Information Security Threats and Vulnerabilities: Master the Fundamentals

Question 1

To reduce the impact of a malware attack, which of these is a commonly used countermeasure?

Accepted Answer

Disable macros in Microsoft Office applications

Answer

Leave software unpatched

Answer

Use antivirus software without regular updates

Answer

Open suspicious email attachments without hesitation

Question 2

Which of these is NOT a common information security threat?

Accepted Answer

Power outage

Answer

Malware

Answer

Phishing

Answer

Ransomware

Question 3

Which of the following is NOT a cyber threat?

Accepted Answer

Earthquake

Answer

Malware

Answer

Phishing

Answer

Social Engineering

Question 4

Which type of malware encrypts files and extorts payment for their release?

Accepted Answer

Ransomware

Answer

Computer virus

Answer

Worm

Answer

Trojan horse

Question 5

What is the term for a system's weakness that can be exploited by an attacker?

Accepted Answer

Vulnerability

Answer

Penetration test

Answer

Threat

Answer

Patch

Question 6

Which network security principle aims to grant access only to authorized entities?

Accepted Answer

Least privilege

Answer

Defense in depth

Answer

Separation of duties

Answer

Need-to-know

Question 7

What is the process of identifying and prioritizing security threats?

Accepted Answer

Threat assessment

Answer

Security audit

Answer

Risk analysis

Answer

Vulnerability management

Question 8

Which type of threat actor specializes in targeted and sophisticated attacks?

Accepted Answer

Advanced persistent threat (APT)

Answer

Social engineer

Answer

Script kiddie

Answer

Insider threat

Question 9

What is the network security device used to control access to network resources?

Accepted Answer

Firewall

Answer

Antivirus software

Answer

Intrusion detection and prevention system (IDS/IPS)

Answer

Virtual private network (VPN)

Question 10

Which type of cryptography utilizes a public key for encryption and a private key for decryption?

Accepted Answer

Asymmetric cryptography

Answer

Hashing

Answer

Message authentication code (MAC)

Answer

Symmetric cryptography

Question 11

What is the term for the technique used to deceive individuals into divulging sensitive information?

Accepted Answer

Social engineering

Answer

Malware

Answer

Phishing

Answer

Exploit

Question 12

What is the primary objective of incident response planning?

Accepted Answer

To minimize the consequences of security incidents.

Answer

To prevent future security incidents from occurring.

Answer

To identify and punish the perpetrators of security incidents.

Question 13

Which of the following types of malware encrypts a victim's files, demanding a ransom payment to decrypt them?

Accepted Answer

Ransomware

Answer

Virus

Answer

Spam

Question 14

What is the term for a software vulnerability that allows an unauthorized user to access a system by exploiting a weakness in the software?

Accepted Answer

Exploit

Answer

Firewall

Answer

Patch

Answer

Intrusion Detection System (IDS)

Question 15

What is the primary function of a firewall?

Accepted Answer

To restrict unauthorized access and network traffic

Answer

To detect and prevent malware

Answer

To back up data

Answer

To encrypt data

Question 16

What is the distinction between internal and external information security threats?

Accepted Answer

Internal threats originate from within the organization, while external threats come from outside

Answer

Internal threats are more common than external threats

Answer

External threats are more severe than internal threats

Question 17

What is the primary objective of a penetration test?

Accepted Answer

To identify security vulnerabilities in a system

Answer

To detect malware

Answer

To train security personnel

Answer

To prevent cyberattacks

Question 18

Which of the following is a type of physical security control?

Accepted Answer

Access control

Answer

Encryption

Answer

Firewalls

Answer

Intrusion Detection Systems (IDS)

Question 19

What is the role of incident response in information security?

Accepted Answer

To control, eliminate, and recover from security breaches

Answer

To monitor network traffic

Answer

To prevent security threats

Question 20

A flaw in a software system that allows an attacker to gain unauthorized access is called a:

Accepted Answer

Vulnerability

Answer

Patch

Answer

Virus

Answer

Malware

Question 21

Which of the following is a type of phishing attack that targets specific individuals or organizations?

Accepted Answer

Spear phishing

Answer

Smishing

Answer

Denial-of-service attack

Answer

Brute force attack

Question 22

What is the primary function of a firewall in information security?

Accepted Answer

To block unauthorized network traffic

Answer

To encrypt data transmissions

Answer

To store data backups

Answer

To detect malicious software

Question 23

Which of the following is a recommended best practice for preventing malware infections?

Accepted Answer

Use and regularly update anti-virus software

Answer

Disable firewalls

Answer

Open all email attachments

Answer

Click on links in unsolicited emails

Question 24

What term describes deliberate attempts to gain unauthorized access to computer systems or networks?

Accepted Answer

Hacking

Answer

Social engineering

Answer

Phishing

Answer

Malware attack

Question 25

The primary objective of information security risk assessments is to:

Accepted Answer

Identify, analyze, and prioritize risks

Answer

Train staff on security awareness

Answer

Monitor and mitigate risks

Answer

Implement security measures

Question 26

Which method is commonly used to mitigate the risk of social engineering attacks?

Accepted Answer

Security awareness training

Answer

Enforcing the use of strong passwords

Answer

Installing anti-virus software

Answer

Deploying firewalls

Question 27

What is the primary responsibility of a Chief Information Security Officer (CISO)?

Accepted Answer

Overseeing the implementation of information security policies and their maintenance

Answer

Training staff on information security

Answer

Managing the IT department

Question 28

Which of the following is NOT considered a typical type of information security threat?

Accepted Answer

Natural disaster

Answer

Malware attack

Answer

Denial-of-service attack

Answer

Phishing

Question 29

Which type of vulnerability grants an attacker unauthorized access to a system by exploiting a flaw in the software?

Accepted Answer

Software vulnerability

Answer

Human vulnerability

Answer

Network vulnerability

Answer

Hardware vulnerability

Question 30

What is the primary objective of a phishing attack?

Accepted Answer

To retrieve sensitive information from users

Answer

To disrupt network operations

Answer

To encrypt and ransom user data

Answer

To gain access to privileged systems

Question 31

Which of the following is a widely used countermeasure against malware infections?

Accepted Answer

Antivirus software

Answer

Intrusion detection system

Answer

Data encryption

Answer

Firewall

Question 32

What is a potential consequence of a successful DDoS attack on a website?

Accepted Answer

Website inaccessibility

Answer

Financial compromise

Answer

Software corruption

Answer

Data exfiltration

Question 33

What is the main purpose of network segmentation in the context of information security?

Accepted Answer

To contain the spread of security breaches

Answer

To enhance network privacy

Answer

To improve network efficiency

Answer

To simplify network management

Question 34

Which information security principle emphasizes ensuring that authorized users can access information when needed?

Accepted Answer

Availability

Answer

Accountability

Answer

Confidentiality

Answer

Integrity

Question 35

What is the primary function of incident response in information security?

Accepted Answer

To identify, mitigate, and recover from security incidents

Answer

To prevent security incidents

Answer

To monitor network activity for suspicious behavior

Question 36

Which of the following is NOT considered a recommended best practice for safeguarding against information security threats?

Accepted Answer

Utilizing unlicensed software

Answer

Conducting regular vulnerability assessments

Answer

Educating users on security awareness

Answer

Enforcing strong passwords

Question 37

Which of the following is NOT considered a type of information security threat?

Accepted Answer

Employee Morale

Answer

Phishing

Answer

Denial of Service (DoS)

Answer

Malware

Question 38

Which type of malware operates by encrypting files and demanding a ransom payment for their release?

Accepted Answer

Ransomware

Answer

Spyware

Answer

Trojan

Answer

Virus

Question 39

What is the primary function of a firewall?

Accepted Answer

Control network traffic based on security policies.

Answer

Monitor user activity and flag suspicious behavior.

Answer

Scramble data to protect its confidentiality.

Answer

Identify and remove malicious software.

Question 40

Which practice contributes to strong password security?

Accepted Answer

Creating unique, complex passwords for each account.

Answer

Storing passwords in an easily accessible location.

Answer

Reusing the same password for multiple accounts.

Answer

Sharing passwords with trusted colleagues.

Question 41

What is the primary objective of a penetration test?

Accepted Answer

Uncover vulnerabilities and weaknesses within a system.

Answer

Educate users on cybersecurity best practices.

Answer

Repair security breaches caused by malicious actors.

Question 42

Which of the following is a common social engineering technique employed by attackers?

Accepted Answer

Phishing

Answer

Buffer overflow

Answer

Denial of Service (DoS)

Answer

Man-in-the-middle attack

Question 43

What is the primary purpose of a security incident and event management (SIEM) system?

Accepted Answer

Centralize the collection, analysis, and response to security events.

Answer

Encrypt sensitive data to protect its confidentiality.

Answer

Monitor user activity and identify anomalous behavior.

Answer

Detect and remove malware from infected systems.

Question 44

What is the primary goal of conducting a risk assessment in the context of information security?

Accepted Answer

Identifying and analyzing potential threats and system vulnerabilities.

Answer

Creating and implementing appropriate security controls.

Answer

Monitoring network traffic for signs of malicious activity.

Question 45

An employee mistakenly sends confidential client data to their personal email account. Which type of threat does this represent?

Accepted Answer

Human error

Answer

Technical malfunction

Answer

Natural disaster

Answer

Cyberattack

Question 46

Which of the following is NOT a common vulnerability found in web applications?

Accepted Answer

Secure coding practices

Answer

Cross-site scripting (XSS)

Answer

SQL injection

Answer

Buffer overflow

Question 47

A phishing email attempts to deceive users into disclosing their login credentials. Which type of attack does this represent?

Accepted Answer

Social engineering

Answer

Brute-force attack

Answer

Denial-of-service attack

Answer

Malware attack

Question 48

A company's server is overwhelmed with traffic from multiple sources, rendering it inaccessible to legitimate users. What type of attack is this?

Accepted Answer

Denial-of-service attack

Answer

Man-in-the-middle attack

Answer

Zero-day exploit

Answer

Password cracking

Question 49

Which of the following security measures can help mitigate the risk of unauthorized data access?

Accepted Answer

Implementing multi-factor authentication

Answer

Leaving computers unlocked

Answer

Sharing passwords with colleagues

Answer

Using easily guessable passwords

Question 50

A software flaw that grants attackers unauthorized system access is known as a:

Accepted Answer

Vulnerability

Answer

Exploit

Answer

Risk

Answer

Threat

Question 51

Which of the following describes a common method used by attackers to exploit a system vulnerability?

Accepted Answer

Exploit

Answer

Countermeasure

Answer

Risk assessment

Answer

Mitigation

Question 52

A company performs an assessment of its network to identify open ports and vulnerabilities. What type of security assessment is this?

Accepted Answer

Vulnerability scan

Answer

Risk assessment

Answer

Penetration test

Answer

Security audit

Question 53

Which of the following is NOT a common type of malware?

Accepted Answer

Firewall

Answer

Virus

Answer

Worm

Answer

Trojan horse

Question 54

A company implements a system that monitors network traffic for suspicious activities. This is an example of a:

Accepted Answer

Intrusion detection system (IDS)

Answer

Data loss prevention (DLP)

Answer

Antivirus software

Answer

Firewall