EC-Council Certified Secure Computer User Exam — Questions and Answers

Question 1: Which type of attack attempts to break encryption by systematically trying every possible key combination?

Phishing attack
SQL injection attack
Social engineering attack
Brute force attack (Correct answer)

Correct answer: Brute force attack

A brute force attack exhaustively tries every possible key or password combination until the correct one is found, which is why longer keys are more secure.

Question 2: Why is it important to disable unnecessary features and services on mobile devices?

Each enabled feature is a potential attack vector that increases the device's attack surface (Correct answer)
Disabling features frees up storage space
Disabled features make the device lighter
It prevents the device from overheating

Correct answer: Each enabled feature is a potential attack vector that increases the device's attack surface

Every enabled feature, service, or connectivity option (Wi-Fi, Bluetooth, NFC, location services) represents a potential attack vector. Disabling unused features reduces the device's attack surface.

Question 3: What is the purpose of a browser's private or incognito mode?

It blocks all advertisements and trackers
It makes you completely anonymous on the internet
It encrypts all internet traffic
It prevents the browser from saving local browsing history, cookies, and form data from the session (Correct answer)

Correct answer: It prevents the browser from saving local browsing history, cookies, and form data from the session

Private/incognito mode prevents the browser from saving browsing history, cookies, site data, and form entries locally after the session ends, but does not make browsing anonymous to websites, ISPs, or network administrators.

Question 4: What is the primary purpose of antivirus software?

To prevent unauthorized access to data
To detect and remove malicious software (Correct answer)
To speed up your computer
To create backups of your files

Correct answer: To detect and remove malicious software

Antivirus software is designed to detect, prevent, and remove viruses and other malicious software from your computer.

Question 5: What is the primary security concern when using public cloud storage services for sensitive business documents?

Data may be accessed by unauthorized parties if not properly encrypted (Correct answer)
Slow upload speeds
Cloud storage has limited capacity
Files cannot be organized into folders

Correct answer: Data may be accessed by unauthorized parties if not properly encrypted

Public cloud storage can expose sensitive data if proper encryption and access controls are not implemented, as data travels through and resides on third-party infrastructure.

Question 6: What security risk is associated with outdated firmware on IoT devices?

Unpatched vulnerabilities in old firmware can be exploited by attackers to compromise the device and potentially the entire network (Correct answer)
Outdated firmware makes devices physically heavier
Outdated firmware prevents the device from connecting to Wi-Fi
Outdated firmware uses more electricity

Correct answer: Unpatched vulnerabilities in old firmware can be exploited by attackers to compromise the device and potentially the entire network

IoT devices running outdated firmware contain known, unpatched vulnerabilities that attackers can exploit to gain unauthorized access, compromising both the device and the broader network.

Question 7: When sending a newsletter to a large group of external contacts, what is the primary privacy benefit of using the Blind Carbon Copy (Bcc) field?

It encrypts the email content for Bcc recipients.
It guarantees the email will bypass spam filters.
It prevents recipients from seeing each other's email addresses. (Correct answer)
It reduces the size of the email header.

Correct answer: It prevents recipients from seeing each other's email addresses.

The Bcc field hides the recipient list from view. When you place email addresses in the Bcc field, those addresses are invisible to everyone else who receives the message, thereby protecting the privacy of your contacts.

Question 8: What is the purpose of a digital signature in email?

To add a decorative signature block at the end of an email
To compress email attachments
To automatically reply to incoming emails
To verify the identity of the sender and ensure the message has not been altered (Correct answer)

Correct answer: To verify the identity of the sender and ensure the message has not been altered

A digital signature uses cryptographic techniques to verify the sender's identity and confirm that the email content has not been modified during transit.

Question 9: What is the primary security risk of authorizing third-party applications, such as games or quizzes, to access your social media account?

They will automatically post spam messages on your profile.
They can significantly slow down your computer's performance.
They can expose your personal data and your friends' data to be harvested or misused. (Correct answer)
They will cause your social media account to be suspended.

Correct answer: They can expose your personal data and your friends' data to be harvested or misused.

Third-party apps often request extensive permissions to access profile information, friend lists, and other personal data. If the app developer has poor security practices or malicious intent, this data can be collected, sold, or exposed in a breach, compromising the privacy of both you and your connections.

Question 10: What does the shared responsibility model in cloud computing define?

The division of security obligations between the cloud provider and the customer (Correct answer)
The process of sharing data between cloud regions
How bandwidth is shared among cloud users
How cloud costs are split between departments

Correct answer: The division of security obligations between the cloud provider and the customer

The shared responsibility model clarifies which security tasks the cloud provider handles (such as physical security and infrastructure) and which the customer must manage (such as data encryption and access controls).

Question 11: What distinguishes a worm from a virus in terms of propagation?

Worms only infect Mac computers while viruses target Windows
Worms are less harmful than viruses
Worms can self-replicate and spread across networks without user interaction, while viruses require a host file and user action to spread (Correct answer)
Worms can only spread through email while viruses spread through USB drives

Correct answer: Worms can self-replicate and spread across networks without user interaction, while viruses require a host file and user action to spread

Unlike viruses that attach to files and require user action to spread, worms are self-replicating malware that can propagate automatically across networks by exploiting vulnerabilities.

Question 12: What is a supply chain attack in the context of malware distribution?

Infecting a single computer in an office
Compromising legitimate software updates or development tools to distribute malware to a wide base of trusting users (Correct answer)
Attacking a company's physical supply warehouse
Stealing products during shipping

Correct answer: Compromising legitimate software updates or development tools to distribute malware to a wide base of trusting users

Supply chain attacks compromise trusted software vendors, update mechanisms, or development tools to inject malware into legitimate software, affecting all users who install the compromised update.

Question 13: You receive an unsolicited email with a generic greeting like 'Dear Customer' that urges you to click a link to 'verify your account details immediately' due to a security alert. This is a common tactic used in which type of attack?

A zero-day exploit
A drive-by download
A phishing attack (Correct answer)
A brute-force attack

Correct answer: A phishing attack

Phishing attacks often use social engineering tactics such as a sense of urgency, generic greetings, and requests to verify account information by clicking a malicious link. The goal is to trick the recipient into divulging sensitive credentials or personal data on a fake website.

Question 14: According to the shared responsibility model for cloud security, which of the following is almost always the user's responsibility, regardless of the service model (IaaS, PaaS, or SaaS)?

Securing and managing their own data and access credentials (Correct answer)
Configuring the physical firewall of the data center
Maintaining the virtualization software (hypervisor)
Patching the server's operating system

Correct answer: Securing and managing their own data and access credentials

In all major cloud service models, the customer (user) is responsible for protecting their own data, including classifying it and managing who has access. They are also responsible for managing their own user credentials, such as passwords and multi-factor authentication. The cloud provider is responsible for the security *of* the cloud, while the customer is responsible for security *in* the cloud.

Question 15: What is an IoT botnet and how are such botnets typically formed?

An IoT device manufacturer's testing network
A group of people who review IoT products online
A network of compromised IoT devices controlled by an attacker, typically formed by exploiting default credentials and unpatched vulnerabilities (Correct answer)
A legitimate network of IoT devices in a smart home

Correct answer: A network of compromised IoT devices controlled by an attacker, typically formed by exploiting default credentials and unpatched vulnerabilities

IoT botnets consist of large numbers of compromised IoT devices (cameras, routers, smart appliances) that have been infected with malware and can be centrally controlled to launch attacks like DDoS.

Question 16: What is a host-based firewall and how does it differ from a network firewall?

A host-based firewall runs on individual computers to filter traffic for that specific device, while a network firewall protects an entire network at its boundary (Correct answer)
There is no difference between host-based and network firewalls
A host-based firewall only blocks outgoing traffic
A host-based firewall is faster than a network firewall

Correct answer: A host-based firewall runs on individual computers to filter traffic for that specific device, while a network firewall protects an entire network at its boundary

A host-based firewall runs on a single computer and controls incoming and outgoing network traffic for that specific device, providing protection even when the device is outside the network firewall's perimeter.

Question 17: How does a credit freeze help protect against identity theft?

It freezes all funds in your bank account
It restricts access to your credit report, preventing new accounts from being opened in your name (Correct answer)
It stops all credit card transactions temporarily
It prevents you from using your existing credit cards

Correct answer: It restricts access to your credit report, preventing new accounts from being opened in your name

A credit freeze restricts access to your credit report, making it impossible for identity thieves to open new credit accounts in your name since creditors cannot check your credit history.

Question 18: A business determines that it cannot afford to lose more than 4 hours of transaction data in the event of a server failure. This 4-hour tolerance for data loss is known as the:

Recovery Time Objective (RTO)
Service Level Agreement (SLA)
Recovery Point Objective (RPO) (Correct answer)
Mean Time To Recovery (MTTR)

Correct answer: Recovery Point Objective (RPO)

The Recovery Point Objective (RPO) refers to the maximum acceptable amount of data loss an organization can tolerate, measured in time. It dictates the minimum frequency for backups. The RTO, on the other hand, is about how quickly the system must be restored to operational status.

Question 19: An individual in a crowded public area suddenly receives an unsolicited, anonymous business card contact on their phone via Bluetooth. The contact contains a simple advertising message. What is this activity called?

Vishing
Bluesnarfing
Bluejacking (Correct answer)
Smishing

Correct answer: Bluejacking

Bluejacking is the act of sending unsolicited messages to other Bluetooth-enabled devices. It is often harmless and used for advertising or as a prank, unlike Bluesnarfing, which involves the unauthorized theft of data from a device via Bluetooth.

Question 20: What is the purpose of a security policy in an organization?

To restrict employees from using computers
To list all software installed on company computers
To document the organization's IT budget
To establish formal rules, guidelines, and procedures that define how the organization protects its information assets and manages security risks (Correct answer)

Correct answer: To establish formal rules, guidelines, and procedures that define how the organization protects its information assets and manages security risks

A security policy provides the formal framework of rules, guidelines, and responsibilities governing how an organization protects its information assets, manages risks, and ensures regulatory compliance.

Question 21: A user downloads what they believe to be a legitimate photo-editing application from a third-party website. After installation, their computer begins to run slowly, and they notice their webcam activating on its own. What type of malware has most likely infected their system?

Trojan Horse (Correct answer)
Adware
Worm
Keylogger

Correct answer: Trojan Horse

A Trojan horse, or Trojan, is a type of malware that disguises itself as a legitimate program to trick users into installing it. Once installed, it performs malicious activities in the background, such as giving an attacker unauthorized access to the system, which could include activating the webcam.

Question 22: What is a potentially unwanted program (PUP)?

Any program not made by Microsoft
An outdated version of a legitimate application
Software that may not be explicitly malicious but exhibits undesirable behaviors such as displaying ads, changing browser settings, or tracking users (Correct answer)
A program that is too large for the hard drive

Correct answer: Software that may not be explicitly malicious but exhibits undesirable behaviors such as displaying ads, changing browser settings, or tracking users

PUPs are programs that users may not have intentionally installed and that exhibit behaviors like displaying unwanted ads, modifying browser settings, or collecting user data without clear consent.

Question 23: What is the purpose of a fraud alert on your credit report?

It notifies creditors to take extra steps to verify your identity before approving new credit applications (Correct answer)
It locks your bank account from all transactions
It automatically rejects all credit applications
It sends you a daily credit score update

Correct answer: It notifies creditors to take extra steps to verify your identity before approving new credit applications

A fraud alert flags your credit report to warn creditors that they should verify the applicant's identity through additional steps before opening new credit accounts.

Question 24: What is social media account hijacking?

Deactivating your own social media account
Creating a new social media account
Sharing someone else's social media posts
Unauthorized access and takeover of someone's social media account, typically through stolen credentials or session tokens (Correct answer)

Correct answer: Unauthorized access and takeover of someone's social media account, typically through stolen credentials or session tokens

Account hijacking occurs when an attacker gains unauthorized access to a social media account through phishing, credential stuffing, session theft, or exploiting security vulnerabilities.

Question 25: What is data residency in the context of cloud computing?

The backup frequency of cloud data
The amount of storage space allocated to a user
The speed at which data is stored in the cloud
The physical or geographic location where data is stored and processed (Correct answer)

Correct answer: The physical or geographic location where data is stored and processed

Data residency refers to the geographic location where data is physically stored and processed, which has important implications for regulatory compliance and data sovereignty laws.

Question 26: What is jailbreaking or rooting a mobile device and why does it increase security risk?

Installing a new operating system
Removing built-in security restrictions to gain full system access, which also removes protections against malware and unauthorized access (Correct answer)
Resetting the device to factory settings
Enabling airplane mode permanently

Correct answer: Removing built-in security restrictions to gain full system access, which also removes protections against malware and unauthorized access

Jailbreaking (iOS) or rooting (Android) removes manufacturer-imposed security restrictions, allowing more customization but also eliminating critical security safeguards that protect against malware and unauthorized access.

Question 27: What should you do before opening an unexpected email attachment?

Download it and rename the file extension
Open it immediately to see what it contains
Verify the attachment's legitimacy with the sender through a separate communication channel (Correct answer)
Forward it to all colleagues to check if they received the same attachment

Correct answer: Verify the attachment's legitimacy with the sender through a separate communication channel

Before opening unexpected attachments, you should verify with the sender through a different channel (phone, text, in-person) to confirm they intentionally sent the file.

Question 28: What is a cryptographic hash function primarily used for?

Encrypting data so it can be decrypted later with a key
Generating asymmetric key pairs
Compressing large files for storage
Creating a fixed-size digital fingerprint of data (Correct answer)

Correct answer: Creating a fixed-size digital fingerprint of data

Hash functions produce a fixed-length digest (fingerprint) of data, used to verify data integrity since any change to input produces a different hash.

Question 29: What security risk does URL shortening services pose?

Shortened URLs obscure the actual destination, making it impossible to verify where the link leads before clicking (Correct answer)
URL shortening services store your passwords
Shortened URLs load websites more slowly
Shortened URLs use more bandwidth

Correct answer: Shortened URLs obscure the actual destination, making it impossible to verify where the link leads before clicking

URL shorteners hide the true destination of a link, preventing users from assessing whether it leads to a legitimate website or a malicious one before clicking.

Question 30: Which macOS feature helps prevent the installation of applications from unverified developers, thereby reducing the risk of malware infection?

Gatekeeper (Correct answer)
System Integrity Protection (SIP)
FileVault
XProtect

Correct answer: Gatekeeper

Gatekeeper is a security feature of macOS that helps protect users from installing malicious software by enforcing code signing and verifying that downloaded applications are from identified developers.

Question 31: Why is it important to keep antivirus signature databases up to date?

Updated signatures prevent software license expiration
Signature updates reduce the size of the antivirus program
Updated signatures improve computer performance
New malware is constantly being created, and updated signatures allow the antivirus to recognize and block the latest threats (Correct answer)

Correct answer: New malware is constantly being created, and updated signatures allow the antivirus to recognize and block the latest threats

Hundreds of thousands of new malware variants emerge daily, and signature updates contain the latest threat definitions needed to detect and block these newly identified threats.

Question 32: What is business email compromise (BEC)?

A targeted scam where attackers impersonate executives or business partners to trick employees into transferring money or sensitive data (Correct answer)
When a company's email server runs out of storage space
A technical failure in the email delivery system
When employees use personal email for work purposes

Correct answer: A targeted scam where attackers impersonate executives or business partners to trick employees into transferring money or sensitive data

BEC is a sophisticated scam where criminals impersonate company executives, business partners, or vendors through email to trick employees into making wire transfers or revealing confidential information.

Question 33: Which of the following is a method to secure your wireless network?

Disabling the network
Using WPA3 encryption (Correct answer)
Using WEP encryption
Setting up a guest network with open access

Correct answer: Using WPA3 encryption

WPA3 encryption is the latest and most secure method for protecting wireless networks.

Question 34: Which of the following is a disadvantage of local backups?

Limited data capacity
High security
Easy accessibility
Risk of physical damage or theft (Correct answer)

Correct answer: Risk of physical damage or theft

Local backups are vulnerable to physical damage or theft, which can result in the loss of both the original data and the backup.

Question 35: When you visit a website, it stores a small text file on your computer to remember your preferences, login status, and items in your shopping cart. What is this file called, and what is a primary security risk associated with it?

Cookie; it can be hijacked to impersonate you and gain unauthorized access to your accounts. (Correct answer)
Cache; it can slow down your browser if it gets too large.
Digital Certificate; an expired certificate can cause browser errors.
Plugin; it can be exploited by attackers if not updated.

Correct answer: Cookie; it can be hijacked to impersonate you and gain unauthorized access to your accounts.

This file is a cookie. While cookies are essential for a personalized web experience, they can pose a security risk. If a session cookie is stolen (hijacked), an attacker can use it to impersonate a legitimate user and gain unauthorized access to their accounts and personal information without needing a password.

Question 36: What is the purpose of a 'salt' added to a hashed password?

To add a random value that prevents two identical passwords from producing the same hash (Correct answer)
To encrypt the hash with an additional key
To slow down the login process for security
To make the password easier to remember

Correct answer: To add a random value that prevents two identical passwords from producing the same hash

A salt is a random value added to a password before hashing so that identical passwords produce unique hashes, defeating precomputed rainbow table attacks.

Question 37: What is secure boot and what threat does it protect against?

A method for encrypting files during startup
A feature that makes the computer start up faster
A power-saving feature for laptops
A firmware-level security mechanism that ensures only trusted, digitally signed software loads during the boot process, preventing bootkit malware (Correct answer)

Correct answer: A firmware-level security mechanism that ensures only trusted, digitally signed software loads during the boot process, preventing bootkit malware

Secure Boot verifies the digital signatures of all software components loaded during startup (bootloader, drivers, OS kernel), preventing rootkits and bootkits from compromising the system before the OS loads.

Question 38: What should you do immediately if you suspect your password has been compromised?

Change the password on that account and any account sharing that password (Correct answer)
Delete the account
Ignore it if no suspicious activity is visible
Wait and monitor account activity

Correct answer: Change the password on that account and any account sharing that password

You should change the compromised password and every account using the same one before attackers can exploit the access.

Question 39: What is versioning in the context of data backup?

Naming backup files with sequential numbers
Converting backup files to newer file formats
Upgrading backup software to the latest release
Maintaining multiple historical versions of files so previous states can be restored (Correct answer)

Correct answer: Maintaining multiple historical versions of files so previous states can be restored

Versioning preserves multiple historical copies of files, allowing users to restore data to a specific point in time rather than only the most recent backup.

Question 40: What is the primary security risk associated with downloading applications for your mobile device from unofficial, third-party app stores?

The apps may not receive regular feature updates.
They can drain the device's battery more quickly.
The apps may be bundled with malware or spyware. (Correct answer)
They often have a poor user interface.

Correct answer: The apps may be bundled with malware or spyware.

Unofficial or third-party app stores are not curated and lack the stringent security checks of official stores like the Apple App Store or Google Play. This makes them a common distribution channel for mobile malware, where malicious code is hidden inside seemingly legitimate applications.

Question 41: What is multi-factor authentication (MFA)?

Having multiple accounts for security
Requiring two or more verification factors to access an account (Correct answer)
Using multiple passwords for one account
Logging in from multiple devices simultaneously

Correct answer: Requiring two or more verification factors to access an account

MFA requires users to provide two or more distinct types of evidence (factors) before granting access, making unauthorized logins much harder.

Question 42: Which protocol is used to establish an encrypted connection between a web browser and a server?

SMTP
TLS/SSL (Correct answer)
DNS
FTP

Correct answer: TLS/SSL

TLS (Transport Layer Security), formerly known as SSL, establishes encrypted and authenticated connections between clients and servers.

Question 43: Which type of backup only saves changes made since the last backup?

Full backup
Differential backup
Continuous backup
Incremental backup (Correct answer)

Correct answer: Incremental backup

Incremental backups only save the changes made since the last backup, reducing storage space and time required.

Question 44: What is continuous data protection (CDP)?

Continuously monitoring data for viruses
A type of firewall that protects data 24/7
Running antivirus software continuously
A backup method that automatically saves every change to data as it occurs, enabling recovery to any point in time (Correct answer)

Correct answer: A backup method that automatically saves every change to data as it occurs, enabling recovery to any point in time

CDP captures every change made to data in real time, creating a continuous journal that allows restoration to any point in time, not just the last scheduled backup.

Question 45: What should you do before entering your password on a website?

Check that the URL uses HTTPS and the domain is correct (Correct answer)
Clear your browser cache
Switch to incognito mode only
Disable your antivirus temporarily

Correct answer: Check that the URL uses HTTPS and the domain is correct

Verifying the HTTPS padlock and the exact domain name protects against phishing and man-in-the-middle attacks before you type sensitive credentials.

Question 46: A small business subscribes to an Infrastructure as a Service (IaaS) provider to host a virtual server for its website. A critical vulnerability is discovered in the server's operating system. According to the shared responsibility model, who is responsible for applying the security patch?

The responsibility is shared equally between the customer and provider.
The internet service provider is responsible.
The small business (the customer) is responsible. (Correct answer)
The cloud provider is solely responsible.

Correct answer: The small business (the customer) is responsible.

In an IaaS model, the cloud provider manages the physical infrastructure (data centers, networking, servers) and the virtualization layer. The customer, however, is responsible for securing everything they put on that infrastructure, which includes the guest operating system, applications, and their data. Therefore, patching the OS is the customer's responsibility.

Question 47: What is DMARC and how does it improve email security?

A protocol that builds on SPF and DKIM to specify how receiving servers should handle failed authentication (Correct answer)
A method for compressing email attachments
A type of email encryption software
A spam filtering technique based on keywords

Correct answer: A protocol that builds on SPF and DKIM to specify how receiving servers should handle failed authentication

DMARC (Domain-based Message Authentication, Reporting, and Conformance) tells receiving mail servers what to do when emails fail SPF or DKIM checks, and provides reporting on authentication results.

Question 48: What is a backup retention policy?

A defined schedule that specifies how long different backup copies are kept before being deleted or overwritten (Correct answer)
A policy that limits the number of files that can be backed up
A rule about who can create backups
A policy that determines how fast backups are created

Correct answer: A defined schedule that specifies how long different backup copies are kept before being deleted or overwritten

A backup retention policy defines how long backup copies are maintained, balancing the need for historical data recovery against storage costs and compliance requirements.

Question 49: A user is working on a public Wi-Fi network and is concerned about their data being intercepted. Besides using a VPN, what operating system feature should be enabled to prevent unsolicited connection attempts from other devices on the same network?

A strong password policy
File encryption
A host-based firewall (Correct answer)
Automatic software updates

Correct answer: A host-based firewall

A host-based firewall, which is built into modern operating systems, can be configured to block incoming connection requests. This is especially important on untrusted networks, like public Wi-Fi, to prevent other malicious devices on the network from accessing services on the user's computer.

Question 50: Which of the following best describes an encryption 'key'?

A type of antivirus signature file
A physical device used to unlock encrypted hardware
A password used only to access a network
A piece of information that controls how data is encrypted or decrypted (Correct answer)

Correct answer: A piece of information that controls how data is encrypted or decrypted

An encryption key is a value that is input into a cryptographic algorithm to determine the transformation applied to the data.

Question 51: What does it mean when a browser warns that a website's certificate is 'expired'?

The website's encryption algorithm is outdated and no longer secure
The digital certificate used to establish a secure connection is no longer valid (Correct answer)
The website has permanently moved to a new server address
The website has been compromised by hackers

Correct answer: The digital certificate used to establish a secure connection is no longer valid

An expired certificate means the time-limited validity period of the digital certificate has passed, so the site's identity and encryption can no longer be verified.

EC-Council Certified Secure Computer User Exam

The CSCU (112-12) exam validates knowledge of secure computing practices including network security, data protection, cloud security, mobile device security, and safe internet usage for end users.

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds