EC-Council Certified Secure Computer User Exam — Questions and Answers

Question 1: What role does a sandbox play in malware analysis?

It blocks all internet access to prevent malware communication
It permanently quarantines infected files
It provides an isolated virtual environment where suspicious code can be safely executed and observed without risking the host system (Correct answer)
It encrypts all files to prevent malware infection

Correct answer: It provides an isolated virtual environment where suspicious code can be safely executed and observed without risking the host system

A sandbox is a controlled, isolated environment where potentially malicious software can be safely executed and its behavior observed without any risk to the actual system or network.

Question 2: An employee receives an email that appears to be from a known supplier with an invoice attached. However, they notice the sender's domain is 'supp1ier.com' instead of the usual 'supplier.com'. This is a classic indicator of what type of attack?

Man-in-the-Middle (MitM)
Denial-of-Service (DoS)
SQL Injection
Typosquatting (Correct answer)

Correct answer: Typosquatting

Typosquatting, also known as URL hijacking, is a form of social engineering where attackers register domain names with slight variations or misspellings of legitimate domains. They use these domains to send phishing emails, hoping recipients won't notice the small difference and will trust the fraudulent message.

Question 3: What type of malware specifically targets backup files to prevent data recovery?

Ransomware (Correct answer)
Adware
Spyware
Browser hijackers

Correct answer: Ransomware

Modern ransomware variants specifically seek out and encrypt or delete backup files to prevent victims from recovering their data without paying the ransom.

Question 4: What is social media account hijacking?

Deactivating your own social media account
Creating a new social media account
Unauthorized access and takeover of someone's social media account, typically through stolen credentials or session tokens (Correct answer)
Sharing someone else's social media posts

Correct answer: Unauthorized access and takeover of someone's social media account, typically through stolen credentials or session tokens

Account hijacking occurs when an attacker gains unauthorized access to a social media account through phishing, credential stuffing, session theft, or exploiting security vulnerabilities.

Question 5: What is the key difference between encoding and encryption?

Encryption requires a network connection but encoding does not
Encoding uses much longer keys than encryption
Encoding is reversible without a key; encryption requires a secret key to reverse (Correct answer)
Encoding is always more secure than encryption

Correct answer: Encoding is reversible without a key; encryption requires a secret key to reverse

Encoding transforms data using a publicly known scheme with no secret key required to reverse it, while encryption requires a secret key to decrypt.

Question 6: A user has several IoT devices, such as smart light bulbs and a smart thermostat, on their home network. To minimize the potential damage if one of these devices is compromised, which of the following is the BEST network security practice?

Connecting all IoT devices using Ethernet cables instead of Wi-Fi.
Placing all IoT devices on a separate, isolated network segment. (Correct answer)
Disabling the firewall on the main router to improve device communication.
Assigning static IP addresses to each IoT device.

Correct answer: Placing all IoT devices on a separate, isolated network segment.

Network segmentation is a critical security practice for IoT devices. By placing them on a separate network (like a guest Wi-Fi network or a VLAN), you isolate them from your primary computers and data. If an IoT device is compromised, the attacker's access is contained within that segment, preventing them from easily accessing more sensitive systems on the main network.

Question 7: Which of the following is a primary security advantage of using a major cloud service provider for data storage compared to storing files solely on a personal external hard drive?

It provides professional security management and geographic data redundancy. (Correct answer)
It eliminates the need for the user to have a strong password.
It guarantees that the user will never accidentally delete a file.
It prevents the user's account from being targeted by phishing attacks.

Correct answer: It provides professional security management and geographic data redundancy.

Major cloud providers employ teams of security experts and operate highly secure, geographically dispersed data centers. This provides a level of data redundancy (protection against data loss from a single event like a fire or hardware failure) and professional security management that is difficult for an individual to achieve with a local storage device.

Question 8: Which data backup strategy involves copying only the data that has changed since the last backup of any type, resulting in the smallest backup sizes and fastest backup times?

Cloud-to-cloud backup
Incremental backup (Correct answer)
Full backup
Differential backup

Correct answer: Incremental backup

An incremental backup only copies data that has changed since the last backup, whether it was a full or another incremental backup. This makes the individual backup files smaller and the process faster compared to full or differential backups.

Question 9: What is RSA primarily used for in cryptography?

Asymmetric encryption and digital signatures (Correct answer)
Scanning networks for vulnerabilities
Creating strong cryptographic hash values
Compressing files for storage efficiency

Correct answer: Asymmetric encryption and digital signatures

RSA is an asymmetric cryptographic algorithm used for secure data transmission and creating digital signatures.

Question 10: What security vulnerability is associated with default credentials on IoT devices?

Attackers can easily access devices using widely known factory-default usernames and passwords (Correct answer)
Default credentials prevent firmware updates
Default credentials use too much storage space
Default credentials make devices run slower

Correct answer: Attackers can easily access devices using widely known factory-default usernames and passwords

Many IoT devices ship with common default credentials (like admin/admin) that are publicly documented and easily exploited if users do not change them during setup.

Question 11: What is synthetic identity theft?

Creating a new fictitious identity by combining real and fabricated personal information (Correct answer)
Copying someone's physical appearance
Using artificial intelligence to impersonate someone online
Stealing someone's identity using synthetic materials

Correct answer: Creating a new fictitious identity by combining real and fabricated personal information

Synthetic identity theft involves combining real data elements (like a legitimate Social Security number) with fake information (name, date of birth) to create an entirely new, fictitious identity for fraud.

Question 12: What is the most critical reason for regularly testing your data backups?

To delete old, unnecessary backup files.
To check the speed of the internet connection.
To verify that the data can be successfully restored. (Correct answer)
To ensure the backup software license is still valid.

Correct answer: To verify that the data can be successfully restored.

The primary purpose of testing backups is to ensure their integrity and confirm that the data is recoverable in a real data loss scenario. A backup is useless if it is corrupted or incomplete and cannot be restored successfully.

Question 13: What is 'password reuse' and why is it dangerous?

Using the same password across multiple accounts; a breach on one site exposes all others (Correct answer)
Creating passwords from personal information; it's easy to guess
Changing a password back to a previous one; it's a minor convenience issue
Writing passwords on paper; they can be physically stolen

Correct answer: Using the same password across multiple accounts; a breach on one site exposes all others

Password reuse means one compromised site can give attackers access to every other account that shares that password.

Question 14: What is 'dumpster diving' in the context of information security?

Accessing deleted files through file recovery software
An attack that floods a network with garbage data
Scanning the dark web for leaked credentials
Searching through discarded materials to find sensitive information (Correct answer)

Correct answer: Searching through discarded materials to find sensitive information

Dumpster diving involves physically searching through trash or recycling bins to find discarded documents, devices, or media containing sensitive information.

Question 15: A type of malware is discovered that encrypts all the files on a user's hard drive and then displays a message demanding payment in cryptocurrency to restore access. This is characteristic of which malware category?

Worm
Ransomware (Correct answer)
Rootkit
Spyware

Correct answer: Ransomware

Ransomware is a malicious software designed to block access to a computer system or its data, typically by encryption, until a sum of money (a ransom) is paid. The scenario described, involving file encryption and a demand for payment, is a textbook example of a ransomware attack.

Question 16: What is the main benefit of using automated backup solutions?

Limited backup frequency
Increased manual work
Higher costs
Reduced risk of human error and ensures regular backups (Correct answer)

Correct answer: Reduced risk of human error and ensures regular backups

Automated backup solutions help ensure that backups are performed regularly and correctly, reducing the risk of human error.

Question 17: What should you do if you receive a suspicious email attachment?

Forward it to your entire contact list
Save it to your desktop for later review
Delete the email immediately without opening the attachment (Correct answer)
Open it to see if it's important

Correct answer: Delete the email immediately without opening the attachment

Opening a suspicious email attachment can lead to malware infection. It's safer to delete it.

Question 18: What is the security benefit of network segmentation for IoT devices?

It reduces the number of IoT devices on the network
It makes IoT devices faster
It isolates IoT devices on a separate network segment, limiting an attacker's ability to reach critical systems if an IoT device is compromised (Correct answer)
It eliminates the need for IoT device passwords

Correct answer: It isolates IoT devices on a separate network segment, limiting an attacker's ability to reach critical systems if an IoT device is compromised

Network segmentation places IoT devices on a separate network, so if an IoT device is compromised, the attacker cannot easily access computers, servers, and sensitive data on the main network.

Question 19: Why should you be cautious about clicking links in emails, even from known contacts?

The sender's email account may have been compromised and used to send malicious links (Correct answer)
Clicking links uses excessive internet bandwidth
Email links expire after 24 hours
Links in emails always contain viruses

Correct answer: The sender's email account may have been compromised and used to send malicious links

Even emails from known contacts can contain malicious links if the sender's account has been hacked, making it important to verify unexpected links before clicking.

Question 20: What is a supply chain attack in the context of malware distribution?

Stealing products during shipping
Attacking a company's physical supply warehouse
Compromising legitimate software updates or development tools to distribute malware to a wide base of trusting users (Correct answer)
Infecting a single computer in an office

Correct answer: Compromising legitimate software updates or development tools to distribute malware to a wide base of trusting users

Supply chain attacks compromise trusted software vendors, update mechanisms, or development tools to inject malware into legitimate software, affecting all users who install the compromised update.

Question 21: Which type of attack attempts to break encryption by systematically trying every possible key combination?

Phishing attack
SQL injection attack
Brute force attack (Correct answer)
Social engineering attack

Correct answer: Brute force attack

A brute force attack exhaustively tries every possible key or password combination until the correct one is found, which is why longer keys are more secure.

Question 22: What is a backup retention policy?

A policy that limits the number of files that can be backed up
A rule about who can create backups
A policy that determines how fast backups are created
A defined schedule that specifies how long different backup copies are kept before being deleted or overwritten (Correct answer)

Correct answer: A defined schedule that specifies how long different backup copies are kept before being deleted or overwritten

A backup retention policy defines how long backup copies are maintained, balancing the need for historical data recovery against storage costs and compliance requirements.

Question 23: What is 'shoulder surfing' in information security?

Remotely accessing a computer without permission
A type of phishing email attack
Observing someone's screen or keyboard to steal information (Correct answer)
A technique for bypassing firewall rules

Correct answer: Observing someone's screen or keyboard to steal information

Shoulder surfing involves physically watching someone enter sensitive information such as passwords or PINs.

Question 24: A user follows the '3-2-1 rule' for their critical photos. They have the original files on their laptop, a copy on an external hard drive stored in their desk, and another copy uploaded to a cloud storage service. Which part of the rule does the cloud storage service primarily fulfill?

Storing copies on two different media
Creating a RAID array
Keeping three copies of the data
Maintaining one off-site copy (Correct answer)

Correct answer: Maintaining one off-site copy

The 3-2-1 backup rule recommends having three copies of your data on two different types of media, with one copy stored off-site. The cloud storage service acts as the off-site copy, protecting the data from local disasters like fire, flood, or theft that could destroy both the laptop and the local external hard drive.

Question 25: What is a man-in-the-middle attack on a mobile device?

A person reading someone's screen over their shoulder
An attacker intercepting communications between the mobile device and a server by positioning themselves in the network path (Correct answer)
Blocking cellular signal to prevent phone calls
Physically stealing a phone from someone's hand

Correct answer: An attacker intercepting communications between the mobile device and a server by positioning themselves in the network path

In a mobile MITM attack, an attacker intercepts the communication between a device and a network service—often through rogue Wi-Fi access points—to steal data or inject malicious content.

Question 26: What is a polymorphic virus?

A virus that changes its code each time it replicates to evade signature-based detection (Correct answer)
A virus that causes multiple types of damage simultaneously
A virus that only infects multiple types of files
A virus that can run on multiple operating systems

Correct answer: A virus that changes its code each time it replicates to evade signature-based detection

Polymorphic viruses mutate their code with each replication cycle, producing functionally identical but code-different variants that evade detection by static signature matching.

Question 27: A network administrator wants to implement a security measure that restricts network access to only devices with specific hardware addresses. Which of the following should be configured?

Port Forwarding
VPN Tunneling
MAC Filtering (Correct answer)
SSID Cloaking

Correct answer: MAC Filtering

MAC (Media Access Control) filtering is a security method that allows or denies network access to devices based on their unique MAC address. The administrator can create a list of approved MAC addresses (a whitelist) to ensure only authorized devices can connect.

Question 28: What precaution should be taken when sending sensitive information via email?

Send the email to multiple recipients for redundancy
Mark the email as high priority
Add a confidentiality disclaimer in the email footer
Use end-to-end encryption or send sensitive data through a secure file-sharing platform instead (Correct answer)

Correct answer: Use end-to-end encryption or send sensitive data through a secure file-sharing platform instead

Sensitive information should be protected with end-to-end encryption or shared through a secure platform, as standard email provides limited security for confidential data.

Question 29: What is the risk of leaving a computer unattended and logged in at work?

The computer may overheat
Software updates may install without permission
An unauthorized person can access your files, email, and applications using your identity (Correct answer)
The screensaver may reveal your desktop wallpaper

Correct answer: An unauthorized person can access your files, email, and applications using your identity

An unattended logged-in computer allows anyone with physical access to act under your credentials, potentially causing data breaches or unauthorized changes.

Question 30: An employee brings a personal wireless router from home and connects it to the company's network to get a better signal in their office. This unauthorized device is BEST described as a:

Honeypot
Rogue Access Point (Correct answer)
Evil Twin
DMZ

Correct answer: Rogue Access Point

A rogue access point is any wireless access point that has been installed on a secure network without explicit authorization from a local network administrator. This creates a significant security vulnerability because it bypasses the company's network security controls.

Question 31: What is full disk encryption (FDE)?

Encrypting data only when it is transferred over a network
Encrypting all data on a storage drive, including the OS and user files (Correct answer)
Encrypting only specific folders selected by the user
Encrypting only the operating system files on a drive

Correct answer: Encrypting all data on a storage drive, including the OS and user files

Full disk encryption encrypts the entire contents of a storage device, protecting all data including the operating system from unauthorized access.

Question 32: What is application sandboxing in operating systems?

Allowing applications to access all system resources freely
Installing applications in a compressed format
Running applications in a beach-themed interface
Isolating applications in a restricted environment that limits their access to system resources and other applications' data (Correct answer)

Correct answer: Isolating applications in a restricted environment that limits their access to system resources and other applications' data

Sandboxing confines applications within restricted environments that limit their access to files, system resources, and other programs, containing potential damage if an application is compromised.

Question 33: What is the primary security risk of authorizing third-party applications, such as games or quizzes, to access your social media account?

They will automatically post spam messages on your profile.
They can significantly slow down your computer's performance.
They can expose your personal data and your friends' data to be harvested or misused. (Correct answer)
They will cause your social media account to be suspended.

Correct answer: They can expose your personal data and your friends' data to be harvested or misused.

Third-party apps often request extensive permissions to access profile information, friend lists, and other personal data. If the app developer has poor security practices or malicious intent, this data can be collected, sold, or exposed in a breach, compromising the privacy of both you and your connections.

Question 34: What is full disk encryption and why is it recommended for operating system security?

Formatting the hard drive to remove old files
Compressing all files on the disk to save space
Partitioning the drive into multiple sections
Encrypting the entire contents of a storage drive so data is unreadable without the proper authentication credentials (Correct answer)

Correct answer: Encrypting the entire contents of a storage drive so data is unreadable without the proper authentication credentials

Full disk encryption protects all data on the drive by encrypting it, ensuring that if the device is lost, stolen, or the drive is removed, the data remains unreadable without proper authentication.

Question 35: Which encryption method protects data while it is being transferred to a cloud service?

Encryption in transit (Correct answer)
Full disk encryption
Database-level encryption
Encryption at rest

Correct answer: Encryption in transit

Encryption in transit protects data as it moves between the user's device and the cloud service, typically using protocols like TLS/SSL to prevent interception.

Question 36: What is secure boot and what threat does it protect against?

A feature that makes the computer start up faster
A firmware-level security mechanism that ensures only trusted, digitally signed software loads during the boot process, preventing bootkit malware (Correct answer)
A power-saving feature for laptops
A method for encrypting files during startup

Correct answer: A firmware-level security mechanism that ensures only trusted, digitally signed software loads during the boot process, preventing bootkit malware

Secure Boot verifies the digital signatures of all software components loaded during startup (bootloader, drivers, OS kernel), preventing rootkits and bootkits from compromising the system before the OS loads.

Question 37: What is business email compromise (BEC)?

When employees use personal email for work purposes
A targeted scam where attackers impersonate executives or business partners to trick employees into transferring money or sensitive data (Correct answer)
When a company's email server runs out of storage space
A technical failure in the email delivery system

Correct answer: A targeted scam where attackers impersonate executives or business partners to trick employees into transferring money or sensitive data

BEC is a sophisticated scam where criminals impersonate company executives, business partners, or vendors through email to trick employees into making wire transfers or revealing confidential information.

Question 38: Why is it important to keep your web browser updated?

Updated browsers have better visual themes
Updated browsers download files faster
Browser updates fix security vulnerabilities that attackers actively exploit to compromise systems (Correct answer)
Browser updates add more bookmark storage

Correct answer: Browser updates fix security vulnerabilities that attackers actively exploit to compromise systems

Browser updates patch security vulnerabilities that attackers exploit through malicious websites, drive-by downloads, and other web-based attacks, making updates critical for safe browsing.

Question 39: What does the term "firewall" refer to in computer security?

A backup solution for critical data
Software or hardware that filters incoming and outgoing network traffic (Correct answer)
A physical barrier to protect a server room
A security update for the operating system

Correct answer: Software or hardware that filters incoming and outgoing network traffic

A firewall is a security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules.

Question 40: What security risk is associated with outdated firmware on IoT devices?

Outdated firmware uses more electricity
Unpatched vulnerabilities in old firmware can be exploited by attackers to compromise the device and potentially the entire network (Correct answer)
Outdated firmware prevents the device from connecting to Wi-Fi
Outdated firmware makes devices physically heavier

Correct answer: Unpatched vulnerabilities in old firmware can be exploited by attackers to compromise the device and potentially the entire network

IoT devices running outdated firmware contain known, unpatched vulnerabilities that attackers can exploit to gain unauthorized access, compromising both the device and the broader network.

Question 41: Which of the following technologies is specifically designed to provide end-to-end encryption for the content of an email, ensuring only the intended recipient can read it?

PGP (Pretty Good Privacy) (Correct answer)
SSL/TLS
WPA3
MAC Filtering

Correct answer: PGP (Pretty Good Privacy)

PGP (and its open-source standard OpenPGP) is a widely used protocol for encrypting the content of emails end-to-end. While SSL/TLS encrypts the connection between your email client and the server, it does not protect the email content at rest on the server or after it's delivered. WPA3 is for Wi-Fi security, and MAC filtering is a network access control method.

Question 42: What type of cloud attack involves intercepting data transmitted between the user and the cloud service?

Brute force attack
SQL injection attack
Denial of Service attack
Man-in-the-middle attack (Correct answer)

Correct answer: Man-in-the-middle attack

A man-in-the-middle (MITM) attack intercepts communications between a user and a cloud service, allowing the attacker to eavesdrop on or alter the data being transmitted.

Question 43: What is a rootkit and why is it particularly dangerous?

A legitimate system administration utility
Malware that hides deep within the operating system to conceal its presence and the presence of other malware (Correct answer)
A tool for managing root access on Linux systems
A type of firewall configuration tool

Correct answer: Malware that hides deep within the operating system to conceal its presence and the presence of other malware

A rootkit embeds itself deep in the operating system—sometimes at the kernel level—to hide malicious activity from security software and users, making detection and removal extremely difficult.

Question 44: What is the purpose of a fraud alert on your credit report?

It automatically rejects all credit applications
It locks your bank account from all transactions
It notifies creditors to take extra steps to verify your identity before approving new credit applications (Correct answer)
It sends you a daily credit score update

Correct answer: It notifies creditors to take extra steps to verify your identity before approving new credit applications

A fraud alert flags your credit report to warn creditors that they should verify the applicant's identity through additional steps before opening new credit accounts.

Question 45: What is a strong password?

A password with a mix of upper and lower case letters, numbers, and special characters (Correct answer)
A password that is easy to remember, like "password123"
A password that is the same for all your accounts
A password that includes your name and birthdate

Correct answer: A password with a mix of upper and lower case letters, numbers, and special characters

A strong password is complex and includes a combination of letters, numbers, and symbols to enhance security.

Question 46: What is a Group Policy and how does it enhance operating system security in enterprise environments?

A method for sharing files between group members
A team collaboration tool
A Windows mechanism that allows administrators to centrally define and enforce security settings across all computers in a domain (Correct answer)
A social media policy for employees

Correct answer: A Windows mechanism that allows administrators to centrally define and enforce security settings across all computers in a domain

Group Policy in Windows Active Directory environments allows administrators to centrally define and enforce security configurations—password policies, software restrictions, firewall rules—across all domain-joined computers.

Question 47: When sending a newsletter to a large group of external contacts, what is the primary privacy benefit of using the Blind Carbon Copy (Bcc) field?

It encrypts the email content for Bcc recipients.
It prevents recipients from seeing each other's email addresses. (Correct answer)
It reduces the size of the email header.
It guarantees the email will bypass spam filters.

Correct answer: It prevents recipients from seeing each other's email addresses.

The Bcc field hides the recipient list from view. When you place email addresses in the Bcc field, those addresses are invisible to everyone else who receives the message, thereby protecting the privacy of your contacts.

Question 48: A user is considering installing a new browser extension that offers to organize their tabs. During installation, it requests permission to 'Read and change all your data on the websites you visit.' Why should this be a cause for concern?

It will prevent other, more important extensions from working correctly.
Such permissions will dramatically slow down the user's internet connection speed.
The extension will likely cause the browser to crash frequently.
This permission level is excessive and could be abused to steal login credentials, monitor activity, or inject malicious scripts. (Correct answer)

Correct answer: This permission level is excessive and could be abused to steal login credentials, monitor activity, or inject malicious scripts.

Requesting excessive permissions is a major security red flag for browser extensions. An extension with the ability to read and change all data on websites can potentially capture sensitive information like passwords and financial details, track all browsing activity, or inject malicious code into legitimate websites without the user's knowledge.

Question 49: How does ransomware-as-a-service (RaaS) operate?

Cloud-based antivirus solutions
Legitimate companies offering ransomware protection services
Criminal developers create and lease ransomware tools to affiliates who carry out attacks, sharing the ransom profits (Correct answer)
Government agencies tracking ransomware groups

Correct answer: Criminal developers create and lease ransomware tools to affiliates who carry out attacks, sharing the ransom profits

RaaS is a criminal business model where ransomware developers create the malware and infrastructure, then recruit affiliates to deploy the ransomware, splitting the ransom payments.

Question 50: What is data residency in the context of cloud computing?

The backup frequency of cloud data
The amount of storage space allocated to a user
The speed at which data is stored in the cloud
The physical or geographic location where data is stored and processed (Correct answer)

Correct answer: The physical or geographic location where data is stored and processed

Data residency refers to the geographic location where data is physically stored and processed, which has important implications for regulatory compliance and data sovereignty laws.

Question 51: Which cloud deployment model provides dedicated infrastructure for a single organization?

Community cloud
Public cloud
Private cloud (Correct answer)
Hybrid cloud

Correct answer: Private cloud

A private cloud is dedicated to a single organization, providing greater control over security, compliance, and customization of the infrastructure.

EC-Council Certified Secure Computer User Exam

The CSCU (112-12) exam validates knowledge of secure computing practices including network security, data protection, cloud security, mobile device security, and safe internet usage for end users.

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds