WorksheetsCybersecurity Fundamentals Quiz
Total questions: 95
Worksheet time: 48mins
What is the core aim of cybersecurity, according to the sources?
To enhance digital marketing strategies and online presence.
To address the risks and vulnerabilities associated with digital systems and networks.
To develop new hardware and software for information systems.
To solely prevent harm caused intentionally by system operators.
Which of the following best describes the principle of "defense in depth" in cybersecurity?
Implementing a single, highly secure measure to protect against all threats.
Focusing only on physical security controls for digital assets.
Implementing multiple layers of security controls to protect against a wide range of cyber threats.
Relying solely on advanced technological safeguards without human intervention.
According to the sources, what does risk management in cybersecurity primarily involve?
Eliminating all potential threats and vulnerabilities entirely.
Prioritizing cybersecurity efforts based on the likelihood and potential impact of threats, and business objectives.
Outsourcing all security responsibilities to third-party vendors.
Focusing exclusively on technical vulnerabilities within digital systems.
Which of the following is NOT listed as a non-technical aspect of cybersecurity?
Security awareness training.
Incident response planning.
Regulatory compliance.
Network intrusion detection systems.
Why is "Protection of Sensitive Data" paramount in information management, according to the sources?
It reduces the need for data backups.
It allows for easier data sharing with unauthorized entities.
It safeguards vast amounts of sensitive data, including PII and intellectual property, from unauthorized access and theft.
It simplifies regulatory compliance by eliminating security measures.
Which cybersecurity measure helps in "Preservation of Integrity" of data?
Distributed Denial of Service (DDoS) protection.
Encryption and access controls.
Digital signatures, cryptographic hashing, and integrity monitoring tools.
Disaster recovery planning.
What is one of the financial consequences of cybersecurity incidents for organizations?
Increased customer loyalty and brand reputation.
Significant financial losses including legal fees, regulatory fines, and loss of business.
Reduced need for security investments.
Improved operational efficiency due to forced system upgrades.
What is one of the learning outcomes for students completing the cybersecurity fundamentals course regarding cybersecurity principles?
Developing advanced hacking techniques.
Gaining a comprehensive understanding of the CIA triad, risk management, and defense in depth.
Becoming proficient in coding security software.
Specializing in a single cybersecurity technology.
Which regulatory compliance standard is mentioned in the learning outcomes as applicable to data protection and privacy?
ISO 9001.
Payment Card Industry Data Security Standard (PCI DSS).
Sarbanes-Oxley Act (SOX).
California Consumer Privacy Act (CCPA).
What is a strategic objective of the course related to the ENISA strategy?
To promote cybersecurity as a fundamental right.
To develop proprietary cybersecurity technologies for the EU.
To centralize all cybersecurity operations within ENISA.
To eliminate all cyber threats globally.
How does the ENISA New Strategy align with Nova's Master's program in Information Management?
It replaces the need for practical cybersecurity studies.
It provides a theoretical framework without practical implications.
It deepens understanding of cybersecurity and aligns with the real-life and business-oriented focus of studies.
It focuses solely on technical aspects, disregarding policy frameworks.
The course is grounded in which cybersecurity framework and follows the guidelines of which strategy?
ISO 27001 and GDPR.
NIST Cybersecurity Framework and ENISA's New Strategy towards a Trusted and Cyber Secure Europe.
OWASP Top 10 and HIPAA.
CIS Controls and CCPA.
Which NIST Cybersecurity Framework function focuses on preventing cyber threats from compromising systems and data?
Identify.
Protect.
Detect.
Respond.
What is the primary reason the NIST Cybersecurity Framework is important for a Cybersecurity Fundamentals course?
It is a mandatory regulation for all organizations.
It provides a comprehensive, yet flexible framework for managing cybersecurity risks and is widely recognized.
It focuses exclusively on advanced technical cybersecurity concepts.
It simplifies cybersecurity to only essential measures.
According to the Kill Chain principle, what is the stage where an attacker collects information about the target system and its vulnerabilities?
Weaponization.
Delivery.
Reconnaissance.
Exploitation.
How long do hackers frequently spend inside an environment, on average, before fully executing a hack?
Less than 50 days.
100-140 days.
Over 300 days.
Only a few hours.
Which malicious activity are botnets NOT commonly used for?
Distributed denial-of-service (DDoS) attacks.
Sending spam emails.
Chatroom management for policy enforcement.
Stealing data.
Which skill or mindset is characteristic of many successful hackers, according to the sources?
Strict adherence to established procedures.
Aversion to risk-taking.
Creative problem-solving.
Disregard for technical expertise.
What do hackers often recognize as "the weakest link in the chain"?
Advanced encryption algorithms.
Hardware vulnerabilities.
Humans.
Network infrastructure.
What is the main purpose of incorporating practical demonstrations into the cybersecurity foundations course for Master's students?
To replace theoretical learning entirely.
To provide students with hands-on experience in cybersecurity tools and techniques and bridge theory with practical application.
To exclusively focus on defensive measures without addressing offensive mindsets.
To prepare students only for certifications, not real-world scenarios.
According to the UK government's definition, what does cybersecurity primarily refer to?
The protection of physical documents from harm or misuse.
The protection of information systems, data, and services from unauthorized access, harm, or misuse.
The development of new software and hardware for computing.
The legal framework governing internet usage.
The Cybersecurity Body of Knowledge (CyBOK) is divided into how many top-level Knowledge Areas (KAs)?
5.
10.
21.
30.
What is a crucial element arguably still missing from the UK government's cybersecurity definition?
A mention of specific hardware components.
The impact of information loss or reduced safety on human behaviors, or how security/privacy breaches impact trust.
Details about network protocols.
Reference to historical cybersecurity incidents.
Information Security is widely regarded as comprised of three main elements. Which of the following is NOT explicitly one of them, according to ISO 27000 definition?
Confidentiality.
Integrity.
Authentication.
Availability.
Which of the following is an example of a Cyber-Physical System (CPS)?
A standalone desktop computer.
An industrial control system.
A traditional paper filing system.
A simple calculator.
What is Cyberspace best understood as, according to the sources?
A physical location where computers are stored.
A "place" where business is conducted, human communications take place, and art is made.
A specific type of network protocol.
A programming language for secure systems.
Who coined the term "cyberspace" for "widespread, interconnected digital technology"?
Claude Shannon.
William Gibson.
Jerome Saltzer.
Auguste Kerckhoffs.
In cybersecurity, controls are often expressed in terms of affecting which three aspects?
Speed, cost, and efficiency.
Prevention, detection, and reaction.
People, process, and technology.
Hardware, software, and data.
What does the "Precautionary Principle" in security design imply for designers of large-scale connected systems?
They should only consider security implications after deployment.
They must consider security and privacy implications from conception through decommissioning.
They should prioritize innovation over security concerns.
They should only address security concerns when a breach occurs.
What is the high-level design of a system from a security perspective called?
Security Implementation.
Security Architecture.
Security Policy.
Security Assurance.
Which of the following is NOT one of the key security requirements of the CIA triad?
Confidentiality.
Identification.
Integrity.
Availability.
What does "Data confidentiality" assure?
That data is accurate and reliable.
That private or confidential information is not made available or disclosed to unauthorized individuals.
That data is always accessible to authorized users.
That data is changed only in a specified and authorized manner.
One of the challenges of computer security is that successful attacks are often designed by exploiting what?
Obvious and well-known weaknesses.
Unexpected weaknesses by looking at the problem in a completely different way.
The absence of any security mechanisms.
Simple brute-force methods only.
Which characteristic describes a 'Threat' in computer security terminology?
A flaw or weakness in a system's design.
An action, device, or procedure that reduces a vulnerability.
A potential for violation of security, existing when there is a circumstance or event that could breach security and cause harm.
A set of rules that specify how a system provides security services.
What is a 'Vulnerability' defined as in computer security?
An intelligent act to evade security services.
A potential for security violation.
A flaw or weakness in a system’s design, implementation, or operation that could be exploited.
A measure of expected loss.
What is the primary characteristic of a 'Passive Attack'?
It alters system resources or affects their operation.
It involves eavesdropping or monitoring transmissions to learn information without affecting system resources.
It creates a false data stream.
It is easily detectable by the system.
Which of Saltzer and Schröder’s design principles states that 'the design of security measures embodied in both hardware and software should be as simple and small as possible'?
Fail-safe defaults.
Complete mediation.
Open design.
Economy of mechanism.
The principle of 'Psychological acceptability' implies what regarding security mechanisms?
They should be overly complex to deter attackers.
They should significantly interfere with user work to ensure maximum security.
They should not interfere unduly with the work of users and meet the needs of those who authorize access.
They should only be implemented by security experts, not users.
What is the purpose of 'Layering' as a contemporary security design principle?
To replace all other security principles.
To use multiple, overlapping protection approaches so that the failure of one does not leave the system unprotected.
To centralize all security controls in a single layer.
To reduce the number of security controls needed.
Which of the following is NOT one of the three aspects of a comprehensive security strategy?
Specification/policy.
Marketing/branding.
Implementation/mechanisms.
Correctness/assurance.
What is a network sniffer primarily used for?
To block all network traffic automatically.
To encrypt data packets before transmission.
To capture and analyze network traffic.
To establish VPN connections.
Which of the following is a legitimate purpose for using packet sniffing?
Injecting malicious programs or viruses into a segment.
Spying on businesses to steal confidential data.
Identifying problems within the network and troubleshooting them.
Monitoring someone’s online behavior for unethical purposes.
How do hackers commonly place sniffers at unsecured Wi-Fi hotspots?
By physically installing hardware on the router.
By setting up fake hotspots to intercept unencrypted passwords and usernames.
By directly connecting to the hotspot's server.
By sending encrypted signals to the hotspot.
What is the difference between Active Sniffing and Passive Sniffing?
Active sniffing targets unbridged networks, while passive sniffing targets point-to-point networks.
Active sniffing actively injects additional traffic into the LAN, while passive sniffing is inserted into a hub and waits for data.
Passive sniffing is illegal, while active sniffing is ethical.
Active sniffing only captures encrypted data, while passive sniffing captures all data.
What is 'Password sniffing' a type of cyber-attack that commonly occurs on public Wi-Fi networks?
It encrypts passwords to make them more secure.
It monitors a victim’s connection to a remote database to obtain their password.
It creates strong passwords for users automatically.
It only targets encrypted communications.
Which type of sniffing attack takes over a web user session by secretly collecting the session ID and masquerading as the authorized user?
DNS poisoning.
JavaScript card sniffing.
TCP session hijacking.
Address resolution protocol (ARP) sniffing.
What is the main goal of 'DNS poisoning'?
To encrypt DNS queries for enhanced security.
To redirect internet traffic to phishing websites or phony web servers.
To optimize DNS server performance.
To monitor DNS traffic for legitimate purposes.
What distinguishes 'JavaScript card sniffing attacks' from 'Foam Jacking'?
JavaScript card sniffing targets any online form, while Foam Jacking targets payment forms.
JavaScript card sniffing targets online store payment forms specifically, while Foam Jacking attacks any type of information in any online form.
Foam Jacking relies on malicious JavaScript, but JavaScript card sniffing does not.
JavaScript card sniffing is a physical attack, while Foam Jacking is digital.
What is the purpose of Address Resolution Protocol (ARP) sniffing, also known as ARP spoofing?
To convert MAC addresses to IP addresses.
To reroute traffic away from their intended destination and towards an attacker.
To secure ARP communication.
To discover legitimate MAC addresses on a network.
Which example of a packet sniffing attack involved exploiting a computer vulnerability developed by the United States National Security Agency (NSA)?
BIPASS RAT and Cobalt Strike.
Hacking Wi-Fi networks using PMKID.
The history-sniffing attack.
Password sniffing cyberattack involving EternalBlue exploit.
One key way to protect against sniffing attacks is to 'Avoid using unsecured networks.' Why?
Unsecured networks are always faster.
Unsecured networks lack firewall protection and antivirus software, making information unencrypted and easy to access.
Unsecured networks only transmit encrypted data.
Unsecured networks are not vulnerable to Man-in-the-Middle (MITM) attacks.
How does using a Virtual Private Network (VPN) help prevent sniffer attempts?
It creates a direct, unencrypted connection to the internet.
It allows sniffers to monitor all traffic easily.
It encrypts all incoming and outgoing communication, making it difficult for spies or sniffers to see traffic.
It only protects against passive sniffing.
Which type of protocol should users prefer to avoid packet sniffing, indicated by the 's' in its name?
HTTP.
FTP.
HTTPS.
SMTP.
What is a 'sniffer detection application' primarily designed to do?
Inject sniffers onto a network.
Detect and preempt sniffing attacks before they cause damage.
Increase network congestion for analysis.
Encrypt all network traffic automatically.
Which tool is a free and open-source network protocol analyzer used for troubleshooting, analysis, development, and education?
Nmap.
Anti-Sniff.
Wireshark.
Snort.
Why is Wireshark considered important for applied security and ethical hacking?
It simplifies network configuration.
It provides insights into network traffic and helps identify security threats, vulnerabilities, and misconfigurations.
It automatically blocks all malicious network traffic.
It only works on encrypted networks.
What is one of the key features of Wireshark's capabilities?
Automated penetration testing.
Deep Inspection, dissecting and displaying details for hundreds of protocols.
Malware removal.
Hardware diagnostics.
Which component is required for packet capturing when installing Wireshark on Windows?
Java Runtime Environment (JRE).
Microsoft SQL Server.
Npcap.
VirtualBox.
What is the first step when you want to start capturing packets in Wireshark?
Apply filters immediately.
Select the network interface you wish to monitor and click the 'Start Capturing Packets' button.
Save the capture file.
Install additional plugins.
Is the use of network sniffers subject to privacy and security laws?
No, they can be used freely on any network.
Yes, it's important to only use them under applicable laws and regulations and on networks you own or have permission to access.
Only if financial information is involved.
Only when used by government institutions.
What is the primary difference between Wireshark 'capture filters' and 'display filters'?
Capture filters modify network traffic, while display filters only show it.
Capture filters limit the amount of traffic Wireshark saves to a file, while display filters narrow down displayed captured traffic.
Display filters are used during live capture, while capture filters are for offline analysis.
Capture filters are for IP addresses, while display filters are for protocols.
Which Wireshark filter expression would display traffic involving a specific IP address, for example, 192.168.0.1?
ip.addr != 192.168.0.1.
ip.addr == 192.168.0.1.
host 192.168.0.1.
src or dst 192.168.0.1.
ng a specific IP address, for example, 192.168.0.1?
ip.addr != 192.168.0.1.
ip.addr == 192.168.0.1.
host 192.168.0.1.
src or dst 192.168.0.1.
To display all TCP SYN/ACK packets, which filter expression should be used?
tcp.flags.syn==1 && tcp.flags.ack==1.
tcp.flags == 0x012.
tcp.port == 80.
tcp.analysis.flags.
How would you apply a filter in Wireshark to display only packets to and from any address in the 10.0.0.0/24 network space?
ip.src == 10.0.0.0/24.
ip.dst == 10.0.0.0/24.
ip.addr == 10.0.0.0/24.
ip.network == 10.0.0.0/24.
Which Wireshark filter is useful for searching on a specific string or user ID within packets?
tcp.port.
frame contains [string].
ip.proto.
tcp.time_delta.
What does the filter !(arp or icmp or stp) achieve in Wireshark?
It displays only ARP, ICMP, and STP packets.
It displays all packets that contain ARP, ICMP, or STP.
It masks out (removes) ARP, ICMP, or STP packets to reduce background noise.
It filters for packets that are exactly ARP, ICMP, or STP.
To filter traffic based on a specific IP protocol, such as TCP or UDP, which filter expression can be used?
ip.addr == [IP address].
ip.proto == [protocol].
ip.len > [length].
tcp.port == [port number].
What is the purpose of the SYN-ACK packet in the TCP handshake process?
To initiate the connection request from the client.
To acknowledge the SYN packet and include a random sequence number from the server.
To confirm the connection request from the client.
To terminate the TCP connection.
Which TCP port is the default communication channel used for web traffic, allowing users to send and receive web page data using the HTTP protocol?
Port 21.
Port 23.
Port 80.
Port 443.
What does an HTTP "200 OK" status code indicate?
That the server encountered an error.
That the requested resource was not found.
That the request was successful and the requested resource is being returned.
That the request is pending further action.
Wireshark TCP Analysis flags like "Out-Of-Order" and "Retransmission" provide useful information primarily for what purpose?
To indicate successful data transmission.
To analyze and troubleshoot network issues related to TCP performance.
To identify new network protocols.
To verify encryption strength.
What does a "Duplicate Acknowledgement" TCP flag indicate in Wireshark?
A successful packet transmission.
A network packet has been received out of order, causing the receiver to send an acknowledgment for the missing packet.
The sender is retransmitting a packet unnecessarily.
The connection has been closed.
To remove ICMP, DNS, and ARP protocols from a Wireshark display, which filter expression can be used?
(icmp and dns and arp).
icmp or dns or arp.
!(icmp or dns or arp).
not (icmp, dns, arp).
What is the "Follow TCP Stream" feature in Wireshark used for?
To filter packets based on specific keywords.
To reconstruct and view the entire data exchange between two network devices in a specific TCP conversation.
To generate new TCP packets for testing.
To analyze only the header information of TCP packets.
The "TCP contains" filter in Wireshark allows you to search for what?
Only the source and destination IP addresses in a TCP packet.
Packets containing specific data within the payload of a TCP packet.
The TCP handshake sequence numbers.
All encrypted TCP traffic.
An SYN attack (SYN flood) is a type of Denial-of-Service (DoS) attack that exploits what aspect of the TCP/IP protocol?
The process of data encryption.
The three-way handshake, by sending many SYN requests without completing the connection.
The ability to send large files quickly.
The functionality of UDP packets.
Which filter expression in Wireshark would you use to discover SYN attacks by looking for packets with the SYN flag set and the ACK flag unset?
tcp.flags.syn==1.
tcp.flags.ack==0.
tcp.flags.syn==1 && tcp.flags.ack==0.
tcp.flags == SYN.
Which of the following is NOT listed as a common form of Denial of Service (DoS) attacks?
Network flood attacks.
Application-layer attacks.
Distributed Denial of Service (DDoS) attacks.
Data exfiltration attacks.
What is the primary characteristic of a Distributed Denial-of-Service (DDoS) attack?
A single attacker overwhelming a server from one location.
Multiple attackers or compromised devices overwhelming a target with fraudulent traffic until it becomes unresponsive.
An attack that targets unencrypted data streams only.
An attack that aims to steal sensitive data.
Which of these is a described symptom of a DDoS attack?
A steady, consistent flow of traffic from diverse sources.
An exponential, unexpected rise in traffic at a single endpoint/server.
The server continuously generating new logs without issues.
Your website responding faster than usual.
What is recommended for a strong password, according to the sources?
It should be at least 6 characters long and easy to remember.
It should be at least 12 characters long and include a mix of uppercase and lowercase letters, numbers, and symbols.
It should be a common word or phrase.
It should be updated once a year.
Which new trend in password management involves eliminating passwords entirely and using alternative authentication methods like biometrics?
Multifactor authentication (MFA).
Single sign-on (SSO).
Passwordless authentication.
Zero-knowledge password management.
How can passwordless authentication be implemented using a "magic link"?
By requiring a user to enter a one-time code from an SMS.
By sending an email with a URL containing a unique token that verifies the user when clicked.
By asking the user for their fingerprint directly.
By providing a hardware token to the user.
Multi-factor authentication (MFA) involves requiring users to provide additional authentication factors. Which of these is an example of "what a user knows"?
An ID card.
Biometric data like a fingerprint.
A user's login ID and password combination.
A hardware token.
What is a significant advantage of SMS 2FA?
It is highly resistant to SIM swapping attacks.
It is the most secure MFA alternative available.
It works offline, as it does not require the phone to be online.
It is the most cost-effective method for authentication.
Which of the following is listed as a disadvantage of SMS 2FA?
Low learning curve for users.
Requires expensive smartphones.
Vulnerable to SIM swapping attacks.
Does not require additional hardware.
What is the core distinction between "Passwords" and "Identity"?
Passwords are inherent attributes, while identity is used for authentication.
Passwords are a means of authentication to verify identity, while identity refers to a set of personal attributes that define who you are.
They are interchangeable terms in cybersecurity.
Identity is always public, while passwords are always private.
What is the purpose of "Authentication" in cybersecurity?
To determine if a user has necessary permissions.
To define policies for identity management.
To verify a user's identity to ensure they are who they claim to be.
To manage user access to applications.
What is "Authorization" in the context of cybersecurity?
The process of verifying a user's identity.
The process of determining whether a user has the necessary permissions to perform a specific action or access a particular resource.
The process of creating new user accounts.
The process of logging all user activities.
Single Sign-On (SSO) aims to simplify password management by allowing users to do what?
Use different credentials for each application.
Sign in to multiple applications or services with a single set of login credentials.
Manually enter passwords for each service.
Bypass authentication for certain services.
What is a key security risk associated with the "Centralized IM" model?
Increased user control over their data.
High security risk and data breaches due to centralization and fragmented identities across many enterprises.
Enhanced interoperability between different entities.
Reduced cost of customer services due to fewer password reset requests.
Which technology has enabled the emergence of "Decentralized IM" as a disruptive innovation?
Centralized Ledger Technology (CLT).
Distributed Ledger Technology (DLT) and Verifiable Credentials data model.
Traditional relational databases.
Single Sign-On (SSO) protocols only.
In the Verifiable Credentials (VCs) model, who sits at the center of the triangle of trust?
The issuer.
The verifier.
The holder (user).
The certificate authority.
What is "Password cracking"?
The process of creating strong, unique passwords.
The process of guessing or recovering a password from a stored or transmitted password hash to gain unauthorized access.
A method to encrypt sensitive data.
