Cybersecurity Fundamentals Practice Exam

Question 1 Cybersecurity Fundamentals

What is a trojan?

Certificate Authority — trusted entity that issues digital certificates. Malware disguised as legitimate software. Same-Origin Policy — browsers restrict scripts from interacting across origins. Social engineering manipulates people into divulging information or performing actions that compromise security, exploiting trust, fear, or urgency. It is highly effective because it targets human psychology rather than technical defenses, bypassing firewalls and encryption entirely.

Question 2 Cybersecurity Fundamentals

What is split tunneling?

Systems ship with security enabled, requiring explicit action to weaken it. Some VPN traffic goes through tunnel, some directly to internet — performance vs. security trade-off. SQL injection works by inserting malicious SQL code into input fields (such as login forms) that are passed directly to a database query without proper sanitization. It exploits improper input validation, allowing attackers to read, modify, or delete database contents. Reducing attack surface by removing unnecessary services, applying secure defaults, restricting access.

Question 3 Cybersecurity Fundamentals

What is HIPAA?

Interactive AST — combines SAST and DAST by instrumenting the running app. A password manager securely stores and generates unique, complex passwords for every account, encrypted behind one master password. It eliminates password reuse, removes the need to memorize passwords, and makes it easy to use strong credentials everywhere. US law protecting health information privacy and security. SQL injection works by inserting malicious SQL code into input fields (such as login forms) that are passed directly to a database query without proper sanitization. It exploits improper input validation, allowing attackers to read, modify, or delete database contents.

Question 4 Cybersecurity Fundamentals

Why is "availability" considered equally important as confidentiality and integrity?

Even if data remains confidential and unaltered, a system is useless if legitimate users cannot access it when needed. DDoS attacks, ransomware, and hardware failures all target availability, potentially causing significant financial and operational damage. A salt is a unique random value added to each password before hashing, ensuring that identical passwords produce different hashes. Without salting, attackers can use precomputed rainbow tables to quickly crack hashed passwords in bulk. Stealing or guessing a session ID to impersonate the user. Injecting carriage return / line feed into HTTP headers to manipulate response.

Question 5 Cybersecurity Fundamentals

How does SQL injection work and what type of vulnerability does it exploit?

Automated workflow responding to a specific alert type — speeds containment. Header preventing the page from being embedded in iframes — defeats clickjacking. Now largely superseded by CSP frame-ancestors. SQL injection works by inserting malicious SQL code into input fields (such as login forms) that are passed directly to a database query without proper sanitization. It exploits improper input validation, allowing attackers to read, modify, or delete database contents. Fail-secure: failure denies access (default for security). Fail-open: failure allows access (for safety-critical systems).

Question 6 Cybersecurity Fundamentals

What is a reverse proxy?

Sits in front of servers, terminating connections; useful for TLS, caching, WAF integration. In a MITM attack, an attacker secretly intercepts and potentially alters communication between two parties who believe they are communicating directly. HTTPS encrypts traffic using TLS, making it extremely difficult for an attacker to read or modify the data in transit. Bring Your Own Device — employees use personal devices for work; introduces security complexity. Random token tied to user session that must accompany state-changing requests — attacker can't forge it.

Question 7 Cybersecurity Fundamentals

What is BYOD?

Identity layer built on OAuth 2.0 — adds authentication and ID tokens. Server includes a recent OCSP response in TLS handshake — reduces client-side OCSP traffic. Bring Your Own Device — employees use personal devices for work; introduces security complexity. Precomputed table of password hashes for fast lookup — defeated by salting.

Question 8 Cybersecurity Fundamentals

What does "confidentiality" mean?

Common Vulnerability Scoring System — 0–10 severity score based on attack vector, complexity, impact. A VPN (Virtual Private Network) creates an encrypted tunnel between the user's device and a VPN server, protecting data from interception on untrusted networks. It also masks the user's IP address, providing anonymity and bypassing geographic restrictions. Information is accessible only to authorized parties — protected from unauthorized disclosure. Same-Origin Policy — browsers restrict scripts from interacting across origins.

Question 9 Cybersecurity Fundamentals

What is a worm?

Self-replicating malware spreading without user interaction. Compromising a software dependency or build pipeline to attack downstream users. Avoid, transfer, mitigate, accept. Process of identifying, assessing, treating, and monitoring risk.

Question 10 Cybersecurity Fundamentals

What is session hijacking?

Assume breach, minimize blast radius, monitor everything, patch quickly, train people. Public/private key pair — public encrypts, private decrypts (or vice versa for signing). List of most critical web application security risks, updated periodically by OWASP. Stealing or guessing a session ID to impersonate the user.

Question 11 Cybersecurity Fundamentals

What is broken access control?

Controls how much referrer info is sent to other origins — reduces leakage. TLS (Transport Layer Security, successor to SSL) encrypts data transmitted between a client and server, ensuring confidentiality and integrity of the communication. It also authenticates the server using digital certificates, preventing impersonation attacks. Failing to enforce permissions on actions or resources — common cause: trusting client-side checks. A zero-day vulnerability is a software flaw unknown to the vendor, meaning no patch exists when it is discovered or exploited. It is especially dangerous because defenders have zero days to prepare, and traditional signature-based security tools cannot detect attacks exploiting it.

Question 12 Cybersecurity Fundamentals

What is a patch?

Web Application Firewall — protects web apps from common attacks (XSS, SQLi, etc.). Vendor-provided fix for a vulnerability — apply promptly especially for internet-facing systems. Data encrypted during processing — confidential computing, homomorphic encryption. The NIST CSF is a voluntary framework providing guidelines for managing cybersecurity risk. Its five core functions are: Identify (understand risk), Protect (implement safeguards), Detect (discover events), Respond (take action), and Recover (restore capabilities).

Question 13 Cybersecurity Fundamentals

What is preventive vs. detective vs. corrective control?

The NIST CSF is a voluntary framework providing guidelines for managing cybersecurity risk. Its five core functions are: Identify (understand risk), Protect (implement safeguards), Detect (discover events), Respond (take action), and Recover (restore capabilities). Preventive stops incidents; detective finds them; corrective fixes them. Content Delivery Network — distributes content across edge servers; provides DDoS protection. A confidentiality breach means unauthorized parties accessed the data (e.g., a data leak). An integrity breach means the data was altered or tampered with without authorization, even if it wasn't exposed — for example, an attacker modifying financial records.

Question 14 Cybersecurity Fundamentals

What is the Secure cookie attribute?

Cookie sent only over HTTPS. Hash signed with private key — proves authenticity and integrity without revealing the key. A salt is a unique random value added to each password before hashing, ensuring that identical passwords produce different hashes. Without salting, attackers can use precomputed rainbow tables to quickly crack hashed passwords in bulk. CSRF tokens, SameSite cookies, double-submit patterns, custom request headers, Origin header checks.

Question 15 Cybersecurity Fundamentals

What is TLS?

Transport Layer Security — protocol securing communications. TLS 1.3 is current; 1.2 still widely used. Zero Trust Network Access — successor to VPN; per-app access based on identity and posture. A zero-day vulnerability is a software flaw unknown to the vendor, meaning no patch exists when it is discovered or exploited. It is especially dangerous because defenders have zero days to prepare, and traditional signature-based security tools cannot detect attacks exploiting it. Tricking users into providing credentials or executing malicious actions, usually via deceptive emails or pages.

Question 16 Cybersecurity Fundamentals

What is the TLS handshake?

Parameterized queries / prepared statements; never concatenate user input into SQL. Updates often patch known vulnerabilities that attackers actively exploit when systems stay unpatched. Negotiation of cipher suites, key exchange, server (and optionally client) authentication. Controls which browser features (camera, microphone, geolocation) the page may use.

Question 17 Cybersecurity Fundamentals

What is the difference between symmetric and asymmetric encryption?

Common Weakness Enumeration — categorization of software weakness types. Zero Trust Network Access — successor to VPN; per-app access based on identity and posture. Symmetric encryption uses a single shared key for both encryption and decryption (fast but requires secure key exchange). Asymmetric encryption uses a public/private key pair where the public key encrypts and the private key decrypts, solving the key distribution problem but being computationally slower. Malware is malicious software designed to damage systems, steal data, spy on activity, or disrupt operations.

Question 18 Cybersecurity Fundamentals

What is a SOC?

Security Operations Center — team monitoring, detecting, and responding to security events. Attacker sets a known session ID before login, then reuses it post-login. Mitigation: rotate session ID on login. Same key used to encrypt and decrypt — fast, but key distribution is the challenge. Fail-secure: failure denies access (default for security). Fail-open: failure allows access (for safety-critical systems).

Question 19 Cybersecurity Fundamentals

What is SHA-256?

Cryptographic hash function in the SHA-2 family — 256-bit output, widely used. Google's zero-trust implementation — based on device and user identity rather than network perimeter. Social engineering manipulates people into divulging information or performing actions that compromise security, exploiting trust, fear, or urgency. It is highly effective because it targets human psychology rather than technical defenses, bypassing firewalls and encryption entirely. HMAC-based One-Time Password — counter-based, less common than TOTP.

Question 20 Cybersecurity Fundamentals

What is the CIA triad?

Certificate Signing Request — what you submit to a CA to get a certificate. Multi-factor authentication — requires two or more independent factors to verify identity. Realistic adversary simulation testing detection and response — broader than pentest. The CIA triad stands for confidentiality, integrity, and availability, three core goals of information security.

Question 21 Cybersecurity Fundamentals

What is a CA?

Role-Based Access Control — permissions assigned to roles, users assigned to roles. Phishing via SMS. Certificate Authority — trusted entity that issues digital certificates. Chief Information Security Officer — executive responsible for an organization's security.

Question 22 Cybersecurity Fundamentals

What is a zero-day vulnerability and why is it particularly dangerous?

A02: Cryptographic Failures (formerly "Sensitive Data Exposure"). Preventive stops incidents; detective finds them; corrective fixes them. A zero-day vulnerability is a software flaw unknown to the vendor, meaning no patch exists when it is discovered or exploited. It is especially dangerous because defenders have zero days to prepare, and traditional signature-based security tools cannot detect attacks exploiting it. API keys, tokens, passwords scattered through code and config — common cause of breaches.

Question 23 Cybersecurity Fundamentals

What are the three components of the CIA triad in cybersecurity?

Standard user becomes admin. Cryptographic hash function in the SHA-2 family — 256-bit output, widely used. Confidentiality (ensuring data is accessible only to authorized parties), Integrity (ensuring data is accurate and unaltered), and Availability (ensuring systems and data are accessible when needed). Together they form the foundation of information security. DNS Security Extensions — cryptographic signatures on DNS records ensuring integrity.

Question 24 Cybersecurity Fundamentals

What is a hash collision?

A password manager securely stores and generates unique, complex passwords for every account, encrypted behind one master password. It eliminates password reuse, removes the need to memorize passwords, and makes it easy to use strong credentials everywhere. Two different inputs producing the same hash output — undermines integrity guarantees. Same key used to encrypt and decrypt — fast, but key distribution is the challenge. Categorizing data by sensitivity to apply appropriate protections (public, internal, confidential, restricted).

Question 25 Cybersecurity Fundamentals

What is the principle "trust but verify"?

Containment prevents the incident from spreading to other systems and limits further damage while the team investigates. Without rapid containment, an attacker could escalate privileges, exfiltrate more data, or compromise additional assets, significantly increasing the impact. Header.Payload.Signature — three base64url-encoded parts separated by dots. HMAC-based One-Time Password — counter-based, less common than TOTP. Trust establishes initial confidence; verification ensures it's still valid — pairs well with zero trust.

Question 26 Cybersecurity Fundamentals

What is the principle of "secure by default"?

Fail-secure: failure denies access (default for security). Fail-open: failure allows access (for safety-critical systems). Prevents browser from MIME-sniffing — stops some content-injection attacks. Systems ship with security enabled, requiring explicit action to weaken it. XML External Entity attack — abuses XML parsers fetching external entities.

Question 27 Cybersecurity Fundamentals

What is typosquatting?

Registering package names similar to popular ones (e.g., reqeusts vs requests) to trap users. A password manager securely stores and generates unique, complex passwords for every account, encrypted behind one master password. It eliminates password reuse, removes the need to memorize passwords, and makes it easy to use strong credentials everywhere. Tunable memory and compute cost, side-channel resistant — winner of the 2015 Password Hashing Competition. 2020 supply chain attack on SolarWinds Orion — infiltrated thousands of government and corporate networks.

Question 28 Cybersecurity Fundamentals

What is ISO 27001?

Server-Side Request Forgery — attacker tricks server into making requests to internal resources. Precomputed table of password hashes for fast lookup — defeated by salting. Security Assertion Markup Language — XML-based standard for SSO between identity provider and service provider. International standard for information security management systems (ISMS).

Question 29 Cybersecurity Fundamentals

What is the JWT structure?

Time-based One-Time Password — 6-digit codes from Google Authenticator, Authy, etc. RFC 6238. Combined red + blue collaboration improving both attack and defense. Least privilege means giving people and systems only the minimum access needed to perform their tasks. Header.Payload.Signature — three base64url-encoded parts separated by dots.

Question 30 Cybersecurity Fundamentals

What is risk management?

Process of identifying, assessing, treating, and monitoring risk. Certificate Signing Request — what you submit to a CA to get a certificate. Safeguards or countermeasures implementing security policies (technical, administrative, physical). Google's zero-trust implementation — based on device and user identity rather than network perimeter.

Question 31 Cybersecurity Fundamentals

What is JWT?

Public append-only log of issued certificates — exposes rogue or misissued certs. Remote Code Execution — attacker runs arbitrary code on the server. Critical severity. W3C standard for public-key authentication in browsers — underpins passkeys. JSON Web Token — a compact, URL-safe token format with claims signed and optionally encrypted.

Question 32 Cybersecurity Fundamentals

What is a residual risk?

Risk remaining after controls are applied. Microsoft's threat categories: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege. Negotiation of cipher suites, key exchange, server (and optionally client) authentication. A DoS attack uses a single source to overwhelm a target with traffic, while a DDoS (Distributed Denial of Service) attack uses many compromised systems (a botnet) simultaneously. DDoS attacks are much harder to mitigate because the traffic comes from thousands of different IP addresses.

Question 33 Cybersecurity Fundamentals

What is a CDN?

Content Delivery Network — distributes content across edge servers; provides DDoS protection. A confidentiality breach means unauthorized parties accessed the data (e.g., a data leak). An integrity breach means the data was altered or tampered with without authorization, even if it wasn't exposed — for example, an attacker modifying financial records. Centralized service for storing and accessing secrets (HashiCorp Vault, AWS Secrets Manager). Asymmetric cipher based on the difficulty of factoring large primes. Common key sizes: 2048, 3072, 4096.

Question 34 Cybersecurity Fundamentals

Why is Argon2 currently preferred?

Identity layer built on OAuth 2.0 — adds authentication and ID tokens. EU General Data Protection Regulation — privacy law with extraterritorial reach. Stealing or guessing a session ID to impersonate the user. Tunable memory and compute cost, side-channel resistant — winner of the 2015 Password Hashing Competition.

Question 35 Cybersecurity Fundamentals

What is multi-factor authentication (MFA) and why is it more secure than passwords alone?

Cybersecurity is the protection of systems, networks, devices, and data from unauthorized access, attack, or disruption. MFA requires two or more verification factors from different categories: something you know (password), something you have (phone/token), or something you are (biometrics). Even if one factor is compromised, an attacker still cannot access the account without the others. Bring Your Own Device — employees use personal devices for work; introduces security complexity. Targeted phishing against specific individuals — researched and customized.

Question 36 Cybersecurity Fundamentals

What is SOAR?

Security Orchestration, Automation and Response — automates SOC workflows. HTTP Strict Transport Security — server header telling browsers to always use HTTPS for the domain. The process of detecting, containing, eradicating, and recovering from security incidents. A02: Cryptographic Failures (formerly "Sensitive Data Exposure").

Question 37 Cybersecurity Fundamentals

What is a rainbow table?

Man-in-the-middle — attacker intercepts communication between two parties. Combined red + blue collaboration improving both attack and defense. Precomputed table of password hashes for fast lookup — defeated by salting. Security Assertion Markup Language — XML-based standard for SSO between identity provider and service provider.

Question 38 Cybersecurity Fundamentals

What is bcrypt / scrypt / Argon2?

Cybersecurity is the protection of systems, networks, devices, and data from unauthorized access, attack, or disruption. Assume breach, minimize blast radius, monitor everything, patch quickly, train people. Slow, memory-hard hash functions designed for password storage — resist GPU brute force. Security Orchestration, Automation and Response — automates SOC workflows.

Question 39 Cybersecurity Fundamentals

What is HOTP?

Phishing aimed at executives or high-value targets. Precomputed table of password hashes for fast lookup — defeated by salting. Indicator of Compromise — observable artifact suggesting an intrusion (file hash, IP, domain, registry change). HMAC-based One-Time Password — counter-based, less common than TOTP.

Question 40 Cybersecurity Fundamentals

What is XDR?

Extended Detection and Response — EDR + network/cloud telemetry into one platform. Returning false DNS responses to redirect traffic — mitigated by DNSSEC. Software Bill of Materials — list of components and dependencies in a piece of software. Two different inputs producing the same hash output — undermines integrity guarantees.

Question 41 Cybersecurity Fundamentals

What is a SIEM correlation rule?

Likelihood of a threat exploiting a vulnerability × impact if it does. Lockheed Martin's model of attack stages: Recon → Weaponization → Delivery → Exploitation → Installation → C2 → Actions on Objectives. Role-Based Access Control — permissions assigned to roles, users assigned to roles. Logic identifying suspicious patterns across multiple log sources to generate alerts.

Question 42 Cybersecurity Fundamentals

What is a CSP header?

A VPN (Virtual Private Network) creates an encrypted tunnel between the user's device and a VPN server, protecting data from interception on untrusted networks. It also masks the user's IP address, providing anonymity and bypassing geographic restrictions. Anti-DDoS services (Cloudflare, AWS Shield), rate limiting, scaling, sinkhole routing. User A accesses user B's data at the same privilege level. Content Security Policy — HTTP header restricting what resources a page can load. Mitigates XSS.

Question 43 Cybersecurity Fundamentals

What is network segmentation?

A VPN (Virtual Private Network) creates an encrypted tunnel between the user's device and a VPN server, protecting data from interception on untrusted networks. It also masks the user's IP address, providing anonymity and bypassing geographic restrictions. Endpoint Detection and Response — agent-based threat detection on endpoints. TLS (Transport Layer Security, successor to SSL) encrypts data transmitted between a client and server, ensuring confidentiality and integrity of the communication. It also authenticates the server using digital certificates, preventing impersonation attacks. Dividing a network into zones to limit lateral movement after a breach.

Question 44 Cybersecurity Fundamentals

What is least privilege in cybersecurity?

Malware activating on a trigger condition (date, event). Framework cataloging adversary tactics, techniques, and procedures (TTPs) — used for threat modeling and detection. A security incident is an event that threatens confidentiality, integrity, or availability and requires investigation or response. Least privilege means giving people and systems only the minimum access needed to perform their tasks.

Question 45 Cybersecurity Fundamentals

What is ABAC?

Targeted phishing against specific individuals — researched and customized. Some VPN traffic goes through tunnel, some directly to internet — performance vs. security trade-off. Security Assertion Markup Language — XML-based standard for SSO between identity provider and service provider. Attribute-Based Access Control — decisions based on attributes of user, resource, action, and environment.

Question 46 Cybersecurity Fundamentals

What is the difference between IDS and IPS?

IDS detects and alerts; IPS detects and actively blocks. Often combined. Payment Card Industry Data Security Standard — rules for handling credit card data. Cross-Origin Resource Sharing — server-controlled relaxation of SOP for cross-origin requests. Password-Based Key Derivation Function — applies a hash many times to slow brute force. Older but still in standards.

Question 47 Cybersecurity Fundamentals

What is a firewall?

Identity layer built on OAuth 2.0 — adds authentication and ID tokens. Security Operations Center — team monitoring, detecting, and responding to security events. Device or software filtering traffic based on rules — allow or deny by source, destination, port, protocol. Header preventing the page from being embedded in iframes — defeats clickjacking. Now largely superseded by CSP frame-ancestors.

Question 48 Cybersecurity Fundamentals

What is XSS?

In a MITM attack, an attacker secretly intercepts and potentially alters communication between two parties who believe they are communicating directly. HTTPS encrypts traffic using TLS, making it extremely difficult for an attacker to read or modify the data in transit. Authorized users can access information and resources when needed. Insecure Direct Object Reference — exposing internal IDs and not authorizing access. Cross-Site Scripting — attacker injects script into a page viewed by other users.

Question 49 Cybersecurity Fundamentals

What is a session?

Malware activating on a trigger condition (date, event). Ransomware encrypts a victim's files and demands payment for the decryption key. Security experts recommend not paying the ransom, as payment doesn't guarantee recovery and funds criminal operations. Instead, isolate affected systems, restore from backups, and report the incident to authorities. NIST Cybersecurity Framework — voluntary risk-management framework: Identify, Protect, Detect, Respond, Recover. Server-side state representing a logged-in user — typically referenced by a session ID in a cookie.

Question 50 Cybersecurity Fundamentals

What is CSRF?

Publishing malicious package with the same name as an internal package — typosquatting on naming. Header preventing the page from being embedded in iframes — defeats clickjacking. Now largely superseded by CSP frame-ancestors. Cross-Site Request Forgery — attacker tricks a user's browser into making unwanted authenticated requests. Even if data remains confidential and unaltered, a system is useless if legitimate users cannot access it when needed. DDoS attacks, ransomware, and hardware failures all target availability, potentially causing significant financial and operational damage.