptographic algorithms
  3. Operating system updates
  4. File compression formats
Show Answer

Correct Answer: B. Asymmetric cryptographic algorithms

Question 45Symmetric & Asymmetric Cryptography

Q45. Compared with asymmetric cryptography, symmetric cryptography is usually:

  1. Always slower for every task
  2. Faster for bulk data encryption
  3. Used only for screenshots
  4. Unable to encrypt data
Show Answer

Correct Answer: B. Faster for bulk data encryption

Question 46Symmetric & Asymmetric Cryptography

Q46. Asymmetric cryptography is especially useful for:

  1. Deleting all databases
  2. Key exchange, digital signatures and identity verification
  3. Replacing user training
  4. Changing monitor brightness
Show Answer

Correct Answer: B. Key exchange, digital signatures and identity verification

Question 47Symmetric & Asymmetric Cryptography

Q47. A public key is designed to be:

  1. Identical to every user's password
  2. Never used by anyone
  3. Stored only in a locked paper notebook
  4. Shared openly for encryption or signature verification
Show Answer

Correct Answer: D. Shared openly for encryption or signature verification

Question 48Symmetric & Asymmetric Cryptography

Q48. A private key should be:

  1. Posted on a public website
  2. Sent in plain text email
  3. Kept secret and protected from unauthorized access
  4. Shared with all visitors
Show Answer

Correct Answer: C. Kept secret and protected from unauthorized access

Question 49Symmetric & Asymmetric Cryptography

Q49. Hybrid encryption combines:

  1. Only social media authentication
  2. Asymmetric methods for key exchange and symmetric methods for fast data encryption
  3. Only hashing and no keys
  4. Only paper-based records
Show Answer

Correct Answer: B. Asymmetric methods for key exchange and symmetric methods for fast data encryption

Question 50Symmetric & Asymmetric Cryptography

Q50. A session key is:

  1. A permanent public blog post
  2. An employee ID card only
  3. A browser color setting
  4. A temporary symmetric key used for one communication session
Show Answer

Correct Answer: D. A temporary symmetric key used for one communication session

Question 51Symmetric & Asymmetric Cryptography

Q51. Encryption transforms:

  1. A backup into a physical lock
  2. Ciphertext into a company logo
  3. A password into a username
  4. Plaintext into ciphertext using an algorithm and key
Show Answer

Correct Answer: D. Plaintext into ciphertext using an algorithm and key

Question 52Symmetric & Asymmetric Cryptography

Q52. Decryption transforms:

  1. Plaintext into a firewall
  2. A certificate into a monitor
  3. Audit logs into malware
  4. Ciphertext back into readable plaintext with the correct key
Show Answer

Correct Answer: D. Ciphertext back into readable plaintext with the correct key

Question 53Symmetric & Asymmetric Cryptography

Q53. Key length affects security because:

  1. Longer secure keys generally make brute-force attacks harder
  2. Only the file name matters
  3. Keys do not affect encryption strength
  4. Shorter keys are always safer
Show Answer

Correct Answer: A. Longer secure keys generally make brute-force attacks harder

Question 54Symmetric & Asymmetric Cryptography

Q54. A brute-force attack attempts to:

  1. Try many possible keys or passwords until one works
  2. Create a training schedule
  3. Install only approved updates
  4. Fix a broken keyboard
Show Answer

Correct Answer: A. Try many possible keys or passwords until one works

Question 55Symmetric & Asymmetric Cryptography

Q55. A block cipher encrypts data:

  1. Only inside email subject lines
  2. In fixed-size blocks
  3. Without a key
  4. Only as audio files
Show Answer

Correct Answer: B. In fixed-size blocks

Question 56Symmetric & Asymmetric Cryptography

Q56. A stream cipher encrypts data:

  1. As a continuous stream of bits or bytes
  2. Only in database rows
  3. Only in printed books
  4. Only after deleting the key
Show Answer

Correct Answer: A. As a continuous stream of bits or bytes

Question 57Symmetric & Asymmetric Cryptography

Q57. A major challenge in symmetric encryption is:

  1. Securely distributing the shared secret key
  2. Choosing a brand logo
  3. Creating a web footer
  4. Increasing screen resolution
Show Answer

Correct Answer: A. Securely distributing the shared secret key

Question 58Symmetric & Asymmetric Cryptography

Q58. Encryption primarily supports:

  1. Employee attendance only
  2. Software decoration
  3. Keyboard replacement
  4. Confidentiality of data
Show Answer

Correct Answer: D. Confidentiality of data

Question 59Symmetric & Asymmetric Cryptography

Q59. Non-repudiation is strongly supported by:

  1. Unsigned text files
  2. Anonymous administrator accounts
  3. Shared passwords used by many people
  4. Digital signatures using asymmetric cryptography
Show Answer

Correct Answer: D. Digital signatures using asymmetric cryptography

Question 60Symmetric & Asymmetric Cryptography

Q60. Cryptanalysis is:

  1. A firewall rule naming style
  2. The study of breaking or evaluating cryptographic systems
  3. A method for deleting browser history
  4. The design of office furniture
Show Answer

Correct Answer: B. The study of breaking or evaluating cryptographic systems

Topic 4

Digital Signatures & Key Management

Back to top ↑
Question 61Digital Signatures & Key Management

Q61. A digital signature mainly provides:

  1. Only file compression
  2. Only faster internet speed
  3. Only screen recording
  4. Authentication, integrity and non-repudiation
Show Answer

Correct Answer: D. Authentication, integrity and non-repudiation

Question 62Digital Signatures & Key Management

Q62. A digital signature is created with the sender's:

  1. Firewall rule number
  2. Plain password
  3. Private key
  4. Public key of every user
Show Answer

Correct Answer: C. Private key

Question 63Digital Signatures & Key Management

Q63. A digital signature is verified with the sender's:

  1. Private key of the verifier
  2. MAC address only
  3. Public key
  4. Database password
Show Answer

Correct Answer: C. Public key

Question 64Digital Signatures & Key Management

Q64. Why is a hash usually created before signing a message?

  1. To sign a fixed-length digest efficiently and detect changes
  2. To make the message larger
  3. To avoid using any key
  4. To remove all identity information
Show Answer

Correct Answer: A. To sign a fixed-length digest efficiently and detect changes

Question 65Digital Signatures & Key Management

Q65. A digital certificate is used to:

  1. Remove the need for trust
  2. Bind a public key to an identity
  3. Encrypt hardware physically
  4. Replace all backups
Show Answer

Correct Answer: B. Bind a public key to an identity

Question 66Digital Signatures & Key Management

Q66. A Certificate Authority usually:

  1. Stores every user's plain password
  2. Deletes all encryption keys
  3. Issues and validates digital certificates
  4. Blocks all legal access
Show Answer

Correct Answer: C. Issues and validates digital certificates

Question 67Digital Signatures & Key Management

Q67. PKI stands for:

  1. Private Keyboard Interface
  2. Packet Knowledge Index
  3. Public Key Infrastructure
  4. Password Key Image
Show Answer

Correct Answer: C. Public Key Infrastructure

Question 68Digital Signatures & Key Management

Q68. Key management lifecycle includes:

  1. Only creating user avatars
  2. Only choosing a file name
  3. Only changing a screen saver
  4. Generation, storage, use, rotation, backup and destruction of keys
Show Answer

Correct Answer: D. Generation, storage, use, rotation, backup and destruction of keys

Question 69Digital Signatures & Key Management

Q69. Secure key generation should use:

  1. Strong and unpredictable randomness
  2. A public social media quote
  3. A repeated common word
  4. The user's date of birth only
Show Answer

Correct Answer: A. Strong and unpredictable randomness

Question 70Digital Signatures & Key Management

Q70. Key rotation means:

  1. Printing a key on paper every hour
  2. Replacing keys periodically or after certain events
  3. Changing keyboard direction
  4. Sharing the same key forever
Show Answer

Correct Answer: B. Replacing keys periodically or after certain events

Question 71Digital Signatures & Key Management

Q71. Key escrow means:

  1. All keys are deleted immediately
  2. A key is published for everyone
  3. A key is changed into an image
  4. A trusted process holds a copy of a key for approved recovery
Show Answer

Correct Answer: D. A trusted process holds a copy of a key for approved recovery

Question 72Digital Signatures & Key Management

Q72. Certificate revocation is used when:

  1. A password is typed correctly
  2. An email is marked as read
  3. A certificate should no longer be trusted
  4. A monitor is upgraded
Show Answer

Correct Answer: C. A certificate should no longer be trusted

Question 73Digital Signatures & Key Management

Q73. CRL and OCSP are related to:

  1. Sorting database columns
  2. Creating a username
  3. Checking certificate revocation status
  4. Designing web colors
Show Answer

Correct Answer: C. Checking certificate revocation status

Question 74Digital Signatures & Key Management

Q74. An HSM is used to:

  1. Scan office furniture
  2. Protect and manage cryptographic keys in secure hardware
  3. Compress images only
  4. Host social media videos
Show Answer

Correct Answer: B. Protect and manage cryptographic keys in secure hardware

Question 75Digital Signatures & Key Management

Q75. Key backup is important because:

  1. It replaces all incident response
  2. Lost keys may make encrypted data unrecoverable
  3. It makes passwords public
  4. It removes access control
Show Answer

Correct Answer: B. Lost keys may make encrypted data unrecoverable

Question 76Digital Signatures & Key Management

Q76. Key compromise means:

  1. The key is longer than expected
  2. The key has no security role
  3. The key was printed correctly
  4. An unauthorized person may have obtained or used a key
Show Answer

Correct Answer: D. An unauthorized person may have obtained or used a key

Question 77Digital Signatures & Key Management

Q77. Signing a message is different from encrypting it because signing:

  1. Always hides the entire message from everyone
  2. Makes the file smaller only
  3. Deletes the message after sending
  4. Proves origin and integrity rather than hiding content
Show Answer

Correct Answer: D. Proves origin and integrity rather than hiding content

Question 78Digital Signatures & Key Management

Q78. Timestamping a digital signature helps to:

  1. Change the sender's identity
  2. Remove audit records
  3. Disable certificates
  4. Show when the signature was created or validated
Show Answer

Correct Answer: D. Show when the signature was created or validated

Question 79Digital Signatures & Key Management

Q79. A certificate chain is:

  1. A sequence of certificates linking an end certificate to a trusted root
  2. A password written in parts
  3. A list of shopping orders
  4. A network cable diagram
Show Answer

Correct Answer: A. A sequence of certificates linking an end certificate to a trusted root

Question 80Digital Signatures & Key Management

Q80. A root certificate authority acts as:

  1. A database table row
  2. A trust anchor in a PKI environment
  3. A local printer driver
  4. A temporary web cookie
Show Answer

Correct Answer: B. A trust anchor in a PKI environment

Topic 5

Authentication & Access Control

Back to top ↑
Question 81Authentication & Access Control

Q81. Authentication is the process of:

  1. Compressing a file
  2. Verifying the identity of a user, device or service
  3. Deleting audit logs
  4. Granting unlimited permissions
Show Answer

Correct Answer: B. Verifying the identity of a user, device or service

Question 82Authentication & Access Control

Q82. Authorization is the process of:

  1. Determining what an authenticated user is allowed to do
  2. Replacing encryption
  3. Checking a person's identity only
  4. Turning off access control
Show Answer

Correct Answer: A. Determining what an authenticated user is allowed to do

Question 83Authentication & Access Control

Q83. Accounting in AAA is used to:

  1. Record user actions for monitoring and accountability
  2. Remove logs after login
  3. Encrypt all traffic automatically
  4. Create passwords for everyone
Show Answer

Correct Answer: A. Record user actions for monitoring and accountability

Question 84Authentication & Access Control

Q84. A password is an example of:

  1. Something you have
  2. Something you delete
  3. Something you know
  4. Something you are
Show Answer

Correct Answer: C. Something you know

Question 85Authentication & Access Control

Q85. A smart card or security token is an example of:

  1. Something you guess
  2. Something you are
  3. Something you have
  4. Something you know
Show Answer

Correct Answer: C. Something you have

Question 86Authentication & Access Control

Q86. A fingerprint or face scan is an example of:

  1. Something you know
  2. Something you download
  3. Something you are
  4. Something you print
Show Answer

Correct Answer: C. Something you are

Question 87Authentication & Access Control

Q87. Multi-factor authentication means:

  1. Using the same password twice
  2. Using two or more different authentication factor types
  3. Disabling all login checks
  4. Only changing a username
Show Answer

Correct Answer: B. Using two or more different authentication factor types

Question 88Authentication & Access Control

Q88. Password salting helps by:

  1. Making passwords shorter
  2. Removing the need for hashing
  3. Sharing passwords with administrators
  4. Adding unique random data before hashing a password
Show Answer

Correct Answer: D. Adding unique random data before hashing a password

Question 89Authentication & Access Control

Q89. Password hashing is used to:

  1. Send passwords in open email
  2. Make passwords visible to users
  3. Store a one-way representation of a password
  4. Store passwords in plain text
Show Answer

Correct Answer: C. Store a one-way representation of a password

Question 90Authentication & Access Control

Q90. Role-Based Access Control assigns permissions based on:

  1. Screen color settings
  2. User roles and job functions
  3. User height
  4. Random keyboard keys
Show Answer

Correct Answer: B. User roles and job functions

Question 91Authentication & Access Control

Q91. Attribute-Based Access Control makes decisions using:

  1. Only file size
  2. Attributes such as user, resource, action and context
  3. Only the time shown on a clock
  4. Only a user's favorite color
Show Answer

Correct Answer: B. Attributes such as user, resource, action and context

Question 92Authentication & Access Control

Q92. Discretionary Access Control allows:

  1. Every user to be anonymous admin
  2. No owner permissions
  3. Only government labels to control access
  4. Resource owners to control access to their objects
Show Answer

Correct Answer: D. Resource owners to control access to their objects

Question 93Authentication & Access Control

Q93. Mandatory Access Control is based on:

  1. Personal preference with no rules
  2. User mood only
  3. Central policies and security labels
  4. Shopping cart value
Show Answer

Correct Answer: C. Central policies and security labels

Question 94Authentication & Access Control

Q94. An Access Control List contains:

  1. Permissions associated with a resource
  2. A list of advertisement captions
  3. A password recovery poem
  4. Only device wallpapers
Show Answer

Correct Answer: A. Permissions associated with a resource

Question 95Authentication & Access Control

Q95. Access review is performed to:

  1. Check whether user permissions are still appropriate
  2. Increase unused privileges
  3. Hide policy violations
  4. Remove all business accounts
Show Answer

Correct Answer: A. Check whether user permissions are still appropriate

Question 96Authentication & Access Control

Q96. Single Sign-On allows users to:

  1. Use public keys as passwords
  2. Authenticate once and access multiple trusted services
  3. Never authenticate again anywhere
  4. Bypass authorization
Show Answer

Correct Answer: B. Authenticate once and access multiple trusted services

Question 97Authentication & Access Control

Q97. Session management is important because:

  1. It removes database security
  2. It makes weak passwords strong
  3. It replaces software testing
  4. It controls authenticated user sessions securely
Show Answer

Correct Answer: D. It controls authenticated user sessions securely

Question 98Authentication & Access Control

Q98. Privilege escalation occurs when:

  1. A user logs out safely
  2. A file is renamed
  3. A backup completes
  4. A user gains higher access than intended
Show Answer

Correct Answer: D. A user gains higher access than intended

Question 99Authentication & Access Control

Q99. Default accounts should be:

  1. Given maximum rights forever
  2. Left with public passwords
  3. Disabled or changed according to secure configuration guidance
  4. Shared by all employees
Show Answer

Correct Answer: C. Disabled or changed according to secure configuration guidance

Question 100Authentication & Access Control

Q100. Zero trust access continuously verifies:

  1. Only the first login ever
  2. Only the color of the login button
  3. Nothing after network entry
  4. Identity, device posture and context before allowing access
Show Answer

Correct Answer: D. Identity, device posture and context before allowing access

Topic 6

Cryptography Concepts

Back to top ↑
Question 101Cryptography Concepts

Q101. Plaintext means:

  1. A certificate authority
  2. Encrypted unreadable data
  3. Readable data before encryption
  4. A firewall log only
Show Answer

Correct Answer: C. Readable data before encryption

Question 102Cryptography Concepts

Q102. Ciphertext means:

  1. A user's original password
  2. Unreadable encrypted data
  3. A printed security policy
  4. A database schema diagram
Show Answer

Correct Answer: B. Unreadable encrypted data

Question 103Cryptography Concepts

Q103. A cryptographic algorithm works together with:

  1. A logo to provide access
  2. A key to provide security
  3. A printer to verify identity
  4. A desk to increase speed
Show Answer

Correct Answer: B. A key to provide security

Question 104Cryptography Concepts

Q104. Kerckhoffs's principle says security should depend on:

  1. Using no keys
  2. The secrecy of the key, not the secrecy of the algorithm
  3. Making documentation unavailable
  4. Hiding the algorithm forever only
Show Answer

Correct Answer: B. The secrecy of the key, not the secrecy of the algorithm

Question 105Cryptography Concepts

Q105. Entropy in cryptography refers to:

  1. File size only
  2. Number of folders
  3. Monitor brightness
  4. Unpredictability or randomness
Show Answer

Correct Answer: D. Unpredictability or randomness

Question 106Cryptography Concepts

Q106. A nonce is:

  1. A repeated encryption key
  2. A number used once to prevent replay or reuse problems
  3. A permanent password
  4. A public employee name
Show Answer

Correct Answer: B. A number used once to prevent replay or reuse problems

Question 107Cryptography Concepts

Q107. An initialization vector is often used to:

  1. Disable the cipher
  2. Replace the encryption key
  3. Add uniqueness to encryption when the same key is reused safely by mode
  4. Store a user's email
Show Answer

Correct Answer: C. Add uniqueness to encryption when the same key is reused safely by mode

Question 108Cryptography Concepts

Q108. A one-time pad is secure only when the key is:

  1. Publicly posted
  2. Truly random, as long as the message and never reused
  3. Shorter than the message and reused
  4. Made from a common phrase
Show Answer

Correct Answer: B. Truly random, as long as the message and never reused

Question 109Cryptography Concepts

Q109. A substitution cipher works by:

  1. Only compressing spaces
  2. Reordering network cables
  3. Deleting every character
  4. Replacing symbols or letters with other symbols or letters
Show Answer

Correct Answer: D. Replacing symbols or letters with other symbols or letters

Question 110Cryptography Concepts

Q110. A transposition cipher works by:

  1. Changing every file extension
  2. Blocking a port
  3. Rearranging the positions of characters
  4. Hashing passwords with salt
Show Answer

Correct Answer: C. Rearranging the positions of characters

Question 111Cryptography Concepts

Q111. The Caesar cipher is an example of:

  1. A biometric factor
  2. A modern public key system
  3. A simple substitution cipher
  4. A database firewall
Show Answer

Correct Answer: C. A simple substitution cipher

Question 112Cryptography Concepts

Q112. Key space means:

  1. The set of all possible keys for an algorithm
  2. A server room area
  3. The free storage on a disk
  4. The space on a keyboard
Show Answer

Correct Answer: A. The set of all possible keys for an algorithm

Question 113Cryptography Concepts

Q113. Computationally infeasible means:

  1. Impossible to write in English
  2. Too difficult to solve with practical time and resources
  3. Easy to solve manually
  4. Required by every login page
Show Answer

Correct Answer: B. Too difficult to solve with practical time and resources

Question 114Cryptography Concepts

Q114. Encryption alone does not always prove:

  1. That data can be hidden
  2. That a key was used
  3. That ciphertext exists
  4. Who created the message or whether it was modified
Show Answer

Correct Answer: D. Who created the message or whether it was modified

Question 115Cryptography Concepts

Q115. Authenticated encryption is useful because it:

  1. Removes the need for secure keys
  2. Makes weak algorithms safe
  3. Deletes all plaintext permanently
  4. Protects confidentiality and verifies integrity/authenticity
Show Answer

Correct Answer: D. Protects confidentiality and verifies integrity/authenticity

Question 116Cryptography Concepts

Q116. A MAC provides:

  1. Only internet speed
  2. Only disk space
  3. Message authentication and integrity using a shared secret key
  4. Only a file icon
Show Answer

Correct Answer: C. Message authentication and integrity using a shared secret key

Question 117Cryptography Concepts

Q117. HMAC combines:

  1. A database with no credentials
  2. A cryptographic hash function with a secret key
  3. A keyboard with a monitor
  4. A web page with a logo
Show Answer

Correct Answer: B. A cryptographic hash function with a secret key

Question 118Cryptography Concepts

Q118. A side-channel attack targets:

  1. Only the official algorithm description
  2. Only a printed textbook title
  3. Information leaked through timing, power use or other implementation behavior
  4. Only public marketing text
Show Answer

Correct Answer: C. Information leaked through timing, power use or other implementation behavior

Question 119Cryptography Concepts

Q119. Crypto agility means:

  1. Removing every certificate
  2. Avoiding all encryption
  3. Using one old algorithm forever
  4. The ability to replace or upgrade cryptographic algorithms and keys
Show Answer

Correct Answer: D. The ability to replace or upgrade cryptographic algorithms and keys

Question 120Cryptography Concepts

Q120. Weak randomness can cause:

  1. Lower attack surface always
  2. Perfect key distribution
  3. Predictable keys, nonces or tokens
  4. Better security automatically
Show Answer

Correct Answer: C. Predictable keys, nonces or tokens

Topic 7

Encryption & Hash Functions

Back to top ↑
Question 121Encryption & Hash Functions

Q121. A hash function produces:

  1. A firewall configuration
  2. A fixed-length digest from input data
  3. A user access role
  4. A reversible ciphertext from a key only
Show Answer

Correct Answer: B. A fixed-length digest from input data

Question 122Encryption & Hash Functions

Q122. A secure hash is commonly used to check:

  1. Data integrity
  2. Network cable length
  3. Employee salary
  4. Monitor size
Show Answer

Correct Answer: A. Data integrity

Question 123Encryption & Hash Functions

Q123. A hash collision occurs when:

  1. A user logs in twice
  2. Two different inputs produce the same hash value
  3. A firewall blocks a port
  4. A password expires
Show Answer

Correct Answer: B. Two different inputs produce the same hash value

Question 124Encryption & Hash Functions

Q124. Preimage resistance means it should be hard to:

  1. Read a public webpage
  2. Update antivirus software
  3. Find an input that matches a given hash
  4. Create a folder name
Show Answer

Correct Answer: C. Find an input that matches a given hash

Question 125Encryption & Hash Functions

Q125. SHA-256 is an example of:

  1. A firewall vendor
  2. A biometric scanner
  3. A cryptographic hash function
  4. A database access role
Show Answer

Correct Answer: C. A cryptographic hash function

Question 126Encryption & Hash Functions

Q126. MD5 and SHA-1 are generally avoided for strong security because:

  1. They encrypt data too strongly
  2. They require no computing power
  3. Known weaknesses make them unsuitable for collision-resistant uses
  4. They are too new to test
Show Answer

Correct Answer: C. Known weaknesses make them unsuitable for collision-resistant uses

Question 127Encryption & Hash Functions

Q127. A salt in password storage helps prevent:

  1. Firewall rule review
  2. Precomputed rainbow table attacks
  3. User training sessions
  4. Network segmentation
Show Answer

Correct Answer: B. Precomputed rainbow table attacks

Question 128Encryption & Hash Functions

Q128. A rainbow table is:

  1. A type of biometric scanner
  2. A backup storage rack
  3. A precomputed table of hashes used to crack passwords
  4. A color palette for websites
Show Answer

Correct Answer: C. A precomputed table of hashes used to crack passwords

Question 129Encryption & Hash Functions

Q129. A message digest can act like:

  1. A digital fingerprint of data
  2. A physical lock only
  3. A legal contract by itself
  4. A network router
Show Answer

Correct Answer: A. A digital fingerprint of data

Question 130Encryption & Hash Functions

Q130. Encryption differs from hashing because encryption is:

  1. Never uses keys
  2. Only used for passwords
  3. Always one-way
  4. Reversible with the correct key
Show Answer

Correct Answer: D. Reversible with the correct key

Question 131Encryption & Hash Functions

Q131. Hashing differs from encryption because hashing is:

  1. One-way and not meant to be decrypted
  2. Always reversible with a public key
  3. Only a network protocol
  4. A form of file compression only
Show Answer

Correct Answer: A. One-way and not meant to be decrypted

Question 132Encryption & Hash Functions

Q132. TLS is mainly used to protect data:

  1. Only before data is created
  2. Only after printing
  3. Only inside paper folders
  4. In transit across networks
Show Answer

Correct Answer: D. In transit across networks

Question 133Encryption & Hash Functions

Q133. Disk or database encryption protects data:

  1. At rest
  2. Only after a user logs out forever
  3. Only inside a web browser icon
  4. Only during keyboard typing
Show Answer

Correct Answer: A. At rest

Question 134Encryption & Hash Functions

Q134. End-to-end encryption means:

  1. No keys are used
  2. Every server on the path can read the message
  3. The message is public by design
  4. Only communicating endpoints can read the message content
Show Answer

Correct Answer: D. Only communicating endpoints can read the message content

Question 135Encryption & Hash Functions

Q135. A key derivation function is used to:

  1. Derive strong keys from passwords or shared secrets
  2. Remove all authentication
  3. Disable secure storage
  4. Change a file extension
Show Answer

Correct Answer: A. Derive strong keys from passwords or shared secrets

Question 136Encryption & Hash Functions

Q136. bcrypt and Argon2 are examples of:

  1. Network routing protocols
  2. Password hashing algorithms designed to slow cracking
  3. Screen recording tools
  4. Digital certificate authorities
Show Answer

Correct Answer: B. Password hashing algorithms designed to slow cracking

Question 137Encryption & Hash Functions

Q137. An integrity check helps confirm that:

  1. The data is always confidential
  2. Data has not been altered unexpectedly
  3. The data is always deleted
  4. Every user is authorized
Show Answer

Correct Answer: B. Data has not been altered unexpectedly

Question 138Encryption & Hash Functions

Q138. The avalanche effect means:

  1. A password becomes public
  2. A server becomes physically cold
  3. A small input change causes a large unpredictable hash output change
  4. A file always becomes smaller
Show Answer

Correct Answer: C. A small input change causes a large unpredictable hash output change

Question 139Encryption & Hash Functions

Q139. A simple checksum is not a strong substitute for:

  1. A calculator in basic arithmetic
  2. A printed page number
  3. A monitor brightness setting
  4. A cryptographic hash when security against attackers is needed
Show Answer

Correct Answer: D. A cryptographic hash when security against attackers is needed

Question 140Encryption & Hash Functions

Q140. File hashes are often published so users can:

  1. Remove file permissions
  2. Verify downloaded files have not been modified
  3. Guess administrator passwords
  4. Disable network security
Show Answer

Correct Answer: B. Verify downloaded files have not been modified

Topic 8

Secure Design Lifecycle & Risk Controls

Back to top ↑
Question 141Secure Design Lifecycle & Risk Controls

Q141. The information security lifecycle is commonly viewed as:

  1. Planning, implementing, monitoring and improving security controls
  2. Only buying hardware once
  3. Only deleting old files
  4. Only writing a final report
Show Answer

Correct Answer: A. Planning, implementing, monitoring and improving security controls

Question 142Secure Design Lifecycle & Risk Controls

Q142. Security requirements should be identified during:

  1. Only after user accounts are deleted
  2. Only after the system is attacked
  3. Only during logo design
  4. The requirements stage of a system project
Show Answer

Correct Answer: D. The requirements stage of a system project

Question 143Secure Design Lifecycle & Risk Controls

Q143. During the design stage, teams should perform:

  1. Threat modeling and control selection
  2. Only font selection
  3. Only social media posting
  4. Only invoice printing
Show Answer

Correct Answer: A. Threat modeling and control selection

Question 144Secure Design Lifecycle & Risk Controls

Q144. During implementation, developers should focus on:

  1. Secure coding and safe configuration
  2. Skipping authentication
  3. Removing all reviews
  4. Sharing private keys
Show Answer

Correct Answer: A. Secure coding and safe configuration

Question 145Secure Design Lifecycle & Risk Controls

Q145. Security testing may include:

  1. Only checking spelling
  2. Only reducing screen brightness
  3. Vulnerability assessment and penetration testing
  4. Only choosing icons
Show Answer

Correct Answer: C. Vulnerability assessment and penetration testing

Question 146Secure Design Lifecycle & Risk Controls

Q146. Deployment hardening means:

  1. Opening every port
  2. Reducing unnecessary services, accounts and insecure settings
  3. Using default passwords
  4. Disabling all logs
Show Answer

Correct Answer: B. Reducing unnecessary services, accounts and insecure settings

Question 147Secure Design Lifecycle & Risk Controls

Q147. Security maintenance includes:

  1. Never reviewing permissions
  2. Monitoring, patching, reviewing and improving controls
  3. Ignoring all alerts
  4. Deleting backups
Show Answer

Correct Answer: B. Monitoring, patching, reviewing and improving controls

Question 148Secure Design Lifecycle & Risk Controls

Q148. Risk management includes:

  1. Only backing up photos
  2. Identifying, assessing, treating and monitoring risks
  3. Only creating a logo
  4. Only sending marketing emails
Show Answer

Correct Answer: B. Identifying, assessing, treating and monitoring risks

Question 149Secure Design Lifecycle & Risk Controls

Q149. Risk appetite means:

  1. The amount and type of risk an organization is willing to accept
  2. The number of users in a database
  3. The taste of a security team
  4. The size of a network cable
Show Answer

Correct Answer: A. The amount and type of risk an organization is willing to accept

Question 150Secure Design Lifecycle & Risk Controls

Q150. Risk treatment options include:

  1. Avoid, mitigate, transfer or accept
  2. Ignore, delete, hide or confuse
  3. Paint, resize, rename or decorate
  4. Print, crop, paste or fold
Show Answer

Correct Answer: A. Avoid, mitigate, transfer or accept

Question 151Secure Design Lifecycle & Risk Controls

Q151. A security baseline is:

  1. A minimum agreed level of secure configuration or control
  2. A temporary password shared publicly
  3. A database table color
  4. A random list of jokes
Show Answer

Correct Answer: A. A minimum agreed level of secure configuration or control

Question 152Secure Design Lifecycle & Risk Controls

Q152. Change management helps security by:

  1. Ignoring production systems
  2. Controlling and reviewing changes before they create new risks
  3. Removing all approval records
  4. Allowing unapproved changes anytime
Show Answer

Correct Answer: B. Controlling and reviewing changes before they create new risks

Question 153Secure Design Lifecycle & Risk Controls

Q153. Configuration management tracks:

  1. System settings, versions and approved states
  2. Only employee birthdays
  3. Only advertisement budgets
  4. Only weather reports
Show Answer

Correct Answer: A. System settings, versions and approved states

Question 154Secure Design Lifecycle & Risk Controls

Q154. Asset classification helps by:

  1. Removing ownership information
  2. Making every asset public
  3. Disabling backups
  4. Prioritizing protection based on asset value and sensitivity
Show Answer

Correct Answer: D. Prioritizing protection based on asset value and sensitivity

Question 155Secure Design Lifecycle & Risk Controls

Q155. Data classification labels data according to:

  1. Keyboard brand
  2. Screen resolution
  3. Sensitivity and required protection level
  4. Font style only
Show Answer

Correct Answer: C. Sensitivity and required protection level

Question 156Secure Design Lifecycle & Risk Controls

Q156. Security training supports the lifecycle by:

  1. Replacing every technical control
  2. Encouraging password sharing
  3. Eliminating the need for monitoring
  4. Helping users understand risks, policies and safe behavior
Show Answer

Correct Answer: D. Helping users understand risks, policies and safe behavior

Question 157Secure Design Lifecycle & Risk Controls

Q157. Business continuity planning focuses on:

  1. Only creating new logos
  2. Keeping critical operations running during disruption
  3. Only changing passwords daily
  4. Only deleting old emails
Show Answer

Correct Answer: B. Keeping critical operations running during disruption

Question 158Secure Design Lifecycle & Risk Controls

Q158. Disaster recovery focuses on:

  1. Blocking all legitimate users
  2. Restoring IT systems and data after a major disruption
  3. Making social media posts
  4. Avoiding backups
Show Answer

Correct Answer: B. Restoring IT systems and data after a major disruption

Question 159Secure Design Lifecycle & Risk Controls

Q159. A good backup strategy should consider:

  1. Frequency, retention, testing and secure storage
  2. Only the desk location
  3. Only file icon color
  4. Only a single untested copy
Show Answer

Correct Answer: A. Frequency, retention, testing and secure storage

Question 160Secure Design Lifecycle & Risk Controls

Q160. Security metrics and KPIs help to:

  1. Make weak passwords acceptable
  2. Hide incidents from management
  3. Measure security performance and guide improvement
  4. Replace risk assessment completely
Show Answer

Correct Answer: C. Measure security performance and guide improvement

Topic 9

Database Security

Back to top ↑
Question 161Database Security

Q161. Database security aims to:

  1. Remove every user role
  2. Disable backups forever
  3. Make all records public
  4. Protect stored data from unauthorized access, change or loss
Show Answer

Correct Answer: D. Protect stored data from unauthorized access, change or loss

Question 162Database Security

Q162. SQL injection occurs when:

  1. Untrusted input changes the meaning of a database query
  2. A server is patched
  3. A user chooses a strong password
  4. A database is backed up correctly
Show Answer

Correct Answer: A. Untrusted input changes the meaning of a database query

Question 163Database Security

Q163. Parameterized queries help prevent:

  1. Power failure
  2. Screen glare
  3. Keyboard damage
  4. SQL injection
Show Answer

Correct Answer: D. SQL injection

Question 164Database Security

Q164. Database least privilege means:

  1. Guest users can drop tables
  2. Permissions are never reviewed
  3. Every account gets DBA rights
  4. Applications and users get only necessary database permissions
Show Answer

Correct Answer: D. Applications and users get only necessary database permissions

Question 165Database Security

Q165. Database encryption at rest protects:

  1. Stored database files or fields if storage is exposed
  2. Only live video calls
  3. Only printed reports
  4. Only keyboard input
Show Answer

Correct Answer: A. Stored database files or fields if storage is exposed

Question 166Database Security

Q166. Row-level security is used to:

  1. Restrict access to specific rows based on rules
  2. Delete all rows automatically
  3. Give all users identical access
  4. Replace backups
Show Answer

Correct Answer: A. Restrict access to specific rows based on rules

Question 167Database Security

Q167. Database access control should define:

  1. Only office furniture
  2. Only page colors
  3. Who can read, insert, update, delete or administer data
  4. Only email templates
Show Answer

Correct Answer: C. Who can read, insert, update, delete or administer data

Question 168Database Security

Q168. Database auditing records:

  1. Only screen size
  2. Database activity such as logins, queries and changes
  3. Only weather data
  4. Only logo versions
Show Answer

Correct Answer: B. Database activity such as logins, queries and changes

Question 169Database Security

Q169. Database backup and recovery planning protects against:

  1. Data loss, corruption and operational disruption
  2. All possible human decisions
  3. Keyboard shortcuts
  4. Legal policy writing only
Show Answer

Correct Answer: A. Data loss, corruption and operational disruption

Question 170Database Security

Q170. Data masking is used to:

  1. Hide sensitive values while preserving usable format for testing or viewing
  2. Make passwords public
  3. Disable encryption
  4. Delete every record permanently
Show Answer

Correct Answer: A. Hide sensitive values while preserving usable format for testing or viewing

Question 171Database Security

Q171. Tokenization replaces sensitive data with:

  1. A monitor serial number
  2. A public password
  3. A firewall port number
  4. A non-sensitive token that maps to the original value
Show Answer

Correct Answer: D. A non-sensitive token that maps to the original value

Question 172Database Security

Q172. A database view can improve security by:

  1. Showing only selected columns or rows to users
  2. Removing all permissions
  3. Disabling authentication
  4. Making every table public
Show Answer

Correct Answer: A. Showing only selected columns or rows to users

Question 173Database Security

Q173. Stored procedures are not automatically secure because:

  1. They never interact with data
  2. They can still be vulnerable if written or used incorrectly
  3. They always encrypt data
  4. They remove the need for access control
Show Answer

Correct Answer: B. They can still be vulnerable if written or used incorrectly

Question 174Database Security

Q174. An inference attack tries to:

  1. Restart a router
  2. Rename a file extension
  3. Derive sensitive information from non-sensitive query results
  4. Install a keyboard driver
Show Answer

Correct Answer: C. Derive sensitive information from non-sensitive query results

Question 175Database Security

Q175. Referential integrity is often enforced with:

  1. Random screenshots
  2. Primary keys and foreign keys
  3. Email signatures only
  4. Browser bookmarks
Show Answer

Correct Answer: B. Primary keys and foreign keys

Question 176Database Security

Q176. Input validation alone is not enough for SQL injection because:

  1. Databases do not use queries
  2. Passwords cannot be stored
  3. Queries still need safe parameterization and proper privileges
  4. Validation always breaks databases
Show Answer

Correct Answer: C. Queries still need safe parameterization and proper privileges

Question 177Database Security

Q177. Database patching is important to:

  1. Fix known DBMS security vulnerabilities
  2. Change font size
  3. Make tables longer
  4. Disable audit logs
Show Answer

Correct Answer: A. Fix known DBMS security vulnerabilities

Question 178Database Security

Q178. ACID properties help databases maintain:

  1. Public anonymous access
  2. A wider screen layout
  3. Reliable and consistent transactions
  4. A social media profile
Show Answer

Correct Answer: C. Reliable and consistent transactions

Question 179Database Security

Q179. NoSQL injection can happen when:

  1. A backup is restored safely
  2. Untrusted input manipulates a NoSQL query or command
  3. A password is hashed correctly
  4. A firewall blocks traffic
Show Answer

Correct Answer: B. Untrusted input manipulates a NoSQL query or command

Question 180Database Security

Q180. Database administrators should separate duties to:

  1. Eliminate all review
  2. Reduce misuse and avoid one person controlling every sensitive function
  3. Give one person all access forever
  4. Make audits impossible
Show Answer

Correct Answer: B. Reduce misuse and avoid one person controlling every sensitive function

Topic 10

Network Security

Back to top ↑
Question 181Network Security

Q181. Network security focuses on:

  1. Protecting network infrastructure, traffic and services
  2. Removing all authentication
  3. Changing desktop wallpaper
  4. Writing only marketing captions
Show Answer

Correct Answer: A. Protecting network infrastructure, traffic and services

Question 182Network Security

Q182. A firewall is used to:

  1. Create user passwords automatically
  2. Filter network traffic based on rules
  3. Encrypt hard drives only
  4. Replace database backups
Show Answer

Correct Answer: B. Filter network traffic based on rules

Question 183Network Security

Q183. An IDS primarily:

  1. Creates encryption keys only
  2. Blocks every attack automatically by definition
  3. Detects suspicious activity and generates alerts
  4. Prints security policies
Show Answer

Correct Answer: C. Detects suspicious activity and generates alerts

Question 184Network Security

Q184. An IPS can:

  1. Only scan documents
  2. Detect and actively block or prevent suspicious traffic
  3. Only write training notes
  4. Only manage payroll
Show Answer

Correct Answer: B. Detect and actively block or prevent suspicious traffic

Question 185Network Security

Q185. A VPN provides:

  1. An encrypted tunnel over an untrusted network
  2. A database schema
  3. A public password store
  4. A printed identity card
Show Answer

Correct Answer: A. An encrypted tunnel over an untrusted network

Question 186Network Security

Q186. Network segmentation helps by:

  1. Disabling all firewalls
  2. Dividing networks to limit access and contain attacks
  3. Sharing one admin password
  4. Connecting every system without controls
Show Answer

Correct Answer: B. Dividing networks to limit access and contain attacks

Question 187Network Security

Q187. A DMZ is commonly used to:

  1. Hide audit logs
  2. Remove web servers from security scope
  3. Store lunch menus
  4. Place public-facing services in a separated network zone
Show Answer

Correct Answer: D. Place public-facing services in a separated network zone

Question 188Network Security

Q188. Port scanning is used by attackers or testers to:

  1. Delete backups safely
  2. Improve image quality
  3. Write legal contracts
  4. Find open ports and services
Show Answer

Correct Answer: D. Find open ports and services

Question 189Network Security

Q189. A DDoS attack attempts to:

  1. Validate a database query
  2. Overwhelm a service with excessive traffic
  3. Reduce network usage
  4. Encrypt a password correctly
Show Answer

Correct Answer: B. Overwhelm a service with excessive traffic

Question 190Network Security

Q190. A man-in-the-middle attack occurs when:

  1. A backup is encrypted
  2. A router is documented
  3. A user changes a theme color
  4. An attacker intercepts or manipulates communication between parties
Show Answer

Correct Answer: D. An attacker intercepts or manipulates communication between parties

Question 191Network Security

Q191. TLS protects network communication by providing:

  1. Only paper filing
  2. Only faster typing
  3. Encryption, integrity and server authentication
  4. Only database normalization
Show Answer

Correct Answer: C. Encryption, integrity and server authentication

Question 192Network Security

Q192. DNS spoofing attempts to:

  1. Redirect users to false destinations by corrupting name resolution
  2. Increase password strength
  3. Improve DNS security
  4. Patch operating systems
Show Answer

Correct Answer: A. Redirect users to false destinations by corrupting name resolution

Question 193Network Security

Q193. Secure Wi-Fi should use:

  1. Strong encryption such as WPA2 or WPA3 with strong credentials
  2. Shared admin panels
  3. Open access with no password
  4. Weak default passwords
Show Answer

Correct Answer: A. Strong encryption such as WPA2 or WPA3 with strong credentials

Question 194Network Security

Q194. Secure routing helps prevent:

  1. Image cropping
  2. Keyboard failures
  3. File compression
  4. Unauthorized or manipulated network paths
Show Answer

Correct Answer: D. Unauthorized or manipulated network paths

Question 195Network Security

Q195. NAT should not be treated as:

  1. A networking function
  2. A common home router feature
  3. A method for address translation
  4. A complete security control by itself
Show Answer

Correct Answer: D. A complete security control by itself

Question 196Network Security

Q196. Zero trust networking requires:

  1. Automatic trust for internal devices
  2. Shared passwords everywhere
  3. No monitoring
  4. Verification and least-privilege access even inside the network
Show Answer

Correct Answer: D. Verification and least-privilege access even inside the network

Question 197Network Security

Q197. Packet sniffing means:

  1. Cleaning a keyboard
  2. Deleting browser cookies
  3. Designing a course title
  4. Capturing network traffic for analysis or attack
Show Answer

Correct Answer: D. Capturing network traffic for analysis or attack

Question 198Network Security

Q198. A SIEM helps network security teams by:

  1. Replacing all staff
  2. Publishing private keys
  3. Removing all authentication
  4. Collecting and correlating security logs and alerts
Show Answer

Correct Answer: D. Collecting and correlating security logs and alerts

Question 199Network Security

Q199. Network monitoring helps to:

  1. Delete incidents
  2. Disable reporting
  3. Detect abnormal traffic, outages and possible attacks
  4. Make all systems public
Show Answer

Correct Answer: C. Detect abnormal traffic, outages and possible attacks

Question 200Network Security

Q200. Isolating a compromised host helps to:

  1. Give attackers more access
  2. Share malware with other systems
  3. Erase all evidence immediately
  4. Contain an incident and limit further spread
Show Answer

Correct Answer: D. Contain an incident and limit further spread

Topic 11

Software Security, Vulnerabilities & Protection

Back to top ↑
Question 201Software Security, Vulnerabilities & Protection

Q201. A software vulnerability is:

  1. A weakness in software that can be exploited
  2. A perfect security guarantee
  3. A user training certificate
  4. A backup location
Show Answer

Correct Answer: A. A weakness in software that can be exploited

Question 202Software Security, Vulnerabilities & Protection

Q202. A threat actor exploits vulnerabilities to:

  1. Improve software documentation
  2. Create stronger passwords
  3. Gain unauthorized access or cause harm
  4. Patch every server
Show Answer

Correct Answer: C. Gain unauthorized access or cause harm

Question 203Software Security, Vulnerabilities & Protection

Q203. A buffer overflow occurs when:

  1. A firewall rule is named incorrectly
  2. A program writes more data than a memory buffer can hold
  3. A password is too long for policy only
  4. A backup is too frequent
Show Answer

Correct Answer: B. A program writes more data than a memory buffer can hold

Question 204Software Security, Vulnerabilities & Protection

Q204. Cross-Site Scripting is commonly caused by:

  1. Correct patching
  2. Encrypted database storage
  3. Strong server authentication
  4. Untrusted input displayed in a browser without proper output encoding
Show Answer

Correct Answer: D. Untrusted input displayed in a browser without proper output encoding

Question 205Software Security, Vulnerabilities & Protection

Q205. Cross-Site Request Forgery tricks a user into:

  1. Choosing a better password
  2. Submitting an unwanted action to a site where they are authenticated
  3. Encrypting their disk
  4. Backing up data
Show Answer

Correct Answer: B. Submitting an unwanted action to a site where they are authenticated

Question 206Software Security, Vulnerabilities & Protection

Q206. Insecure deserialization can allow:

  1. Perfectly safe object loading always
  2. Only screen sharing
  3. Only faster database queries
  4. Attackers to manipulate serialized data and trigger harmful behavior
Show Answer

Correct Answer: D. Attackers to manipulate serialized data and trigger harmful behavior

Question 207Software Security, Vulnerabilities & Protection

Q207. Broken authentication may result in:

  1. A smaller attack surface
  2. Better password storage automatically
  3. Improved privacy
  4. Account takeover or unauthorized access
Show Answer

Correct Answer: D. Account takeover or unauthorized access

Question 208Software Security, Vulnerabilities & Protection

Q208. Dependency scanning helps identify:

  1. Only spelling mistakes
  2. Only web colors
  3. Only user birthdays
  4. Known vulnerabilities in third-party libraries
Show Answer

Correct Answer: D. Known vulnerabilities in third-party libraries

Question 209Software Security, Vulnerabilities & Protection

Q209. SAST analyzes:

  1. Source code or binaries without running the application
  2. Only network packets in transit
  3. Only paper forms
  4. Only user training sessions
Show Answer

Correct Answer: A. Source code or binaries without running the application

Question 210Software Security, Vulnerabilities & Protection

Q210. DAST tests:

  1. Only employee profiles
  2. Only source code comments
  3. A running application from the outside
  4. Only hardware serial numbers
Show Answer

Correct Answer: C. A running application from the outside

Question 211Software Security, Vulnerabilities & Protection

Q211. Secure coding means:

  1. Sharing secrets in code
  2. Ignoring input validation
  3. Writing code with no comments ever
  4. Writing software to reduce security weaknesses
Show Answer

Correct Answer: D. Writing software to reduce security weaknesses

Question 212Software Security, Vulnerabilities & Protection

Q212. Input validation helps software security by:

  1. Storing plain passwords
  2. Removing authentication
  3. Allowing all input without checks
  4. Rejecting or handling unexpected input safely
Show Answer

Correct Answer: D. Rejecting or handling unexpected input safely

Question 213Software Security, Vulnerabilities & Protection

Q213. Output encoding helps prevent:

  1. Power failure
  2. XSS by safely rendering untrusted data
  3. Hard disk damage
  4. Firewall overheating
Show Answer

Correct Answer: B. XSS by safely rendering untrusted data

Question 214Software Security, Vulnerabilities & Protection

Q214. Secure error handling should:

  1. Reveal stack traces to all users
  2. Show database passwords in error pages
  3. Avoid exposing sensitive internal details
  4. Disable logging
Show Answer

Correct Answer: C. Avoid exposing sensitive internal details

Question 215Software Security, Vulnerabilities & Protection

Q215. Secrets management is used to:

  1. Store and control API keys, tokens and passwords securely
  2. Email private keys to everyone
  3. Hardcode secrets in public repositories
  4. Remove rotation
Show Answer

Correct Answer: A. Store and control API keys, tokens and passwords securely

Question 216Software Security, Vulnerabilities & Protection

Q216. Code review can improve security by:

  1. Sharing passwords with reviewers
  2. Finding design and coding mistakes before release
  3. Guaranteeing no future vulnerabilities
  4. Replacing all tests
Show Answer

Correct Answer: B. Finding design and coding mistakes before release

Question 217Software Security, Vulnerabilities & Protection

Q217. Updating dependencies reduces risk from:

  1. Clean input validation
  2. Too much logging
  3. Stronger authentication
  4. Known vulnerabilities in libraries and packages
Show Answer

Correct Answer: D. Known vulnerabilities in libraries and packages

Question 218Software Security, Vulnerabilities & Protection

Q218. API rate limiting helps protect against:

  1. Abuse, brute force attempts and excessive requests
  2. Office noise
  3. File naming conflicts
  4. Data encryption at rest only
Show Answer

Correct Answer: A. Abuse, brute force attempts and excessive requests

Question 219Software Security, Vulnerabilities & Protection

Q219. Secure HTTP headers can help protect against:

  1. Spreadsheet formatting
  2. Hardware theft alone
  3. Clickjacking, XSS and insecure transport choices
  4. Printer faults
Show Answer

Correct Answer: C. Clickjacking, XSS and insecure transport choices

Question 220Software Security, Vulnerabilities & Protection

Q220. A vulnerability disclosure process helps:

  1. Ignore user reports
  2. Hide all weaknesses forever
  3. Report, triage and fix vulnerabilities responsibly
  4. Punish every researcher automatically
Show Answer

Correct Answer: C. Report, triage and fix vulnerabilities responsibly

Topic 12

Firewalls, IDS & Security Policies

Back to top ↑
Question 221Firewalls, IDS & Security Policies

Q221. A packet-filtering firewall makes decisions mainly using:

  1. Source, destination, ports and protocol information
  2. Only password length
  3. Only screen brightness
  4. Only document title
Show Answer

Correct Answer: A. Source, destination, ports and protocol information

Question 222Firewalls, IDS & Security Policies

Q222. A stateful firewall tracks:

  1. The state of network connections
  2. Only keyboard shortcuts
  3. Only employee attendance
  4. Only file icons
Show Answer

Correct Answer: A. The state of network connections

Question 223Firewalls, IDS & Security Policies

Q223. An application proxy firewall can:

  1. Only change IP addresses
  2. Only create backups
  3. Only encrypt a hard disk
  4. Inspect traffic at the application layer
Show Answer

Correct Answer: D. Inspect traffic at the application layer

Question 224Firewalls, IDS & Security Policies

Q224. A Web Application Firewall helps protect against:

  1. Low battery level
  2. Physical fire in server rooms
  3. Weak office lighting
  4. Common web attacks such as SQL injection and XSS
Show Answer

Correct Answer: D. Common web attacks such as SQL injection and XSS

Question 225Firewalls, IDS & Security Policies

Q225. A network-based IDS monitors:

  1. Only a single printed form
  2. Traffic on network segments
  3. Only user fingerprints
  4. Only file names
Show Answer

Correct Answer: B. Traffic on network segments

Question 226Firewalls, IDS & Security Policies

Q226. A host-based IDS monitors:

  1. Activity on an individual computer or server
  2. Only public web search trends
  3. Only cables in a rack
  4. Only logo files
Show Answer

Correct Answer: A. Activity on an individual computer or server

Question 227Firewalls, IDS & Security Policies

Q227. Signature-based detection relies on:

  1. Random guesses only
  2. No rules or patterns
  3. Known attack patterns
  4. User interface colors
Show Answer

Correct Answer: C. Known attack patterns

Question 228Firewalls, IDS & Security Policies

Q228. Anomaly-based detection looks for:

  1. Only names of employees
  2. Only exact known signatures
  3. Behavior that differs from normal patterns
  4. Only backup file sizes
Show Answer

Correct Answer: C. Behavior that differs from normal patterns

Question 229Firewalls, IDS & Security Policies

Q229. A false positive is:

  1. A benign activity incorrectly flagged as malicious
  2. A correct password
  3. A deleted audit log
  4. A real attack missed by the system
Show Answer

Correct Answer: A. A benign activity incorrectly flagged as malicious

Question 230Firewalls, IDS & Security Policies

Q230. A false negative is:

  1. A real malicious activity that is not detected
  2. A harmless alert
  3. A training certificate
  4. A firewall rule comment
Show Answer

Correct Answer: A. A real malicious activity that is not detected

Question 231Firewalls, IDS & Security Policies

Q231. A security policy defines:

  1. Rules, responsibilities and expectations for security
  2. Only the company logo
  3. Only a web headline
  4. Only a database color
Show Answer

Correct Answer: A. Rules, responsibilities and expectations for security

Question 232Firewalls, IDS & Security Policies

Q232. An acceptable use policy states:

  1. How users may use systems and networks appropriately
  2. How to design office chairs
  3. How to ignore incidents
  4. How to uninstall every firewall
Show Answer

Correct Answer: A. How users may use systems and networks appropriately

Question 233Firewalls, IDS & Security Policies

Q233. A password policy usually covers:

  1. Complexity, length, reuse, storage and change requirements
  2. Only lunch breaks
  3. Only wall paint color
  4. Only printer settings
Show Answer

Correct Answer: A. Complexity, length, reuse, storage and change requirements

Question 234Firewalls, IDS & Security Policies

Q234. An incident response policy defines:

  1. How to share passwords
  2. How to avoid all logging
  3. How incidents are reported, handled and escalated
  4. How to create memes
Show Answer

Correct Answer: C. How incidents are reported, handled and escalated

Question 235Firewalls, IDS & Security Policies

Q235. Firewall rule order matters because:

  1. Rules are decorative only
  2. All rules allow everything
  3. Rules are often processed in sequence
  4. Order never affects traffic
Show Answer

Correct Answer: C. Rules are often processed in sequence

Question 236Firewalls, IDS & Security Policies

Q236. Default deny means:

  1. Authentication is removed
  2. Logs are always deleted
  3. Traffic is blocked unless explicitly allowed
  4. Everything is allowed unless blocked manually
Show Answer

Correct Answer: C. Traffic is blocked unless explicitly allowed

Question 237Firewalls, IDS & Security Policies

Q237. IDS logs are valuable because they:

  1. Support investigation, alerting and trend analysis
  2. Replace all encryption
  3. Provide public passwords
  4. Make attacks harmless
Show Answer

Correct Answer: A. Support investigation, alerting and trend analysis

Question 238Firewalls, IDS & Security Policies

Q238. A SIEM correlation rule can:

  1. Write exams automatically
  2. Create physical locks
  3. Turn off every alert
  4. Connect events from multiple sources to find suspicious patterns
Show Answer

Correct Answer: D. Connect events from multiple sources to find suspicious patterns

Question 239Firewalls, IDS & Security Policies

Q239. Policy exceptions should be:

  1. Granted to everyone
  2. Documented, approved, time-bound and reviewed
  3. Used to bypass all security
  4. Secret, permanent and unreviewed
Show Answer

Correct Answer: B. Documented, approved, time-bound and reviewed

Question 240Firewalls, IDS & Security Policies

Q240. Security policies should be reviewed:

  1. Never after publication
  2. Only when users forget passwords
  3. Regularly and when risks, laws or systems change
  4. Only after deletion
Show Answer

Correct Answer: C. Regularly and when risks, laws or systems change

Topic 13

Policy Formation & Enforcement

Back to top ↑
Question 241Policy Formation & Enforcement

Q241. Policy formation should begin with:

  1. Random opinions only
  2. A list of jokes
  3. Business goals, legal requirements, assets and risks
  4. A color palette only
Show Answer

Correct Answer: C. Business goals, legal requirements, assets and risks

Question 242Policy Formation & Enforcement

Q242. A standard is different from a policy because it:

  1. Is always optional advice
  2. Specifies mandatory detailed requirements to support a policy
  3. Replaces all procedures
  4. Has no relation to security
Show Answer

Correct Answer: B. Specifies mandatory detailed requirements to support a policy

Question 243Policy Formation & Enforcement

Q243. A procedure is:

  1. A broad statement of intent only
  2. A random password
  3. A step-by-step instruction for performing a task
  4. A type of encryption key
Show Answer

Correct Answer: C. A step-by-step instruction for performing a task

Question 244Policy Formation & Enforcement

Q244. A guideline is usually:

  1. Recommended advice that supports good practice
  2. An administrator password
  3. A criminal law by itself
  4. A guaranteed technical control
Show Answer

Correct Answer: A. Recommended advice that supports good practice

Question 245Policy Formation & Enforcement

Q245. Information security governance provides:

  1. Only database indexes
  2. Direction, accountability and oversight for security
  3. Only software decoration
  4. Only keyboard shortcuts
Show Answer

Correct Answer: B. Direction, accountability and oversight for security

Question 246Policy Formation & Enforcement

Q246. Policy stakeholders may include:

  1. Only printers
  2. Only attackers
  3. Only anonymous visitors
  4. Management, IT, legal, HR, security teams and users
Show Answer

Correct Answer: D. Management, IT, legal, HR, security teams and users

Question 247Policy Formation & Enforcement

Q247. Compliance means:

  1. Deleting all documentation
  2. Ignoring approved rules
  3. Making accounts anonymous
  4. Following applicable policies, standards, contracts and laws
Show Answer

Correct Answer: D. Following applicable policies, standards, contracts and laws

Question 248Policy Formation & Enforcement

Q248. Policy enforcement requires:

  1. No records or responsibility
  2. No training
  3. Monitoring, accountability and consequences for violations
  4. All users as administrators
Show Answer

Correct Answer: C. Monitoring, accountability and consequences for violations

Question 249Policy Formation & Enforcement

Q249. Sanctions in a policy context are:

  1. Backup schedules
  2. Search engine keywords
  3. Consequences for violating security rules
  4. Decorative page borders
Show Answer

Correct Answer: C. Consequences for violating security rules

Question 250Policy Formation & Enforcement

Q250. Awareness and training help policy enforcement by:

  1. Making policies secret
  2. Removing all responsibilities
  3. Replacing all monitoring
  4. Teaching users what rules mean and how to follow them
Show Answer

Correct Answer: D. Teaching users what rules mean and how to follow them

Question 251Policy Formation & Enforcement

Q251. Policy version control helps by:

  1. Hiding old decisions
  2. Tracking changes, approvals and current approved versions
  3. Removing ownership
  4. Making rules impossible to audit
Show Answer

Correct Answer: B. Tracking changes, approvals and current approved versions

Question 252Policy Formation & Enforcement

Q252. Every security policy should have:

  1. An owner responsible for maintenance and review
  2. A public password
  3. No responsible person
  4. Only one sentence with no scope
Show Answer

Correct Answer: A. An owner responsible for maintenance and review

Question 253Policy Formation & Enforcement

Q253. Policy metrics help measure:

  1. How well policies are implemented and followed
  2. Only social media reactions
  3. Only screen size
  4. Only paper weight
Show Answer

Correct Answer: A. How well policies are implemented and followed

Question 254Policy Formation & Enforcement

Q254. Security audits evaluate:

  1. Only website colors
  2. Whether controls and practices meet requirements
  3. Only document font styles
  4. Only employee hobbies
Show Answer

Correct Answer: B. Whether controls and practices meet requirements

Question 255Policy Formation & Enforcement

Q255. A data retention policy defines:

  1. How to choose passwords only
  2. How to draw diagrams
  3. How to rename folders
  4. How long data is kept and when it is disposed of
Show Answer

Correct Answer: D. How long data is kept and when it is disposed of

Question 256Policy Formation & Enforcement

Q256. A data classification policy defines:

  1. Only blog categories
  2. Labels and handling rules for different sensitivity levels
  3. Only office locations
  4. Only file icons
Show Answer

Correct Answer: B. Labels and handling rules for different sensitivity levels

Question 257Policy Formation & Enforcement

Q257. A remote access policy should cover:

  1. Only printer names
  2. Only lunch hours
  3. Approved methods, authentication, devices and monitoring
  4. Only wallpaper choices
Show Answer

Correct Answer: C. Approved methods, authentication, devices and monitoring

Question 258Policy Formation & Enforcement

Q258. A BYOD policy addresses:

  1. Only brand slogans
  2. Only paper notebooks
  3. Only office parking
  4. Security rules for personally owned devices used for work
Show Answer

Correct Answer: D. Security rules for personally owned devices used for work

Question 259Policy Formation & Enforcement

Q259. The policy lifecycle includes:

  1. Creation, approval, communication, enforcement and review
  2. Only deleting records
  3. Only writing once and forgetting
  4. Only changing colors
Show Answer

Correct Answer: A. Creation, approval, communication, enforcement and review

Question 260Policy Formation & Enforcement

Q260. Continuous improvement in policy management means:

  1. Keeping outdated rules forever
  2. Removing all documentation
  3. Updating policies based on feedback, incidents and changing risks
  4. Avoiding user feedback
Show Answer

Correct Answer: C. Updating policies based on feedback, incidents and changing risks

Topic 14

Risk Assessment & Cybercrime

Back to top ↑
Question 261Risk Assessment & Cybercrime

Q261. Risk assessment is used to:

  1. Identify and evaluate risks to information assets
  2. Choose website animations only
  3. Make every asset public
  4. Remove all controls
Show Answer

Correct Answer: A. Identify and evaluate risks to information assets

Question 262Risk Assessment & Cybercrime

Q262. Likelihood and impact are used to estimate:

  1. Screen quality
  2. Password color
  3. Risk level
  4. Backup file extension
Show Answer

Correct Answer: C. Risk level

Question 263Risk Assessment & Cybercrime

Q263. Qualitative risk assessment uses:

  1. Only exact monetary values
  2. Ratings such as low, medium and high
  3. Only keyboard shortcuts
  4. No judgment or categories
Show Answer

Correct Answer: B. Ratings such as low, medium and high

Question 264Risk Assessment & Cybercrime

Q264. Quantitative risk assessment uses:

  1. Only colors and icons
  2. Only broad opinions
  3. Numerical values such as cost, probability and loss estimates
  4. Only handwritten notes
Show Answer

Correct Answer: C. Numerical values such as cost, probability and loss estimates

Question 265Risk Assessment & Cybercrime

Q265. A risk matrix helps to:

  1. Encrypt network traffic
  2. Prioritize risks by likelihood and impact
  3. Change access roles automatically
  4. Store passwords
Show Answer

Correct Answer: B. Prioritize risks by likelihood and impact

Question 266Risk Assessment & Cybercrime

Q266. Threat intelligence provides:

  1. Only user profile photos
  2. Only printer ink levels
  3. Only font recommendations
  4. Information about attackers, tactics, indicators and emerging threats
Show Answer

Correct Answer: D. Information about attackers, tactics, indicators and emerging threats

Question 267Risk Assessment & Cybercrime

Q267. A vulnerability assessment aims to:

  1. Find and report weaknesses in systems or processes
  2. Exploit systems without permission
  3. Remove every security control
  4. Hide all weaknesses
Show Answer

Correct Answer: A. Find and report weaknesses in systems or processes

Question 268Risk Assessment & Cybercrime

Q268. Penetration testing should be:

  1. Performed only to damage systems
  2. Unapproved and hidden from owners
  3. Authorized and scoped before testing begins
  4. Done without documentation
Show Answer

Correct Answer: C. Authorized and scoped before testing begins

Question 269Risk Assessment & Cybercrime

Q269. Cybercrime generally means:

  1. Illegal activity involving computers, networks or digital data
  2. Any legal use of a keyboard
  3. Only installing updates
  4. Only writing secure code
Show Answer

Correct Answer: A. Illegal activity involving computers, networks or digital data

Question 270Risk Assessment & Cybercrime

Q270. Phishing attempts to:

  1. Trick people into revealing information or taking unsafe actions
  2. Improve password strength
  3. Patch vulnerabilities
  4. Encrypt backups safely
Show Answer

Correct Answer: A. Trick people into revealing information or taking unsafe actions

Question 271Risk Assessment & Cybercrime

Q271. Ransomware is malware that:

  1. Only monitors temperature
  2. Only improves performance
  3. Encrypts or blocks access to data and demands payment
  4. Only changes wallpaper
Show Answer

Correct Answer: C. Encrypts or blocks access to data and demands payment

Question 272Risk Assessment & Cybercrime

Q272. Malware is:

  1. Software designed to harm, disrupt or gain unauthorized access
  2. Any approved update
  3. A secure backup
  4. A password policy document
Show Answer

Correct Answer: A. Software designed to harm, disrupt or gain unauthorized access

Question 273Risk Assessment & Cybercrime

Q273. Identity theft involves:

  1. Creating a strong password
  2. Encrypting a database
  3. Using another person's identity information without permission
  4. Updating a firewall
Show Answer

Correct Answer: C. Using another person's identity information without permission

Question 274Risk Assessment & Cybercrime

Q274. Social engineering attacks target:

  1. Only file compression
  2. Human behavior and trust
  3. Only screen resolution
  4. Only hardware temperature
Show Answer

Correct Answer: B. Human behavior and trust

Question 275Risk Assessment & Cybercrime

Q275. An insider threat can come from:

  1. Only external hackers
  2. A trusted person who misuses access intentionally or accidentally
  3. Only unsupported cables
  4. Only public websites
Show Answer

Correct Answer: B. A trusted person who misuses access intentionally or accidentally

Question 276Risk Assessment & Cybercrime

Q276. Evidence preservation requires:

  1. Protecting logs, files and devices from alteration
  2. Posting evidence publicly
  3. Changing timestamps
  4. Deleting logs immediately
Show Answer

Correct Answer: A. Protecting logs, files and devices from alteration

Question 277Risk Assessment & Cybercrime

Q277. Chain of custody documents:

  1. Only login page color
  2. Only keyboard model numbers
  3. Who collected, handled and transferred evidence
  4. Only office furniture
Show Answer

Correct Answer: C. Who collected, handled and transferred evidence

Question 278Risk Assessment & Cybercrime

Q278. Incident reporting should be:

  1. Delayed until all evidence is lost
  2. Avoided to protect appearances
  3. Timely, accurate and sent through approved channels
  4. Done only on social media
Show Answer

Correct Answer: C. Timely, accurate and sent through approved channels

Question 279Risk Assessment & Cybercrime

Q279. A risk register contains:

  1. Identified risks, owners, ratings, treatments and status
  2. Only public marketing slogans
  3. Only employee phone numbers
  4. Only software logos
Show Answer

Correct Answer: A. Identified risks, owners, ratings, treatments and status

Question 280Risk Assessment & Cybercrime

Q280. Residual risk is:

  1. Risk before any analysis
  2. Risk remaining after controls are applied
  3. A type of encryption algorithm
  4. Risk that never needs approval
Show Answer

Correct Answer: B. Risk remaining after controls are applied

Topic 15

Privacy, Anonymity, Cyber Law & Ethics

Back to top ↑
Question 281Privacy, Anonymity, Cyber Law & Ethics

Q281. Information privacy is mainly about:

  1. Responsible collection, use, sharing and protection of personal data
  2. Removing all user rights
  3. Deleting every backup
  4. Making all data public
Show Answer

Correct Answer: A. Responsible collection, use, sharing and protection of personal data

Question 282Privacy, Anonymity, Cyber Law & Ethics

Q282. Personal data is information that can:

  1. Identify or relate to an individual
  2. Only show a firewall port
  3. Only describe a network cable
  4. Only list public holidays
Show Answer

Correct Answer: A. Identify or relate to an individual

Question 283Privacy, Anonymity, Cyber Law & Ethics

Q283. Data minimization means:

  1. Never deleting old data
  2. Sharing data with everyone
  3. Collecting everything possible forever
  4. Collecting only the personal data that is necessary
Show Answer

Correct Answer: D. Collecting only the personal data that is necessary

Question 284Privacy, Anonymity, Cyber Law & Ethics

Q284. Purpose limitation means data should be used:

  1. Only for the stated and legitimate purpose
  2. Only by attackers
  3. For any new purpose without notice
  4. Only after it is leaked
Show Answer

Correct Answer: A. Only for the stated and legitimate purpose

Question 285Privacy, Anonymity, Cyber Law & Ethics

Q285. Consent in privacy should be:

  1. Assumed for every activity
  2. Ignored after collection
  3. Hidden in confusing language
  4. Informed, clear and freely given where required
Show Answer

Correct Answer: D. Informed, clear and freely given where required

Question 286Privacy, Anonymity, Cyber Law & Ethics

Q286. Anonymization aims to:

  1. Reveal private keys
  2. Remove identifying information so a person cannot reasonably be identified
  3. Add more names to data
  4. Increase unnecessary data
Show Answer

Correct Answer: B. Remove identifying information so a person cannot reasonably be identified

Question 287Privacy, Anonymity, Cyber Law & Ethics

Q287. Pseudonymization replaces identifiers with:

  1. Aliases or codes while keeping possible re-linking under control
  2. Plain names only
  3. Firewall ports
  4. Public passwords
Show Answer

Correct Answer: A. Aliases or codes while keeping possible re-linking under control

Question 288Privacy, Anonymity, Cyber Law & Ethics

Q288. Re-identification risk means:

  1. Anonymous-looking data may be linked back to a person
  2. Data can never identify anyone
  3. All encryption is broken
  4. Backups are unnecessary
Show Answer

Correct Answer: A. Anonymous-looking data may be linked back to a person

Question 289Privacy, Anonymity, Cyber Law & Ethics

Q289. Encryption supports privacy by:

  1. Removing legal duties
  2. Making data collection unlimited
  3. Allowing all tracking
  4. Protecting personal data from unauthorized reading
Show Answer

Correct Answer: D. Protecting personal data from unauthorized reading

Question 290Privacy, Anonymity, Cyber Law & Ethics

Q290. Access logging supports accountability by:

  1. Recording who accessed data and when
  2. Removing user responsibility
  3. Publishing private data
  4. Making access invisible
Show Answer

Correct Answer: A. Recording who accessed data and when

Question 291Privacy, Anonymity, Cyber Law & Ethics

Q291. Ethics in information security requires:

  1. Using skills to harm others
  2. Ignoring confidentiality
  3. Acting responsibly, legally and with respect for rights
  4. Bypassing permission
Show Answer

Correct Answer: C. Acting responsibly, legally and with respect for rights

Question 292Privacy, Anonymity, Cyber Law & Ethics

Q292. Responsible disclosure means:

  1. Ignoring serious flaws
  2. Reporting vulnerabilities through an appropriate process so they can be fixed
  3. Selling stolen data
  4. Publishing exploit details immediately without notice
Show Answer

Correct Answer: B. Reporting vulnerabilities through an appropriate process so they can be fixed

Question 293Privacy, Anonymity, Cyber Law & Ethics

Q293. Computer misuse laws commonly prohibit:

  1. Approved system administration
  2. Unauthorized access, interference and data misuse
  3. Encrypting personal devices
  4. Using strong passwords
Show Answer

Correct Answer: B. Unauthorized access, interference and data misuse

Question 294Privacy, Anonymity, Cyber Law & Ethics

Q294. Intellectual property issues include:

  1. Secure backups only
  2. User awareness training
  3. Unauthorized copying, software piracy and misuse of protected content
  4. Firewall configuration
Show Answer

Correct Answer: C. Unauthorized copying, software piracy and misuse of protected content

Question 295Privacy, Anonymity, Cyber Law & Ethics

Q295. A professional code of conduct guides:

  1. Only screen resolution
  2. Only office seating
  3. Only logo placement
  4. Ethical behavior and responsibilities of practitioners
Show Answer

Correct Answer: D. Ethical behavior and responsibilities of practitioners

Question 296Privacy, Anonymity, Cyber Law & Ethics

Q296. A conflict of interest occurs when:

  1. Personal interests may improperly influence professional duties
  2. A password is strong
  3. A database is encrypted
  4. A system is patched
Show Answer

Correct Answer: A. Personal interests may improperly influence professional duties

Question 297Privacy, Anonymity, Cyber Law & Ethics

Q297. Due care in information security means:

  1. Taking reasonable steps to protect systems and data
  2. Avoiding documentation
  3. Ignoring known risks
  4. Sharing credentials
Show Answer

Correct Answer: A. Taking reasonable steps to protect systems and data

Question 298Privacy, Anonymity, Cyber Law & Ethics

Q298. A confidentiality agreement helps:

  1. Remove every legal responsibility
  2. Make all secrets public
  3. Protect sensitive information shared with employees or partners
  4. Disable access control
Show Answer

Correct Answer: C. Protect sensitive information shared with employees or partners

Question 299Privacy, Anonymity, Cyber Law & Ethics

Q299. Digital forensics should be conducted:

  1. Without documentation
  2. Lawfully, ethically and with evidence integrity
  3. Only for entertainment
  4. By altering evidence freely
Show Answer

Correct Answer: B. Lawfully, ethically and with evidence integrity

Question 300Privacy, Anonymity, Cyber Law & Ethics

Q300. Balancing security and privacy means:

  1. Removing all monitoring even when required
  2. Publishing personal records for convenience
  3. Protecting systems while respecting personal data and user rights
  4. Collecting unlimited data because security exists
Show Answer

Correct Answer: C. Protecting systems while respecting personal data and user rights

Contact ElecturesAI

For updates, notes and exam-preparation material, join our WhatsApp channel or contact us directly.

WhatsApp Channel: https://whatsapp.com/channel/0029VbCBele72WU5CJvllA0p
WhatsApp: +971562492274
Email: Electuresai@gmail.com

WhatsApp
© ElecturesAI — Information Security MCQs with Answers

Biodiversity and Conservation MCQs with Answers