Cyber Security Certification Exam — Questions and Answers

Question 1: Large corporations are the only ones targeted by cybercriminals. Is this statement true or false?

A) False (Correct answer)
B) True

Correct answer: A) False

Cybercriminals target organizations of all sizes, including small and medium-sized businesses (SMBs), as well as individuals. SMBs are often seen as easier targets due to potentially weaker security measures and fewer resources dedicated to cybersecurity. Individuals are also frequently targeted through phishing, malware, and identity theft schemes, making the statement false.

Question 2: What is container image scanning used to detect in DevSecOps?

Unauthorized network access between pods
Misconfigurations in Kubernetes RBAC policies
Known vulnerabilities in OS packages and libraries within container images (Correct answer)
Excessive CPU usage by containers

Correct answer: Known vulnerabilities in OS packages and libraries within container images

Container image scanning identifies CVEs in base images and installed packages before containers are deployed to production.

Question 3: What is a VPN primarily used for in a corporate environment?

Speed up internet browsing
Block malware downloads
Monitor employee emails
Create a secure encrypted tunnel for remote access (Correct answer)

Correct answer: Create a secure encrypted tunnel for remote access

A VPN creates an encrypted tunnel allowing remote users to securely access corporate resources.

Question 4: Which framework provides a structured vocabulary for describing attacker tactics, techniques, and procedures (TTPs)?

ISO 27001
MITRE ATT&CK (Correct answer)
NIST CSF
OWASP Top 10

Correct answer: MITRE ATT&CK

MITRE ATT&CK is a globally accessible knowledge base of real-world attacker TTPs used for threat detection and response.

Question 5: What does the principle of separation of duties prevent in access management?

A single individual from having enough access to commit and conceal fraud (Correct answer)
Users from delegating access to other employees
Service accounts from having administrator rights
Users from accessing multiple applications at once

Correct answer: A single individual from having enough access to commit and conceal fraud

Separation of duties requires multiple people to complete sensitive tasks, preventing any one person from both initiating and approving a transaction.

Question 6: What does the term 'dwell time' refer to in a security incident?

Time required to restore systems after a breach
Time taken to patch a vulnerability after discovery
The delay between alert generation and analyst review
The duration an attacker remains undetected inside a compromised network (Correct answer)

Correct answer: The duration an attacker remains undetected inside a compromised network

Dwell time is the period between initial compromise and detection, during which attackers can freely operate.

Question 7: What is the purpose of Single Sign-On (SSO)?

Automatically log users out after 30 minutes of inactivity
Allow a user to authenticate once and gain access to multiple applications (Correct answer)
Allow a user to have only one password across all systems
Restrict users to accessing a single application per session

Correct answer: Allow a user to authenticate once and gain access to multiple applications

SSO lets users authenticate once with a central identity provider and access multiple connected applications without re-authenticating.

Question 8: What is the first phase of a penetration testing engagement?

Post-exploitation
Reconnaissance (Correct answer)
Reporting
Exploitation

Correct answer: Reconnaissance

Reconnaissance is the first phase where the tester gathers information about the target before attacking.

Question 9: Which strategy is used for identity theft if the information is retrieved by looking through objects that the user has discarded?

scavenger hunting
None of the above
dumpster diving (Correct answer)
pretexting

Correct answer: dumpster diving

Dumpster diving is a social engineering technique where attackers literally 'dive' into trash or recycling bins to find discarded documents, bills, or other items containing sensitive personal information. This information can then be used for identity theft or to facilitate other attacks. It's a low-tech but effective method of data collection.

Question 10: What is the purpose of a hardware security key (e.g., YubiKey) as an MFA factor?

Store encrypted backups of user credentials
Generate one-time passwords via a mobile app
Provide phishing-resistant authentication using a physical cryptographic device (Correct answer)
Verify identity through fingerprint scanning

Correct answer: Provide phishing-resistant authentication using a physical cryptographic device

Hardware security keys use public key cryptography bound to the specific website, making them resistant to phishing attacks.

Question 11: What is SQL injection?

Cracking database passwords via brute force
Uploading malicious SQL files to a server
Sniffing SQL traffic on the network
Injecting malicious SQL code into input fields to manipulate database queries (Correct answer)

Correct answer: Injecting malicious SQL code into input fields to manipulate database queries

SQL injection inserts malicious SQL statements into user input fields to manipulate backend database queries.

Question 12: What does MAC address spoofing allow an attacker to do on a network?

Impersonate another device's hardware address (Correct answer)
Encrypt traffic between hosts
Bypass TLS certificate checks
Escalate privileges on a server

Correct answer: Impersonate another device's hardware address

MAC address spoofing changes the hardware address to impersonate another device, bypassing MAC-based access controls.

Question 13: What is a CSPM (Cloud Security Posture Management) tool used for?

Managing user identities in multi-cloud environments
Continuously monitoring cloud infrastructure for misconfigurations and compliance violations (Correct answer)
Scanning cloud storage for malware
Encrypting data stored in cloud databases

Correct answer: Continuously monitoring cloud infrastructure for misconfigurations and compliance violations

CSPM tools automatically detect misconfigurations such as public S3 buckets or overly permissive IAM policies.

Question 14: Which type of malware disguises itself as legitimate software to trick users into installing it?

Adware
Trojan horse (Correct answer)
Worm
Rootkit

Correct answer: Trojan horse

A Trojan horse appears to be a useful program but carries malicious code when executed.

Question 15: What is the risk of orphaned accounts in access management?

They consume excessive storage in the identity store
They generate excessive authentication log noise
They represent access paths that may be exploited since no active owner monitors them (Correct answer)
They prevent new users from being created

Correct answer: They represent access paths that may be exploited since no active owner monitors them

Orphaned accounts (accounts of former employees or decommissioned services) remain active and can be exploited by attackers.

Question 16: What is two-factor authentication (2FA) typically composed of?

A username and password
Two different passwords
Something you know and something you have (Correct answer)
Two security questions

Correct answer: Something you know and something you have

2FA combines two distinct factor types, such as a password and a one-time code from a device.

Question 17: What is the purpose of a Certificate Revocation List (CRL)?

List all active certificates
Store private keys securely
Rank certificates by trust level
Identify certificates that have been revoked before expiry (Correct answer)

Correct answer: Identify certificates that have been revoked before expiry

A CRL lists digital certificates that have been revoked before their expiration date, informing relying parties not to trust them.

Question 18: Which property of a cryptographic hash function ensures it is computationally infeasible to find the original input from its hash?

Determinism
Collision resistance
Preimage resistance (Correct answer)
Avalanche effect

Correct answer: Preimage resistance

Preimage resistance means it is computationally infeasible to reverse a hash and recover the original input.

Question 19: If a user receives a phone call from someone posing as a bank employee demanding that the user update personal information, what type of attack strategy is being used?

pretexting (Correct answer)
blind calling
shoulder surfing
skimming

Correct answer: pretexting

Pretexting is a social engineering technique where an attacker creates a fabricated scenario or 'pretext' to trick a victim into divulging sensitive information. In this case, posing as a bank employee demanding personal information is a classic example of pretexting, as the attacker is creating a false identity and urgent situation to manipulate the victim into revealing data.

Question 20: Which artifact should be preserved immediately when ransomware is detected on a system?

Web server configuration files
All user desktop shortcuts
Email server logs from the past year
A forensic memory and disk image before shutdown (Correct answer)

Correct answer: A forensic memory and disk image before shutdown

Capturing memory and disk images before shutdown preserves volatile forensic evidence and encryption key artifacts.

Question 21: What is credential stuffing?

Encoding passwords in Base64 before transmission
Using stolen username/password pairs from one breach to attempt login to other services (Correct answer)
Storing credentials in an unencrypted text file
Brute-forcing passwords using a dictionary list

Correct answer: Using stolen username/password pairs from one breach to attempt login to other services

Credential stuffing automates login attempts using credentials leaked from one breach to compromise accounts on other services.

Question 22: What does JIT (Just-In-Time) provisioning provide in privileged access management?

Automatic user account creation upon hire
Real-time password rotation for service accounts
Temporary elevated access granted only when needed and automatically revoked after use (Correct answer)
Permanent admin access for all IT staff

Correct answer: Temporary elevated access granted only when needed and automatically revoked after use

JIT provisioning grants elevated privileges only for the duration needed for a task, minimizing persistent privileged access.

Question 23: Which principle ensures that data has not been altered or tampered with during transmission?

Availability
Non-repudiation
Integrity (Correct answer)
Confidentiality

Correct answer: Integrity

Integrity guarantees that information remains accurate and unmodified during storage or transit.

Question 24: What type of malware encrypts victim files and demands payment for the decryption key?

Ransomware (Correct answer)
Rootkit
Spyware
Adware

Correct answer: Ransomware

Ransomware encrypts files on infected systems and demands payment (usually cryptocurrency) for the decryption key.

Question 25: What is the purpose of fuzzing in security testing?

Decrypting captured network traffic
Sending random or malformed input to applications to find crashes or vulnerabilities (Correct answer)
Reverse engineering compiled binaries
Scanning for open ports on a target

Correct answer: Sending random or malformed input to applications to find crashes or vulnerabilities

Fuzzing sends unexpected or random data to applications to uncover crashes, memory corruption, and input validation flaws.

Question 26: What does social engineering exploit in a security context?

Unpatched network services
Software vulnerabilities in operating systems
Human psychology to manipulate individuals into revealing information or taking actions (Correct answer)
Weak cryptographic algorithms

Correct answer: Human psychology to manipulate individuals into revealing information or taking actions

Social engineering manipulates people rather than systems, exploiting trust, urgency, or fear to obtain sensitive information.

Question 27: Which scanning technique sends a TCP SYN packet and waits for a SYN-ACK without completing the handshake?

FIN scan
Full connect scan
SYN (half-open) scan (Correct answer)
UDP scan

Correct answer: SYN (half-open) scan

A SYN scan sends a SYN packet and analyzes responses without completing the full TCP handshake, making it stealthier.

Question 28: What is the purpose of a payload in exploitation?

Encrypt the communication channel
Identify open ports on a target
Generate a vulnerability report
Execute code on the target after a vulnerability is exploited (Correct answer)

Correct answer: Execute code on the target after a vulnerability is exploited

A payload is code delivered to the target after exploitation to perform actions such as opening a remote shell.

Question 29: Which port is used by default for HTTPS traffic?

22
80
8080
443 (Correct answer)

Correct answer: 443

HTTPS uses port 443 by default for encrypted web communication.

Question 30: Which mode of AES operation turns the block cipher into a stream cipher by XORing plaintext with an encrypted counter?

CBC
ECB
OFB
CTR (Correct answer)

Correct answer: CTR

CTR (Counter) mode encrypts successive counter values and XORs the result with plaintext, enabling parallel processing.

Question 31: What is the purpose of a nonce in cryptographic protocols?

Verify the certificate chain
Compress data before encryption
Store the private key securely
Ensure each message or session is unique to prevent replay attacks (Correct answer)

Correct answer: Ensure each message or session is unique to prevent replay attacks

A nonce is a random value used once in a protocol to ensure uniqueness and prevent replay attacks.

Question 32: What is a zero-day vulnerability?

A vulnerability discovered more than a year ago
A vulnerability that is unknown to the vendor with no available patch (Correct answer)
A flaw that only affects systems with no updates installed
An expired CVE entry

Correct answer: A vulnerability that is unknown to the vendor with no available patch

A zero-day is a vulnerability unknown to the vendor, meaning no patch exists and systems are immediately at risk.

Question 33: What is steganography?

Hiding secret data within non-secret files or media (Correct answer)
Signing messages with a hash function
Encrypting data with a one-time pad
Compressing data to reduce file size

Correct answer: Hiding secret data within non-secret files or media

Steganography conceals secret information within ordinary files such as images, audio, or video.

Question 34: What is a rainbow table attack used to crack?

TLS session keys
Encrypted disk images
Hashed passwords by looking up precomputed hash-to-plaintext mappings (Correct answer)
RSA private keys

Correct answer: Hashed passwords by looking up precomputed hash-to-plaintext mappings

Rainbow table attacks use precomputed tables mapping hashes to plaintext values to quickly reverse password hashes.

Question 35: Which cloud service model gives customers the most control over security configurations?

PaaS (Platform as a Service)
IaaS (Infrastructure as a Service) (Correct answer)
SaaS (Software as a Service)
FaaS (Function as a Service)

Correct answer: IaaS (Infrastructure as a Service)

IaaS gives customers control over the OS, applications, and network settings, requiring the most security management.

Question 36: Which hashing algorithm produces a 256-bit digest and is commonly used in digital signatures and certificates?

CRC32
SHA-1
SHA-256 (Correct answer)
MD5

Correct answer: SHA-256

SHA-256 produces a 256-bit hash and is widely used in TLS certificates and digital signatures.

Question 37: Which compliance framework is specifically designed for organizations handling US federal government data in the cloud?

FedRAMP (Correct answer)
HIPAA
SOC 2
PCI DSS

Correct answer: FedRAMP

FedRAMP (Federal Risk and Authorization Management Program) standardizes security requirements for cloud services used by US federal agencies.

Question 38: What does IOC stand for in cybersecurity incident response?

Indicator of Compromise (Correct answer)
Incident Operations Center
Index of Compromise
Input-Output Control

Correct answer: Indicator of Compromise

Indicators of Compromise (IOCs) are artifacts such as malicious IPs, file hashes, or domains that signal a breach.

Question 39: What is multi-factor authentication (MFA)?

Sharing one account across multiple users
Using multiple passwords for a single account
Requiring an admin to approve every login attempt
Requiring two or more verification factors from different categories to authenticate (Correct answer)

Correct answer: Requiring two or more verification factors from different categories to authenticate

MFA combines something you know, something you have, and/or something you are to verify identity more securely.

Question 40: What is Server-Side Request Forgery (SSRF)?

An attack that forges HTTP responses to inject malicious content into a browser
An attack that submits forged form data to bypass server-side validation
An attack where the server is tricked into making requests to unintended internal or external resources (Correct answer)
An attack that spoofs server certificates to perform man-in-the-middle interception

Correct answer: An attack where the server is tricked into making requests to unintended internal or external resources

SSRF manipulates a server into making HTTP requests to internal services or external systems on behalf of the attacker, potentially exposing cloud metadata or internal APIs.

Question 41: What does a CVE (Common Vulnerabilities and Exposures) number identify?

A standard for encrypting network traffic
An authorization level for penetration testers
A classification of malware families
A publicly known cybersecurity vulnerability with a unique identifier (Correct answer)

Correct answer: A publicly known cybersecurity vulnerability with a unique identifier

CVE numbers are unique identifiers assigned to publicly disclosed cybersecurity vulnerabilities.

Question 42: What is privilege escalation in the context of ethical hacking?

Covering tracks by deleting logs
Exfiltrating data from a compromised host
Gaining initial access to a system
Gaining higher-level permissions on a system after initial access (Correct answer)

Correct answer: Gaining higher-level permissions on a system after initial access

Privilege escalation involves exploiting vulnerabilities or misconfigurations to gain elevated permissions such as root or admin.

Question 43: Which elliptic curve algorithm is commonly used for key agreement in modern TLS implementations?

HMAC-SHA1
ECDH (Elliptic Curve Diffie-Hellman) (Correct answer)
RSA-2048
3DES

Correct answer: ECDH (Elliptic Curve Diffie-Hellman)

ECDH provides key agreement using elliptic curve mathematics, offering strong security with shorter key lengths.

Question 44: What technique does a pentester use to move from one compromised system to other systems on the same network?

Privilege escalation
Data exfiltration
Persistence
Lateral movement (Correct answer)

Correct answer: Lateral movement

Lateral movement involves using an initial foothold to access other systems within the same network environment.

Question 45: What is the purpose of a Content Security Policy (CSP) header?

To rate-limit requests to protect against DDoS attacks
To control which cookies are sent with cross-origin requests
To restrict which sources browsers may load resources from, mitigating XSS attacks (Correct answer)
To enforce HTTPS connections across a website

Correct answer: To restrict which sources browsers may load resources from, mitigating XSS attacks

CSP is an HTTP response header that allows servers to declare approved content sources, instructing browsers to only execute or render resources from those origins to reduce XSS risk.

Question 46: What is a CVSS score used for in vulnerability management?

Classifying malware behavior
Identifying the author of a vulnerability disclosure
Measuring the severity of a vulnerability on a standardized scale (Correct answer)
Tracking patch deployment progress

Correct answer: Measuring the severity of a vulnerability on a standardized scale

CVSS (Common Vulnerability Scoring System) provides a standardized numeric severity score from 0 to 10.

Question 47: What does MTTR stand for in incident response metrics?

Mean Time to Respond or Recover (Correct answer)
Multi-Tenant Threat Response
Maximum Threat and Tracking Report
Managed Threat Triage Report

Correct answer: Mean Time to Respond or Recover

MTTR (Mean Time to Respond/Recover) measures the average time to contain and resolve a security incident.

Question 48: What is XML External Entity (XXE) injection?

Using malformed XML to overflow a buffer in the parsing library
Forging XML digital signatures to bypass authentication
Exploiting XML parsers that process external entity references to access files or internal services (Correct answer)
Injecting malicious XML tags to crash the XML parser

Correct answer: Exploiting XML parsers that process external entity references to access files or internal services

XXE injection exploits XML parsers that resolve external entity declarations, allowing attackers to read local files, perform SSRF, or execute denial-of-service attacks.

Question 49: What is the Shared Responsibility Model in cloud security?

The cloud provider is responsible for all security
Security is the responsibility of the internet service provider
Customers own all security controls in the cloud
Security responsibilities are divided between the cloud provider and the customer depending on the service model (Correct answer)

Correct answer: Security responsibilities are divided between the cloud provider and the customer depending on the service model

The shared responsibility model defines what the cloud provider secures (infrastructure) versus what the customer secures (data, apps, access).

Question 50: What does the principle of least privilege mean in cloud IAM?

Require MFA for all cloud API calls
Grant all users admin access to simplify management
Grant users only the minimum permissions needed to perform their job functions (Correct answer)
Automatically revoke all permissions after 24 hours

Correct answer: Grant users only the minimum permissions needed to perform their job functions

Least privilege limits the blast radius of compromised accounts by granting only the permissions necessary for a user's role.

Question 51: What is an access review in identity governance?

A scan of all systems for open ports and vulnerabilities
An audit of all failed login attempts over a time period
A periodic process where managers verify that users have appropriate access rights (Correct answer)
A review of MFA adoption rates across the organization

Correct answer: A periodic process where managers verify that users have appropriate access rights

Access reviews require managers or data owners to certify that users' current permissions remain appropriate for their roles.

Question 52: Which OWASP Top 10 risk refers to using outdated components with known vulnerabilities in web applications?

Injection
Using Components with Known Vulnerabilities (Correct answer)
Security Misconfiguration
Broken Access Control

Correct answer: Using Components with Known Vulnerabilities

Using Components with Known Vulnerabilities is an OWASP Top 10 risk where outdated libraries or frameworks introduce exploitable flaws.

Question 53: What is mass assignment vulnerability in web applications?

Performing bulk SQL inserts without parameterized queries
Assigning excessive permissions to all new user accounts by default
Allowing attackers to bind HTTP request parameters to object properties to modify unauthorized fields (Correct answer)
Assigning the same weak password to multiple user accounts

Correct answer: Allowing attackers to bind HTTP request parameters to object properties to modify unauthorized fields

Mass assignment occurs when a framework automatically binds request parameters to model properties, allowing attackers to set sensitive fields (like 'isAdmin') that were never intended to be user-controlled.

Question 54: What is the first step in the NIST incident response lifecycle?

Preparation (Correct answer)
Post-Incident Activity
Detection and Analysis
Containment

Correct answer: Preparation

Preparation is the first phase in NIST SP 800-61's incident response lifecycle, establishing policies, teams, and tools.

Question 55: What does salting a password hash protect against?

Man-in-the-middle attacks
Rainbow table and precomputed hash attacks (Correct answer)
Session hijacking
Brute force via CPU speed

Correct answer: Rainbow table and precomputed hash attacks

Adding a unique random salt before hashing prevents attackers from using precomputed rainbow tables.

Question 56: What is a common risk associated with publicly accessible cloud storage buckets?

Unintended exposure of sensitive data to anyone on the internet (Correct answer)
Loss of data due to cloud provider hardware failure
Higher cloud billing costs
Increased latency for cloud applications

Correct answer: Unintended exposure of sensitive data to anyone on the internet

Public cloud storage buckets can expose sensitive data to the entire internet if access controls are not properly configured.

Question 57: What is a cloud workload protection platform (CWPP) designed to secure?

Network traffic between cloud regions
Cloud provider billing accounts
Cloud-based identity directories
Servers, containers, and serverless functions running in cloud environments (Correct answer)

Correct answer: Servers, containers, and serverless functions running in cloud environments

CWPP provides runtime protection and vulnerability management for cloud workloads including VMs, containers, and serverless functions.

Question 58: What is the key benefit of encrypting data at rest in cloud storage?

It prevents data loss due to hardware failure
It reduces cloud storage costs
It protects data from unauthorized access if storage media is compromised or misconfigured (Correct answer)
It speeds up data retrieval from cloud services

Correct answer: It protects data from unauthorized access if storage media is compromised or misconfigured

Encrypting data at rest ensures that even if storage is improperly accessed, the data remains unreadable without the encryption key.

Question 59: What is the OWASP Software Assurance Maturity Model (SAMM) used for?

Automatically scanning web applications for the OWASP Top 10 vulnerabilities
Certifying developers as qualified secure coding professionals
Generating security test cases based on application architecture
Providing a framework to assess and improve an organization's software security practices (Correct answer)

Correct answer: Providing a framework to assess and improve an organization's software security practices

OWASP SAMM is an open framework that helps organizations assess their current software security posture and define an improvement roadmap across governance, design, implementation, verification, and operations.

Question 60: What is OAuth 2.0 primarily designed for?

Authenticating users to verify their identity
Encrypting tokens during network transmission
Authorizing third-party applications to access resources on behalf of a user (Correct answer)
Managing group memberships in enterprise directories

Correct answer: Authorizing third-party applications to access resources on behalf of a user

OAuth 2.0 is an authorization framework enabling limited access to user resources without exposing credentials.

Question 61: What is the purpose of a digital signature?

Verify the authenticity and integrity of a message (Correct answer)
Generate session keys
Encrypt message content
Store passwords securely

Correct answer: Verify the authenticity and integrity of a message

A digital signature verifies that a message came from the claimed sender and has not been altered.

Question 62: What does the acronym DDoS stand for?

Distributed Denial of Service (Correct answer)
Direct Data on Server
Dynamic Denial of Security
Dual Domain Operating System

Correct answer: Distributed Denial of Service

A DDoS attack uses many compromised systems to flood a target simultaneously.

Question 63: What type of attack attempts every possible key combination until the correct one is found?

Brute force attack (Correct answer)
Birthday attack
Dictionary attack
Side-channel attack

Correct answer: Brute force attack

A brute force attack systematically tries every possible key or password until the correct one is found.

Question 64: Which security control helps detect unauthorized API calls and configuration changes in AWS?

AWS Shield
AWS CloudTrail (Correct answer)
AWS Macie
AWS WAF

Correct answer: AWS CloudTrail

AWS CloudTrail logs all API calls and management events, providing an audit trail for security investigations.

Question 65: What is infrastructure as code (IaC) security scanning used to detect?

Data exfiltration from cloud storage
Misconfigurations in Terraform or CloudFormation templates before deployment (Correct answer)
Malware in container images
Unauthorized API calls in production

Correct answer: Misconfigurations in Terraform or CloudFormation templates before deployment

IaC security scanning analyzes templates like Terraform or CloudFormation to find misconfigurations before they reach production.

Question 66: Which option is the best for determining who in a company should be in charge of cybersecurity?

They are in the best position to understand and promote cybersecurity within a company, IT specialists are the finest candidates.
To lessen the danger of cyber assaults, all employees should have a basic understanding of cybersecurity. (Correct answer)
Owners of a company They are the ones that run the company, so they must be familiar with cybersecurity fundamentals and put them into practice in order to lower the danger of a cyberattack.
Managers, because they are in charge of ensuring that employees follow the proper procedures.

Correct answer: To lessen the danger of cyber assaults, all employees should have a basic understanding of cybersecurity.

While IT specialists and company owners play critical roles in establishing and maintaining cybersecurity infrastructure and policies, effective cybersecurity is a shared responsibility. Every employee, regardless of their role, interacts with company systems and data, making them a potential entry point for cyber threats. Therefore, a basic understanding of cybersecurity best practices across all employees is essential to create a strong human firewall and significantly reduce the risk of successful attacks.

Question 67: Which type of XSS attack stores the malicious script on the server so it affects all users who view the page?

Blind XSS
DOM-based XSS
Stored (persistent) XSS (Correct answer)
Reflected XSS

Correct answer: Stored (persistent) XSS

Stored XSS persists the malicious script in the server's database, delivering it to every user who views the affected page.

Question 68: What is password spraying?

Trying a few common passwords against many accounts to avoid account lockout (Correct answer)
Capturing hashed passwords from a compromised database
Attempting many passwords against a single account quickly
Injecting password reset tokens via CSRF

Correct answer: Trying a few common passwords against many accounts to avoid account lockout

Password spraying tries a small number of common passwords across many accounts, evading lockout policies triggered by many attempts on one account.

Question 69: What is the primary goal of the eradication phase in incident response?

Restore backups and resume business operations
Conduct a lessons-learned review
Remove the threat from all affected systems (Correct answer)
Notify law enforcement of the attack

Correct answer: Remove the threat from all affected systems

Eradication removes malware, closes vulnerabilities, and eliminates all traces of the attacker from affected systems.

Question 70: What is a chain of custody in digital forensics?

The order in which malware spreads across a network
Documentation tracking evidence handling from collection to court presentation (Correct answer)
A checklist for incident response procedures
The sequence of events in a security incident

Correct answer: Documentation tracking evidence handling from collection to court presentation

Chain of custody documents who handled digital evidence, when, and how, preserving its integrity for legal proceedings.

Question 71: Which encryption type uses the same key for both encryption and decryption?

Hashing
Symmetric encryption (Correct answer)
Asymmetric encryption
Public-key encryption

Correct answer: Symmetric encryption

Symmetric encryption relies on a single shared secret key for both operations.

Question 72: What is a privileged access workstation (PAW) used for?

Monitor network traffic from admin accounts
Rotate service account passwords automatically
Provide a hardened, isolated machine for performing administrative tasks (Correct answer)
Allow general employees to access cloud services

Correct answer: Provide a hardened, isolated machine for performing administrative tasks

A PAW is a dedicated, hardened workstation used only for privileged tasks, reducing the attack surface for admin credentials.

Question 73: What is the difference between an incident and an event in cybersecurity?

Events are more severe than incidents
Incidents are automatically resolved; events require manual response
An event is any observable occurrence; an incident is an event with negative security implications (Correct answer)
Events require executive notification; incidents do not

Correct answer: An event is any observable occurrence; an incident is an event with negative security implications

An event is any observable system activity, while an incident is an event that violates security policies or poses a threat.

Question 74: Which protocol is most vulnerable to ARP poisoning attacks?

HTTPS traffic
IPv4 on a local network segment (Correct answer)
DNS over TLS
IPv6

Correct answer: IPv4 on a local network segment

ARP poisoning targets IPv4 on local network segments by associating the attacker's MAC with a legitimate IP address.

Question 75: Which key is used to encrypt a message so that only the intended recipient can decrypt it?

The CA's root key
The sender's private key
A shared symmetric key
The recipient's public key (Correct answer)

Correct answer: The recipient's public key

Encrypting with the recipient's public key ensures only the holder of the corresponding private key can decrypt it.

Question 76: What is the primary purpose of a firewall?

To encrypt stored files
To monitor and control incoming and outgoing network traffic (Correct answer)
To scan for malware signatures
To back up data automatically

Correct answer: To monitor and control incoming and outgoing network traffic

A firewall enforces rules that filter network traffic between trusted and untrusted networks.

Question 77: What is the key difference between symmetric and asymmetric encryption?

Symmetric uses one shared key; asymmetric uses a public/private key pair (Correct answer)
Symmetric is slower than asymmetric
Symmetric uses two keys; asymmetric uses one
Asymmetric requires hardware tokens

Correct answer: Symmetric uses one shared key; asymmetric uses a public/private key pair

Symmetric encryption uses one shared key for both encryption and decryption, while asymmetric uses a public/private key pair.

Question 78: What does HMAC (Hash-based Message Authentication Code) provide?

Key generation for asymmetric algorithms
Both message integrity and authenticity using a shared secret key (Correct answer)
Certificate signing for PKI
Entropy for random number generation

Correct answer: Both message integrity and authenticity using a shared secret key

HMAC combines a cryptographic hash with a secret key to provide both data integrity and authentication.

Question 79: What document legally authorizes a penetration tester to perform testing activities on a client's systems?

Non-Disclosure Agreement (NDA)
Statement of Health (SoH)
Vulnerability Assessment Report
Rules of Engagement (RoE) and Scope of Work (Correct answer)

Correct answer: Rules of Engagement (RoE) and Scope of Work

The Rules of Engagement and Scope of Work define what is authorized, limiting legal risk for the tester.

Question 80: What does containment in incident response aim to achieve?

Identify the root cause of the incident
Document all evidence for legal proceedings
Restore systems to normal operations
Limit the spread and damage of the incident (Correct answer)

Correct answer: Limit the spread and damage of the incident

Containment stops the incident from spreading to additional systems while the organization investigates and plans recovery.

Question 81: What does a Virtual Private Cloud (VPC) provide in cloud environments?

A managed container orchestration service
Automatic backups of all virtual machine data
A dedicated physical server in the cloud provider's data center
An isolated network environment within the cloud for deploying resources (Correct answer)

Correct answer: An isolated network environment within the cloud for deploying resources

A VPC provides an isolated, logically defined network in the cloud where you control IP ranges, subnets, and routing.

Question 82: What is a SQL injection attack?

Flooding a database server with requests to cause downtime
Intercepting database traffic between client and server
Inserting malicious SQL code into input fields to manipulate database queries (Correct answer)
Encrypting database contents to demand ransom

Correct answer: Inserting malicious SQL code into input fields to manipulate database queries

SQL injection inserts malicious SQL statements into input fields, manipulating backend queries to expose, modify, or delete database data.

Question 83: Which phase of penetration testing involves documenting findings and providing remediation recommendations?

Reconnaissance
Reporting (Correct answer)
Lateral movement
Exploitation

Correct answer: Reporting

The reporting phase documents vulnerabilities found, their severity, and recommended remediation steps for the client.

Question 84: What does ABAC (Attribute-Based Access Control) use to make access decisions?

Fixed roles assigned at account creation
Group membership in Active Directory
Attributes of the user, resource, and environment at the time of access (Correct answer)
Physical badges and biometrics only

Correct answer: Attributes of the user, resource, and environment at the time of access

ABAC evaluates attributes such as user department, resource classification, and time of day to make dynamic access decisions.

Question 85: What is memory forensics used to uncover during incident response?

Deleted files on a hard drive
Running processes, injected code, and encryption keys in volatile RAM (Correct answer)
Network firewall rule changes
Web browser history from last month

Correct answer: Running processes, injected code, and encryption keys in volatile RAM

Memory forensics analyzes a RAM dump to find running processes, malware artifacts, and data that never touches disk.

Question 86: What is the purpose of security groups in AWS?

Encrypt data stored in S3 buckets
Monitor cloud resource usage for billing purposes
Act as virtual firewalls controlling inbound and outbound traffic for EC2 instances (Correct answer)
Group IAM users with similar permission sets

Correct answer: Act as virtual firewalls controlling inbound and outbound traffic for EC2 instances

AWS security groups function as virtual firewalls, controlling allowed inbound and outbound traffic for instances.

Question 87: What is lateral movement detection typically based on in a SIEM?

Slow network throughput on WAN links
Anomalous authentication events and unusual access patterns across internal systems (Correct answer)
High CPU usage on a server
Increased DNS query volume from a workstation

Correct answer: Anomalous authentication events and unusual access patterns across internal systems

SIEM rules flag unusual authentication patterns, such as a single account logging into many hosts in a short time window.

Question 88: Which encryption standard replaced DES and is the current US federal standard for symmetric encryption?

RSA
AES (Correct answer)
Blowfish
3DES

Correct answer: AES

AES (Advanced Encryption Standard) replaced DES in 2001 and is the current NIST-approved symmetric cipher.

Question 89: Which log source is most useful for detecting unauthorized privilege escalation on a Windows system?

Windows Security Event Log (Correct answer)
Web server access logs
DNS query logs
DHCP lease logs

Correct answer: Windows Security Event Log

The Windows Security Event Log records authentication events, privilege use, and account management changes.

Question 90: What distinguishes a white-box penetration test from a black-box test?

White-box testers have full knowledge of the target; black-box testers have none (Correct answer)
Black-box tests require physical access; white-box tests do not
White-box testers have no prior knowledge; black-box testers have full knowledge
White-box tests are automated; black-box tests are manual

Correct answer: White-box testers have full knowledge of the target; black-box testers have none

In a white-box test, the tester has full knowledge of the target environment, simulating an insider threat or informed attacker.

Cyber Security Certification Exam

The Cyber Security exam assesses knowledge of network security, cryptography, ethical hacking, incident response, cloud security, and identity and access management.

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds