Cybersecurity MCQs – Set-1 | 50 questions on security principles, threats, authentication, cryptography, network defenses, and incident response.
Mixed difficulty · Select one answer and open each explanation to review the concept.
Which three goals make up the CIA security triad?
A Confidentiality, integrity, availability
B Control, inspection, authentication
C Compliance, indexing, access
D Caching, isolation, authorization
Answer: A. Confidentiality, integrity, availability. The classic CIA triad is confidentiality, integrity, and availability.
What does confidentiality protect against?
A Unexpected power loss
B Unauthorized information disclosure
C Slow network response
D Duplicate file storage
Answer: B. Unauthorized information disclosure. Confidentiality prevents information from being disclosed to unauthorized people or processes.
What does information integrity help preserve?
A Fast access
B User anonymity
C Accuracy and completeness
D Network bandwidth
Answer: C. Accuracy and completeness. Integrity protects information against improper modification or destruction.
What does availability aim to ensure?
A Hidden data
B Encrypted backups
C Verified identities
D Authorized access when needed
Answer: D. Authorized access when needed. Availability aims to provide timely and reliable access to information and services.
What is a cybersecurity vulnerability?
A A weakness open to exploitation
B A verified user identity
C A completed backup
D A network performance metric
Answer: A. A weakness open to exploitation. A vulnerability is a weakness that could be exploited by a threat.
What is a cybersecurity threat?
A A confirmed data backup
B A potential cause of harm
C A patch installation record
D A permission setting
Answer: B. A potential cause of harm. A threat is a potential cause of an unwanted incident or harm.
How is cybersecurity risk commonly assessed?
A By counting installed apps
B By measuring screen size
C Likelihood and potential impact
D By listing user names
Answer: C. Likelihood and potential impact. Risk assessment considers the likelihood of adverse events and the impact they could have.
What does an attack surface include?
A Only the antivirus program
B Only encrypted files
C Only a company’s public website
D Exposed points attackers could target
Answer: D. Exposed points attackers could target. An attack surface includes exposed systems, interfaces, and other points that could be targeted.
What does authentication verify?
A A user’s claimed identity
B A user’s screen brightness
C A file’s compression ratio
D A network’s cable type
Answer: A. A user’s claimed identity. Authentication verifies the identity claimed by a user or system.
After authentication, what does authorization determine?
A Who created the software
B Which actions are permitted
C How long files are stored
D Which device is newest
Answer: B. Which actions are permitted. Authorization determines what an authenticated identity may access or do.
What is multifactor authentication (MFA)?
A Using one long password
B Using two usernames
C Two or more factor types
D Using one security question
Answer: C. Two or more factor types. MFA requires two or more distinct types of evidence to verify identity.
What is phishing designed to do?
A Improve a network connection
B Compress email attachments
C Repair software vulnerabilities
D Deceive people into unsafe actions
Answer: D. Deceive people into unsafe actions. Phishing uses deceptive messages or sites to trick people into revealing data or taking unsafe actions.
What does smishing use to deliver phishing bait?
A Text messages
B Printed letters
C Ethernet cables
D Database queries
Answer: A. Text messages. Smishing is phishing delivered through SMS or other text messaging.
Which channel is associated with vishing?
A Social media posts
B Voice calls
C USB drives
D Printed invoices
Answer: B. Voice calls. Vishing uses voice calls or voice messages to conduct phishing.
What does ransomware commonly do?
A Improves backup speed
B Adds user permissions
C Encrypts or blocks data
D Creates secure certificates
Answer: C. Encrypts or blocks data. Ransomware commonly blocks access to or encrypts data and demands a ransom.
How does a Trojan commonly disguise itself?
A As a backup copy
B As a network router
C As an operating system update
D As legitimate software
Answer: D. As legitimate software. A Trojan disguises malicious functionality as a legitimate or useful program.
What distinguishes a computer worm?
A It can self-propagate
B It only changes screen colors
C It is always harmless
D It requires a printer
Answer: A. It can self-propagate. A worm can propagate between systems without relying on a user to copy it manually.
What can spyware secretly do?
A Restore deleted files
B Monitor user activity
C Improve processor cooling
D Assign local IP addresses
Answer: B. Monitor user activity. Spyware can secretly collect information or monitor user activity.
What does the term malware mean?
A A network cable type
B An authentication method
C Malicious software
D A data backup format
Answer: C. Malicious software. Malware is software designed to perform malicious or unauthorized actions.
Why apply security patches promptly?
A To increase display resolution
B To add storage capacity
C To replace the network card
D To fix defects and vulnerabilities
Answer: D. To fix defects and vulnerabilities. Security patches fix known software defects, including vulnerabilities attackers may exploit.
What is a zero-day vulnerability?
A Unfixed exploitable software flaw
B A vulnerability patched years ago
C A failed password attempt
D A deleted backup file
Answer: A. Unfixed exploitable software flaw. A zero-day flaw is one for which defenders have had little or no time to prepare a fix before exploitation.
What does the principle of least privilege recommend?
A Give everyone administrator access
B Grant only necessary permissions
C Disable all user accounts
D Share one password widely
Answer: B. Grant only necessary permissions. Least privilege limits each user or process to the access needed for its task.
What can a password manager help users do?
A Share one password everywhere
B Remove multifactor authentication
C Create and store unique passwords
D Disable account recovery
Answer: C. Create and store unique passwords. Password managers can generate and store distinct passwords for different accounts.
How does MFA improve account protection?
A No passwords needed
B It blocks every phishing message
C It hides all user identities
D It adds another verification factor
Answer: D. It adds another verification factor. MFA adds another type of identity evidence, reducing reliance on a password alone.
What does encryption at rest protect?
A Stored data
B Only live video calls
C Only public website text
D A router’s physical casing
Answer: A. Stored data. Encryption at rest protects stored data on devices or storage media.
When does encryption in transit protect information?
A While the drive is unplugged
B While data travels between systems
C Only after a backup ends
D Only printed files
Answer: B. While data travels between systems. Encryption in transit protects data as it moves across networks between systems.
How does symmetric encryption use keys?
A With a public key only
B Without any key
C Using the same secret key
D Different key per byte
Answer: C. Using the same secret key. Symmetric encryption uses the same secret key for encryption and decryption.
What key arrangement does asymmetric cryptography use?
A One shared password only
B No keys at all
C A single rotating token
D Public/private key pair
Answer: D. Public/private key pair. Asymmetric cryptography uses a mathematically related public and private key pair.
What does a cryptographic hash produce?
A A one-way digest
B A reversible ciphertext
C A digital certificate
D A network address
Answer: A. A one-way digest. A cryptographic hash maps data to a digest and is designed to be computationally one-way.
Why add a salt when hashing passwords?
A To make passwords shorter
B To reduce precomputed hash attacks
C To encrypt the whole database
D To share passwords securely
Answer: B. To reduce precomputed hash attacks. A unique salt makes precomputed attacks against password hashes less effective.
What can a digital signature help verify?
A File size and format
B A user’s screen lock
C Data integrity and signer authenticity
D A server’s physical location
Answer: C. Data integrity and signer authenticity. A digital signature helps verify that signed data has not changed and was signed using the corresponding private key.
What does a digital certificate commonly bind?
A A password to a username
B A file to a backup
C A router to a network
D A public key to identity
Answer: D. A public key to identity. A digital certificate binds a public key to an identity and is signed by a trusted issuer.
What does a network firewall commonly do?
A Filter traffic by rules
B Store every email permanently
C Repair all server software
D Assign passwords to users
Answer: A. Filter traffic by rules. A firewall filters traffic according to configured security rules.
What is the main role of an intrusion detection system (IDS)?
A Automatically encrypt every file
B Monitor events and raise alerts
C Replace all network switches
D Create user accounts
Answer: B. Monitor events and raise alerts. An IDS monitors events for suspicious activity and can alert responders.
How does an intrusion prevention system (IPS) differ from passive detection?
A It only stores backups
B It only checks passwords
C It can block detected traffic
D It creates network cables
Answer: C. It can block detected traffic. An IPS can take preventive action, such as blocking traffic identified as malicious.
What does vulnerability scanning help identify?
A Unauthorized user names
B Expired software licenses
C Network cable lengths
D Known weaknesses in systems
Answer: D. Known weaknesses in systems. Vulnerability scanners identify known weaknesses that may need assessment and remediation.
What is a penetration test?
A An authorized simulated attack
B A routine data backup
C A software license review
D A system temperature check
Answer: A. An authorized simulated attack. A penetration test is an authorized exercise that simulates attacks to assess defenses.
Why use secure configuration baselines?
A To permit every network connection
B To reduce unsafe default settings
C To turn off all logging
D To share administrator passwords
Answer: B. To reduce unsafe default settings. Secure baselines reduce exposure by applying approved settings and disabling unnecessary functionality.
How should organizations prepare backups against ransomware?
A Keep all backups writable
B Use the same device only
C Maintain isolated recoverable copies
D Skip testing restoration
Answer: C. Maintain isolated recoverable copies. Isolated, tested backups can support recovery if production data is encrypted or destroyed.
Which NIST CSF functions support incident-response preparation?
A Detect, respond, recover
B Plan, code, deploy
C Encrypt, hash, sign
D Govern, identify, protect
Answer: D. Govern, identify, protect. NIST CSF 2.0’s Govern, Identify, and Protect functions support broader preparation; incident response includes Detect, Respond, and Recover.
Which functions describe incident response in NIST CSF 2.0?
A Detect, respond, recover
B Build, test, release
C Identify, protect, govern
D Encrypt, decrypt, authenticate
Answer: A. Detect, respond, recover. NIST CSF 2.0 describes incident response through Detect, Respond, and Recover functions.
What is a key goal of incident containment?
A Erase all logs immediately
B Limit spread and impact
C Restore every account password
D Publish the incident publicly
Answer: B. Limit spread and impact. Containment limits an incident’s spread and impact while responders investigate and recover.
Why preserve security logs during an investigation?
A Increase storage speed
B Reduce software licensing costs
C Reconstruct events and support analysis
D Change network addresses
Answer: C. Reconstruct events and support analysis. Logs help responders reconstruct events, detect activity, and support investigation.
What is a data breach?
A A successful backup job
B A planned software release
C A temporary network delay
D Unauthorized access or disclosure
Answer: D. Unauthorized access or disclosure. A data breach involves unauthorized access to or disclosure of protected information.
What does data exfiltration mean?
A Unauthorized removal of data
B A secure software update
C An internal file backup
D A network login attempt
Answer: A. Unauthorized removal of data. Exfiltration is the unauthorized transfer or removal of data from an environment.
How does social engineering target people?
A By changing processor voltages
B Manipulating them toward unsafe actions
C By encrypting network packets
D By replacing database indexes
Answer: B. Manipulating them toward unsafe actions. Social engineering manipulates people into disclosing information or taking actions that aid an attacker.
What is tailgating in physical security?
A Logging into another account
B Scanning files for malware
C Follow another person inside
D Sending a fake email
Answer: C. Follow another person inside. Tailgating is entering a restricted physical area by following someone who has authorized access.
How can network segmentation limit an intrusion?
A It prevents all Internet access
B It hides every server
C It automatically removes malware
D Restrict movement between zones
Answer: D. Restrict movement between zones. Segmentation limits communication between zones and can reduce an attacker’s lateral movement.
Which coding practice reduces SQL injection risk?
A Use parameterized queries
B Store passwords in source code
C Trust all user input
D Disable database constraints
Answer: A. Use parameterized queries. Parameterized queries keep data separate from SQL command structure.
What can output encoding help prevent in web applications?
A Ransomware encryption
B Cross-site scripting execution
C Wi-Fi interference
D Database replication delays
Answer: B. Cross-site scripting execution. Context-aware output encoding helps prevent untrusted input from executing as script in a browser.