NEW
Font size
WorksheetsQuiz
Total questions: 30
Worksheet time: 15mins
Which device primarily forwards packets between different networks?
Switch
Router
Hub
Repeater
Which address is tied to a network interface card (NIC) and usually fixed by the manufacturer?
IPv4 address
MAC address
Public IP
DNS name
What does the “A” in the CIA triad stand for?
Accountability
Availability
Authentication
Authorization
Which protocol is used to securely browse the web?
HTTP
FTP
HTTPS
Telnet
Which network type covers the largest physical area?
LAN
PAN
MAN
WAN
Which tool is commonly used for discovering open ports on a host?
Wireshark
Nmap
Burp Suite
OpenVAS
Which is NOT part of the OWASP Top 10?
Injection
Cross-Site Scripting (XSS)
Weak Wi-Fi passwords (WPA2)
Insecure Deserialization
Which malware type spreads automatically across networks without user interaction?
Virus
Trojan
Worm
Adware
What is Spear Phishing?
Mass email fraud to many recipients
A phishing attack targeted at a specific individual or organization
Phishing via SMS
Phishing via voice call
Which framework uses the functions Identify, Protect, Detect, Respond, Recover?
ISO 27001
NIST Cybersecurity Framework
PCI-DSS
GDPR
What is the main goal of Vulnerability Assessment?
Permanently shut down vulnerable hosts
Identify and prioritize weaknesses before exploitation
Develop exploits for penetration testing services
Replace patch management
Which scan type gives the tester no internal knowledge of the target beforehand?
White box
Grey box
Black box
Blue box
CVSS is used to:
Define network topology
Score vulnerability severity
Encrypt sensitive data
Log user activity
Which of the following is a sign of a misconfigured web server?
Custom 404 pages
Default admin panels reachable with default credentials
Proper TLS certificates in place
Minimal exposed services
What does “asset inventory” mean in vulnerability management?
A list of software licenses only
A comprehensive listing of all hardware, software, and services to protect
A list of customers and vendors
A backup schedule
What kind of address is 192.168.1.10 typically considered?
Public IPv4 address
Private IPv4 address
IPv6 address
MAC address
Which of these is an example of social engineering?
SQL Injection
Pretexting via phone call
Buffer overflow
Cross-site scripting
What is the purpose of a firewall?
To accelerate web traffic
To filter and control network traffic based on rules
To serve as a DNS resolver
To store backups
Which of the following best describes a zero-day vulnerability?
A vulnerability that’s patched instantly
A vulnerability known to the vendor for many years
A vulnerability exploited before a patch is available
A vulnerability found only in physical devices
Which protocol should never be used for an admin login over the Internet?
HTTPS
SSH
SFTP
Telnet
What does OWASP stand for?
Open Web Application Security Project
Open Worldwide Application Security Program
Online Web Application Support Platform
Open Web Attack Security Project
Which is a primary difference between vulnerability scanning and penetration testing?
Scanning can prove exploitability; penetration testing only finds vulnerabilities
Penetration testing attempts active exploitation; scanning is primarily detection and reporting
They are the same process under different names
Scanning always requires a human to run exploits manually
In network segmentation, VLANs are used to:
Physically separate cables for each department
Log traffic only
Create logical separate networks within the same switch infrastructure
Replace firewalls entirely
Which log collection/analysis system centralizes logs and raises alerts?
FTP server
SIEM (Security Information and Event Management)
DNS cache
DHCP server
What is the primary risk of using components with known vulnerabilities?
They are always slower
They increase cost of maintenance
Attackers can reuse known exploits to compromise systems
They prevent patching of other components
Which of the following best reduces the risk of phishing credential theft?
Only longer passwords
Multi-Factor Authentication (MFA)
Use of HTTP instead of HTTPS
Disabling firewalls
What is Shodan mainly used for?
Scanning internal application code
Searching internet-connected devices and exposed services
Hashing passwords
Generating SSL certificates
Which of these describes a “worm” like WannaCry?
Needs user to open attachment to spread
Self-propagating malware exploiting network vulnerabilities
Only runs on mobile phones
Only displays ads to the user
Which is the best hashing algorithm choice for storing user passwords?
MD5
SHA-1
bcrypt or Argon2
Base64
In vulnerability management, a “compensating control” means:
A permanent software rewrite
Temporary or alternative control that reduces risk until full remediation is possible
Complete removal of the asset
Public disclosure of the vulnerability
