1. Which security principle ensures that a user can access only the resources necessary for their role?
A. Defense in Depth
B. Principle of Least Privilege
C. Security Through Obscurity
D. Availability
2. A hacker sends a specially crafted email containing a malicious link that redirects a victim to a fake login page. Which attack is this MOST likely to represent?
A. DDoS attack
B. Phishing attack
C. Brute-force attack
D. SQL injection
3. What is the primary purpose of a cryptographic hash function such as SHA-256?
A. To encrypt data so it can always be decrypted
B. To generate a fixed-length representation used to verify data integrity
C. To increase network bandwidth
D. To hide an IP address
4. Which scenario BEST describes a Man-in-the-Middle (MitM) attack?
A. An attacker overwhelms a server with traffic
B. An attacker secretly intercepts communication between two parties
C. An attacker guesses a password repeatedly
D. An attacker deletes files from a computer
5. In cybersecurity, what is the primary purpose of a digital certificate?
A. To increase internet speed
B. To verify the identity of a website or entity and support secure communication
C. To remove malware automatically
D. To store user passwords
6. Which attack exploits unsanitized user input to execute unauthorized database queries?
A. Cross-Site Scripting (XSS)
B. SQL Injection
C. Ransomware
D. Credential Stuffing
7. An organization uses multiple independent security controls so that if one fails, others can still protect the system. What security strategy is this?
A. Defense in Depth
B. Single Sign-On
C. Data Compression
D. Open Access
8. Which statement BEST distinguishes encryption from hashing?
A. Encryption is generally reversible with the appropriate key, while hashing is designed to be one-way
B. Hashing always requires a private key, while encryption does not
C. Encryption cannot protect confidential information
D. Hashing is used only for video files
9. A security analyst discovers that an employee’s password was leaked online and then used to access several other accounts because the employee reused the same password. Which attack technique is MOST relevant?
A. Credential Stuffing
B. Packet Sniffing
C. DDoS
D. Port Scanning
10. A company assumes that no user or device should automatically be trusted, even when operating inside the organization’s network. Which security model does this describe?
A. Zero Trust Architecture
B. Open Network Architecture
C. Perimeter-Only Security
D. Anonymous Access
1-B | 2-B | 3-B | 4-B | 5-B | 6-B | 7-A | 8-A | 9-A | 10-A
