How to find: Press "Ctrl + F" in your browser and type key terms to locate the specific exam item or explanation. If the item is not listed on this page, please search for it in our comprehensive IT Exam Items Repository.
Introduction to Cybersecurity: My Knowledge Check Answers
1. What action will an IDS take upon detection of malicious traffic?
- Block or deny all traffic
- Drop only packets identified as malicious
- Create a network alert and log the detection
- Reroute malicious traffic to a honeypot
Explanation: Topic 4.1.7
An IDS, or intrusion detection system, is a device that can scan packets and compare them to a set of rules or attack signatures. If the packets match attack signatures, then the IDS can create an alert and log the detection.
2. Which of the following is an example of two factor authentication?
- Your account number and your name
- Your answer to a general knowledge question and your password
- Your fingerprint and your password
- Your password and your username
Explanation: Topic 3.4.1
3. Which of the statements correctly describes cybersecurity?
- Cybersecurity is the ongoing effort to protect individuals, organizations and governments from digital attacks
- Cybersecurity is the ongoing effort to protect individuals, organizations and governments from crimes that happen only in cyberspace
- Cybersecurity is the ongoing effort to protect computers, networks and data from malicious attacks
Explanation: Topic 1.1.1
Cybersecurity is the ongoing effort to protect individuals, organizations and governments from digital attacks by protecting networked systems and data from unauthorized use or harm.
4. Which of the following certifications tests your understanding and knowledge in how to look for weaknesses and vulnerabilities in target systems using the same knowledge and tools as a malicious hacker, but in a lawful and legitimate manner?
- Microsoft Technology Associate Security Fundamentals
- Palo Alto Networks Certified Cybersecurity Associate
- ISACA CSX Cybersecurity Fundamentals
- CompTIA Security+
- EC Council Certified Ethical Hacker
- ISC2 Certified Information Systems Security Professional
Explanation: Topic 5.2.2
This certification tests your understanding and knowledge of how to look for weaknesses and vulnerabilities in target systems using the same knowledge and tools as a malicious hacker but in a lawful and legitimate manner.
5. Carrying out a multi-phase, long-term, stealthy and advanced operation against a specific target is often referred to as what?
- Network sniffing
- Advanced persistent threat
- Social engineering
- Script kiddies
- Rainbow tables
Explanation: Topic 2.2.10
An Advanced Persistent Threat (APT) is defined as a multi-phase, long-term, and stealthy operation directed at a specific target. Its primary goal is to deploy customized malware and maintain unauthorized access to the target's systems while remaining undetected for an extended period.
6. Can you identify the cyber attacker type from the following descriptions?
- Make political statements in order to raise awareness about issues that are important to them - Hacktivists
- Gather intelligence or commit sabotage on specific goals on behalf of their government - State-sponsored attackers
- Use existing tools on the Internet to launch a cyber attack - Script kiddies
Explanation: Topic 1.4.1
7. What is a security playbook?
- A collection of repeatable queries or reports that outline a standardized process for incident detection and response
- A collection of security alerts, logs and historical data from the network
- A step-by-step guide on how to carry out IT-related procedures
Explanation: Topic 4.3.2
8. Which of the following characteristics describe a worm? (Choose two.)
- Executes when software is run on a computer
- Is self-replicating
- Hides in a dormant state until needed by an attacker
- Infects computers by attaching to software code
- Travels to new computers without any intervention or knowledge of the user
Explanation: Topic 2.1.1
Worm is a type of malware that replicates itself in order to spread from one computer to another. Unlike a virus, which requires a host program to run, worms can run by themselves. Other than the initial infection of the host, they do not require user participation and can spread very quickly over the network.
9. What is the main purpose of cyberwarfare?
- To protect cloud-based data centers
- To gain advantage over adversaries
- To develop advanced network devices
- To simulate possible war scenarios among nations
Explanation: Topic 1.5.2
Cyberwarfare is Internet-based conflict that involves the penetration of the networks and computer systems of other nations. The main purpose of cyberwarfare is to gain advantage over adversaries, whether they are nations or competitors.
10. During a meeting with the Marketing department, a representative from IT discusses features of an upcoming product that will be released next year. Is this employee’s behavior ethical or unethical?
- Ethical
- Unethical
Explanation: Topic 1.2.1
Sharing information on a new product to the Marketing department of the same company is ethical behavior. It gives them ample lead time to begin development of a marketing plan for the new product.
11. What is the only way of ensuring that deleted files on your computer are irrecoverable?
- Using a software program such as SDelete or Secure Empty Trash
- Emptying your computer’s recycle bin
- Physically destroying your computer’s hard drive
Explanation: Topic 3.2.5
The only way to be certain that data or files are not recoverable is to physically destroy the hard drive or storage device.
12. Which of the following items are states of data? (Choose three.)
- Storage
- Text
- ASCII
- Transmission
- Binary
- Processing
Explanation: Topic 1.2.2
Processing refers to data that is being used to perform an operation such as updating a database record (data in process).
Storage refers to data stored in memory or on a permanent storage device such as a hard drive, solid-state drive or USB drive (data at rest).
Transmission refers to data traveling between information systems (data in transit).
13. Which of the following actions should an organization take in the event of a security breach? (Choose two.)
- Contain the information so that it does not go public
- Communicate a call to action to all employees
- Carry out research to uncover what caused the breach
- Assume this type of breach won’t happen again
- Advise employees to be more careful
Explanation: Topic 4.2.5
14. In networking, what name is given to the identifier at both ends of a transmission to ensure that the right data is passed to the correct application?
- IP address
- Sequence number
- MAC address
- Port number
Explanation: Topic 4.1.5
In networking, every application running on a device is assigned a specific port number. This identifier is used at both ends of a transmission to ensure that data is passed to the intended application rather than another process on the same device.
15. 'Cryptocurrencies are handled on a centralized exchange.' Is this statement true or false?
- True
- False
Explanation: Topic 2.4.1
16. Which of the following are examples of on-path attacks? (Choose two.)
- SEO poisoning
- Man-in-the-Mobile
- Ransomware
- DDoS
- Man-in-the-Middle
- Worms
Explanation: Topic 2.2.5
An on-path attack is a method of infiltration where an attacker intercepts or modifies communications between two devices to collect sensitive information or impersonate one of the devices. The sources explicitly state that this type of attack is also referred to as a Man-in-the-Middle (MitM) or a Man-in-the-Mobile (MitMo) attack.
17. Which of the following firewalls filters traffic based on the user, device, role, application type and threat profile?
- Network layer firewall
- Application layer firewall
- Network address translation firewall
- Host-based firewall
- Context aware application firewall
Explanation: Topic 4.1.3
A Context aware application firewall (referred to as a context aware layer firewall in the sources) filters network communications by analyzing specific parameters such as the user, device, role, application type, and threat profile. This provides more sophisticated security than basic firewalls that only filter by IP addresses or ports.
18. Which of the following security vulnerabilities could result in the receipt of malicious information that could force a program to behave in an unintended way?
- Non-validated input
- Buffer overflow
- Race condition
- Access control problem
Explanation: Topic 2.3.3
Programs often require data input, but this incoming data could have malicious content, designed to force the program to behave in an unintended way.
19. Which of the following is an entry-level certification for newcomers who are preparing to start their career in cybersecurity?
- Microsoft Technology Associate Security Fundamentals
- Palo Alto Networks Certified Cybersecurity Associate
- ISACA CSX Cybersecurity Fundamentals
- CompTIA Security+
- EC Council Certified Ethical Hacker
- ISC2 Certified Information Systems Security Professional
Explanation: Topic 5.2.2
This is an entry-level certification for newcomers who are preparing to start their career in the cybersecurity field.
20. Can you identify why each of the following organizations might be interested in your online identity?
Internet service providers:
- They may be legally required to share your online information with government surveillance agencies or authorities
Advertisers:
- To monitor your online activities and send targeted ads your way
Social media platforms:
- To gather information based on your online activity, which is then shared with or sold to advertisers for a profit
Websites:
- To track your activities using cookies in order to provide a more personalized experience
Explanation: Topic 1.1.10
21. What can the skills developed by cybersecurity professionals be used for?
- Cybersecurity professionals develop many skills that can be only be used for good
- Cybersecurity professionals develop many skills that can only be used for evil
- Cybersecurity professionals develop many skills that cannot be used for evil
- Cybersecurity professionals develop many skills that can be used for good or evil
Explanation: Topic 5.1.1
22. One of your colleagues has lost her identification badge. She is in a hurry to get to a meeting and does not have time to visit Human Resources to get a temporary badge. You lend her your identification badge until she can obtain a replacement. Is this behavior ethical or unethical?
- Ethical
- Unethical
Explanation: Topic 5.1.2
Lending an identification badge is unethical because it bypasses access control, which is the formal process of managing physical access to an organization's equipment and resources. While the intention to help a colleague is positive, cybersecurity ethics require professionals to act within the bounds of policy and the law to protect the organization's data and reputation. Such behavior creates a security vulnerability and does not comply with established security practices.
23. Which of the following statements best describes cybersecurity?
- It is a framework for security policy development
- It is a standard-based model for developing firewall technologies to fight against cybercrime
- It is the name of a comprehensive security application for end users to protect workstations from being attacked
- It is an ongoing effort to protect Internet-connected systems and the data associated with those systems from unauthorized use or harm
Explanation: Topic 1.1.1
Cybersecurity is defined as the ongoing effort to protect individuals, organizations, and governments from digital attacks by safeguarding networked (Internet-connected) systems and data from unauthorized use or harm. It is a continuous process rather than a single application or fixed framework.
24. Why might internal security threats cause greater damage to an organization than external security threats?
- Internal users have better hacking skills
- Internal users have direct access to the infrastructure devices
- Internal users can access the organizational data without authentication
- Internal users can access the infrastructure devices through the Internet
Explanation: Topic 1.4.3
Internal threats have the potential to cause greater damage than external threats because internal users have direct access to the building and its infrastructure devices. Internal users may not have better hacking skills than external attackers. Both internal users and external users can access the network devices through the Internet. A well designed security implementation should require authentication before corporate data is accessed, regardless of whether the access request is from within the corporate campus or from the outside network.
25. What is the most common goal of search engine optimization (SEO) poisoning?
- To trick someone into installing malware or divulging personal information
- To overwhelm a network device with maliciously formed packets
- To build a botnet of zombies
- To increase web traffic to malicious sites
Explanation: Topic 2.2.6
A malicious user could create a SEO so that a malicious website appears higher in search results. The malicious website commonly contains malware or is used to obtain information via social engineering techniques.
26. What should you do in order to make sure that people you live with do not have access to your secure data?
- Turn on a firewall
- Increase the privacy settings on your browser
- Install antivirus software
- Set up password protection
Explanation: Topic 3.1.2
27. Which of these is the most recognizable and popular security certification, requiring at least five years’ relevant industry experience before you can take the exam?
- Microsoft Technology Associate Security Fundamentals
- Palo Alto Networks Certified Cybersecurity Associate
- ISACA CSX Cybersecurity Fundamentals
- CompTIA Security+
- EC Council Certified Ethical Hacker
- ISC2 Certified Information Systems Security Professional
Explanation: Topic 5.2.2
28. ____ is the use of technology to penetrate and attack another nation’s computer systems and networks in an effort to cause damage or disrupt services, such as shutting down a power grid.
- Cyberwarfare
- Cyberterrorism
- A cyber attack
- A cyber campaign
Explanation: Topic 1.5
29. Who is responsible for overseeing a blockchain electronic ledger?
- Anyone belonging to the blockchain network
- A central blockchain authority
- A central bank
- A government regulatory body
Explanation: Topic 2.4.1
30. A medical office employee sends emails to patients about their recent visits to the facility. What information would put the privacy of the patients at risk if it was included in the email?
- Contact information
- Next appointment
- Patient records
- First and last name
Explanation: Topic 1.1.4
An email message is transmitted in plain text and can be read by anyone who has access to the data while it is en route to a destination. Patient records include confidential or sensitive information that should be transmitted in a secure manner.
31. What tool can identify malicious traffic by comparing packet contents to known attack signatures?
- IDS
- Zenmap
- Nmap
- NetFlow
Explanation: Topic 4.1.7
An email message is transmitted in plain text and can be read by anyone who has access to the data while it is en route to a destination. Patient records include confidential or sensitive information that should be transmitted in a secure manner.
32. Which of the following firewalls hides or masquerades the private addresses of network hosts?
- Network layer firewall
- Host-based firewall
- Reverse proxy firewall
- Proxy server
- Network address translation firewall
Explanation: Topic 4.1.3
A Network address translation (NAT) firewall is specifically designed to hide or masquerade the private addresses of network hosts, protecting internal network identities from the public internet.
33. Improper management of physical access to a resource, such as a file, can lead to what type of security vulnerability?
- Buffer overflow
- Non-validated input
- Race conditions
- Weaknesses in security practices
- Access control problems
Explanation: Topic 2.3.3
Access control involves managing who can access resources, ranging from physical access to equipment to dictating who can read or change a file. Improper management of these controls creates security vulnerabilities because an attacker with physical access can bypass standard operating system protections to read data directly from a disk.
34. Which of the following methods is used to check the integrity of data?
- Backup
- Hashes or checksums
- Encryption
- Authentication
Explanation: Topic 1.2.2
Integrity ensures that system information or processes are protected from intentional or accidental modification. One way to ensure integrity is to use a hash function or checksum.
35. ‘Data coming into a program should be sanitized, as it could have malicious content, designed to force the program to behave in an unintended way.’ This statement describes what security vulnerability?
- Weaknesses in security practices
- Access control problems
- Buffer overflow
- Non-validated input
- Race conditions
Explanation: Topic 2.3.3
Non-validated input is a software vulnerability that occurs when data entering a program is not properly sanitized, allowing it to contain malicious content designed to force the program to behave in an unintended way. An example of this exploit is a user providing a file with invalid dimensions to force a program to allocate buffers of incorrect and unexpected sizes.
36. What is the best approach for preventing a compromised IoT device from maliciously accessing data and devices on a local network?
- Install a software firewall on every network device
- Place all IoT devices that have access to the Internet on an isolated network
- Disconnect all IoT devices from the Internet
- Set the security settings of workstation web browsers to a higher level
Explanation: Topic 3.1.2
The best approach to protect a data network from a possibly compromised IoT device is to place all IoT devices on an isolated network that only has access to the Internet.
37. How do Cisco ISE and TrustSec work?
- They enforce access to network resources by creating role-based access control policies
- They stop sensitive data from being stolen or escaping a network
- They block network traffic based on a positive rule or signature match
Explanation: Topic 4.3.4
38. Which of the following certifications does not expire or require periodic recertification and is geared towards post-secondary graduates and those interested in a career change?
- Microsoft Technology Associate Security Fundamentals
- Palo Alto Networks Certified Cybersecurity Associate
- ISACA CSX Cybersecurity Fundamentals
- CompTIA Security+
- EC Council Certified Ethical Hacker
- ISC2 Certified Information Systems Security Professional
Explanation: Topic 5.2.2
According to the sources, the Cisco Certified Support Technician (CCST) Cybersecurity is the entry-level certification that does not expire or require periodic recertification. It is specifically geared towards newcomers, including high school students, early college students, and those interested in a career change. While other certifications like CompTIA Security+ or EC Council CEH are mentioned, the sources do not attribute these specific non-expiring characteristics to them.
39. 'Securing physical access to target equipment is an organization’s best defense against a cyber attack.' Is this true or false?
- True
- False
Explanation: Topic 2.3.3
40. Which of the following firewalls filters ports and system service calls on a single computer operating system?
- Network layer firewall
- Application layer firewall
- Transport layer firewall
- Network address translation firewall
- Host-based firewall
Explanation: Topic 4.1.3
A host-based firewall is specifically designed to run on a single computer with the purpose of protecting that one device by filtering ports and system service calls on its operating system. Other firewall types, such as network layer or transport layer firewalls, typically focus on filtering external network traffic based on IP addresses or connection states.
41. What is the correct definition of risk management?
- The process of transferring risks that cannot be eliminated or mitigated
- The process of identifying and assessing risk to determine the severity of threats
- The process of accepting risks that cannot be eliminated, mitigated or transferred
- The process of identifying and assessing risk to reduce the impact of threats and vulnerabilities
Explanation: Topic 4.2.6
Risk management is the formal process of continuously identifying and assessing risk in an effort to reduce the impact of threats and vulnerabilities.
42.Which of the following security implementations use biometrics? (Choose two.)
- Fingerprint
- Phone
- Credit card
- Voice recognition
- Fob
Explanation: Topic 3.4.1
Biometrics verify identity using unique physical or behavioral characteristics. According to the sources, fingerprints and voice recognition (along with facial recognition) are specific examples of biometric scans, whereas devices like phones, credit cards, or fobs are classified as physical objects used for authentication.
43. Which of the following certifications meets the U.S. Department of Defense Directive 8570.01-M requirements, which is important for anyone looking to work in IT security for the federal government?
- EC Council Certified Ethical Hacker
- Microsoft Technology Associate Security Fundamentals
- ISACA CSX Cybersecurity Fundamentals
- CompTIA Security+
- ISC2 Certified Information Systems Security Professional
- Palo Alto Networks Certified Cybersecurity Associate
Explanation: Topic 5.2.2
This is an entry-level security certification that meets the U.S. Department of Defense Directive 8570.01-M requirements, which is an important item for anyone looking to work in IT security for the federal government.
44. 'Cryptocurrencies are handled on a centralized exchange.' Is this statement true or false?
- True
- False
Explanation: Topic 2.4.1
Cryptocurrency transactions are recorded in a decentralized electronic ledger known as a blockchain. This system is self-managed and operates with no interference from third parties such as central banks or government entities, meaning it does not rely on a centralized exchange.
45. Stuxnet malware was designed for which primary purpose?
- To hijack and take control of targeted computers
- To cause physical damage to equipment controlled by computers
- To cause serious harm to workers in a nuclear enrichment plant
Explanation: Topic 1.5.1
Stuxnet malware that was designed not just to hijack targeted computers but to actually cause physical damage to equipment controlled by computers
46. The risk management process consists of four steps. Can you put these in the right order?
- Frame the risk
- Assess the risk
- Respond to the risk
- Monitor the risk
Explanation: Topic 4.2.6
47. What is the main aim of a Cyber Security Incident Response Team (CSIRT)?
- To help ensure organization, system and data preservation by performing investigations into computer security incidents
- To enforce access to network resources by creating role-based control policies
- To provide guidance on the implementation of safeguards and personnel training
- To help client organizations improve their incident management capabilities
Explanation: Topic 4.3.1
48. What names are given to a database where all cryptocurrency transactions are recorded? (Choose two.)
- Blockchain
- Table
- Ledger
- Spreadsheet
Explanation: Topic 2.4.1
Cryptocurrency owners keep their money in encrypted, virtual ‘wallets.’ When a transaction takes place between the owners of two digital wallets, the details are recorded in a decentralized, electronic ledger or blockchain system. This means it is carried out with a degree of anonymity and is self-managed, with no interference from third parties such as central banks or government entities.
49. What of the following are examples of cracking an encrypted password? (Choose four.)
- Intimidation
- Brute force attack
- Network sniffing
- Rainbow tables
- Social engineering
- Spraying
- Dictionary attack
Explanation: Topic 2.2.8
These four techniques are specific methods used to uncover or crack passwords: brute-force attacks try every possible character combination; dictionary attacks systematically test words from a list; spraying uses common passwords across many different accounts; and rainbow tables utilize a dictionary of precomputed hashes to identify passwords without calculating each hash individually.
50. 'An employee does something as an organization representative with the knowledge of that organization and this action is deemed illegal. The organization is legally responsible for this action.' Is this statement true or false?
- True
- False
Explanation: Topic 4.3.1
Organizations are required to abide by cybersecurity laws in the countries where they operate. If an employee breaks these laws while performing their duties as a representative of the organization, the company can be held legally responsible and may be punished.
51. What is the purpose of a rootkit?
- To masquerade as a legitimate program
- To deliver advertisements without user consent
- To replicate itself independently of any other programs
- To gain privileged access to a device while concealing itself
Explanation: Topic 2.1.1
Most rootkits take advantage of software vulnerabilities to gain access to resources that normally shouldn’t be accessible (privilege escalation) and modify system files.
Malware can be classified as follows:
– Virus (self replicates by attaching to another program or file)
– Worm (replicates independently of another program)
– Trojan Horse (masquerades as a legitimate file or program)
– Rootkit (gains privileged access to a machine while concealing itself)
– Spyware (collects information from a target system)
– Adware (delivers advertisements with or without consent)
– Bot (waits for commands from the hacker)
– Ransomware (holds a computer system or data captive until payment is received)ent)
52. You are configuring access settings to require employees in your organization to authenticate first before accessing certain web pages. Which requirement of information security is addressed through this configuration?
- Integrity
- Scalability
- Availability
- Confidentiality
Explanation: Topic 1.2.2
Confidentiality is a set of rules that prevents sensitive information from being disclosed to unauthorized people, resources and processes. Methods to ensure confidentiality include data encryption, identity proofing and two factor authentication.
53. How can you prevent others from eavesdropping on network traffic when operating a PC on a public Wi-Fi hotspot?
- Connect with a VPN service
- Use WPA2 encryption
- Disable Bluetooth
- Create unique and strong passwords
Explanation: Topic 3.1.4
You should use an encrypted VPN service to prevent others from intercepting your information (known as ‘eavesdropping’) over a public wireless network. This service gives you secure access to the Internet, by encrypting the connection between your device and the VPN server. Even if hackers intercept a data transmission in an encrypted VPN tunnel, they will not be able to decipher it.
54. Which of the following certifications is aimed at high school and early college students, as well as anyone interested in a career change?
- Microsoft Technology Associate Security Fundamentals
- Palo Alto Networks Certified Cybersecurity Associate
- ISACA CSX Cybersecurity Fundamentals
- CompTIA Security+
- EC Council Certified Ethical Hacker
- ISC2 Certified Information Systems Security Professional
Explanation: Topic 5.2.2
The sources explicitly state that the Cisco Certified Support Technician (CCST) Cybersecurity certification is an entry-level credential aimed at high school and early college students, as well as anyone interested in a career change. Although this specific certification was not included in your list, it is the one that matches your description according to the provided material.
55. Can you identify the software vulnerability from the following descriptions?
| Occurs when data is written beyond the limits of memory areas that are allocated to an application | Buffer overflow |
| Occurs when an ordered or timed set of processes is disrupted or altered by an exploit | Race condition |
| Occurs through the improper use of practices that manage equipment, data or applications | Access control |
Explanation: Topic 2.3.3
56. Which of the following is a key motivation of a white hat attacker?
- Taking advantage of any vulnerability for illegal personal gain
- Fine tuning network devices to improve their performance and efficiency
- Studying operating systems of various platforms to develop a new system
- Discovering weaknesses of networks and systems to improve the security level of these systems
Explanation: Topic 1.4.1
57. Which of the following statements describes cyberwarfare?
- Cyberwarfare is an attack carried out by a group of script kiddies
- Cyberwarfare is simulation software for Air Force pilots that allows them to practice under a simulated war scenario
- Cyberwarfare is a series of personal protective equipment developed for soldiers involved in nuclear war
- Cyberwarfare is an Internet-based conflict that involves the penetration of information systems of other nations
Explanation: Topic 1.5
Cyberwarfare, as its name suggests, is the use of technology to penetrate and attack another nation’s computer systems and networks in an effort to cause damage or disrupt services, such as shutting down a power grid.
58. 'A data breach does not impact the reputation of an organization.' Is this statement true or false?
- True
- False
Explanation: Topic 1.2.6
A data breach can have a severe and negative long-term impact on an organization’s reputation that took years to build. Such incidents often lead to a loss of trust from customers, who may seek compensation or switch to more secure competitors, and can even cause employees to leave the organization.
59. You have stored your data on a local hard disk. Which method would secure this data from unauthorized access?
- Data encryption
- Duplication of the hard drive
- Deletion of sensitive files
- Two factor authentication
Explanation: Topic 2.3.3
Encryption is the process of converting information into a form in which unauthorized parties cannot read it. Only a trusted, authorized person with the secret key or password can decrypt the data and access it in its original form.
60. An individual user profile on a social network site is an example of an ..... identity.
- online
- offline
Explanation: Topic 1.1.2
61. You are having difficulty remembering passwords for all of your online accounts. What should you do?
- Write the passwords down and keep them out of sight
- Save the passwords in a centralized password manager program
- Create a single strong password to be used across all online accounts
- Share the passwords with a network administrator or computer technician
Explanation: Topic 3.1.5
