Security Engineer · CyberQuiz

Q1 Easy 10 pts

The 'CIA triad' stands for:

Central Intelligence Agency Confidentiality, Integrity, Availability Control, Isolation, Auditing Cipher, Identity, Access

Q2 Medium 15 pts

Which is an ASYMMETRIC (public-key) algorithm?

AES RSA SHA-256 ChaCha20

Q3 Medium 15 pts

Giving each identity only the access it needs is the principle of least ____ .

Q4 Medium 15 pts

Passwords at rest should be stored as:

Plaintext A shared-key encryption A slow salted hash (bcrypt/Argon2) Base64

Q5 Medium 15 pts

Layering multiple overlapping controls so no single failure is fatal is defense in ____ .

Q6 Easy 10 pts

MFA combines factors from which categories?

Two passwords Something you know, have, and are Username and email IP and MAC

Q7 Medium 15 pts

A 'salt' in password hashing:

Speeds hashing Adds unique random data so identical passwords hash differently (defeats rainbow tables) Encrypts the DB Shortens the hash

Q8 Medium 15 pts

Which provides INTEGRITY of a message, proving it wasn't altered?

Compression A cryptographic hash / MAC / digital signature Base64 A firewall

Q9 Medium 20 pts

TLS provides confidentiality primarily via:

Hashing only Symmetric encryption of the session (keys exchanged asymmetrically) Base64 Compression

Q10 Medium 20 pts

A digital signature provides:

Only speed Authenticity and integrity (and non-repudiation) using the signer's private key Compression Load balancing

Q11 Medium 15 pts

A Certificate Authority (CA) is trusted to:

Route packets Issue and vouch for digital certificates binding keys to identities Encrypt disks Store passwords

Q12 Hard 20 pts

An HSM (Hardware Security Module) is used to:

Speed the GPU Securely generate/store cryptographic keys and perform crypto operations Serve web pages Scan ports

Q13 Medium 15 pts

'Zero Trust' architecture assumes:

The internal network is safe No implicit trust; verify every request regardless of location VPN is enough Firewalls solve everything

Q14 Easy 10 pts

RBAC grants permissions based on:

The user's mood The user's role/job function Random assignment IP address only

Q15 Hard 20 pts

ABAC makes decisions based on:

Only roles Attributes (user, resource, environment) evaluated by policy Passwords MAC addresses

Q16 Medium 15 pts

SAML and OIDC are used for:

Disk encryption Federated authentication / single sign-on Packet capture Port scanning

Q17 Hard 20 pts

OAuth 2.0 is fundamentally about:

Authentication of the user's identity Delegated AUTHORIZATION (granting access to resources) Encryption Logging

Q18 Medium 15 pts

Network segmentation improves security by:

Speeding traffic Limiting lateral movement and containing breaches Removing firewalls Sharing one VLAN

Q19 Medium 15 pts

A DMZ is:

A password vault A buffer network zone exposing public services while isolating the internal network A VPN client An IDS rule

Q20 Hard 20 pts

STRIDE is a model for:

Password strength Threat modeling (Spoofing, Tampering, Repudiation, Info disclosure, DoS, Elevation) Encryption Load balancing

Q21 Medium 15 pts

Risk is commonly expressed as:

Cost only Likelihood × Impact Users × Servers CPU × RAM

Q22 Easy 10 pts

Patch/vulnerability management aims to:

Add features Reduce exposure by remediating known vulnerabilities timely Increase attack surface Disable logging

Q23 Easy 10 pts

CVSS scores range from:

0–5 0–10 1–100 A–F

Q24 Hard 20 pts

RPO (Recovery Point Objective) defines:

How fast you recover The maximum acceptable amount of data loss (time) The backup size The uptime SLA

Q25 Hard 20 pts

RTO (Recovery Time Objective) defines:

Data loss allowed The maximum acceptable downtime before recovery Backup frequency Password length

Q26 Medium 15 pts

The '3-2-1' backup rule means:

3 passwords, 2 admins, 1 server 3 copies, on 2 media types, with 1 offsite 3 firewalls 3 VPNs

Q27 Medium 15 pts

Key rotation is important because:

It speeds crypto It limits exposure if a key is compromised It shortens keys It disables TLS

Q28 Hard 20 pts

Perfect Forward Secrecy ensures that:

Keys never change Compromise of a long-term key doesn't expose past session traffic No encryption is used Passwords are shared

Q29 Medium 15 pts

Secrets like DB passwords should live in:

Source code A secrets manager/vault, injected at runtime A public wiki Client JavaScript

Q30 Medium 15 pts

A WAF sits at which layer to protect apps?

Physical layer Application layer (HTTP/HTTPS) Data-link layer Power supply

Q31 Hard 20 pts

NIST CSF's five core functions are:

Plan, Do, Check, Act, Repeat Identify, Protect, Detect, Respond, Recover Scan, Patch, Log, Alert, Fix Read, Write, Execute, Deny, Allow

Q32 Medium 15 pts

PCI-DSS applies to organizations that:

Handle health records Store/process/transmit payment card data Run schools Sell books only

Q33 Medium 15 pts

HIPAA primarily protects:

Payment cards Protected health information (PHI) Trade secrets Source code

Q34 Medium 15 pts

GDPR is a regulation focused on:

Card payments Personal data protection and privacy for EU individuals Network speed Cloud billing

Q35 Medium 15 pts

Input validation defends primarily against:

Slow networks Injection and malformed-input attacks High latency Disk failure

Q36 Medium 15 pts

A security 'baseline' (e.g. CIS Benchmarks) provides:

A password list Hardening standards for secure configuration of systems A malware sample A network map

Q37 Medium 15 pts

Logging and monitoring are critical because:

They slow attackers by noise Without them, breaches go undetected and can't be investigated They encrypt data They replace backups

Q38 Hard 20 pts

DNSSEC protects against:

Slow DNS DNS response tampering/spoofing via cryptographic signatures Large zones Email spam

Q39 Medium 15 pts

Rate limiting and CAPTCHAs help mitigate:

Encryption failures Automated abuse: brute force, scraping, credential stuffing Disk errors TLS handshakes

Q40 Medium 15 pts

An air-gapped system is:

Always online Physically isolated from unsecured networks A cloud VM A load balancer

Q41 Hard 20 pts

Non-repudiation ensures:

Data is fast A party cannot deny having performed an action (via signatures/logs) Data is compressed Keys are shared

Q42 Medium 15 pts

Symmetric encryption (e.g. AES) uses:

A public/private key pair The same shared secret key to encrypt and decrypt No key A hash

Q43 Hard 20 pts

Certificate pinning defends against:

Slow TLS Fraudulent/mis-issued certificates by expecting a known cert/key Large files DNS caching

Q44 Easy 10 pts

A 'defense in depth' example is:

Only a password Firewall + MFA + endpoint protection + monitoring together One antivirus A single VLAN

Q45 Medium 15 pts

Threat modeling is best done:

After a breach only Early in design, iteratively as the system evolves Never Only by auditors

Q46 Hard 20 pts

A honeytoken is:

A crypto coin A decoy credential/file that alerts when accessed A backup key A firewall rule

Q47 Medium 15 pts

Encrypting data 'in transit' and 'at rest' addresses:

Availability only Confidentiality of data on the wire and on disk Latency Compression

Q48 Medium 15 pts

Principle of 'fail secure' means on failure the system:

Grants all access Defaults to denying access / a safe state Deletes data Ignores errors

Q49 Medium 15 pts

A SOC 2 report attests to controls around:

Card payments only Security, availability, confidentiality, etc. of a service org Kernel code Wi-Fi speed

Q50 Easy 10 pts

The best security culture treats security as:

One team's job at the end A shared, continuous responsibility across the org and lifecycle Optional A one-time audit