🏠 Homepage 📘 Download PDF Books 📕 Premium PDF Books

Cyber Security Quiz 19 (10 MCQs)

This set of multiple-choice questions evaluates knowledge of cyber security threats, including DDoS attacks, phishing, and pharming, as well as network security measures such as firewalls, encryption, and access controls. It assesses the ability to identify security vulnerabilities, understand hacker tactics, and implement risk mitigation strategies.

Quiz Instructions

Select an option to see the correct answer instantly.

1. It acts as a barrier between a trusted system or network and outside connections, such as the Internet.

Correct Answer: Correct answer is: (A) Firewall.

Exam Relevance: CISSP, CompTIA Security+, CEH

Difficulty: Easy

Concept notes: A firewall is a security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules. It acts as a barrier between a trusted system or network and outside connections, such as the Internet.

Common Mistakes: A common misunderstanding is that a firewall is the only security measure needed to protect a network. In reality, a firewall is just one component of a comprehensive security strategy.

Explanations: A firewall acts as a barrier between a trusted system or network and outside connections, such as the Internet. It monitors and controls network traffic based on security rules, preventing unauthorized access and protecting the network from potential threats.

Option Analysis:

Option A: Correct. A firewall acts as a barrier between a trusted system or network and outside connections, such as the Internet.
Option B: Incorrect. Spyware is malicious software that secretly monitors a user's activities and collects personal information, but it does not act as a barrier.
Option C: Incorrect. Phishing is a fraudulent attempt to obtain sensitive information by disguising oneself as a trustworthy entity, but it does not act as a barrier.
Option D: Incorrect. Encryption is the process of converting information into a secure code to prevent unauthorized access, but it does not act as a barrier.

2. What is a Distributed Denial of Service (DDoS) attack?

Correct Answer: Correct answer is: (B) An attempt to deny access to a website by flooding the website's servers with millions of requests from different computers.

Exam Relevance: CISSP, CompTIA Security+, CEH

Difficulty: Easy

Concept notes: A Distributed Denial of Service (DDoS) attack is a cyber attack where multiple compromised computer systems attack a target, such as a server, website, or other network resource. The goal is to overwhelm the target with a flood of internet traffic, making it inaccessible to legitimate users.

Common Mistakes: A common misunderstanding is that a DDoS attack is the same as a Denial of Service (DoS) attack. While both aim to disrupt services, a DDoS attack uses multiple sources, whereas a DoS attack typically uses a single source.

Explanations: A DDoS attack involves flooding a website's servers with millions of requests from different computers. This overwhelming amount of traffic can cause the website to become unresponsive or crash, effectively denying access to legitimate users. This is a common tactic used by cyber attackers to disrupt services and cause significant downtime.

Option Analysis:

Option A: This describes a government action to restrict internet access, not a DDoS attack.
Option B: This accurately describes a DDoS attack, where multiple computers are used to flood a website's servers with requests.
Option C: This describes a social media issue, not a DDoS attack.
Option D: This describes an attempt to access private information, which is a different type of cyber attack, not a DDoS attack.

Mnemonic: DDoS: Distributed Denial of Service, "D" for "Different" sources.

3. Which of the following is a secure connection that hides your IP address?

Correct Answer: Correct answer is: (B) VPN.

Exam Relevance: CISSP, CompTIA Security+, CCNA Security

Difficulty: Easy

Concept notes: A Virtual Private Network (VPN) is a secure connection that hides your IP address by routing your internet traffic through a remote server.

Common Mistakes: A common misunderstanding is that other network types like LAN or ISP can also hide your IP address, but they do not provide the same level of security and privacy as a VPN.

Explanations: A Virtual Private Network (VPN) encrypts your internet traffic and routes it through a remote server, which hides your original IP address. This makes it difficult for anyone to track your online activities or determine your location. Other options like LAN, DNS, and ISP do not provide this level of security and privacy.

Option Analysis:

Option A: LAN (Local Area Network) is a network that connects computers within a limited area, such as a home or office, and does not hide your IP address.
Option B: VPN (Virtual Private Network) is a secure connection that hides your IP address by routing your internet traffic through a remote server.
Option C: DNS (Domain Name System) is a system that translates domain names into IP addresses and does not provide security or privacy features.
Option D: ISP (Internet Service Provider) provides internet access but does not hide your IP address.

4. Which of the following is the best description of a hacker?

Correct Answer: Correct answer is: (A) A computer user who attempts to acquire unauthorized entry to servers and computer systems.

Exam Relevance: CISSP, CEH, CompTIA Security+

Difficulty: Moderate

Concept notes: In cyber security, a hacker is typically defined as someone who attempts to gain unauthorized access to computer systems or networks.

Common Mistakes: A common misunderstanding is that all hackers are malicious, but in reality, there are different types of hackers, such as white-hat, black-hat, and grey-hat hackers, each with different intentions.

Explanations: The correct answer describes a hacker as a computer user who attempts to acquire unauthorized entry to servers and computer systems. This aligns with the common definition in cyber security, where hackers are individuals who exploit vulnerabilities to gain unauthorized access. The other option describes a cyberbully, which is a different concept in cyber security.

Option Analysis:

Option A: This option correctly defines a hacker in the context of cyber security.
Option B: This option describes a cyberbully, which is not the same as a hacker.

5. An Internet attack that causes a server to crash by making repeated requests to the same IP address:

Correct Answer: Correct answer is: (A) DDoS (Distributed Denial of Service).

Exam Relevance: CISSP, CEH, CompTIA Security+

Difficulty: Moderate

Concept notes: DDoS attacks involve overwhelming a server with a large number of requests, causing it to crash or become unavailable.

Common Mistakes: A common misunderstanding is that DDoS attacks are the same as DoS (Denial of Service) attacks. While both aim to disrupt services, DDoS attacks use multiple sources, making them more difficult to mitigate.

Explanations: DDoS attacks are designed to flood a server with a high volume of traffic from multiple sources, often using botnets. This repeated and overwhelming traffic can cause the server to crash or become unresponsive, effectively denying legitimate users access to the service.

Option Analysis:

Option A: Correct. DDoS attacks involve multiple sources sending repeated requests to a server, causing it to crash.
Option B: Incorrect. Cache poisoning involves corrupting a DNS cache to redirect users to malicious sites, not crashing a server.
Option C: Incorrect. DNS hijacking involves redirecting traffic to a different server, not crashing the original server.
Option D: Incorrect. Phishing involves tricking users into providing sensitive information, not crashing a server.

Mnemonic: DDoS: "Distributed Denial of Service" - "D" for "Distributed" and "D" for "Denial."

6. A feature or defect of a computer system that allows surreptitious unauthorized access to data

Correct Answer: Correct answer is: (C) Back doors.

Exam Relevance: CISSP, CompTIA Security+, CEH

Difficulty: Moderate

Concept notes: A back door is a hidden method of bypassing normal authentication or security mechanisms to gain unauthorized access to a system.

Common Mistakes: A common misunderstanding is that a back door is a type of malware, but it is actually a feature or defect that allows unauthorized access.

Explanations: Back doors are intentionally or unintentionally created vulnerabilities that allow unauthorized access to a system. They are not malware like trojan horses, nor are they network types like intranets or blended threats. Back doors are specifically designed or discovered to provide a way for unauthorized users to access data or systems.

Option Analysis:

Option A: An intranet is a private network that is used within an organization, not a method for unauthorized access.
Option B: A trojan horse is a type of malware that appears to be legitimate software but can perform malicious actions, not a back door.
Option C: A back door is a hidden method of bypassing normal security mechanisms to gain unauthorized access, which matches the description in the question.
Option D: A blended threat is a combination of different types of malware, not a back door.

7. Which is a process of testing weaknesses of the system?

Correct Answer: Correct answer is: (A) Pen Test.

Exam Relevance: CISSP, CEH, CompTIA Security+

Difficulty: Easy

Concept notes: Penetration testing, or pen testing, is a process of evaluating the security of a computer system or network by simulating an attack from malicious threats.

Common Mistakes: A common misunderstanding is that other tests like "Pencil Test," "Chalk Test," or "Rubber Test" are valid security testing methods. These terms are not recognized in the context of cybersecurity.

Explanations: Pen testing involves identifying and exploiting vulnerabilities in a system to assess its security. This process helps organizations understand their security posture and take necessary measures to mitigate risks.

Option Analysis:

Option A: Pen Test is the correct term for testing the weaknesses of a system in cybersecurity.
Option B: Pencil Test is not a recognized term in cybersecurity.
Option C: Chalk Test is not a recognized term in cybersecurity.
Option D: Rubber Test is not a recognized term in cybersecurity.

Mnemonic: PEN for Penetration, TEST for Testing

8. Which of the following is not a test of access controls?

Correct Answer: Correct answer is: (C) Backup controls.

Exam Relevance: CISSP, CompTIA Security+, CISA

Difficulty: Moderate

Concept notes: Access controls are mechanisms used to regulate who or what can view or use resources in a computing environment. They are designed to ensure that only authorized users have access to specific resources.

Common Mistakes: A common misunderstanding is that backup controls are a form of access control. However, backup controls are primarily concerned with data recovery and integrity, not with regulating access to resources.

Explanations: Access controls include methods such as biometric controls (e.g., fingerprint or facial recognition) and encryption controls (e.g., securing data with cryptographic keys). Inference controls are also a form of access control, designed to prevent unauthorized inference of sensitive information. Backup controls, on the other hand, are focused on ensuring data can be restored in case of loss or corruption, and do not directly regulate access to resources.

Option Analysis:

Option A: Biometric controls are a form of access control that uses physical characteristics to authenticate users.
Option B: Encryption controls are a form of access control that secures data to prevent unauthorized access.
Option C: Backup controls are not a form of access control; they are focused on data recovery and integrity.
Option D: Inference controls are a form of access control that prevents unauthorized inference of sensitive information.

9. Implementing a "threat-centric" security strategy means to focus on which one of the following options?

Correct Answer: Correct answer is: (B) Attacks.

Exam Relevance: CISSP, CISM, CEH

Difficulty: Moderate

Concept notes: A "threat-centric" security strategy focuses on understanding and mitigating specific threats or attacks that could compromise an organization's security.

Common Mistakes: A common misunderstanding is that a threat-centric approach focuses on general defenses or compliance regulations rather than specific attacks.

Explanations: A threat-centric security strategy prioritizes identifying and understanding the specific attacks that pose the greatest risk to an organization. This approach involves analyzing potential threats, understanding their methods, and implementing targeted defenses to mitigate these specific risks. By focusing on attacks, organizations can better allocate resources and develop more effective security measures.

Option Analysis:

Option A: Defenses are a part of the security strategy but do not define a threat-centric approach.
Option B: Attacks are the focus of a threat-centric security strategy, as it involves understanding and mitigating specific threats.
Option C: Company assets are important but are not the primary focus of a threat-centric approach.
Option D: Compliance regulations are important for legal and operational reasons but do not define a threat-centric approach.

10. Pharming, phishing and other malicious acts are known as .....

Correct Answer: Correct answer is: (B) Social Engineering.

Exam Relevance: CISSP, CompTIA Security+, CEH

Difficulty: Moderate

Concept notes: Social engineering involves manipulating individuals to divulge confidential information or perform actions that can compromise security. This includes tactics like phishing and pharming.

Common Mistakes: A common mistake is confusing social engineering with social networking, which refers to online platforms for social interaction.

Explanations: Pharming, phishing, and other malicious acts are categorized under social engineering because they exploit human psychology to gain unauthorized access to information or systems. These tactics rely on deception and manipulation rather than technical hacking methods.

Option Analysis:

Option A: Social networking is a platform for social interaction and does not involve malicious activities.
Option B: Social engineering involves manipulating individuals to perform actions that can compromise security, which includes phishing and pharming.
Option C: This option is incorrect as social engineering is the correct term for these malicious acts.
Option D: This option is incorrect as not all the above options are correct.

Frequently Asked Questions

What is a DDoS attack?

A DDoS attack, or Distributed Denial of Service attack, is a cyber attack where multiple compromised systems overwhelm a target server with traffic, causing it to crash or become inaccessible.

How does a firewall protect a network?

A firewall acts as a barrier between a trusted internal network and untrusted external networks, monitoring and controlling incoming and outgoing network traffic based on predetermined security rules.

What is the purpose of encryption controls?

Encryption controls protect data by converting it into a coded form that can only be accessed with a decryption key, ensuring that sensitive information remains confidential and secure.

What is social engineering in the context of cybersecurity?

Social engineering involves manipulating individuals into divulging confidential information or performing actions that compromise security, often through deceptive tactics like phishing or pretexting.

What is a back door in cybersecurity?

A back door is a hidden method, often intentionally created, that allows unauthorized access to a computer system or network, bypassing normal authentication procedures.

🏠 Back to Homepage 📘 Download PDF Books 📕 Premium PDF Books