During a cyber audit, a company finds that many employees use the same password across systems. What vulnerability does this highlight?

A user downloads a free mobile app that silently records keystrokes. What type of malware is this?

After opening a suspicious attachment, an employee finds all files on their PC encrypted, with a ransom note demanding cryptocurrency. What is this attack known as?

A government database is breached through an outdated system that had not been patched in years. What was the most likely root cause?

A cybercriminal intercepts data sent between two parties without them noticing. What type of attack is this?

A disgruntled ex-employee remotely accesses internal systems using valid credentials that were never revoked. Which threat category does this fall under?

Your organization's website goes offline for several hours due to an overwhelming flood of traffic. What type of attack does this suggest?

A hotel's digital key system is locked down by attackers who demand Bitcoin. What element is primarily being exploited?

A hacker uses publicly available information from a company's 'About Us' page to guess employee email addresses and target them. Which phase of an attack is this?

A user reports a pop-up asking for admin credentials immediately after visiting a compromised website. What is this technique likely targeting?

After clicking a deceptive link, a user's browser begins redirecting to unknown search engines and spam websites. What type of malware might be involved?

During a cybersecurity awareness training, employees are taught to hover over links in emails before clicking. What is this practice meant to prevent?

A manufacturing plant experiences a shutdown after hackers manipulate temperature sensors remotely. What is being targeted here?

An organization installs software that monitors network traffic to identify anomalies. What kind of system is this?

A CEO receives a convincing email that appears to be from the CFO requesting a wire transfer. This is an example of:

A cybercriminal gains access by guessing a password based on social media clues. What tactic was used?

A hacker installs code that remains dormant until triggered by a specific condition. What is this called?

Employees at a company are required to use a second verification method after password entry. This method is used to improve:

After a breach, an IT analyst investigates the origin and timeline of access. What activity is this?

A hacker uses a public USB charging station to install malware on connected devices. What kind of attack does this represent?

During penetration testing, testers find a vulnerability in the way user roles are assigned. This is a weakness in:

A news site is temporarily defaced with a politically charged message. What is the likely motive behind the attack?

A system starts sending traffic to multiple random IP addresses after a suspicious update. This behavior suggests:

A user installs a seemingly useful browser extension that silently monitors all inputs. This is a form of:

A data center is physically breached and routers are stolen. This incident involves a violation of:

After a new regulation, organizations are forced to disclose breaches within 72 hours. What type of policy is this?

A cybersecurity analyst uses the MITRE ATT&CK framework. What is their main goal?

A hacker gains access through an unsecured third-party vendor account. What kind of vulnerability is this?

A company implements a security model where access is granted based on job roles. What model is this?

A user receives a phone call from someone claiming to be IT support asking for credentials. What kind of attack is this?

A team installs decoy systems to lure and study attackers. These systems are known as:

A file is downloaded that appears benign but opens a backdoor when executed. What type of malware is this?

A hacker bypasses a system's login by exploiting default admin credentials. This is a failure in:

A company uses artificial intelligence to detect threats based on traffic patterns. This is an example of:

A cyberattack shuts down a region's power supply. Which sector is being attacked?

A policymaker argues for stricter encryption rules after a government leak. This is a reaction to issues with:

A military organization uses satellites and sensors for early warning cyber threats. This approach is part of:

An attacker copies encrypted data hoping to break it later. This is called:

During a conference, a USB drive is distributed containing malware. This is a form of:

A cybercriminal installs software that spreads automatically via email contacts. What type of malware is this?

A company requires encryption of all customer data in storage and transit. This aims to protect:

An online banking platform uses geolocation to block access from unknown regions. This is a form of:

A ransomware group avoids detection by using legitimate Windows processes. What is this tactic called?

An attacker replaces software updates with malicious versions. This is an example of:

A threat actor inserts malicious code into a login page that captures credentials. This attack is known as:

A company wants to reduce the likelihood of employees falling for scams. What should they prioritize?

A hacker waits silently in a network for weeks before launching an attack. This behavior characterizes a:

A national cybersecurity law mandates encryption standards for private companies. This is an example of:

A threat actor steals information and sells it on the dark web. This threat is mostly motivated by:

What aspect of cybersecurity focuses on preventing data from being accessed by unauthorized individuals?

Which of the following is a behavior that improves cybersecurity at the individual level?

What is considered part of the "attack surface" of an organization?

Who is responsible for cybersecurity in an organization?

Which of the following best describes phishing?

Which tool helps monitor for malicious activity on a network?

What is the role of firewalls in cybersecurity?

What is a strong practice for protecting your online accounts?

What type of threat often comes through email attachments or suspicious links?

What is the purpose of antivirus software?

What is the simplest reason to keep your software up to date?

Which of the following could be a human factor vulnerability?

Which actor is least likely to follow formal rules but may cause significant damage?

How might cybercriminals access systems through social means?

What's a potential result of a cyberattack?

What kind of information is at risk in a cybersecurity breach?

Who uses cybersecurity frameworks like NIST?

What makes cyber threats particularly difficult to manage?

What is a common reason hackers exploit systems?

Which method is commonly used to trick people into revealing confidential information?

What term refers to a weakness in a system that can be exploited by a threat actor?

What describes the act of identifying and evaluating cybersecurity threats before they happen?

Which actor group typically works for a government and engages in cyber operations?

What phase of hacking involves sending the exploit to the victim?

Which of these is a benefit of implementing cybersecurity policies at the national level?

What is one ethical dilemma faced in cybersecurity governance?

Scenario: A cybersecurity analyst detects unusual outbound traffic. What is the most likely response?

What type of hacker attacks systems to protest political or social causes?

What does a holistic cybersecurity approach involve?

What's a challenge with attributing a cyberattack?

Scenario: A media company experiences a DoS attack. What happens?

What is weaponization in the hacking process?

What's an example of a cascading effect in cybersecurity?

Why are critical infrastructure sectors high-risk targets?

What tool is used to detect suspicious activity and alert admins?

What makes malware-less attacks harder to detect?

What describes cyber attacks that manipulate individuals through deception?

What is the most likely motivation behind ransomware?

Why should policymakers collaborate internationally?

Which cyber threat involves impersonating trusted contacts to obtain information?

What does the term "cybersecurity policy" generally include?

What is the biggest limitation of relying solely on technical defenses?

Scenario: A hacker uses tools from the dark web to infiltrate a government database without malware. What is this an example of?

Why is reconnaissance important in the hacking process?

What is one role of national cybersecurity strategies?

What makes cybercrime attractive to organized groups?

Why is understanding TTPs (Tactics, Techniques, Procedures) important for defense teams?

How can cybersecurity incidents affect a nation's economy?