Cybersecurity Fundamentals: CIA Triad, Risk, Attacks, Cryptography & Networks

[Q1.1] A DDoS attack floods your website with traffic, crashing it and making it unavailable to the public. Which CIA Triad principle is most directly compromised?

Availability

[Q1.2] A malicious file corrupts a student's OS and makes the device unusable, so they can't submit assignments. Which CIA Triad principle is primarily affected?

Availability

[Q1.3] True or False: A company's security must be a defense-in-depth strategy, with layers of protection across all domains.

True

[Q1.4] True or False: The IT security policy framework (Policies, Standards, Procedures, Guidelines) is a 'bottom-up' approach, beginning with guidelines and ending with policies.

False

[Q1.5] Employees must use 2FA and a VPN to access the company network from off-site. Which IT infrastructure domain do these controls primarily protect?

Remote Access Domain

[Q1.6] An employee clicks a phishing link that installs a virus encrypting student records. This failure belongs to which IT infrastructure domain?

User Domain

[Q1.7] Sensitive customer data is leaked from your company's database to the public internet. Which CIA Triad principle is directly compromised?

Confidentiality

[Q1.8] True or False: An undiscovered software flaw is considered a 'risk' on its own.

False

[Q1.9] A policy says employees must use strong passwords. A related standard says passwords must be at least 12 characters with mixed character types. What is the relationship of the standard to the policy?

A mandatory requirement that supports and formalizes the high-level policy

[Q1.10] True or False: If a system's integrity is compromised, it always means a hacker has stolen data.

False

[Q2.1] True or False: A company's brand image and reputation are non-essential assets in risk management because they're hard to value, so protecting them is a lower priority than financial or IP assets.

False

[Q2.2] Why is a layered (defense-in-depth) approach more effective than a single powerful antivirus against polymorphic malware?

If the malware bypasses the antivirus (one layer), other controls like an IPS or firewalls may still detect and block it

[Q2.3] True or False: A qualitative risk assessment is more objective than a quantitative one because it relies on expert consensus.

False

[Q2.4] What is the core difference between phishing and pharming?

Phishing tricks the user with a deceptive email or message; pharming poisons DNS to redirect the user without their knowledge

[Q2.5] A software bug could be exploited by a malicious actor to gain unauthorized access to customer data. What are the bug and the actor, respectively?

The bug is a vulnerability; the malicious actor is a threat

[Q2.6] Someone finds your zero-day, offers to disclose the fix for a bug bounty, and threatens to go public if you don't pay. What type of hacker is this?

Gray-hat hacker

[Q2.7] True or False: Whaling is social engineering that targets high-value individuals such as executives with highly personalized, convincing tactics.

True

[Q2.8] A ransomware risk lands in the upper-right quadrant of the qualitative risk matrix. What does that signify and what is the response?

High probability and high impact; it should be the immediate focus of risk reduction efforts

[Q2.9] True or False: A BCP is primarily about restoring IT infrastructure, while a DRP focuses on keeping business functions operating through an outage.

False

[Q2.10] True or False: Brute-force and dictionary password attacks are both active attacks, even though they don't require interaction with a live user.

True

[Q3.1] What key characteristic must an effective honeypot have?

A dedicated firewall that prevents all outbound traffic in case it is compromised

[Q3.2] Firewall logs show scans to an unusual port, but your IDS didn't alert. What is the most likely reason?

It's signature-based and the scan came from a new, unknown tool not in the signature database

[Q3.3] What is the best argument to counter a non-IT manager who says physical breaches are more likely and damaging than cyberattacks?

Cyberattacks have all the same consequences as physical breaches (reputation, financial loss, etc.) but can occur globally at much faster speed

[Q3.4] Malware infects web servers, spreads across the local network, and emails itself to contacts. What is the best historical comparison?

W32/Nimda (first worm to use multiple propagation vectors: email, network shares, web servers)

[Q3.5] What is the biggest risk of a rogue wireless access point connected to the internal network?

It gives an attacker a new, easy entry point for a direct attack that bypasses perimeter defenses

[Q3.6] How should you respond to a manager worried about file-infecting viruses spreading through file sharing and email?

Acknowledge it, but file-infecting viruses aren't the primary threat today; network-based threats are far more common because of the Internet

[Q3.7] True or False: A low-level employee angry about a demotion uses their credentials to delete critical files. This is a structured attack because of their anger.

False

[Q3.8] An attacker performs DNS lookups, ping sweeps, and port scans. What is the objective at this phase?

Reconnaissance and probing: collect information to identify vulnerabilities for a future exploit

[Q3.9] What is the main advantage of whitelisting over blacklisting against zero-day malware?

Whitelisting blocks unknown threats by default; blacklisting only blocks known threats

[Q3.10] What is the most compelling argument that threats to AI-powered mobile devices and IoT will be a major concern?

History shows new malware appears whenever new platforms increase the number of vulnerable targets

[Q4.1] A log file's hash doesn't match a hash freshly computed from a copy. What objective was the hash protecting, and what does the mismatch mean?

Integrity; the file has been altered

[Q4.2] True or False: A one-time pad is theoretically unbreakable if the key is truly random, as long as the message, and used for only one message.

True

[Q4.3] What is the best way to securely send a very large file to many users?

Use asymmetric encryption to exchange a temporary symmetric session key, then use it to encrypt the large file

[Q4.4] True or False: A large keyspace alone does not guarantee a cipher is computationally secure (a design flaw can allow the key to be broken one part at a time).

True

[Q4.5] True or False: Reusing the same key for all communications over a set period makes a home-grown cipher easier and more secure.

False

[Q4.6] What does verifying a client's digital signature on a contract give the lawyer?

Assurance of the sender's identity (authentication) and that the contract wasn't altered (integrity)

[Q4.7] Three employees each need a unique shared symmetric key with every other employee. How many keys are needed?

3

[Q4.8] Why did the Allies break Enigma despite its enormous keyspace?

A weakness in the German key management protocol let cryptanalysts exploit patterns in message keying (a repeated message key at the start of each transmission)

[Q4.9] A report must be unreadable if intercepted and verifiably unchanged. Which cryptographic principles achieve this?

Confidentiality and Integrity

[Q4.10] Which key system is most practical for 10,000 employees who must all communicate securely, and why?

Asymmetric; each employee manages just one key pair (symmetric would need 49,995,000 keys)

[Q5.1] Which feature separates the patient records system from guest Wi-Fi on the same core switch and minimizes broadcast traffic?

VLAN (Virtual Local Area Network)

[Q5.2] True or False: A border router's primary security role is to apply NAT before packets exit to the WAN, while an internal router's role is to logically separate subnets and filter traffic between departments.

True

[Q5.3] True or False: NAC posture checking primarily focuses on authenticating the user's credentials.

False

[Q5.4] True or False: A fiber-optic cable manufacturer must ensure compatibility with Layer 3 IP addressing and Layer 4 TCP.

False

[Q5.5] A firewall rule limits new connection attempts per second to a database's service port. Which OSI layer is this defense applied at?

Layer 4: Transport

[Q5.6] End-to-end encryption is enforced to stop an insider passively listening via a network tap. Which CIA goal does it protect and which risk does it address?

Confidentiality; eavesdropping

[Q5.7] True or False: Security professionals always prefer TCP over UDP because TCP's reliability makes it inherently more secure.

False

[Q5.8] Why choose SSH over Telnet for remote administration?

SSH encrypts the session; Telnet sends credentials and data in plain text

[Q5.9] Which two adjacent OSI layers are most critical for encryption and secure presentation of data?

Application (L7) and Presentation (L6)

[Q5.10] True or False: MAC address filtering on a wireless access point is a strong control because an attacker would need physical access to the building's wiring to defeat it.

False