Which HTTP method is idempotent and typically used for updating a resource?

Status code 302 indicates:

Which header allows a client to tell the server which types of content it can process?

When resolving a domain name, which record maps an IP address back to a hostname?

An attacker injects script into a form field that executes in a victim's browser. What vulnerability is this?

Which OWASP Top 10 category refers to unpatched software potentially exploitable by attackers?

Scenario: A user bypasses hostname validation and proceeds to accept a self-signed certificate habitually. What security principle is most violated?

What does CSRF stand for?

In Metasploit, what is a 'payload'?

Which command launches the Metasploit console on Linux?

Scenario: A pentester uses Burp Suite to intercept web traffic by configuring HTTP traffic routing through the AttackBox on port 8080. This illustrates which method?

'Auxiliary' modules in Metasploit are used primarily for:

Meterpreter is a type of:

What does antivirus software primarily do?

The process of securing a system by reducing its attack surface is called:

Regular patching helps in:

Scenario: A hospital encrypts stored patient data, but ransomware still stops staff from accessing it. Which principle of the CIA triad has been compromised?

Implementing fingerprint-based access to server racks is an example of which security control type?

Which risk management phase involves identifying threats and vulnerabilities?

Defense-in-depth refers to:

Scenario: A healthcare worker shares credentials in response to a fake call from 'IT support.' What type of social engineering is this?

Least Privilege principle ensures:

Segregation of Duties prevents:

Which stage of SDLC is ideal for performing threat modeling?

OWASP stands for:

Integrity in cybersecurity ensures:

Non-repudiation means:

Which framework categorizes attacker behaviors and techniques?

Scenario: A hospital staffer uses default credentials on a new medical device. Which principle is violated?

Scenario: Logs are collected but not reviewed, missing signs of intrusion. What kind of control failed?

Scenario: A system hashes passwords but uses MD5. What is the risk?

Scenario: A web app trusts data from a third-party API without validating it. Which security requirement is not met?

Scenario: During incident response, a team isolates affected systems. Which stage is this?

Scenario: For GDPR compliance, which principle ensures users' data is erased upon request?

Scenario: A website permits unlimited login attempts without lockout. What risk is this?

Scenario: A janitor gains tailgate access into a data floor. Which security lapse occurred?

Scenario: A cloud config allows public read, exposing patient data. What principle is compromised?

Scenario: A log file uses timestamps from different time zones, complicating audits. What security aspect is affected?

In HTTPS, what ensures server identity to the client?

HTTP/2 is faster than HTTP/1.1 because it uses:

DNS Spoofing involves:

A web server responds with Cache-Control: no-store. This affects which aspect?

Scenario: An admin manually reviews access logs every month. This is a form of:

The principle of 'defense-in-depth' advocates for:

Scenario: A hospital uses both passwords and fingerprint scanners. This is an example of:

Scenario: A researcher hashes a file before altering it. What does this help ensure during forensic analysis?

Scenario: An insider installs a hidden rootkit on workstations. Which security principle is mainly jeopardized?

Scenario: An API uses bearer tokens that never expire. This violates:

Which component renders content directly in your browser?

Which language defines the structure of a webpage?

If an image tag is missing its extension, what must you do to make it load?