Font size
WorksheetsCybersecurity Fundamentals Quiz
Total questions: 121
Worksheet time: 1hrs 1mins
What does the CIA triad in cybersecurity stand for?
Central Intelligence Agency
Confidentiality, Integrity, Availability
Computer Information Access
Cybersecurity Implementation Architecture
Which security goal ensures that information is accessible only to authorized users?
Availability
Integrity
Confidentiality
Non-repudiation
A banking system that prevents unauthorized modification of account balances is primarily addressing which security goal?
Confidentiality
Integrity
Availability
Authentication
Which of the following is NOT a common threat to availability?
DDoS attacks
Hardware failures
Eavesdropping
Power outages
Digital signatures primarily support which security goal?
Confidentiality
Availability
Non-repudiation
Authorization
An e-commerce website ensuring 99.9% uptime is primarily focusing on which security goal?
Confidentiality
Integrity
Availability
Authentication
Which security goal is most directly threatened by a man-in-the-middle attack?
Availability
Integrity
Authorization
Accountability
Hash functions are primarily used to ensure:
Confidentiality
Availability
Integrity
Authentication
Multi-factor authentication primarily supports which security concept?
Confidentiality
Authentication
Availability
Integrity
Social engineering attacks primarily threaten which security goal?
Availability
Integrity
Confidentiality
All of the above
When should security be considered in the system development lifecycle?
Only during the testing phase
After the system is deployed
From the initial design phase
Only when vulnerabilities are discovered
Which phase of the Secure Development Lifecycle (SDLC) involves identifying security risks and vulnerabilities?
Planning
Analysis
Implementation
Maintenance
What is the primary benefit of incorporating security during the design phase rather than after deployment?
Easier to implement
More cost-effective
Better user acceptance
Faster development
Which principle suggests that systems should be secure in their default configuration?
Fail securely
Secure defaults
Complete mediation
Minimize attack surface
Threat modeling is typically performed during which phase?
Implementation
Testing
Design
Maintenance
Which of the following is NOT a phase of the Secure Development Lifecycle?
Planning
Marketing
Analysis
Deployment
The principle of 'minimize attack surface' means:
Reduce physical size of systems
Reduce number of potential entry points
Minimize user interfaces
Reduce system functionality
Security requirements analysis involves:
Identifying what needs protection
Writing code
Testing applications
Deploying systems
Which approach emphasizes that security should not be an afterthought?
Security-first approach
Performance-first approach
Cost-first approach
User-first approach
Risk assessment in secure system design involves:
Evaluating likelihood and impact of threats
Testing system performance
Training users
Installing antivirus software
Which type of threat comes from employees within an organization?
External threat
Internal threat
Environmental threat
Network threat
Nation-state actors are examples of which type of threat?
Internal threats
Environmental threats
External threats
Physical threats
Which attack involves intercepting communications between two parties?
DoS attack
SQL injection
Man-in-the-middle attack
Buffer overflow
Phishing emails are examples of which type of attack?
Network-based attack
Social engineering
Physical attack
Application-based attack
Which attack involves overwhelming a system with traffic to make it unavailable?
SQL injection
Cross-site scripting
Denial of Service (DoS)
Buffer overflow
Natural disasters fall under which threat category?
Internal threats
External threats
Environmental threats
Social threats
The MITRE ATT&CK framework provides:
Antivirus signatures
A matrix of attack techniques
Firewall rules
Encryption algorithms
Shoulder surfing is an example of which type of attack?
Network attack
Application attack
Physical attack
Social engineering
Which of the following is NOT typically considered an internal threat?
Malicious insiders
Accidental insider threats
DDoS attacks
Privileged user abuse
Threat intelligence is best described as:
Software for detecting threats
Evidence-based knowledge about threats
A type of firewall
An encryption method
What is the main advantage of embedding security controls during the design phase?
Cheaper implementation costs
Better integration with system architecture
Reduced security gaps
All of the above
Which architecture pattern follows the principle 'never trust, always verify'?
Layered Security Architecture
Zero Trust Architecture
Service-Oriented Security
Client-Server Architecture
In layered security architecture, which layer handles input validation?
Data layer
Application layer
Presentation layer
Network layer
Single Sign-On (SSO) is an example of which security pattern?
Authorization pattern
Authentication pattern
Data protection pattern
Network security pattern
Role-Based Access Control (RBAC) is an example of which type of pattern?
Authentication pattern
Authorization pattern
Data protection pattern
Communication pattern
Google's BeyondCorp model is an example of:
Traditional perimeter security
Zero trust implementation
Layered security
Security by obscurity
Which security architecture pattern emphasizes reusable security modules?
Layered Security Architecture
Zero Trust Architecture
Service-Oriented Security
Monolithic Security
Micro-segmentation is a key feature of which architecture?
Traditional network architecture
Zero Trust Architecture
Client-server architecture
Peer-to-peer architecture
Data tokenization is an example of which security pattern?
Authentication pattern
Authorization pattern
Data protection pattern
Network security pattern
Proactive security integration means:
Adding security after deployment
Embedding security during design
Focusing only on perimeter security
Using only open-source security tools
The security-usability trade-off refers to:
Choosing between different security vendors
Balancing strong security with user convenience
Selecting encryption algorithms
Deciding on password policies
Which of the following represents a successful balance between security and convenience?
Complex 20-character passwords changed daily
Biometric authentication (Touch ID/Face ID)
Manual approval for every system access
Disabling all remote access
What often happens when security measures are too complex for users?
Users improve their security awareness
Systems become more secure
Users find workarounds or avoid the security measures
Productivity increases
Progressive security (adaptive authentication) means:
Gradually increasing security over time
Adjusting security requirements based on risk context
Using multiple security vendors
Implementing security in phases
Which approach can help reduce the burden of multiple passwords on users?
Writing passwords down
Using simple passwords
Single Sign-On (SSO) systems
Sharing passwords between applications
'Alert fatigue' occurs when:
Security systems fail frequently
Users ignore security warnings due to too many false alarms
Systems run out of memory
Networks become congested
Users ignore security warnings due to too many false alarms.
Users ignore security warnings due to too many false alarms
Systems run out of memory
Networks become congested
Context-aware security controls: Adjust security based on user context and risk.
Ignore user location and behavior
Apply the same security to all situations
Adjust security based on user context and risk
Only work during business hours
Which of the following led to users creating workarounds that reduced security?
Simple password requirements
Overly complex enterprise VPN systems
Biometric authentication
Single sign-on systems
User-centric security design involves: Conducting usability testing for security features.
Ignoring user preferences
Making security as complex as possible
Conducting usability testing for security features
Removing all security controls
Password managers help achieve balance by: Enabling complex passwords with ease of use.
Eliminating the need for passwords
Allowing simple passwords everywhere
Enabling complex passwords with ease of use
Sharing passwords between users
Security requirements engineering is: The process of identifying and managing security requirements throughout SDLC.
Only done after coding is complete
The process of identifying and managing security requirements throughout SDLC
Only concerned with network security
Focused solely on compliance requirements
Which of the following is a functional security requirement?
System performance under attack
Authentication mechanisms
Scalability of security measures
Reliability of security controls
"The system shall encrypt all sensitive data using AES-256 encryption" is an example of: Confidentiality requirement.
Availability requirement
Integrity requirement
Confidentiality requirement
Authentication requirement
Which requirement type focuses on how well security measures perform rather than what they do?
Functional security requirements
Non-functional security requirements
Business requirements
User requirements
Security use cases include: Normal usage and abuse cases.
Only normal usage scenarios
Normal usage and abuse cases
Only attack scenarios
Only compliance requirements
"The system shall maintain 99.9% uptime" is an example of: Availability requirement.
Confidentiality requirement
Integrity requirement
Availability requirement
Authentication requirement
PCI DSS requirements are an example of: Detailed security requirements for specific industries.
Functional requirements only
Non-functional requirements only
Detailed security requirements for specific industries
General software requirements
Abuse cases in security requirements help identify: How the system might be misused.
Normal system usage
How the system might be misused
Performance requirements
User interface design
"Database transactions shall use ACID properties" is an example of: Integrity requirement.
Confidentiality requirement
Integrity requirement
Availability requirement
Authorization requirement
Security acceptance criteria should be: Specific and measurable.
Vague and general
Specific and measurable
Optional for most projects
Only focused on compliance
Security by obscurity means: Relying on secrecy of system design for security.
Using complex passwords
Relying on secrecy of system design for security
Hiding physical servers
Using encryption
According to Kerckhoffs's Principle, a cryptosystem should be secure even if: Everything except the key is public knowledge.
The key is known
Everything except the key is public knowledge
The algorithm is complex
Multiple users access it
Which of the following is an example of security by obscurity? Hiding system version information.
Using AES encryption
Implementing multi-factor authentication
Hiding system version information
Regular security updates
Why does security by obscurity typically fail as a primary security measure? Secrets are difficult to maintain long-term.
It's too expensive to implement
Secrets are difficult to maintain long-term
It requires special hardware
Users don't understand it
The Wired Equivalent Privacy (WEP) protocol failed because: Its proprietary algorithm was easily broken.
It was too complex for users
It was too expensive
Its proprietary algorithm was easily broken
It required special hardware
When might security by obscurity be appropriately used? As an additional layer in defense in depth.
As the primary security mechanism
As an additional layer in defense in depth
Instead of encryption
To replace authentication systems
HTTPS provides strong security by: Using well-known, publicly documented standards with secret keys.
Hiding the encryption algorithm
Using secret protocols
Using well-known, publicly documented standards with secret keys
Obscuring network traffic
Which statement about proprietary encryption algorithms is generally true? They are often weaker than open standards.
They are always more secure than open standards
They are often weaker than open standards
They are easier to implement
They are preferred by security experts
Reverse engineering can defeat security by obscurity because: It can reveal hidden system details.
It's illegal in most countries
It can reveal hidden system details
It requires expensive tools
It's too time-consuming
The best approach to security is: Rely on proven, open security standards with proper key management.
Rely entirely on security by obscurity
Use only open-source solutions
Rely on proven, open security standards with proper key management
Avoid all forms of obscurity
The principle "Keep It Simple" (Economy of Mechanism) suggests that: Security mechanisms should be as simple as possible while meeting requirements.
Security mechanisms should be as complex as possible
Security mechanisms should be as simple as possible while meeting requirements
Only one security control should be used
Security should be ignored to keep systems simple
Fail-safe defaults means: Systems should default to a secure state when they fail.
Systems should never fail
Systems should default to an insecure state when they fail
Systems should default to a secure state when they fail
Systems should shut down completely when they fail
Complete mediation requires that: Every access attempt to every resource must be checked.
Some access attempts are checked
Every access attempt to every resource must be checked
Only the first access attempt is checked
Access checks are optional
The principle of least privilege means: Users should have only the minimum privileges necessary.
Users should have maximum privileges for convenience
Users should have only the minimum privileges necessary
All users should have the same privileges
Privileges should never be granted
Which principle led to the selection of AES through an open competition? Open design.
Fail-safe defaults
Least privilege
Open design
Separation of privilege
Nuclear weapon systems requiring multiple keys exemplify which principle? Separation of privilege.
Least privilege
Separation of privilege
Economy of mechanism
Complete mediation
Psychological acceptability means security mechanisms should be: Easy to use and understand.
Complex and comprehensive
Hidden from users
Easy to use and understand
Available only to experts
Least common mechanism suggests: Minimize shared mechanisms between different users.
All users should share the same security controls
Minimize shared mechanisms between different users
Use only one type of security control
Common mechanisms are always better
A firewall defaulting to block traffic unless explicitly allowed demonstrates: Fail-safe defaults.
Complete mediation
Fail-safe defaults
Least privilege
Open design
Virtualization systems isolating different VMs exemplify which principle? Least common mechanism.
Economy of mechanism
Psychological acceptability
Least common mechanism
Open design
Defense in depth is based on the principle that: Multiple layers of defense provide better protection.
One strong security control is sufficient
Multiple layers of defense provide better protection
Security controls should be complex
Physical security is most important
Which military concept inspired defense in depth? Multiple defensive positions to slow attackers.
Surprise attacks
Multiple defensive positions to slow attackers
Overwhelming force
Quick retreats
Perimeter security typically includes: Firewalls, intrusion detection, and physical security.
Only firewalls
Firewalls, intrusion detection, and physical security
Only antivirus software
Only access controls
Which type of control detects security incidents after they occur?
Preventive controls
Detective controls
Corrective controls
Deterrent controls
Host security controls include:
Network firewalls only
Antivirus, host firewalls, and OS hardening
Physical security only
Database encryption only
A bank implementing physical security, network controls, application security, and data encryption is using:
Single point of failure approach
Defense in depth
Security by obscurity
Minimum security approach
What is a potential challenge of implementing defense in depth?
Improved security
Better compliance
Increased complexity and costs
Reduced attack surface
Complementary controls in defense in depth should be:
Dependent on each other
Independent and non-overlapping
Identical in function
Simple and basic
Data security layer in defense in depth includes:
Only backup systems
Encryption, DLP, and database security
Only access controls
Only network monitoring
The main benefit of defense in depth is:
Reduced costs
Simplified management
Resilience against multiple attack types
Faster system performance
Diversity in defense means:
Using only one type of security control
Using different types of security controls and technologies
Having diverse user groups
Using multiple operating systems
Vendor diversity helps reduce:
System performance
Risk of vendor-specific vulnerabilities
User training needs
System complexity
Using antivirus products from multiple vendors is an example of:
Technology diversity
Vendor diversity
Temporal diversity
Architectural diversity
Rotating security measures over time represents:
Vendor diversity
Technology diversity
Temporal diversity
Architectural diversity
Which benefit does diversity in defense provide?
Reduced security costs
Simplified management
Increased attacker effort required
Faster system response
Financial services using multiple fraud detection systems from different vendors demonstrates:
Poor security planning
Unnecessary redundancy
Effective diversity in defense
Vendor lock-in
A potential drawback of diversity in defense is:
Better security coverage
Reduced vulnerabilities
Increased management complexity
Improved system resilience
Different authentication methods for different access levels represent:
Vendor diversity
Technology diversity
Temporal diversity
Geographic diversity
Critical infrastructure using diverse control systems helps prevent:
System updates
Common vulnerabilities affecting all systems
User access
Network communication
The main rationale for diversity in defense is that:
It's required by regulations
Attacks that defeat one defense may not work against different defenses
It reduces costs
It simplifies security management
The weakest link principle states that:
All security controls are equally important
A system's security is only as strong as its weakest component
Physical security is always the weakest link
Technical controls are weaker than human controls
Which is often considered the weakest link in security systems?
Firewalls
Encryption algorithms
Human factors
Network protocols
The Target data breach (2013) occurred because:
Their firewall failed
Weak vendor management was exploited
Employees were untrained
They used weak encryption
The Equifax data breach (2017) was caused by:
Social engineering
Physical security failure
Unpatched software vulnerability
Weak passwords
Which method helps identify weakest links in security?
User training only
Vulnerability scans and penetration testing
Installing more firewalls
Increasing password complexity
Common technical weakest links include:
Well-configured systems
Updated software
Legacy systems with known vulnerabilities
Strong authentication systems
To strengthen human factors as potential weakest links, organizations should:
Remove all user access
Implement security awareness training
Install more technical controls only
Ignore user behavior
Attackers typically target:
The strongest security controls
The most expensive systems
The path of least resistance
Random system components
Which is NOT typically a procedural weakness?
Inadequate security policies
Poor incident response procedures
Strong encryption algorithms
Insufficient monitoring
Continuous monitoring helps by:
Eliminating all weaknesses
Identifying and addressing weakest links over time
Replacing human oversight
Reducing system complexity
Failsafe stance means systems should:
Never fail under any circumstances
Fail in a secure manner when they malfunction
Shut down completely when problems occur
Continue operating normally despite failures
Fail-secure (fail-closed) systems:
Allow access when they fail
Deny access when they fail
Shut down completely
Ignore security during failures
Fail-safe (fail-open) systems:
Deny access when they fail
Allow access when they fail
Maintain all security controls
Never experience failures
Which type of system would appropriately use fail-open behavior?
Bank vault security systems
Nuclear facility access controls
Hospital emergency room door systems
Military classified data systems
Default deny policies demonstrate which failsafe approach?
Fail-open
Fail-secure
Fail-soft
No failsafe approach
Fire doors that automatically close during emergencies exemplify:
Poor design
Fail-open systems
Failsafe design principles
Fail-soft systems
ATMs that retain cards when fraud is suspected demonstrate:
Fail-open behavior
Fail-secure behavior
System malfunction
Poor user experience design
Graceful degradation (fail-soft) means:
Systems fail completely
Systems continue with reduced functionality
Systems ignore all security
Systems become more vulnerable
Which consideration is important when designing failsafe systems?
Always prioritize security over safety
Always prioritize availability over security
Balance security, safety, and availability based on risk assessment
Ignore user requirements
Nuclear power plants that shut down when safety systems fail demonstrate:
Poor engineering
Fail-open design
Appropriate failsafe design for safety-critical systems
Fail-secure design
