NEW
Font size
WorksheetsNetwork and Security Quiz
Total questions: 25
Worksheet time: 13mins
A company wants to block all incoming traffic from a specific country to prevent common cyberattacks originating from that region. Which security tool is best suited for this task?
An Intrusion Detection System (IDS)
An Intrusion Prevention System (IPS)
A packet-filtering firewall
A Web Application Firewall (WAF)
An administrator notices a high volume of unauthorized login attempts to a server from a single IP address. Which security device is designed to both detect this activity and automatically block the source IP address in real-time?
Firewall
Intrusion Detection System (IDS)
Intrusion Prevention System (IPS)
Load Balancer
Which of the following is a key advantage of using HTTPS over HTTP?
It is faster.
It uses a simpler protocol.
It encrypts the data in transit.
It is less vulnerable to DDoS attacks.
A network security professional decides to implement a stateful firewall. Why is this considered more secure than a simple packet-filtering firewall?
It inspects the content of the data packet.
It can detect and block viruses.
It keeps a record of active connections and only allows traffic that is part of an established session.
It is much cheaper and easier to configure.
Your server is configured to allow SSH connections. Which protocol's secure counterpart should you use to ensure your remote management is protected from eavesdropping?
HTTP
SFTP
Telnet
FTP
Which of the following is a core principle of 'OS hardening'?
Installing a new operating system.
Reducing the attack surface by disabling unnecessary services.
Encrypting the entire hard drive.
Installing a third-party antivirus program.
A malicious actor gains control of a user's Windows laptop by exploiting a memory-based vulnerability. The attacker never writes a file to the hard drive. Which security solution is specifically designed to detect this type of fileless malware?
Traditional signature-based antivirus
A host-based firewall
A Network Intrusion Detection System (NIDS)
An Endpoint Detection and Response (EDR) solution
In Linux, what is a fundamental practice for securing the system?
Allowing direct root login for convenience.
Using the sudo command to run all applications.
Disabling all file permissions.
Regularly applying patches and updates.
Which Windows Group Policy setting prevents pass-the-hash attacks?
Enable Windows Defender
Restrict NTLM authentication
Disable Registry Editor
Block USB drives
A Linux server has PasswordAuthentication yes in /etc/ssh/sshd_config. What’s the risk?
Brute-force attacks on SSH
DNS leakage
SQL injection
CSRF vulnerabilities
A web form accepts user input directly into an SQL query without sanitization. This is vulnerable to:
SQL Injection
XSS
Clickjacking
DoS
Which OWASP Top 10 risk involves manipulating session tokens?
Broken Authentication
Insecure Deserialization
Security Misconfiguration
XXE
A WAF (Web Application Firewall) can block which attack by inspecting HTTP headers?
Cross-Site Scripting (XSS)
IP spoofing
ARP poisoning
BIOS exploits
Storing passwords as plaintext in a database violates which OWASP principle?
Sensitive Data Exposure
Broken Access Control
Insufficient Logging
Using Known Vulnerabilities
What is the primary purpose of CSP (Content Security Policy)?
Mitigate XSS by restricting script sources
Encrypt database backups
Block DDoS attacks
Manage VPN access
In the AWS Shared Responsibility Model, who manages OS patching for EC2 instances?
AWS
The customer
ISP
Third-party auditor
An IoT device with default credentials admin:admin is vulnerable to:
Mirai botnet infection
SQL Injection
CSRF
DNS hijacking
Which OWASP Top 10 vulnerability occurs when user input modifies backend queries?
XSS
CSRF
SQL Injection
Insecure Deserialization
WAFs are primarily designed to protect against:
Layer 2 attacks
Application-layer attacks (SQLi, XSS)
Malware infections on endpoints
Physical access to servers
A banking web app allows users to perform transactions without CSRF tokens. What risk exists?
Session hijacking
Cross-site request forgery attack
Privilege escalation
Buffer overflow
Which OWASP Top 10 issue is MOST relevant if an application uses default admin passwords?
Broken Authentication
Security Misconfiguration
Insecure Logging
Injection
In defending against XSS, which is the MOST effective practice?
Use CAPTCHA
Input sanitization & output encoding
Enable HTTP on port 80
Disable SSL certificates
In cloud environments, IAM best practices recommend:
Use of root account for daily tasks
Least privilege principle for users and services
Sharing credentials across teams
Disabling MFA for admins
A banking web app allows users to perform transactions without CSRF tokens. What risk exists?
Session hijacking
Cross-site request forgery attack
Privilege escalation
Buffer overflow
A developer accidentally commits cloud API keys to GitHub. What is the immediate action?
Ignore if repository is private
Rotate/revoke exposed keys immediately
Wait for next security audit
Disable MFA
