After a flood destroyed its primary data center, a company relied on its secondary backup facility to restore operations. Which CIA principle was preserved by this action?

An organization sets up security policies requiring all employees to attend annual cybersecurity awareness training. What type of control is this?

A company applies data masking to display only the last four digits of customer credit card numbers. What is the main objective of this technique?

An attacker intercepts sensitive data being transmitted between a client and a server. Which data state was compromised?

A company experiences a ransomware attack. They restore operations by using backup files. Which type of control was applied in the recovery process?

A power outage corrupts some stored customer files, leading to missing information in their records. This is an example of a violation of which principle?

Which technique involves partially hiding data, such as showing only the last four digits of a credit card?

Which of the following is an operational control?

An organization enforces access restrictions by limiting users to login only from certain countries. What type of restriction is this?

Which of the following describes tokenization?

A DLP (Data Loss Prevention) system that monitors outgoing network traffic for sensitive data is classified as:

A company installs a biometric lock on the data center door. This is an example of what type of control?

Which of the following best describes the main motivation of organized crime as cyber threat actors?

Which threat actor is most likely to carry out a zero-day attack using custom research labs?

Which of the following scenarios best illustrates a hacktivist motivation?

A disgruntled employee steals sensitive data after being denied a promotion. This is an example of:

Which hacker “hat” type describes someone who identifies vulnerabilities without authorization but later reports them?

An attacker drops infected USB drives in a company’s parking lot. Which threat vector is being exploited?

A phishing email that tricks users into entering login details into a fake website is an example of:

A poorly secured Wi-Fi network allows outsiders to connect from the parking lot. This is an example of:

Which of the following best explains why shadow IT is risky?

A nation-state group that compromises power grid systems during conflict is most likely motivated by:

A company has strong antivirus protection, but users still report sudden file encryption with ransom notes displayed.
Which security control likely failed, and what alternative mitigation could have minimized the damage?

A security analyst detects unusual outbound traffic from multiple systems. The traffic is directed toward known malicious IPs, but no files on the systems match antivirus signatures. Which malware type is most likely responsible?

An employee downloads a “free PDF editor” that later starts enrolling the device into paid subscription services without consent. What best identifies this malware?

Which malware type poses the greatest threat if a company relies heavily on online transactions but uses strong file backups?

A company discovers a malicious script embedded inside payroll software, designed to activate on the last Friday of every month. Which malware type does this represent?

Which malware would be most effective for attackers who want long-term, stealthy access to a corporate server without triggering detection?

A system administrator observes a suspicious process imitating “explorer.exe” that sends keystroke data to a remote server. Which two malware types could explain this behavior?

If a worm infection spreads via IoT devices and USB drives, which layered defense strategy would be most effective in prevention?

A newly hired IT technician claims that pre-installed “manufacturer software” isn’t dangerous because it isn’t malware. From a cybersecurity perspective, why is this reasoning flawed?

Statement A: Ransomware often uses phishing emails as the initial infection vector.
Statement B: The only way to recover from ransomware is by paying the ransom.

Statement A: Bloatware is intentionally designed to damage a computer system.
Statement B: Bloatware may not be malicious but can consume system resources and increase vulnerabilities.

Statement A: Viruses need a host file or program to spread.
Statement B: Viruses can remain dormant until triggered by specific conditions.

Statement A: Threat intelligence feeds can include details such as MAC addresses, file hashes, and URLs.
Statement B: Using only one threat intelligence feed is always sufficient to stay updated on emerging threats.

Which type of hacker is authorized to test systems?

Insiders pose a risk because they:

Which type of threat actor is motivated by financial gain?

Cyberterrorists aim to:

Which of the following reduces the attack surface?

Clicking a fake login page is an example of:

Email viruses usually spread through:

A simple way to remove bloatware is to:

Adding fraudulent transactions to a financial record is an example of:

Which term describes stored data on hard drives, tapes, or cloud?

Which technique transforms data so the original cannot be retrieved?

Which technique completely cuts off a system from external networks?

Which triad is most useful in identifying possible threats?

Which of the following BEST protects against eavesdropping attacks on transmitted data?