Blog Categories

Cloud Computing
Digital Marketing
Data Science
IT Service and Architecture
Big Data
Salesforce
Project Management
Corporate Training
Machine Learning AI
Technology
Cyber Security
Business Intelligence
Programming Languages
DevOps
Deep Learning
Robotic Process Automation
Artificial Intelligence
Microsoft Certifications
Data Analytics
Machine Learning
Mobile Development
Website Development
Testing
Blockchain
Others
ERP
Quizzes
Cheat Sheet
Interview Questions
Python
Java
Golang
R programming
C Programming
C Sharp
JavaScript
HTML
CSS
Ruby
C Plus Plus
Online Compilers

Blog Quizzes Top Cyber Security MCQs With Answers

Top Cyber Security MCQs With Answers

By: Chinmay

Last Updated: September 24th, 2026

Read Time: 30:00 Minutes

1. Cybersecurity Fundamentals

2. Threats and Attacks

3. Security Technologies

4. Security Practices and Management

5. Latest Cybersecurity Features and Updates

6. Network Security

7. Data Protection and Compliance

8. Identity and Access Management

9. Network Security

10. Web and Application Security

11. Cloud Security

12. Endpoint and Mobile Security

13. SOC, Detection and Incident Response

14. Vulnerability Management and Penetration Testing

15. Cryptography and Key Management

16. Governance, Risk and Compliance

17. DevSecOps and Software Supply Chain

18. Emerging Security Practices

19. Your Quiz Result

Preparing to become a Cyber Security Engineer? This Top Cybersecurity MCQs collection is your ultimate resource. It includes frequently asked multiple-choice questions, categorized for comprehensive learning, to evaluate your expertise and identify areas for improvement.

Note: Score 60% or higher to unlock an exclusive offer of up to 50% off on all self-paced cybersecurity courses.

Let's begin!

Cybersecurity Fundamentals

1. What is the main objective of cybersecurity measures?

A) To enhance system performance
B) To streamline software development
C) To safeguard information and infrastructure from cyber threats
D) To boost data storage efficiency

2. What does CIA stand for in the context of cybersecurity?

A) Confidentiality, Integrity, Availability
B) Control, Isolation, Authentication
C) Compliance, Investigation, Access
D) Connectivity, Inspection, Authorization

3. What is the primary function of multi-factor authentication (MFA)?

A) To reduce authentication time
B) To enhance security with multiple verification steps
C) To simplify user login processes
D) To increase network capacity

4. Which of the following is a type of authentication factor?

A) Biometric
B) Firewall
C) Encryption
D) Packet filtering

5. What is the key role of encryption in securing digital information?

A) To compress data for storage
B) To accelerate data processing
C) To facilitate data sharing
D) To render data unreadable without a key

6. Which of the following is a common access control model?

A) Data encryption model
B) Network segmentation model
C) Role-Based Access Control (RBAC)
D) Packet filtering model

7. What is a digital signature used for?

A) To encrypt network traffic
B) To store user credentials
C) To increase server performance
D) To verify the authenticity of a message

8. Which of the following is an example of a public key encryption algorithm?

A) RSA
B) DES
C) 3DES
D) Blowfish

9. What is the primary function of a hardware security token?

A) To verify user identity securely
B) To enhance network speed
C) To store large datasets
D) To monitor system performance

10. What does the principle of least privilege (PoLP) entail?

A) Granting users full system access
B) Encrypting all user data
C) Limiting user access to only necessary resources
D) Monitoring all user activities

Threats and Attacks

11. Which of the following is a common type of cyber attack?

A) Data encryption
B) System backup
C) Phishing
D) Network optimization

12. Which type of malware locks a user's data and demands payment for access?

A) Virus
B) Worm
C) Ransomware
D) Spyware

13. Which of the following best describes a DDoS attack?

A) Stealing user credentials
B) Encrypting sensitive data
C) Installing malware on a device
D) Overwhelming a system with traffic

14. Which technique involves manipulating individuals to disclose sensitive information?

A) SQL injection
B) Baiting
C) Brute force attack
D) Network scanning

15. What does the term 'zero-day' refer to in cybersecurity?

A) A day with no cyber attacks
B) A day when systems are updated
C) A day when backups are performed
D) A vulnerability exploited before a patch is available

16. What is a man-in-the-middle (MITM) attack?

A) Locking a user's data for ransom
B) Flooding a server with requests
C) Intercepting communication between two parties
D) Guessing a user's password

17. What is the purpose of a brute force attack?

A) To guess passwords through trial and error
B) To encrypt sensitive data
C) To monitor network traffic
D) To optimize server performance

18. Which of the following is a type of malware that disguises itself as legitimate software?

A) Trojan
B) Worm
C) Virus
D) Ransomware

19. Which of the following is a common type of spyware?

A) Ransomware
B) Worm
C) Keylogger
D) Trojan

20. Which of the following is a common type of phishing attack?

A) Spear phishing
B) Brute force attack
C) SQL injection
D) Packet sniffing

Security Technologies

21. What is the primary role of a firewall in a network?

A) To filter and regulate network traffic
B) To store critical system logs
C) To develop secure applications
D) To encrypt user credentials

22. What is the primary function of an Intrusion Detection System (IDS)?

A) To encrypt network traffic
B) To detect suspicious activity
C) To optimize database queries
D) To manage user accounts

23. Which encryption algorithm uses the same key for both encryption and decryption?

A) RSA
B) AES
C) ECC
D) DSA

24. What is the main function of a proxy server in a secure network?

A) To encrypt all network traffic
B) To store sensitive data securely
C) To mediate between users and external networks
D) To optimize server performance

25. What is the core function of a Security Information and Event Management (SIEM) system?

A) To develop secure applications
B) To manage user permissions
C) To optimize network performance
D) To collect and analyze security event data

26. What is the purpose of a honeypot in cybersecurity?

A) To store sensitive data
B) To attract and detect malicious activity
C) To encrypt network traffic
D) To optimize server performance

27. What is the purpose of a sandbox in cybersecurity?

A) To isolate and analyze suspicious files
B) To store sensitive data
C) To optimize network traffic
D) To manage user accounts

28. Which of the following is a network security device?

A) Intrusion Prevention System (IPS)
B) Database server
C) Web server
D) File server

29. What is the purpose of a certificate authority (CA)?

A) To monitor network traffic
B) To optimize server performance
C) To manage user accounts
D) To issue and manage digital certificates

30. What is the role of a Web Application Firewall (WAF)?

A) To manage user authentication
B) To protect web applications from attacks
C) To optimize server storage
D) To monitor network bandwidth

Security Practices and Management

31. What is the purpose of a security policy?

A) To increase network speed
B) To define rules for protecting an organization's assets
C) To optimize database performance
D) To store user data

32. What is the purpose of a security audit?

A) To increase server storage
B) To evaluate and improve security measures
C) To optimize database performance
D) To develop new software

33. What is the purpose of a penetration test?

A) To develop new software
B) To identify vulnerabilities in a system
C) To optimize network performance
D) To manage user permissions

34. What is the primary role of a Security Operations Center (SOC)?

A) To detect and respond to security events
B) To develop cybersecurity software
C) To enhance network speed
D) To manage user authentication

35. What is the primary purpose of a cybersecurity tabletop exercise?

A) To replace production security controls
B) To measure application performance under load
C) To rehearse incident response roles and decisions
D) To automatically patch every endpoint

36. What is the purpose of a security awareness training program?

A) To optimize network performance
B) To educate employees about cybersecurity best practices
C) To develop new software
D) To manage user accounts

37. What does patch management involve?

A) Updating software to fix vulnerabilities
B) Encrypting network traffic
C) Monitoring user activity
D) Backing up data

38. What is the purpose of a vulnerability assessment?

A) To optimize network performance
B) To manage user accounts
C) To encrypt sensitive data
D) To identify weaknesses in a system

39. Which of the following is a common type of insider threat?

A) DDoS attack
B) Data theft by employees
C) SQL injection
D) Packet sniffing

40. What is the purpose of incident response planning?

A) To optimize server performance
B) To develop new applications
C) To prepare for and mitigate security breaches
D) To increase network bandwidth

Latest Cybersecurity Features and Updates

41. What is the core principle of Zero Trust Architecture, a recent cybersecurity trend?

A) Trust all users by default
B) Encrypt all data automatically
C) Verify every user and device continuously
D) Allow unrestricted network access

42. Which recent technology is increasingly used for real-time threat detection?

A) Artificial Intelligence (AI)
B) Manual log analysis
C) Basic antivirus software
D) Static rule-based systems

43. What is the purpose of post-quantum cryptography, a developing field in cybersecurity?

A) To increase network speed
B) To protect against quantum computer attacks
C) To simplify user authentication
D) To optimize database queries

44. Which of the following is a feature of modern Endpoint Detection and Response (EDR) systems?

A) Blocking all network traffic
B) Encrypting all data by default
C) Managing user accounts
D) Continuous monitoring and automated response

45. What is a key benefit of Secure Access Service Edge (SASE), a recent cybersecurity framework?

A) Integrates network security with cloud-based services
B) Reduces network security controls
C) Stores all data locally
D) Disables cloud access

46. Which recent advancement enhances Security Orchestration, Automation, and Response (SOAR) platforms?

A) Manual threat analysis
B) Automated incident response workflows
C) Disabling firewalls
D) Reducing encryption strength

47. What is the purpose of Extended Detection and Response (XDR), a newer cybersecurity solution?

A) To manage user accounts
B) To optimize network performance
C) To integrate security data across multiple systems
D) To store sensitive data

48. Which of the following is a recent trend in cloud security?

A) Cloud-native security platforms
B) Disabling cloud access
C) Manual log monitoring
D) Reducing encryption levels

49. What is the role of AI-driven User and Entity Behavior Analytics (UEBA) in modern cybersecurity?

A) To optimize database performance
B) To detect anomalies in user behavior
C) To store sensitive data
D) To manage network bandwidth

50. Which of the following is a feature of modern passwordless authentication systems?

A) Requiring longer passwords
B) Using static credentials
C) Relying solely on usernames
D) Using biometrics or secure tokens

Network Security

51. Which protocol is commonly used to secure web communication?

A) FTP
B) HTTP
C) HTTPS
D) SMTP

52. What is a VPN used for?

A) To block all network traffic
B) To create a secure connection over the internet
C) To increase server storage
D) To monitor user activity

53. Which of the following is a common network security protocol?

A) TLS
B) SMTP
C) FTP
D) HTTP

54. Which of the following is a common type of network attack?

A) Data encryption
B) Packet sniffing
C) User authentication
D) Database backup

55. What is the purpose of network segmentation in cybersecurity?

A) To increase network speed
B) To store sensitive data
C) To isolate network sections for security
D) To optimize database queries

56. What is the role of a Network Intrusion Detection System (NIDS)?

A) To monitor network traffic for suspicious activity
B) To encrypt sensitive data
C) To manage user accounts
D) To optimize server performance

57. What is the purpose of a DMZ (Demilitarized Zone) in network security?

A) To store sensitive data
B) To provide a buffer zone for public-facing services
C) To increase network bandwidth
D) To manage user authentication

58. Which of the following is a benefit of using VLANs in network security?

A) Increasing server storage
B) Encrypting all network traffic
C) Monitoring user activity
D) Isolating network traffic for security

59. What is the purpose of IPsec in network security?

A) To provide secure communication over IP networks
B) To manage user accounts
C) To optimize database performance
D) To monitor server performance

60. What is the role of a packet filter in network security?

A) To encrypt sensitive data
B) To store network logs
C) To control network traffic based on rules
D) To optimize network bandwidth

Data Protection and Compliance

61. What is the purpose of a data loss prevention (DLP) system?

A) To optimize network performance
B) To manage user accounts
C) To encrypt network traffic
D) To prevent unauthorized data access and leakage

62. Which of the following is a common standard for information security management?

A) HTTP
B) FTP
C) ISO 27001
D) SMTP

63. Which of the following is a common method to prevent SQL injection attacks?

A) Increasing server bandwidth
B) Using parameterized queries
C) Disabling firewalls
D) Reducing encryption strength

64. Which of the following is a common method to protect against cross-site scripting (XSS) attacks?

A) Increasing server bandwidth
B) Input validation and sanitization
C) Disabling encryption
D) Reducing firewall rules

65. What is the purpose of the General Data Protection Regulation (GDPR)?

A) To optimize network performance
B) To protect personal data and privacy
C) To manage user accounts
D) To increase server storage

66. What is the purpose of data encryption at rest?

A) To protect stored data from unauthorized access
B) To increase data transmission speed
C) To monitor network traffic
D) To optimize database queries

67. Which of the following is a key requirement of the Payment Card Industry Data Security Standard (PCI DSS)?

A) Optimizing network bandwidth
B) Disabling encryption
C) Protecting cardholder data
D) Increasing server storage

68. What is the purpose of a data retention policy?

A) To increase data storage capacity
B) To define how long data should be stored
C) To monitor network traffic
D) To optimize server performance

69. What is the role of a Data Protection Officer (DPO) under GDPR?

A) To oversee data protection compliance
B) To manage network firewalls
C) To optimize database performance
D) To develop new software

70. What is the purpose of data anonymization in cybersecurity?

A) To increase data storage
B) To monitor user activity
C) To remove identifiable information from data
D) To optimize network bandwidth

Identity and Access Management

71. Which access control approach grants permissions based on a user's job function?

A) DAC
B) Network Address Translation
C) RBAC
D) Packet filtering

72. What is the main purpose of Privileged Access Management (PAM)?

A) Increase internet bandwidth
B) Control and monitor access to privileged accounts
C) Replace endpoint antivirus
D) Compress security logs

73. Which authentication method is generally resistant to credential phishing because the authenticator is bound to the legitimate site?

A) SMS OTP
B) Security questions
C) Static passwords
D) FIDO2/WebAuthn

74. What is just-in-time privileged access designed to provide?

A) Temporary elevated permissions only when needed
B) Permanent administrator rights
C) Anonymous access to servers
D) Shared passwords for administrators

75. What is the primary purpose of single sign-on (SSO)?

A) Encrypt all application databases
B) Eliminate authorization checks
C) Let users authenticate once and access multiple trusted applications
D) Remove the need for identity providers

76. In an identity federation, what does the identity provider typically do?

A) Route packets between networks
B) Authenticate users and provide identity assertions or tokens
C) Scan source code for vulnerabilities
D) Store firewall rules

77. Which practice most directly reduces the risk from dormant user accounts?

A) Periodic account review and deprovisioning
B) Increasing password length only
C) Disabling security logs
D) Allowing shared accounts

78. What does adaptive authentication use to influence an authentication decision?

A) Only username length
B) Only account creation date
C) Only network speed
D) Context such as device, location, behavior, and risk

79. What is an entitlement review intended to verify?

A) Whether a server has enough storage
B) Whether a certificate uses RSA
C) Whether users still need the permissions assigned to them
D) Whether DNS records are cached

80. Which principle is most closely associated with limiting an administrator's permissions to what is required for a task?

A) Least privilege
B) Open access
C) Default allow
D) Flat trust

81. What is a service account primarily used for?

A) Representing a customer's browser
B) Replacing all human identities
C) Encrypting backups automatically
D) Allowing an application or service to authenticate to another system

82. Why should long-lived cloud access keys be avoided when short-lived credentials are available?

A) They reduce encryption strength
B) They increase the window of opportunity if compromised
C) They prevent logging
D) They disable MFA

83. What is the purpose of a break-glass account?

A) To bypass all auditing
B) To provide normal daily administration
C) To provide emergency access when standard identity controls are unavailable
D) To share credentials across teams

84. Which control helps prevent one administrator from approving and executing a sensitive change alone?

A) Separation of duties
B) Data compression
C) Port forwarding
D) Load balancing

85. What is an identity lifecycle process intended to manage?

A) Packet routing
B) Database indexing
C) Malware signatures
D) Account creation, changes, and removal over time

Network Security

86. What is the main difference between an IDS and an IPS?

A) IDS encrypts traffic while IPS decrypts it
B) IDS primarily detects while IPS can also block or prevent traffic
C) IDS manages identities while IPS manages passwords
D) IDS is only used for databases

87. What is microsegmentation intended to achieve?

A) Increase the size of broadcast domains
B) Remove internal access controls
C) Apply granular security policies between workloads or network segments
D) Disable east-west traffic monitoring

88. Which DNS security technique helps prevent users from reaching known malicious domains?

A) DNS filtering
B) ARP flooding
C) Port mirroring
D) MAC spoofing

89. What is the purpose of Network Access Control (NAC)?

A) Generate encryption keys
B) Manage application source code
C) Replace DNS
D) Enforce access policies based on device or user posture

90. What does an egress filtering rule control?

A) Incoming physical mail
B) Outbound network traffic
C) Local file permissions only
D) Database indexes

91. Which network architecture principle is central to Zero Trust?

A) Trust internal traffic automatically
B) Put all users on one flat network
C) Continuously evaluate access using identity, device, context, and policy
D) Disable authentication after VPN login

92. What is east-west traffic in a data center or cloud environment?

A) Traffic between internal workloads or services
B) Traffic from users to the public internet only
C) Physical traffic between buildings
D) Email traffic only

93. What is north-south traffic generally used to describe?

A) Traffic between two databases
B) Traffic between containers in one cluster
C) Traffic between two internal hosts
D) Traffic entering or leaving an environment

94. Which control is useful for detecting anomalous outbound connections from a workstation?

A) Increasing DHCP lease time
B) Network monitoring and behavioral analytics
C) Disabling endpoint logs
D) Removing DNS

95. What is ARP spoofing commonly used to facilitate?

A) Password hashing
B) Software patching
C) Traffic interception or redirection on a local network
D) Database replication

96. Which protocol is commonly used to securely administer a Linux server remotely?

A) SSH
B) Telnet
C) FTP
D) TFTP

97. What security advantage does TLS provide for application traffic?

A) It guarantees the server is malware-free
B) It removes the need for authorization
C) It prevents all denial-of-service attacks
D) It can provide confidentiality and integrity in transit

98. What is a reverse proxy commonly positioned in front of?

A) A user's keyboard
B) Backend servers or web applications
C) A database backup tape
D) A local printer only

99. Why is network segmentation useful after an attacker compromises one host?

A) It guarantees the attacker is removed
B) It increases the host's CPU
C) It can limit lateral movement to other systems
D) It disables all logging

100. What is the primary purpose of a secure web gateway?

A) Inspect and control users' web traffic according to security policy
B) Replace endpoint identity
C) Manage database schemas
D) Issue TLS certificates

101. Which technology can provide security inspection for encrypted web traffic when configured with appropriate organizational controls?

A) DHCP
B) NTP
C) ICMP
D) TLS inspection

102. What is a bastion host?

A) A public DNS resolver
B) A hardened host used as a controlled administrative entry point
C) A malware sample repository
D) A wireless access point with no authentication

103. What does a stateful firewall track when making filtering decisions?

A) Only MAC addresses
B) Only usernames
C) The state and context of network connections
D) Only file hashes

104. Which practice reduces the exposure of management interfaces on internet-facing systems?

A) Restricting administrative access through controlled networks or private paths
B) Publishing management ports publicly
C) Disabling authentication
D) Using shared administrator credentials

105. What is the purpose of a network security baseline?

A) To guarantee zero vulnerabilities
B) To replace incident response
C) To eliminate configuration management
D) To define an approved security configuration for comparison and monitoring

Web and Application Security

106. Which vulnerability occurs when untrusted input is incorporated into a database query without adequate controls?

A) CSRF
B) Clickjacking
C) SQL injection
D) DNS poisoning

107. What is the main risk of a stored cross-site scripting vulnerability?

A) Malicious script can be persisted and served to other users
B) Database records are automatically encrypted
C) Network routing tables are deleted
D) TLS certificates expire

108. What does Cross-Site Request Forgery (CSRF) attempt to exploit?

A) Weak disk encryption
B) Open network ports
C) DNS cache expiration
D) A user's authenticated browser session to trigger an unintended action

109. Which HTTP response header helps control which sources a browser may load scripts and other resources from?

A) ETag
B) Content-Security-Policy
C) Cache-Control
D) Accept-Language

110. What is an IDOR vulnerability?

A) A DNS configuration error
B) A denial-of-service technique
C) Unauthorized access to an object by manipulating a direct identifier
D) A type of password hash

111. What is output encoding intended to prevent in web applications?

A) Interpretation of untrusted data as executable markup or script
B) Network congestion
C) Certificate renewal
D) Disk fragmentation

112. Why should server-side authorization checks not rely solely on hidden UI elements?

A) Hidden elements improve encryption
B) UI controls cannot be cached
C) Browsers always reject hidden fields
D) Attackers can call application endpoints directly

113. What is the purpose of an API gateway in a security architecture?

A) Store source code backups
B) Centralize controls such as authentication, routing, rate limiting, and policy enforcement
C) Replace all application authorization
D) Generate user passwords

114. What is rate limiting commonly used to mitigate?

A) Data-at-rest encryption failures
B) Certificate misconfiguration
C) Excessive requests such as credential stuffing or API abuse
D) Physical theft

115. What is credential stuffing?

A) Using previously stolen username-password pairs against other services
B) Guessing every possible password from scratch
C) Encrypting credentials in a database
D) Rotating API keys

116. Which approach is generally preferred for storing user passwords?

A) Reversible encryption with a shared key
B) Plain text
C) Unsalted MD5
D) A password-hashing function designed for passwords, with appropriate salting and parameters

117. What does secure session management help protect?

A) DNS records
B) Authenticated sessions from theft, fixation, or misuse
C) CPU cache
D) Network cables

118. What is SSRF?

A) Secure server replication format
B) Static source routing framework
C) Server-Side Request Forgery, where an application is induced to make unintended requests
D) Secure session recovery function

119. Which design choice helps reduce SSRF risk?

A) Restricting outbound destinations and validating requested resources
B) Allowing arbitrary URL fetching
C) Disabling all authentication
D) Exposing metadata services publicly

120. What is the purpose of threat modeling during application design?

A) Estimate employee salaries
B) Replace penetration testing completely
C) Improve application speed only
D) Identify threats and design appropriate mitigations before deployment

121. What does SAST primarily analyze?

A) Live network packets
B) Application source code or binaries for security weaknesses
C) Physical access logs
D) Cloud billing records

122. What does DAST generally test?

A) Source code without execution
B) Hardware firmware only
C) A running application from an external perspective
D) Employee background checks

123. What is software composition analysis (SCA) used for?

A) Identify risks in third-party and open-source dependencies
B) Configure wireless channels
C) Replace identity providers
D) Encrypt database backups

124. Why is dependency pinning useful in software security?

A) It disables package managers
B) It removes all vulnerabilities
C) It prevents code review
D) It makes dependency versions more predictable and reduces unexpected changes

125. What is a software bill of materials (SBOM) primarily intended to provide?

A) A list of employee permissions
B) An inventory of software components and dependencies
C) A network routing table
D) A password recovery database

Cloud Security

126. Under the shared responsibility model, what generally remains the customer's responsibility regardless of cloud provider?

A) Data center building security
B) Physical server replacement
C) Appropriate configuration and protection of the customer's data and workloads
D) Provider power management

127. What is a common cause of cloud data exposure?

A) Misconfigured storage or access permissions
B) Using version control
C) Enabling MFA
D) Applying security patches

128. What does CSPM primarily help organizations do?

A) Manage employee payroll
B) Build mobile applications
C) Replace endpoint detection
D) Identify and remediate cloud configuration and compliance risks

129. What is CIEM focused on?

A) Container image compression
B) Managing and analyzing cloud identities and entitlements
C) Network cable testing
D) Physical access control

130. What is a cloud security group typically used for?

A) Password hashing
B) Source code compilation
C) Controlling allowed network traffic to or from cloud resources
D) Database normalization

131. Why should cloud storage buckets not be public by default?

A) Public access can expose sensitive information to unauthorized users
B) Public buckets always increase CPU usage
C) Public access disables backups
D) Public storage prevents encryption

132. What is workload identity intended to provide?

A) A physical location for servers
B) A replacement for encryption
C) A shared password for containers
D) An identity that a workload can use to access authorized resources

133. Which practice is useful for protecting secrets used by cloud workloads?

A) Hard-code them in source code
B) Store them in a managed secrets system with controlled access
C) Put them in public documentation
D) Commit them to a public repository

134. What is cloud network segmentation designed to limit?

A) Employee training
B) Data compression
C) Unnecessary communication between workloads and environments
D) Application logging

135. What does a cloud audit log help security teams determine?

A) Which identities or services performed actions and when
B) The physical weight of servers
C) The color of network cables
D) The user's keyboard layout

136. Why are immutable backups valuable against ransomware?

A) They make passwords unnecessary
B) They prevent all phishing
C) They eliminate endpoint attacks
D) They make stored backup data harder for attackers to alter or delete

137. What is a container image vulnerability scanner intended to identify?

A) Employee access badges
B) Vulnerabilities and risky packages in container images
C) DNS server locations
D) Physical network failures

138. Why should containers not automatically run as root?

A) Root containers cannot use networking
B) Root disables logging
C) A compromise may provide broader privileges than necessary
D) Root containers cannot access files

139. What is Kubernetes RBAC used for?

A) Controlling who can perform which actions on Kubernetes resources
B) Encrypting container images
C) Balancing CPU workloads only
D) Scanning physical servers

140. What is a Kubernetes NetworkPolicy designed to control?

A) Cloud billing
B) User payroll
C) Container image licensing
D) Allowed network communication between pods or endpoints

141. What is the security benefit of workload isolation in a cloud environment?

A) It removes all vulnerabilities
B) It reduces the blast radius when one workload is compromised
C) It prevents all insider threats
D) It eliminates the need for identity controls

142. What does secrets rotation reduce?

A) The number of security logs
B) Network latency
C) The useful lifetime of exposed or compromised credentials
D) The need for authorization

143. What is infrastructure as code (IaC) scanning used for in security?

A) Detect insecure infrastructure configurations before deployment
B) Monitor employee attendance
C) Replace runtime controls
D) Disable configuration management

144. What is a common security concern with overly broad cloud IAM permissions?

A) Faster DNS resolution
B) Lower storage costs
C) Better application performance
D) A compromised identity may access more resources than necessary

145. What is a cloud access security broker (CASB) commonly used to provide?

A) Physical data center cooling
B) Visibility and policy controls for cloud application usage
C) Source code compilation
D) Hardware replacement

Endpoint and Mobile Security

146. What is the primary purpose of Endpoint Detection and Response (EDR)?

A) Manage office printers
B) Replace identity providers
C) Collect endpoint telemetry and support detection and response
D) Increase disk capacity

147. What is application allowlisting?

A) Allowing only approved applications to execute
B) Blocking all network traffic
C) Encrypting every file
D) Disabling software updates

148. What does endpoint isolation typically do during an incident?

A) Deletes the operating system
B) Publishes endpoint data
C) Disables all evidence collection
D) Restricts the endpoint's network communication while investigation continues

149. Why is full-disk encryption useful on laptops?

A) It prevents phishing
B) It protects stored data if the device or drive is lost or stolen
C) It blocks DDoS attacks
D) It prevents software bugs

150. What is Mobile Device Management (MDM) primarily used for?

A) Database indexing
B) Network routing
C) Enforcing security policies and managing organizational mobile devices
D) Creating encryption algorithms

151. Which mobile control helps reduce the risk from an untrusted application accessing sensitive corporate data?

A) Application permissions and managed app policies
B) Longer screen timeout
C) Disabling device updates
D) Public Wi-Fi sharing

152. What is a secure boot mechanism intended to help verify?

A) Employee identity
B) Network bandwidth
C) Database schema
D) That trusted software is used during the boot process

153. Why are operating system security updates important?

A) They guarantee no future attacks
B) They can remediate known vulnerabilities and improve security
C) They remove the need for backups
D) They eliminate all phishing attempts

154. What is the purpose of host-based firewall rules?

A) Manage cloud billing
B) Encrypt application data
C) Control network connections to and from an endpoint
D) Rotate user passwords

155. What is an endpoint baseline?

A) An approved security configuration used to identify deviations
B) A list of phishing emails
C) A database backup format
D) A wireless password

156. What is device posture assessment used for?

A) Calculate storage costs
B) Generate DNS records
C) Replace endpoint logging
D) Determine whether a device meets security requirements before granting access

157. What does application sandboxing provide?

A) Permanent administrator rights
B) Isolation that limits an application's access to other resources
C) Unrestricted file access
D) Automatic source-code review

158. What is the main security purpose of removing unnecessary software from an endpoint?

A) Increase the number of attack paths
B) Disable security controls
C) Reduce the attack surface
D) Increase privileged access

159. What is USB device control designed to manage?

A) Which removable devices can connect to endpoints and what they can do
B) Which users can access the internet
C) Which DNS records are trusted
D) Which cloud region stores backups

160. What is the purpose of endpoint telemetry in a SOC?

A) Reduce employee training
B) Replace all network logs
C) Improve printer performance
D) Provide evidence about processes, connections, and activity on endpoints

SOC, Detection and Incident Response

161. What is the first priority when a security alert is received?

A) Delete the alert
B) Validate and triage the alert using available evidence
C) Rebuild every server
D) Disable all user accounts

162. What is alert enrichment?

A) Increasing alert volume
B) Removing timestamps
C) Adding contextual information such as asset, identity, reputation, or threat intelligence data
D) Disabling detection rules

163. What is the purpose of a SIEM correlation rule?

A) Combine related events to identify potentially meaningful activity
B) Compress endpoint disks
C) Replace all firewalls
D) Issue certificates

164. What does mean time to detect (MTTD) measure?

A) Time to patch every system
B) Time to restore a backup
C) Time to train an employee
D) Time taken to identify that a security incident or event has occurred

165. What does mean time to respond (MTTR) generally measure in incident response?

A) Time to create a user account
B) Time taken to take response action after detection
C) Time to compile an application
D) Time to renew a domain

166. What is a playbook in security operations?

A) A list of software licenses
B) A database schema
C) A documented sequence of actions for handling a specific alert or incident type
D) A network topology diagram only

167. What is the purpose of containment during incident response?

A) Limit the spread or impact of an incident
B) Permanently delete evidence
C) Publish attacker details immediately
D) Disable all security controls

168. What is eradication intended to accomplish?

A) Increase attacker persistence
B) Preserve malicious access
C) Reduce logging
D) Remove the root cause or malicious artifacts from affected systems

169. What is recovery in incident response?

A) Identifying the original phishing email only
B) Restoring affected services to normal operation while monitoring for recurrence
C) Disabling backups
D) Removing all user accounts

170. Why is evidence preservation important during a security investigation?

A) It improves internet speed
B) It guarantees attribution
C) It helps maintain information needed for analysis, investigation, or legal processes
D) It replaces access control

171. What is chain of custody used to document?

A) The handling and transfer of evidence
B) Employee vacation schedules
C) Network bandwidth usage
D) Password complexity

172. What is threat hunting?

A) Waiting for antivirus alerts only
B) Blocking every IP address
C) Replacing vulnerability management
D) Proactively searching for signs of malicious activity that automated alerts may have missed

173. What is a detection engineering team primarily concerned with?

A) Building office networks
B) Creating and improving rules, analytics, and detections for suspicious behavior
C) Managing payroll
D) Writing marketing copy

174. What is a false positive in security monitoring?

A) A confirmed breach
B) An attack that was never detected
C) A benign event incorrectly classified as malicious
D) A vulnerability with no patch

175. Why is excessive alert noise a problem for a SOC?

A) Analysts may miss important events among low-value alerts
B) It automatically encrypts logs
C) It prevents all attacks
D) It disables MFA

176. What is a security orchestration platform commonly used to automate?

A) Physical server repairs
B) Employee hiring
C) Database normalization
D) Repetitive investigation and response actions across security tools

177. What is a useful purpose of threat intelligence in detection?

A) Increase storage costs
B) Add context about indicators, tactics, techniques, and adversary activity
C) Replace endpoint controls
D) Eliminate incident response

178. What is an indicator of compromise (IoC)?

A) A guaranteed attacker identity
B) A security policy document
C) Evidence that may indicate a system or account has been compromised
D) A backup schedule

179. What is an indicator of attack (IoA) intended to describe?

A) Behavior or activity associated with an attack attempt
B) A completed software installation
C) A hardware warranty
D) A data retention period

180. What should a post-incident review primarily identify?

A) Ways to hide the incident
B) Which logs can be deleted
C) How to avoid documenting lessons
D) Lessons learned and improvements to controls, processes, and response

Vulnerability Management and Penetration Testing

181. What is the primary difference between vulnerability scanning and penetration testing?

A) Scanning always exploits vulnerabilities
B) Scanning identifies potential weaknesses, while penetration testing validates exploitability within an authorized scope
C) Penetration testing never requires authorization
D) Scanning is only used for physical security

182. What does CVSS primarily provide?

A) A list of affected employees
B) A legal verdict
C) A standardized way to express vulnerability severity
D) A password encryption algorithm

183. Why should vulnerability remediation be prioritized using business context rather than severity alone?

A) Exploitability, asset importance, exposure, and business impact can change practical risk
B) Severity scores are always incorrect
C) Critical vulnerabilities never matter
D) Business context replaces technical validation

184. What is an authenticated vulnerability scan?

A) A scan performed without network access
B) A scan that only checks public DNS
C) A scan of physical buildings
D) A scan that uses valid credentials to inspect systems more deeply

185. What is a compensating control?

A) A control that removes the need for security
B) An alternative control used to reduce risk when the preferred control cannot be implemented
C) A duplicate user account
D) A type of malware

186. What is a false negative in vulnerability scanning?

A) A benign finding marked vulnerable
B) A vulnerability with a high CVSS score
C) A real vulnerability that the scanner fails to identify
D) A patched system correctly reported as secure

187. What is responsible disclosure intended to promote?

A) Coordinated reporting and remediation of vulnerabilities
B) Public release of exploit details before fixes
C) Unrestricted testing of third-party systems
D) Anonymous access to production environments

188. Why is authorization essential before penetration testing?

A) It improves scanner speed
B) It guarantees no vulnerabilities exist
C) It eliminates all legal requirements
D) It establishes permission and scope for security testing

189. What is attack surface management concerned with?

A) Employee performance
B) Discovering and managing externally or internally exposed assets and potential attack paths
C) Password formatting
D) Backup compression

190. What is an exposed attack surface example?

A) A disabled service
B) An offline backup
C) An internet-facing administrative interface
D) An encrypted offline disk

191. What is privilege escalation?

A) Gaining higher permissions than initially authorized
B) Reducing network bandwidth
C) Encrypting a backup
D) Creating a low-privilege account

192. What is lateral movement?

A) Changing a password
B) Patching a workstation
C) Encrypting a network
D) Moving from one compromised system or account to other resources

193. What is persistence in an attack context?

A) Removing malicious code
B) Maintaining access to a compromised environment over time
C) Closing network ports
D) Restoring from backup

194. Why should production penetration testing have clearly defined stop conditions?

A) To hide findings
B) To make reports shorter
C) To reduce the chance of unacceptable service disruption or unintended impact
D) To prevent all vulnerability discovery

195. What is a remediation validation scan used for?

A) Confirm that reported vulnerabilities or configuration issues have been addressed
B) Create new vulnerabilities
C) Replace change management
D) Disable vulnerability scanners

Cryptography and Key Management

196. What is the main purpose of a cryptographic hash function?

A) Reversible encryption
B) Network routing
C) User authentication by itself
D) Producing a fixed-length digest useful for integrity and other security purposes

197. Which property makes a secure cryptographic hash difficult to reverse into its original input?

A) Compression
B) Preimage resistance
C) Load balancing
D) Packet filtering

198. What is a salt used for when storing passwords?

A) Encrypt network traffic
B) Recover forgotten passwords
C) Make identical passwords produce different stored hashes and resist precomputed attacks
D) Replace password hashing

199. What is the difference between encryption and hashing?

A) Encryption is designed to be reversible with the appropriate key, while hashing is generally one-way
B) Hashing always uses two keys
C) Encryption cannot protect confidentiality
D) Hashing is used only for network routing

200. What is authenticated encryption designed to provide?

A) Compression only
B) User provisioning
C) Network segmentation
D) Confidentiality and integrity/authenticity of protected data

201. Why is key rotation important?

A) It increases password reuse
B) It limits the impact of a key being exposed and supports key lifecycle management
C) It removes the need for encryption
D) It guarantees perfect forward secrecy

202. What is a Hardware Security Module (HSM) commonly used for?

A) Web browsing
B) Network packet routing
C) Protecting and performing cryptographic operations with sensitive keys
D) Endpoint patching

203. What is perfect forward secrecy intended to protect?

A) Past session data from being decrypted if a long-term key is later compromised
B) Passwords from being forgotten
C) Network availability
D) Cloud billing records

204. Which is an example of asymmetric cryptography?

A) AES
B) ChaCha20
C) HMAC
D) RSA

205. What is HMAC primarily used to provide?

A) Data compression
B) Integrity and authenticity using a shared secret key
C) Public key encryption
D) Network address translation

206. What does certificate pinning attempt to do in an application?

A) Disable TLS
B) Rotate passwords
C) Restrict trusted certificates or public keys beyond the normal trust store
D) Replace authorization

207. What is a certificate revocation mechanism used for?

A) Indicate that a certificate should no longer be trusted before its normal expiration
B) Increase certificate lifetime
C) Encrypt passwords
D) Block all DNS queries

208. What is a key escrow system designed to provide?

A) Automatic password guessing
B) Public access to private keys
C) Unrestricted administrator access
D) Controlled recovery of cryptographic keys under defined policies

209. Why is private key protection critical for a digital certificate?

A) The private key is public by design
B) Compromise of the private key can allow an attacker to impersonate the key holder or forge signatures, depending on use
C) It controls DNS TTL
D) It stores application logs

210. What is the goal of post-quantum cryptography?

A) Increase CPU clock speed
B) Remove all symmetric cryptography
C) Develop cryptographic schemes designed to resist attacks from sufficiently capable quantum computers
D) Replace security monitoring

Governance, Risk and Compliance

211. What is the purpose of a risk assessment?

A) Identify threats, vulnerabilities, likelihood, and potential impact to support risk decisions
B) Guarantee compliance with every regulation
C) Replace security controls
D) Eliminate business risk

212. What is inherent risk?

A) Risk remaining after controls
B) Risk accepted by an auditor
C) Risk caused only by employees
D) Risk that exists before considering the effect of controls

213. What is residual risk?

A) Risk before controls
B) Risk remaining after controls are applied
C) Risk with no business impact
D) Risk that cannot be measured

214. What does risk acceptance mean?

A) Eliminating a risk completely
B) Transferring all risk to a vendor
C) Formally deciding to tolerate a defined level of risk
D) Ignoring a risk without documentation

215. What is risk treatment?

A) Selecting and applying actions such as mitigation, transfer, avoidance, or acceptance
B) Deleting risk registers
C) Disabling security monitoring
D) Replacing business owners

216. What is the primary purpose of ISO/IEC 27001?

A) Define a programming language
B) Standardize network routing
C) Certify individual penetration testers
D) Provide requirements for an information security management system

217. What does SOC 2 primarily evaluate?

A) A company's source-code syntax
B) Controls relevant to specified trust services criteria
C) Network bandwidth
D) Employee technical certifications

218. What is data classification used for?

A) Increase data volume
B) Remove metadata
C) Categorize information according to sensitivity and handling requirements
D) Replace encryption

219. What is data minimization?

A) Collecting and retaining only the data necessary for a defined purpose
B) Encrypting data twice
C) Deleting all logs
D) Removing access controls

220. What is privacy by design?

A) Adding privacy controls only after a breach
B) Avoiding all data processing
C) Publishing personal data openly
D) Considering privacy protections throughout system and process design

221. What is a business impact analysis (BIA) used to identify?

A) Malware signatures
B) Critical business processes and the effects of their disruption
C) Employee passwords
D) Firewall firmware versions

222. What does Recovery Time Objective (RTO) define?

A) Maximum acceptable data loss
B) Maximum password age
C) Target time to restore a service after disruption
D) Maximum log size

223. What does Recovery Point Objective (RPO) define?

A) The amount of data loss measured in time that can be tolerated
B) The time needed to detect phishing
C) The number of administrators required
D) The number of backups per server

224. What is a third-party risk assessment intended to evaluate?

A) Employee productivity
B) Internet speed
C) Office seating capacity
D) Security and operational risks introduced by a vendor or partner

225. Why is evidence important during an audit?

A) It makes controls unnecessary
B) It supports claims that required controls or processes are operating as described
C) It guarantees certification
D) It replaces risk assessment

DevSecOps and Software Supply Chain

226. What is the main goal of DevSecOps?

A) Remove developers from security decisions
B) Delay security until production
C) Integrate security practices throughout the software delivery lifecycle
D) Replace testing with manual reviews

227. What is shift-left security?

A) Addressing security earlier in development rather than waiting until deployment
B) Moving security teams out of engineering
C) Disabling production monitoring
D) Testing only after release

228. What is a secret scanning tool intended to detect?

A) Network latency
B) CPU overheating
C) Broken user interfaces
D) Credentials or sensitive tokens accidentally committed to code or repositories

229. What is a secure CI/CD pipeline expected to protect?

A) Only the developer's laptop
B) Source code, build processes, credentials, artifacts, and deployment stages
C) Only application screenshots
D) Office Wi-Fi passwords

230. What is artifact signing used to help establish?

A) Faster builds
B) Lower storage costs
C) Integrity and provenance of software artifacts
D) Automatic vulnerability remediation

231. What is dependency confusion?

A) A supply-chain attack where a package manager may retrieve a malicious package with a conflicting name
B) A network routing failure
C) A password reset issue
D) A database deadlock

232. What is typosquatting in software ecosystems?

A) Encrypting package metadata
B) Rotating dependency versions
C) Scanning container images
D) Using names that closely resemble legitimate packages to trick users into installing them

233. Why should CI/CD service credentials have narrowly scoped permissions?

A) To make builds slower
B) To limit the impact if pipeline credentials are compromised
C) To prevent code review
D) To disable deployment automation

234. What is policy as code?

A) Writing passwords into scripts
B) Replacing security policies with documentation
C) Expressing enforceable rules in machine-readable form for automated evaluation
D) Encrypting policy documents

235. What does container image signing help consumers verify?

A) That an image is associated with a trusted signer or source and has not been altered after signing
B) That an image has no vulnerabilities
C) That a container cannot be compromised
D) That the image contains no open-source software

236. What is runtime application self-protection (RASP) designed to do?

A) Build source code
B) Manage employee identities
C) Replace code review
D) Monitor and potentially block suspicious application behavior at runtime

237. Why is code review valuable for application security?

A) It guarantees defect-free software
B) It can identify insecure logic, unsafe changes, and security weaknesses before release
C) It replaces automated testing
D) It eliminates dependency risks

238. What is a secure software development lifecycle (SSDLC)?

A) A method for increasing application advertising
B) A hardware replacement process
C) A development lifecycle that incorporates security requirements and activities throughout delivery
D) A cloud billing model

239. What is a reproducible build intended to improve?

A) Confidence that the same source and build inputs produce the expected artifact
B) Employee authentication
C) Network segmentation
D) Password recovery

240. Why should build dependencies be sourced from trusted registries?

A) To eliminate the need for testing
B) To increase package count
C) To bypass software licensing
D) To reduce exposure to malicious or tampered components

Emerging Security Practices

241. What is XDR intended to improve compared with isolated security tools?

A) Reduce all security telemetry
B) Correlate detection and response data across multiple security domains
C) Replace every firewall
D) Remove endpoint monitoring

242. What is the primary security purpose of a security data lake?

A) Store passwords in plain text
B) Replace all identity systems
C) Centralize large volumes of security telemetry for analysis and detection
D) Disable log retention

243. What is an AI-assisted security analyst most appropriately used for?

A) Accelerating tasks such as alert summarization, investigation support, and query generation with human oversight
B) Granting unrestricted administrator access
C) Making irreversible production changes without review
D) Replacing every security control

244. What is a major security concern when using generative AI with sensitive enterprise data?

A) Faster typing
B) Lower monitor brightness
C) Increased network cabling
D) Unintended disclosure or misuse of sensitive information

245. What is prompt injection in an AI application?

A) A method of encrypting prompts
B) Malicious or untrusted instructions designed to manipulate an AI system's behavior or handling of data
C) A network firewall rule
D) A password hashing algorithm

246. What security control can reduce the impact of a compromised AI agent with access to enterprise tools?

A) Granting the agent all permissions
B) Disabling audit logs
C) Least-privilege tool access with scoped permissions and approvals
D) Storing credentials in prompts

247. What is a major security consideration for LLM applications that retrieve enterprise documents?

A) Ensuring retrieved content is authorized for the requesting user
B) Making every document publicly searchable
C) Disabling document access controls
D) Treating all retrieved content as trusted instructions

248. What is the purpose of a cloud-native application protection platform (CNAPP)?

A) Manage employee payroll
B) Replace all network protocols
C) Provide physical access to data centers
D) Bring together security capabilities across cloud workloads and development or runtime environments

249. Why is cryptographic agility becoming important for long-lived systems?

A) It eliminates key management
B) It makes it easier to replace cryptographic algorithms or parameters when requirements or threats change
C) It removes the need for certificates
D) It prevents all quantum research

250. What is the main security objective of continuous exposure management?

A) Increase the number of exposed assets
B) Replace incident response
C) Continuously identify and prioritize exposures based on their potential business risk
D) Disable vulnerability scanning

Your Quiz Result

Right Answers:

Wrong Answers:

Unattempted:

Score: %

Congratulations!
With a % score, you have unlocked up to 50% discount on all of our self-paced SQL courses.
Click on the Contact button to avail the offer.

You Can Also Check:
1. Top Cybersecurity Interview Questions and Answers
2. Cyber Security Tutorial
3. How to Become an Ethical Hacker
4. Top 10 Cybersecurity Tools For 2026
5. A Guide To Start A Career in Cyber Security
6. Top 10 Career Opportunities in Cyber Security (Updated 2026)

About the Author

Chinmay

Chinmay has worked in cybersecurity for over a decade, handling vulnerability assessments and incident response across sectors. He's seen firsthand how theoretical security policies break down against real attack patterns. He tests techniques in controlled labs before recommending them, writing for professionals who want to understand how attacks actually work.

Enquiry is created successfully

Drop Us a Query

Fields marked * are mandatory

Name

Phone Number