60 questions / 10 random questions
Random questions, instant feedback, and review for missed questions.
View recommended Registered Information Security Specialist resources →
Why is symmetric-key encryption (e.g., AES) well suited to encrypting large volumes of data?
Answer: It is faster than public-key encryption
Symmetric encryption is faster than public-key encryption, suiting bulk data; key distribution must be solved separately.
Which approach delivers a symmetric key via public-key encryption and encrypts the body quickly with that symmetric key?
Answer: Hybrid cryptography
Hybrid cryptography distributes the key with public-key crypto and encrypts the body with symmetric crypto, balancing security and speed; TLS uses this.
Which technique is used to verify that a file has not been tampered with?
Answer: Comparing hash values (e.g., SHA-256)
A hash changes drastically with any input change, so comparing hashes before and after distribution detects tampering.
Which technique uses a shared key to confirm both message integrity and sender authenticity?
Answer: HMAC (keyed-hash message authentication)
HMAC combines a shared key with a hash function to provide both tamper detection and sender authentication.
Which security property does a digital signature provide?
Answer: Integrity, authentication, and non-repudiation
A digital signature, created with the signer private key and verified with the public key, provides integrity, authentication, and non-repudiation.
Which electronic data has a trusted third party vouch for the binding between a public key and its owner?
Answer: A digital certificate (public-key certificate)
A digital certificate, issued by a CA, attests that a public key truly belongs to the stated owner.
Which mechanism checks online whether a digital certificate has been revoked?
Answer: OCSP
OCSP queries certificate revocation status online; a CRL distributes revocations as a list.
Which authentication combines a password with something like an IC card or biometrics?
Answer: Multi-factor authentication
Multi-factor authentication combines different factor types so one leaked factor is not enough to break in.
Which framework securely delegates access to a user's resources on one service to another service?
Answer: OAuth 2.0
OAuth 2.0 delegates authorization without sharing passwords, using access tokens.
Which mechanism lets users access multiple services after a single authentication?
Answer: Single sign-on (SSO)
SSO lets one authentication grant access to multiple services; SAML and OpenID Connect are common implementations.
Which phishing-resistant method authenticates with public-key cryptography instead of passwords?
Answer: FIDO2 / passwordless authentication
FIDO2 authenticates with a device-held private key and public-key crypto, sending no password, making it phishing-resistant.
Which attack injects malicious scripts into a web page so they run in visitors' browsers?
Answer: Cross-site scripting (XSS)
XSS injects malicious scripts where input is not properly escaped; output escaping is the basic defense.
Which attack forces a logged-in user's browser to perform unintended actions on a site?
Answer: Cross-site request forgery (CSRF)
CSRF tricks a logged-in user into sending forged requests; CSRF tokens and similar checks defend against it.
Which is the most fundamental defense against SQL injection?
Answer: Use placeholders (prepared statements)
Placeholders treat input as data so it cannot alter the SQL structure, providing a fundamental defense.
Which attack uses sequences like ../ to access files outside the intended directory?
Answer: Directory traversal
Directory traversal exploits weak path validation to read unintended files; validating and normalizing input prevents it.
Which attack intercepts a connection and impersonates both parties to eavesdrop or alter traffic?
Answer: Man-in-the-middle (MITM) attack
MITM intercepts a connection to eavesdrop or tamper; TLS encryption and certificate validation mitigate it.
Which attack feeds false resolution data into a DNS server to redirect users to fake sites?
Answer: DNS cache poisoning
DNS cache poisoning caches forged responses to redirect users to malicious sites; DNSSEC is one countermeasure.
Which attack reuses ID/password pairs leaked from another service to attempt logins?
Answer: Credential stuffing (password list attack)
Credential stuffing reuses leaked credentials on other sites; avoiding password reuse and using MFA mitigate it.
Which setting helps prevent theft of cookies holding a session ID?
Answer: Set the Secure and HttpOnly attributes on the cookie
Secure restricts the cookie to HTTPS and HttpOnly blocks script access, reducing session-theft risk.
Which protocol encrypts HTTP traffic between browser and server to prevent spoofing and eavesdropping?
Answer: TLS
TLS provides encryption, server authentication, and integrity, underpinning HTTPS; FTP and Telnet are plaintext.
Which technology builds an encrypted, virtual private link between sites over the internet?
Answer: IPsec VPN
IPsec VPN provides encryption and authentication at the IP layer to connect sites securely.
Which mechanism inspects traffic to detect and block web-app attacks such as SQL injection and XSS?
Answer: WAF (Web Application Firewall)
A WAF inspects web-application-layer traffic to detect and block common attack patterns.
Which system aggregates and correlates logs from many devices to detect security anomalies?
Answer: SIEM
SIEM centrally collects and correlates logs to detect signs of attacks or anomalies and support incident response.
Which is a fundamental practice emphasized in secure coding?
Answer: Properly validate all input
Input validation is fundamental against many vulnerabilities; avoid leaking info in errors and excessive privileges.
Which term means building security in from the planning and design phases?
Answer: Security by design
Security by design incorporates security from the earliest design stages rather than bolting it on later.
Which activity analyzes logs and media after an incident to find the cause and preserve evidence?
Answer: Digital forensics
Digital forensics analyzes logs and media while preserving evidence integrity, aiding root-cause and legal response.
In incident response, which is an appropriate first action?
Answer: Identify the scope and contain it to prevent further damage
Early response identifies scope and contains the incident; avoid deleting logs so evidence is preserved.
Which law prohibits using others' credentials without permission and intruding by exploiting vulnerabilities?
Answer: The unauthorized computer access law
The unauthorized access law prohibits using others' credentials without permission and intruding via security holes.
A corporate endpoint shows suspicious PowerShell execution and outbound traffic. Which product category is used for investigation, isolation, and process termination after compromise?
Answer: EDR
EDR continuously records and detects endpoint behavior and supports investigation, isolation, and containment during compromise.
You do not want to rely only on perimeter defense and instead decide access each time based on device state, user, destination, and risk. Which concept applies?
Answer: Zero trust
Zero trust avoids implicit trust based on network location and continuously evaluates authentication, authorization, device posture, and context.
For vulnerability remediation on public servers, you want to prioritize using CVSS plus exposure and exploit availability. Which approach is appropriate?
Answer: Prioritize risk-based remediation using asset criticality, exposure, and exploitability
In practice, prioritization considers CVSS, asset criticality, internet exposure, exploitation, mitigations, and business impact.
In a cloud environment, you want to avoid embedding long-lived access keys in an app and delegate permissions using temporary credentials. Which policy is appropriate?
Answer: Use a workload role so temporary credentials are obtained automatically
Assigning roles to workloads and using temporary credentials reduces long-lived key leakage risk; least privilege should also be designed.
You want to detect known vulnerabilities in container images before production deployment. Which CI/CD measure is appropriate?
Answer: Run image scanning and block deployment based on severity and exploitability
Container security integrates image scanning, base image updates, signature verification, and least-privilege runtime into CI/CD.
You want to know OSS libraries and versions in use and quickly identify impact when a vulnerability is disclosed. What should be maintained?
Answer: SBOM
An SBOM lists software components, versions, and dependencies, supporting software supply chain risk management.
An API lets users specify any URL that the server fetches, creating risk of access to internal admin endpoints. Which vulnerability is this?
Answer: SSRF
SSRF makes a server send attacker-controlled requests to internal networks or metadata services; allow lists and internal target blocking help.
Which mechanism uses SPF and DKIM results to tell receivers how to handle mail spoofing your domain?
Answer: DMARC
DMARC lets a domain owner publish policy for mail failing SPF or DKIM checks, helping reduce domain spoofing.
Which logging practice improves evidential value for future incident investigation?
Answer: Synchronize time and store logs for the required period in tamper-resistant storage
Logs are more useful for investigation and audit when time is synchronized and integrity, access control, retention, and centralization are managed.
Which backup design practice improves recoverability against ransomware?
Answer: Keep versions and store copies in offline or immutable locations that attackers cannot easily modify
Ransomware-ready backups use multiple versions, offline or immutable storage, separated privileges, and regular restore testing.
Before moving a critical process to an external SaaS, you want to check availability, logging, data deletion, and incident contact. Which management activity is appropriate?
Answer: Risk assessment and supplier management for cloud service use
SaaS risk management checks contract terms, SLA, audit logs, data protection, deletion or return, incident contacts, and supplier controls.
A former employee's account remained active and could still log in to VPN. Which control best prevents recurrence?
Answer: Disable accounts linked to HR events and perform periodic account inventory and access reviews
Identity lifecycle management links joiner, mover, and leaver events to access changes and uses account cleanup, periodic review, and log monitoring.
A large object store is encrypted, and rotating the master key should not require re-encrypting every object. Which key-management design is appropriate?
Answer: Envelope encryption using a per-object data encryption key wrapped by a master key
Envelope encryption encrypts data with a DEK and wraps that DEK with a KEK. KEK rotation can rewrap only the DEKs instead of re-encrypting all data.
An AES-GCM implementation reuses the same key and nonce pair. What is the most important correction?
Answer: Guarantee nonce uniqueness for each key and design generation and storage to prevent reuse
Reusing a key and nonce in GCM breaks confidentiality and authentication security. Nonces must be uniquely managed, and data must be rejected if tag verification fails.
An internal API must verify the client workload's identity with a certificate as well as the server's identity. Which approach fits?
Answer: Mutual TLS (mTLS)
mTLS has both parties present and validate certificates, providing encrypted transport and mutual workload authentication. Issuance, revocation, and rotation must also be operated.
Which mechanism should a mobile application's OAuth 2.0 authorization code flow use to prevent an intercepted authorization code from being redeemed?
Answer: PKCE code verifier and code challenge
PKCE binds the authorization request challenge to a verifier used at token exchange, preventing an attacker with only the code from redeeming it. Redirect URIs must also be strictly matched.
Privileged production database access should be allowed only during an approved ticket window and the session must be recorded. Which design fits?
Answer: Use PAM integrating just-in-time access, a credential vault, and session recording
PAM isolates privileged credentials and combines approval, time limits, and session records to reduce standing privilege and accountability risks.
An API passes untrusted input directly into Java object deserialization, creating remote-code-execution risk. What is the fundamental mitigation?
Answer: Use a safe data format, restrict allowed types and schemas, and avoid dangerous native deserialization
Untrusted deserialization can execute gadget chains. Prefer simple formats, strict schemas, allowlists, updated libraries, and avoid unnecessary object reconstruction.
A reverse proxy and backend disagree on HTTP request boundaries, causing a following request to be interpreted as attacker input. Which attack is likely?
Answer: HTTP request smuggling
Request smuggling exploits frontend/backend disagreement over fields such as Content-Length and Transfer-Encoding. Reject ambiguity, normalize protocols, and update components.
Which network control best prevents arbitrary outbound traffic from a compromised server while allowing only required external APIs?
Answer: Allowlist destinations and ports through an egress firewall or proxy and monitor DNS and traffic logs
Egress controls restrict C2 and exfiltration paths. Maintain approved destinations and detect deviations in proxy and DNS logs.
An endpoint makes frequent queries for long subdomains with unusually large responses. What activity and validation are appropriate?
Answer: Suspect DNS tunneling and correlate query length, entropy, frequency, destination domains, and endpoint processes
DNS tunneling encodes data in subdomains for C2 or exfiltration. Combine statistical features, domain intelligence, and endpoint telemetry for analysis.
Which combination finds tainted-input paths during development and externally tests authentication or session issues in a running web application?
Answer: Use both SAST and DAST
SAST examines code structure and data flow; DAST tests external behavior of a running system. Add SCA, manual review, and penetration testing according to risk.
Which activity identifies how attackers might abuse assets across trust boundaries during design?
Answer: Threat modeling using data-flow diagrams and a method such as STRIDE
Threat modeling identifies assets, actors, data flows, trust boundaries, abuse cases, and mitigations while design changes are still inexpensive.
How should a CI pipeline authenticate to a cloud provider without storing long-lived access keys as secrets?
Answer: Use OIDC federation to validate repository and branch claims and issue short-lived credentials
Workload identity federation validates the CI OIDC token and exchanges it for short-lived cloud credentials. Constrain audience, subject, branch, and environment with least privilege.
A running server is suspected of compromise. Which evidence is highly volatile and should be acquired before a disk image when feasible?
Answer: Volatile data such as memory, processes, network connections, and logged-on sessions
Following order of volatility, preserve memory artifacts and live network state first when appropriate. Balance this against containment needs and document acquisition steps.
Ransomware is executing on multiple endpoints and domain administrator credentials may be compromised. What is an appropriate initial containment strategy?
Answer: Isolate infected hosts and affected segments, revoke and rotate compromised credentials through a safe path, and protect backups and critical servers
Ransomware containment must address lateral movement, credential abuse, and backup destruction together. Coordinate isolation scope and business impact, using clean administration paths.
What is required when transferring a forensic image to an external investigator to demonstrate evidence identity and handling history?
Answer: A chain of custody recording hashes at acquisition and copy, timestamps, handlers, storage, and transfers
Chain of custody continuously records who handled what, when, and in what condition, while hashes verify copy integrity. Analysis should normally use a verified working copy.
How should an organization prohibit disabling audit logs and creating public storage across many cloud accounts?
Answer: Enforce organization-level guardrails or SCPs and detect violation attempts through centralized monitoring
Organization-level preventive guardrails deny dangerous operations, while logs centralized in a separate account resist tampering by individual account administrators.
Which controls reduce the risk that an SSRF flaw in a cloud VM web application steals credentials from instance metadata?
Answer: Require metadata-session tokens, limit hops, control egress, and apply least privilege to the workload role
SSRF defense combines application destination validation, metadata-service protections, and least-privilege roles to limit credential theft and impact if one layer fails.
Which storage design makes security-log deletion or tampering difficult even if an administrator account is compromised?
Answer: Forward logs to a separate account with append-only or WORM retention and tightly restricted deletion rights
Separating logs from the managed domain and applying immutability, retention locks, least privilege, and time synchronization improves resistance to evidence destruction.
A SIEM rule produces so many false positives that analysts miss important alerts. What is the appropriate improvement?
Answer: Validate detection intent and data quality, tune with asset criticality, identity, and baselines, and continue measuring outcomes
Detection engineering tunes use cases, telemetry, thresholds, and context, then continuously measures true and false positives, coverage, and response time.
A security analyst is asked to accept a new service's residual risk alone. What is the appropriate process?
Answer: Present business impact and alternatives so the authorized risk owner formally approves with conditions and an expiry
Risk acceptance belongs to an authorized business risk owner who understands assessment results, alternatives, conditions, and expiry. Security provides analysis and advice.