Cyber Quiz level 3

A major healthcare company recently suffered a cyberattack where attackers stole sensitive personal and medical data of over 30 million customers, then used social media platforms to threaten company executives for alleged grievances. What is the MOST critical cybersecurity lesson from this incident?

• Cybersecurity breaches can lead to not only data theft but also targeted intimidation and extortion tactics.
• Data breaches only affect company finances and rarely involve personal data exposure.
• Physical security is more important than digital security in preventing cyberattacks.
• Cyber attackers mainly target small companies, so large companies are usually safe.

Answer explanation

Healthcare breaches often expose sensitive personal and medical data which attackers can exploit for social engineering, intimidation, or extortion—extending the threat beyond data theft to reputational and operational damage.

An organization wants to enhance remote access security without using VPNs. Which strategy offers the MOST robust protection?

• Restricting access through device authentication and role-based permissions
• Allowing employees to access from any device for flexibility
• Sharing administrator credentials among senior staff
• Relying on strong passwords alone without additional controls

Answer explanation

Device authentication with role-based permissions ensures only authorized devices and users access resources—core to Zero Trust principles and safer than passwords alone.

Which action MOST effectively strengthens account protection against phishing-based compromises?

• Using a long and complex password but the same one across trusted accounts
• Allowing browsers or password managers to autofill saved credentials on login pages
• Frequently changing your password every few months without 2FA
• Enabling two-factor authentication through an authenticator app rather than SMS

Answer explanation

Authenticator apps offer stronger 2FA security than SMS, which can be intercepted or SIM-swapped—greatly reducing phishing success rates.

You receive a pop-up on your computer claiming your software is out-of-date and urging immediate installation. What is the safest action?

• Click the update immediately to avoid security risks
• Ignore the pop-up and continue working
• Close the pop-up and manually check for updates from the official software site
• Restart the computer and try again

Answer explanation

Fake update pop-ups often deliver malware; always verify updates manually from official software sources.

Multiple user accounts show frequent login failures from different locations. Which is the LEAST likely reason?

• Automated brute-force attempt
• Users forgot passwords
• Credential stuffing attack
• Misconfigured identity provider

Answer explanation

Repeated login failures across locations usually indicate attacks, not simple forgetfulness; brute-force or credential stuffing are more probable.

A critical business application reports multiple unpatched vulnerabilities. Which action increases risk the MOST?

• Monitoring for active exploits without patching
• Applying only urgent patches
• Performing updates during off-hours
• Delaying updates to avoid downtime

Answer explanation

Delaying patches leaves known vulnerabilities exposed, creating a window for exploitation—timely updates are crucial.

During a cyber incident drill, which is the MOST important FIRST step after detecting malware?

• Notify media
• Run antivirus on all devices
• Isolate impacted systems
• Begin forensic analysis

Answer explanation

Isolation stops the malware from spreading and limits damage before any cleanup or analysis begins.

Which network defense technique MOST limits the spread of a cyberattack?

• Installing a firewall at entry points
• Network segmentation
• Disabling USB ports
• Full disk encryption

Answer explanation

Network segmentation confines attackers within network zones, preventing lateral movement better than perimeter-only defenses.

Which of the following emails is MOST likely a phishing attempt?

• An urgent request from IT support asking you to verify your account via a link, with minor spelling errors but coming from an email closely matching official domain names.
• A company newsletter with links to third-party surveys sent from a verified internal email, encouraging employee engagement.
• An email from your bank confirming a transaction, including masked account details but requesting action via a secure portal link.
• A message from a known colleague asking for a quick status update on a project, without links or attachments.

Answer explanation

Phishing emails often mimic urgency and near-identical domains to trick recipients into clicking malicious links.

Which practice helps ensure unbiased and thorough cyber incident investigations?

• Ask managers for incident details
• Maintain complete and tamper-proof logs
• Involve only affected departments
• Rely solely on automated threat detection

Answer explanation

Tamper-proof logs provide verifiable evidence for unbiased investigations, avoiding gaps or manipulation.