Cyber Security Practice Test 1 — Questions and Answers

Question 1: What is the difference between "http://" (without the "s") and "http://" (with the "s") at the beginning of a URL?

That information entered into the site is encrypted (Correct answer)
That the site has special high definition
That the site is not accessible to certain computers
That the site is the newest version available

Correct answer: That information entered into the site is encrypted

The 's' in 'https://' stands for 'secure.' It indicates that the website uses an SSL/TLS certificate to encrypt all communication between your browser and the web server. This encryption protects sensitive data, such as login credentials or credit card numbers, from being intercepted by malicious actors during transmission. HTTP (without the 's') transmits data in plain text, making it vulnerable to eavesdropping.

Question 2: Which of the following is a "phishing" attack example?

Sending a text message to someone that contains a malicious link disguised as a notification that they have won a contest
Sending someone an email with a harmful link disguised as an email from someone they know
To trick consumers into entering their login information, create a fake website that seems remarkably identical to a real website.
All of the above (Correct answer)

Correct answer: All of the above

Phishing is a type of social engineering attack where attackers attempt to trick individuals into revealing sensitive information or performing actions by impersonating a trustworthy entity. This can occur through various channels, including malicious links in text messages (smishing), harmful links in emails disguised as known contacts, or fake websites designed to mimic legitimate ones. All the listed options are common tactics used in phishing attacks.

Question 3: Which of the following options is the best for securing your router?

Disable remote management on your router.
Once the router is configured, log out as the administrator.
Change the router's default name and password. (Correct answer)
All of the above.

Correct answer: Change the router's default name and password.

Changing the router's default name (SSID) and, more importantly, its default administrator password is a crucial first step in securing your network. Default credentials are often publicly known or easily guessable, making routers vulnerable to unauthorized access. While disabling remote management and logging out as administrator are also good practices, changing the default password directly prevents unauthorized access to the router's settings.

Question 4: Large corporations are the only ones targeted by cybercriminals. Is this statement true or false?

A) False (Correct answer)
B) True

Correct answer: A) False

Cybercriminals target organizations of all sizes, including small and medium-sized businesses (SMBs), as well as individuals. SMBs are often seen as easier targets due to potentially weaker security measures and fewer resources dedicated to cybersecurity. Individuals are also frequently targeted through phishing, malware, and identity theft schemes, making the statement false.

Question 5: Which option is the best for determining who in a company should be in charge of cybersecurity?

They are in the best position to understand and promote cybersecurity within a company, IT specialists are the finest candidates.
Owners of a company They are the ones that run the company, so they must be familiar with cybersecurity fundamentals and put them into practice in order to lower the danger of a cyberattack.
To lessen the danger of cyber assaults, all employees should have a basic understanding of cybersecurity. (Correct answer)
Managers, because they are in charge of ensuring that employees follow the proper procedures.

Correct answer: To lessen the danger of cyber assaults, all employees should have a basic understanding of cybersecurity.

While IT specialists and company owners play critical roles in establishing and maintaining cybersecurity infrastructure and policies, effective cybersecurity is a shared responsibility. Every employee, regardless of their role, interacts with company systems and data, making them a potential entry point for cyber threats. Therefore, a basic understanding of cybersecurity best practices across all employees is essential to create a strong human firewall and significantly reduce the risk of successful attacks.

Question 6: What is the name of the law in India that governs internet usage?

The IT Gazette of India Act, 2004
The Internet consumption Act, 1998
The Information Technology Act, 2004 (Correct answer)
None of the above

Correct answer: The Information Technology Act, 2004

The primary law in India that deals with cybercrime and e-commerce is the Information Technology Act. While initially enacted in 2000, it underwent significant amendments in 2008, often referred to as the IT Act, 2008, which came into effect in 2009. The option 'The Information Technology Act, 2004' refers to this core legislation.

Question 7: Which section of the Information Technology Act deals with the appointment of a Controller of Certifying Authorities?

Section 10
Section 17 (Correct answer)
Section 5
Section 15

Correct answer: Section 17

Section 17 of the Information Technology Act, 2000 (and its subsequent amendments) specifically outlines the provisions for the appointment of the Controller of Certifying Authorities (CCA). The CCA is a crucial regulatory body responsible for licensing and overseeing the working of Certifying Authorities (CAs) in India, which issue digital signatures. This section establishes the legal framework for the CCA's role and powers.

Question 8: A networked group of computers used by hackers to steal information is referred to as a...

DDoS
Operating system
Botnet (Correct answer)
Rootkit

Correct answer: Botnet

A botnet is a network of compromised computers, often called 'zombie computers' or 'bots,' that are controlled by a single attacker (the 'bot-herder'). These infected computers can be used to perform various malicious activities, including stealing information, sending spam, or launching distributed denial-of-service (DDoS) attacks, all without the owners' knowledge.

Question 9: Which of the four passwords listed below is the most secure?

PWh!5B (Correct answer)
234560
Goat123
info*49

Correct answer: PWh!5B

The most secure password among the options is 'PWh!5B' because it incorporates a strong mix of uppercase letters, lowercase letters, numbers, and special characters. This variety significantly increases the complexity and length, making it much harder for attackers to guess or crack using brute-force or dictionary attacks compared to passwords that use only one or two character types.

Question 10: Which of the following identifies a specific sequence of input or is triggered by a user ID or an unusual sequence of events?

Trojan horse
Logic Bomb
Virus
Trap doors (Correct answer)

Correct answer: Trap doors

A trap door, often referred to as a backdoor, is a secret entry point into a program or system that bypasses normal security authentication. It can be triggered by a specific sequence of input, a particular user ID, or an unusual set of events, allowing unauthorized access. This allows developers or malicious actors to gain access without going through standard security protocols.

Question 11: The very first computer virus is called

Creeper (Correct answer)
I Love You
Sasser
Blaster

Correct answer: Creeper

The Creeper program, created in 1971 by Bob Thomas, is widely considered the first computer virus. It was an experimental self-replicating program that moved between TENEX systems on ARPANET, displaying the message 'I'M THE CREEPER : CATCH ME IF YOU CAN.' While not malicious in the modern sense, it demonstrated the concept of self-replicating code.

Question 12: What is the file extension for storing e-mails locally in Outlook Express?

doc
xls
nsf
pst (Correct answer)

Correct answer: pst

The file extension for storing emails, contacts, calendars, and other data locally in Microsoft Outlook (and historically Outlook Express) is .pst, which stands for Personal Storage Table. These files are used to archive or back up Outlook data on a user's computer. Other email clients might use different formats, but .pst is specific to Outlook.

Question 13: Criminals gain access to a computer and encrypt the user's personal information and files. Unless the user pays the thieves to decrypt the files, the user will be unable to view the information. This method is known as...

Ransomware (Correct answer)
Botnet
Spam
Driving

Correct answer: Ransomware

This scenario perfectly describes a ransomware attack. Ransomware is a type of malicious software that encrypts a victim's files, making them inaccessible. The attacker then demands a ransom payment, usually in cryptocurrency, in exchange for the decryption key, threatening to keep the files encrypted or delete them if the ransom is not paid.

Question 14: What is the abbreviation for malicious software (software that is designed to cause computer malfunctions, collect sensitive data, or obtain unauthorized access to computer systems)?

Moleculewar
Malisoft
Malware (Correct answer)
Malairasoft

Correct answer: Malware

Malware is a portmanteau of 'malicious software.' It is a general term used to describe any software specifically designed to disrupt, damage, or gain unauthorized access to a computer system, network, or data. This includes viruses, worms, Trojans, ransomware, spyware, and adware, all intended to cause harm or unwanted actions.

Question 15: Turning off your smartphone's GPS function prevents your phone's location from being tracked.

A) False (Correct answer)
B) True

Correct answer: A) False

While turning off GPS limits one method of location tracking, it does not prevent your phone's location from being tracked entirely. Smartphones can still be tracked using other technologies like Wi-Fi triangulation, cellular tower triangulation, and IP address location. Apps with specific permissions or network providers can still infer your general location, making the statement false.

Question 16: When someone tries to harm a group of people by using a computer, what do they call themself?

Social engineer
Whitehat intruder
Cyber terrorist (Correct answer)
Cracker

Correct answer: Cyber terrorist

A cyber terrorist uses computer networks and the internet to cause disruption, fear, or harm, often with political or ideological motivations, targeting groups of people or critical infrastructure. While 'cracker' refers to someone who breaks into systems maliciously, 'cyber terrorist' specifically implies a broader, often politically motivated, intent to cause widespread harm or panic.

Question 17: What term is used to describe the act of stealing money or resources on a timer?

Salami Attack (Correct answer)
Pigeon drop
Pharming
Identity theft

Correct answer: Salami Attack

A salami attack is a type of cybercrime where small, often imperceptible, amounts of money or resources are stolen from a large number of accounts over a period of time. Each individual theft is so small that it goes unnoticed, but when aggregated, the total stolen amount can be significant. This method relies on the 'slicing' off of tiny portions, like slices of salami.

Question 18: Is it safe to use a public Wi-Fi network (such as in an airport or café) for critical activities like online banking if it requires a password?

A) No, it is not safe (Correct answer)
B) Yes, it is safe

Correct answer: A) No, it is not safe

Even if a public Wi-Fi network requires a password, it does not guarantee security for critical activities like online banking. The password often only protects access to the network, not the traffic within it. Other users on the same network could potentially intercept your data, especially if the network uses outdated encryption or if an attacker sets up a rogue access point. A VPN should always be used on public Wi-Fi for sensitive tasks.

Question 19: Which of the following is a cybercrime example?

Spam
Nigerian Fraud schemes
Online shopping scam
Computer Hacking (Correct answer)

Correct answer: Computer Hacking

Computer hacking is the act of gaining unauthorized access to a computer system or network, which is a direct and clear example of a cybercrime. While spam, Nigerian fraud schemes, and online shopping scams are often facilitated by or related to cyber activities, 'computer hacking' itself is the fundamental illegal act of breaching digital security.

Question 20: What types of cybersecurity threats may a Virtual Private Network (VPN) help minimize?

De-anonymization by network operators
Use of insecure Wi-Fi networks (Correct answer)
Phishing attacks
Key-logging

Correct answer: Use of insecure Wi-Fi networks

A Virtual Private Network (VPN) encrypts your internet connection and routes it through a secure server, creating a private tunnel. This significantly enhances security when using insecure Wi-Fi networks, such as those in public places, by preventing others on the same network from intercepting your data. While VPNs offer some privacy benefits, they are not designed to directly prevent phishing attacks or keylogging, which are different types of threats.

Question 21: Which strategy is used for identity theft if the information is retrieved by looking through objects that the user has discarded?

pretexting
dumpster diving (Correct answer)
scavenger hunting
None of the above

Correct answer: dumpster diving

Dumpster diving is a social engineering technique where attackers literally 'dive' into trash or recycling bins to find discarded documents, bills, or other items containing sensitive personal information. This information can then be used for identity theft or to facilitate other attacks. It's a low-tech but effective method of data collection.

Question 22: If a user receives a phone call from someone posing as a bank employee demanding that the user update personal information, what type of attack strategy is being used?

shoulder surfing
blind calling
pretexting (Correct answer)
skimming

Correct answer: pretexting

Pretexting is a social engineering technique where an attacker creates a fabricated scenario or 'pretext' to trick a victim into divulging sensitive information. In this case, posing as a bank employee demanding personal information is a classic example of pretexting, as the attacker is creating a false identity and urgent situation to manipulate the victim into revealing data.

Question 23: Which provision of the Information Technology Act deals with computer system hacking and the penalties associated with it?

Section 66 (Correct answer)
Section 62
Section 67
Section 65

Correct answer: Section 66

Section 66 of the Information Technology Act, 2000 (and its subsequent amendments) specifically addresses the offense of computer hacking. It defines what constitutes hacking and prescribes the penalties, including imprisonment and fines, for individuals found guilty of unauthorized access and damage to computer systems or data. This section is a cornerstone for prosecuting cybercriminals in India.

Question 24: Nimda worm carried out what kind of attack?

Trojan horse attack
Interpreted Virus attack
Compiled Virus attack
Blended attack (Correct answer)

Correct answer: Blended attack

The Nimda worm was characterized by its ability to spread through multiple vectors, including email, web server vulnerabilities, and network shares. This multi-pronged approach, combining characteristics of viruses, worms, and web-based attacks, defines it as a blended threat or blended attack. It leveraged various methods to propagate and infect systems simultaneously.

Question 25: Which of the following is a self-contained malicious program that does not require the use of a host application?

Trojan horse
Trap doors
Worm (Correct answer)
Virus

Correct answer: Worm

A worm is a type of malicious software that replicates itself and spreads to other computers without needing to attach to an existing program. Unlike a virus, which requires a host file, a worm is a self-contained program capable of independent propagation across networks. This autonomy is its defining characteristic.

Cyber Security Practice Test 1

What is the difference between "http://" (without the "s") and "http://" (with the "s") at the beginning of a URL?