EC-Council Certified Secure Computer User Exam — Questions and Answers

Question 1: What is a Kensington lock used for?

Encrypting files on a laptop
Locking USB ports to prevent unauthorized devices
Physically securing a laptop to a desk or fixed object to prevent theft (Correct answer)
Securing a password manager vault

Correct answer: Physically securing a laptop to a desk or fixed object to prevent theft

A Kensington lock is a cable security system that physically tethers a laptop to a desk, deterring opportunistic theft in public spaces.

Question 2: Which of the following is a common characteristic of phishing emails?

Regular updates from subscribed newsletters
Personalized messages from known contacts
Unsolicited requests for personal information (Correct answer)
Official-looking email addresses

Correct answer: Unsolicited requests for personal information

Phishing emails often appear to be from legitimate sources but request personal information unsolicitedly.

Question 3: A user is working from a public coffee shop and connects to the establishment's free Wi-Fi. To protect their data from being intercepted by others on the same network, which of the following is the MOST effective tool to use?

A Virtual Private Network (VPN) (Correct answer)
Antivirus software
Disabling the SSID broadcast
A hardware firewall

Correct answer: A Virtual Private Network (VPN)

A VPN creates an encrypted tunnel for your internet traffic, making it unreadable to anyone who might be snooping on the public Wi-Fi network. Antivirus protects against malware, a firewall blocks unauthorized network access to your device, and disabling SSID broadcast is a router setting not applicable to a client device on a public network.

Question 4: What is the primary purpose of data backup?

To create copies of data to prevent data loss (Correct answer)
To increase the speed of your computer
To free up space on your hard drive
To prevent unauthorized access to your data

Correct answer: To create copies of data to prevent data loss

Data backups are essential for creating copies of important data to recover from data loss incidents.

Question 5: A user wants to ensure that if their laptop is stolen, the data on the hard drive is unreadable to an unauthorized person. Which of the following Windows features is specifically designed for this purpose?

Windows Update
BitLocker (Correct answer)
User Account Control (UAC)
Windows Defender Firewall

Correct answer: BitLocker

BitLocker is a full-volume encryption feature included with Microsoft Windows versions starting with Vista. It is designed to protect data by providing encryption for entire volumes. If a computer is lost or stolen, BitLocker prevents unauthorized access to the data stored on the drive.

Question 6: What is data residency in the context of cloud computing?

The physical or geographic location where data is stored and processed (Correct answer)
The speed at which data is stored in the cloud
The amount of storage space allocated to a user
The backup frequency of cloud data

Correct answer: The physical or geographic location where data is stored and processed

Data residency refers to the geographic location where data is physically stored and processed, which has important implications for regulatory compliance and data sovereignty laws.

Question 7: Why should backup integrity be regularly tested?

To verify that backup data can be successfully restored when needed (Correct answer)
To ensure the backup software license is still valid
To increase the speed of the backup process
To reduce the size of backup files

Correct answer: To verify that backup data can be successfully restored when needed

Regular backup testing verifies that backup data is complete, uncorrupted, and can be successfully restored, ensuring the organization can actually recover from data loss events.

Question 8: A user clears their browser's cache. What is the primary function of this action?

To delete stored website files like images and scripts from the computer, which can resolve display issues and free up space. (Correct answer)
To permanently erase all records of visited websites from their Internet Service Provider.
To log out of all currently active web sessions.
To remove all saved passwords from the browser's autofill.

Correct answer: To delete stored website files like images and scripts from the computer, which can resolve display issues and free up space.

The browser cache is a temporary storage area on your computer for website files (like images, HTML, and CSS) that have been downloaded. Its purpose is to make websites load faster on subsequent visits. Clearing the cache removes these temporary files, which can help troubleshoot website loading or formatting problems and reclaim disk space.

Question 9: Which cloud deployment model provides dedicated infrastructure for a single organization?

Community cloud
Hybrid cloud
Private cloud (Correct answer)
Public cloud

Correct answer: Private cloud

A private cloud is dedicated to a single organization, providing greater control over security, compliance, and customization of the infrastructure.

Question 10: What should you do immediately if you suspect you are a victim of identity theft?

Wait a month to see if the problem resolves itself
Only change your email password
Post about it on social media to warn others
Place a fraud alert or credit freeze, report to the FTC, file a police report, and notify affected financial institutions (Correct answer)

Correct answer: Place a fraud alert or credit freeze, report to the FTC, file a police report, and notify affected financial institutions

Immediate steps include placing a fraud alert or credit freeze with credit bureaus, filing a report at IdentityTheft.gov (FTC), notifying banks and creditors, and filing a local police report.

Question 11: What is a host-based firewall and how does it differ from a network firewall?

A host-based firewall is faster than a network firewall
There is no difference between host-based and network firewalls
A host-based firewall runs on individual computers to filter traffic for that specific device, while a network firewall protects an entire network at its boundary (Correct answer)
A host-based firewall only blocks outgoing traffic

Correct answer: A host-based firewall runs on individual computers to filter traffic for that specific device, while a network firewall protects an entire network at its boundary

A host-based firewall runs on a single computer and controls incoming and outgoing network traffic for that specific device, providing protection even when the device is outside the network firewall's perimeter.

Question 12: What should you do immediately if you suspect your password has been compromised?

Ignore it if no suspicious activity is visible
Change the password on that account and any account sharing that password (Correct answer)
Wait and monitor account activity
Delete the account

Correct answer: Change the password on that account and any account sharing that password

You should change the compromised password and every account using the same one before attackers can exploit the access.

Question 13: What does the shared responsibility model in cloud computing define?

How cloud costs are split between departments
The process of sharing data between cloud regions
How bandwidth is shared among cloud users
The division of security obligations between the cloud provider and the customer (Correct answer)

Correct answer: The division of security obligations between the cloud provider and the customer

The shared responsibility model clarifies which security tasks the cloud provider handles (such as physical security and infrastructure) and which the customer must manage (such as data encryption and access controls).

Question 14: To maintain effectiveness against new and evolving threats, what is the MOST critical routine maintenance task for any antivirus software?

Performing a full system scan daily.
Clearing the quarantine folder weekly.
Regularly updating the virus definition files. (Correct answer)
Reinstalling the software every six months.

Correct answer: Regularly updating the virus definition files.

Antivirus software relies heavily on its virus definition files (or signature database) to identify known malware. New malware is created daily, so it is crucial to update these definitions regularly to ensure the software can recognize and protect against the latest threats.

Question 15: What is social media account hijacking?

Unauthorized access and takeover of someone's social media account, typically through stolen credentials or session tokens (Correct answer)
Deactivating your own social media account
Creating a new social media account
Sharing someone else's social media posts

Correct answer: Unauthorized access and takeover of someone's social media account, typically through stolen credentials or session tokens

Account hijacking occurs when an attacker gains unauthorized access to a social media account through phishing, credential stuffing, session theft, or exploiting security vulnerabilities.

Question 16: What is the security benefit of network segmentation for IoT devices?

It eliminates the need for IoT device passwords
It isolates IoT devices on a separate network segment, limiting an attacker's ability to reach critical systems if an IoT device is compromised (Correct answer)
It makes IoT devices faster
It reduces the number of IoT devices on the network

Correct answer: It isolates IoT devices on a separate network segment, limiting an attacker's ability to reach critical systems if an IoT device is compromised

Network segmentation places IoT devices on a separate network, so if an IoT device is compromised, the attacker cannot easily access computers, servers, and sensitive data on the main network.

Question 17: An employee brings a personal wireless router from home and connects it to the company's network to get a better signal in their office. This unauthorized device is BEST described as a:

Rogue Access Point (Correct answer)
DMZ
Evil Twin
Honeypot

Correct answer: Rogue Access Point

A rogue access point is any wireless access point that has been installed on a secure network without explicit authorization from a local network administrator. This creates a significant security vulnerability because it bypasses the company's network security controls.

Question 18: What is Mobile Device Management (MDM) and what is its primary purpose?

A system for optimizing mobile device battery life
A solution that allows organizations to remotely manage, monitor, and secure employee mobile devices (Correct answer)
Software for managing mobile game subscriptions
An app for tracking mobile data usage

Correct answer: A solution that allows organizations to remotely manage, monitor, and secure employee mobile devices

MDM solutions enable organizations to enforce security policies, manage applications, and remotely monitor and control mobile devices used for work purposes.

Question 19: What precaution should be taken when sending sensitive information via email?

Add a confidentiality disclaimer in the email footer
Send the email to multiple recipients for redundancy
Mark the email as high priority
Use end-to-end encryption or send sensitive data through a secure file-sharing platform instead (Correct answer)

Correct answer: Use end-to-end encryption or send sensitive data through a secure file-sharing platform instead

Sensitive information should be protected with end-to-end encryption or shared through a secure platform, as standard email provides limited security for confidential data.

Question 20: What security vulnerability is associated with default credentials on IoT devices?

Default credentials make devices run slower
Attackers can easily access devices using widely known factory-default usernames and passwords (Correct answer)
Default credentials use too much storage space
Default credentials prevent firmware updates

Correct answer: Attackers can easily access devices using widely known factory-default usernames and passwords

Many IoT devices ship with common default credentials (like admin/admin) that are publicly documented and easily exploited if users do not change them during setup.

Question 21: What is a Recovery Point Objective (RPO)?

The maximum time allowed to restore a system after failure
The number of recovery attempts allowed before escalation
The total cost of recovering lost data
The maximum acceptable amount of data loss measured in time (Correct answer)

Correct answer: The maximum acceptable amount of data loss measured in time

RPO defines the maximum period of data loss an organization can tolerate, determining how frequently backups should be performed.

Question 22: What does AES stand for in cryptography?

Applied Encryption Software
Advanced Encoding Scheme
Automated Encryption System
Advanced Encryption Standard (Correct answer)

Correct answer: Advanced Encryption Standard

AES (Advanced Encryption Standard) is a widely adopted symmetric encryption algorithm standardized by NIST and used by the US government.

Question 23: Which practice BEST protects you when using public Wi-Fi and entering passwords?

Disabling your firewall
Using the same password you use at home
Connecting through a VPN before logging in (Correct answer)
Using a very long password

Correct answer: Connecting through a VPN before logging in

A VPN encrypts your traffic on public Wi-Fi, preventing eavesdroppers from intercepting your credentials in transit.

Question 24: An employee receives an email that appears to be from a known supplier with an invoice attached. However, they notice the sender's domain is 'supp1ier.com' instead of the usual 'supplier.com'. This is a classic indicator of what type of attack?

Typosquatting (Correct answer)
Man-in-the-Middle (MitM)
SQL Injection
Denial-of-Service (DoS)

Correct answer: Typosquatting

Typosquatting, also known as URL hijacking, is a form of social engineering where attackers register domain names with slight variations or misspellings of legitimate domains. They use these domains to send phishing emails, hoping recipients won't notice the small difference and will trust the fraudulent message.

Question 25: What should you consider when choosing a cloud backup provider?

Only the price of the service
The color scheme of their website
Encryption standards, data center locations, compliance certifications, recovery capabilities, and the provider's data retention and privacy policies (Correct answer)
How many employees the company has

Correct answer: Encryption standards, data center locations, compliance certifications, recovery capabilities, and the provider's data retention and privacy policies

Evaluating a cloud backup provider should consider encryption (in transit and at rest), data center locations for compliance, certifications, SLA guarantees, recovery speed, and privacy policies.

Question 26: What is a cipher in the context of cryptography?

A type of computer virus
A hardware device for storing passwords
A type of firewall rule
An algorithm used to encrypt and decrypt data (Correct answer)

Correct answer: An algorithm used to encrypt and decrypt data

A cipher is a cryptographic algorithm that transforms plaintext into ciphertext and reverses the process with the correct key.

Question 27: Why should you regularly review the third-party applications connected to your social media accounts?

To increase your social media follower count
To see which apps are available for download
To check which apps have the best ratings
Connected apps may retain access permissions and can access your data, post on your behalf, or be compromised themselves (Correct answer)

Correct answer: Connected apps may retain access permissions and can access your data, post on your behalf, or be compromised themselves

Third-party apps connected to social media retain their granted permissions until revoked, potentially accessing personal data, posting content, or becoming a security risk if the third-party app is compromised.

Question 28: A user downloads what they believe to be a legitimate photo-editing application from a third-party website. After installation, their computer begins to run slowly, and they notice their webcam activating on its own. What type of malware has most likely infected their system?

Keylogger
Worm
Adware
Trojan Horse (Correct answer)

Correct answer: Trojan Horse

A Trojan horse, or Trojan, is a type of malware that disguises itself as a legitimate program to trick users into installing it. Once installed, it performs malicious activities in the background, such as giving an attacker unauthorized access to the system, which could include activating the webcam.

Question 29: What is the primary security risk of sideloading apps on a mobile device?

Sideloaded apps use more battery power
Sideloaded apps bypass official app store security reviews and may contain malware (Correct answer)
Sideloaded apps cannot access the internet
Sideloaded apps are always larger in file size

Correct answer: Sideloaded apps bypass official app store security reviews and may contain malware

Sideloading installs apps from sources outside official app stores, bypassing the security vetting process that screens for malware, excessive permissions, and other security issues.

Question 30: What is the key difference between incremental and differential backups?

Incremental backups only save changes since the last backup of any type, while differential backups save all changes since the last full backup (Correct answer)
Incremental backups are faster to restore than differential backups
There is no difference; the terms are interchangeable
Differential backups use less storage space than incremental backups

Correct answer: Incremental backups only save changes since the last backup of any type, while differential backups save all changes since the last full backup

Incremental backups capture only changes since the last backup (full or incremental), using less storage but requiring more steps to restore. Differential backups capture all changes since the last full backup, using more storage but enabling faster restoration.

Question 31: What is the primary purpose of email encryption?

To reduce the size of email attachments
To prevent emails from being marked as spam
To ensure only the intended recipient can read the email content (Correct answer)
To speed up email delivery

Correct answer: To ensure only the intended recipient can read the email content

Email encryption converts email content into an unreadable format that can only be decrypted by the intended recipient, protecting the confidentiality of the message.

Question 32: What distinguishes a worm from a virus in terms of propagation?

Worms can only spread through email while viruses spread through USB drives
Worms only infect Mac computers while viruses target Windows
Worms can self-replicate and spread across networks without user interaction, while viruses require a host file and user action to spread (Correct answer)
Worms are less harmful than viruses

Correct answer: Worms can self-replicate and spread across networks without user interaction, while viruses require a host file and user action to spread

Unlike viruses that attach to files and require user action to spread, worms are self-replicating malware that can propagate automatically across networks by exploiting vulnerabilities.

Question 33: When sending a newsletter to a large group of external contacts, what is the primary privacy benefit of using the Blind Carbon Copy (Bcc) field?

It encrypts the email content for Bcc recipients.
It prevents recipients from seeing each other's email addresses. (Correct answer)
It guarantees the email will bypass spam filters.
It reduces the size of the email header.

Correct answer: It prevents recipients from seeing each other's email addresses.

The Bcc field hides the recipient list from view. When you place email addresses in the Bcc field, those addresses are invisible to everyone else who receives the message, thereby protecting the privacy of your contacts.

Question 34: What is a cryptographic hash function primarily used for?

Generating asymmetric key pairs
Encrypting data so it can be decrypted later with a key
Creating a fixed-size digital fingerprint of data (Correct answer)
Compressing large files for storage

Correct answer: Creating a fixed-size digital fingerprint of data

Hash functions produce a fixed-length digest (fingerprint) of data, used to verify data integrity since any change to input produces a different hash.

Question 35: What is an important step to take before restoring data from a backup?

Delete the original data
Ensure the backup data is current and not corrupted (Correct answer)
Disconnect from the internet
Turn off antivirus software

Correct answer: Ensure the backup data is current and not corrupted

It's important to verify that the backup data is up-to-date and not corrupted before starting the restoration process.

Question 36: How can data broker websites contribute to identity theft risks?

They slow down internet connection speeds
They encrypt all personal data they collect
They only contain publicly available business information
They aggregate and sell personal information that criminals can use to build profiles for identity theft (Correct answer)

Correct answer: They aggregate and sell personal information that criminals can use to build profiles for identity theft

Data brokers collect and sell personal information such as addresses, phone numbers, relatives, and financial details, which identity thieves can use to answer security questions or impersonate victims.

Question 37: What is a zero-day vulnerability?

A vulnerability that has existed for zero days
A vulnerability that was fixed on the same day it was discovered
A virus that can only operate for one day
A previously unknown software vulnerability that is exploited by attackers before the vendor has developed a patch (Correct answer)

Correct answer: A previously unknown software vulnerability that is exploited by attackers before the vendor has developed a patch

A zero-day vulnerability is an unknown software flaw that attackers discover and exploit before the software vendor is aware of it or has released a fix, leaving zero days for users to protect themselves.

Question 38: What security risk does URL shortening services pose?

Shortened URLs load websites more slowly
Shortened URLs use more bandwidth
Shortened URLs obscure the actual destination, making it impossible to verify where the link leads before clicking (Correct answer)
URL shortening services store your passwords

Correct answer: Shortened URLs obscure the actual destination, making it impossible to verify where the link leads before clicking

URL shorteners hide the true destination of a link, preventing users from assessing whether it leads to a legitimate website or a malicious one before clicking.

Question 39: What is a security incident response plan?

A list of all security software installed on a computer
A schedule for changing passwords
A documented set of procedures for detecting, containing, eradicating, and recovering from security incidents (Correct answer)
A plan for purchasing new security equipment

Correct answer: A documented set of procedures for detecting, containing, eradicating, and recovering from security incidents

An incident response plan provides structured procedures for handling security breaches and attacks through defined phases: preparation, identification, containment, eradication, recovery, and lessons learned.

Question 40: What does 'clean desk policy' mean in a workplace security context?

Mandatory desk sanitization each morning
Restricting food and drinks near computers
Ensuring no sensitive documents or devices are left unattended or visible when not in use (Correct answer)
Requiring employees to keep their workspace physically tidy

Correct answer: Ensuring no sensitive documents or devices are left unattended or visible when not in use

A clean desk policy requires employees to secure or remove sensitive materials from their desks when they step away, reducing the risk of unauthorized access.

Question 41: What is a rootkit and why is it particularly dangerous?

A type of firewall configuration tool
A tool for managing root access on Linux systems
Malware that hides deep within the operating system to conceal its presence and the presence of other malware (Correct answer)
A legitimate system administration utility

Correct answer: Malware that hides deep within the operating system to conceal its presence and the presence of other malware

A rootkit embeds itself deep in the operating system—sometimes at the kernel level—to hide malicious activity from security software and users, making detection and removal extremely difficult.

Question 42: What is the primary security concern when using public cloud storage services for sensitive business documents?

Slow upload speeds
Data may be accessed by unauthorized parties if not properly encrypted (Correct answer)
Cloud storage has limited capacity
Files cannot be organized into folders

Correct answer: Data may be accessed by unauthorized parties if not properly encrypted

Public cloud storage can expose sensitive data if proper encryption and access controls are not implemented, as data travels through and resides on third-party infrastructure.

Question 43: What is the security risk of auto-forwarding rules in email accounts?

Forwarded emails lose their formatting
Auto-forwarding makes emails arrive slower
Auto-forwarding increases email storage usage
Attackers can set up hidden forwarding rules to silently receive copies of all incoming emails (Correct answer)

Correct answer: Attackers can set up hidden forwarding rules to silently receive copies of all incoming emails

If an attacker gains temporary access to an email account, they can create hidden auto-forwarding rules that silently send copies of all incoming messages to an external address, maintaining persistent access to communications.

Question 44: What primary security service does a digital signature provide for an email message, ensuring that the sender cannot later deny having sent the message?

Anonymity
Confidentiality
Availability
Non-repudiation (Correct answer)

Correct answer: Non-repudiation

A digital signature provides authentication (proof of sender), integrity (proof the message wasn't altered), and non-repudiation. Non-repudiation is the assurance that someone cannot deny the validity of something, meaning the sender cannot deny having sent the message. Confidentiality is provided by encryption, not signatures.

Question 45: Which macOS feature helps prevent the installation of applications from unverified developers, thereby reducing the risk of malware infection?

XProtect
Gatekeeper (Correct answer)
FileVault
System Integrity Protection (SIP)

Correct answer: Gatekeeper

Gatekeeper is a security feature of macOS that helps protect users from installing malicious software by enforcing code signing and verifying that downloaded applications are from identified developers.

Question 46: What type of cloud attack involves intercepting data transmitted between the user and the cloud service?

Man-in-the-middle attack (Correct answer)
Brute force attack
SQL injection attack
Denial of Service attack

Correct answer: Man-in-the-middle attack

A man-in-the-middle (MITM) attack intercepts communications between a user and a cloud service, allowing the attacker to eavesdrop on or alter the data being transmitted.

Question 47: You receive an email with a link to what appears to be your bank's website. Which of the following is the BEST technique to verify the link's legitimacy before clicking?

Replying to the email to ask if the link is legitimate.
Checking if the email contains the bank's official logo. (Correct answer)
Clicking the link to see if the website has a padlock icon.
Hovering the mouse cursor over the link to see the actual destination URL in the browser's status bar.

Correct answer: Checking if the email contains the bank's official logo.

Phishing attacks often use hyperlinks where the displayed text looks legitimate, but the underlying URL points to a malicious site. By hovering the mouse over the link without clicking, you can preview the actual destination URL in the bottom corner of the browser window. This allows you to check for misspellings or entirely different domains before navigating to a potentially dangerous site.

Question 48: What is a potentially unwanted program (PUP)?

A program that is too large for the hard drive
Any program not made by Microsoft
Software that may not be explicitly malicious but exhibits undesirable behaviors such as displaying ads, changing browser settings, or tracking users (Correct answer)
An outdated version of a legitimate application

Correct answer: Software that may not be explicitly malicious but exhibits undesirable behaviors such as displaying ads, changing browser settings, or tracking users

PUPs are programs that users may not have intentionally installed and that exhibit behaviors like displaying unwanted ads, modifying browser settings, or collecting user data without clear consent.

Question 49: What is secure boot and what threat does it protect against?

A power-saving feature for laptops
A firmware-level security mechanism that ensures only trusted, digitally signed software loads during the boot process, preventing bootkit malware (Correct answer)
A feature that makes the computer start up faster
A method for encrypting files during startup

Correct answer: A firmware-level security mechanism that ensures only trusted, digitally signed software loads during the boot process, preventing bootkit malware

Secure Boot verifies the digital signatures of all software components loaded during startup (bootloader, drivers, OS kernel), preventing rootkits and bootkits from compromising the system before the OS loads.

Question 50: Why is it important to keep antivirus signature databases up to date?

Updated signatures improve computer performance
New malware is constantly being created, and updated signatures allow the antivirus to recognize and block the latest threats (Correct answer)
Updated signatures prevent software license expiration
Signature updates reduce the size of the antivirus program

Correct answer: New malware is constantly being created, and updated signatures allow the antivirus to recognize and block the latest threats

Hundreds of thousands of new malware variants emerge daily, and signature updates contain the latest threat definitions needed to detect and block these newly identified threats.

Question 51: A user receives an SMS text message that warns their bank account has been locked and provides a link to 'verify' their identity. This is a classic example of which type of attack?

Bluejacking
Spear Phishing
Smishing (Correct answer)
Vishing

Correct answer: Smishing

Smishing is a form of phishing that is conducted using SMS (Short Message Service) text messages. The goal is the same as email phishing: to trick the user into revealing sensitive information or clicking a malicious link, but the medium is a mobile text message.

EC-Council Certified Secure Computer User Exam

The CSCU (112-12) exam validates knowledge of secure computing practices including network security, data protection, cloud security, mobile device security, and safe internet usage for end users.

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

cert.eccouncil.org — Score validity, eligibility, exam format, passing score, renewal, time limit · verified Oct 2026
store.eccouncil.org — Test delivery · verified Oct 2026