WorksheetsComputer Networks & Security Quiz
Total questions: 50
Worksheet time: 25mins
Which OSI layer is responsible for logical addressing (IP)?
Data Link
Network
Transport
Application
A switch works mainly at which OSI layer?
Layer 1
Layer 2
Layer 3
Layer 7
Which device separates networks and controls traffic based on rules?
Switch
Firewall
Hub
Repeater
Which of these is an example of a network segmentation technique?
VLANs
Using USBs
Printing documents
Disabling Wi-Fi
The main purpose of AAA in security is:
Authentication, Authorization, Accounting
Availability, Access, Application
Admin, Audit, Access
Advanced Automatic Analysis
Encryption provides which of the following?
Confidentiality
Printing speed
Internet access
Hardware security only
Which protocol is secure for remote login?
Telnet
FTP
SSH
HTTP
A “stateful firewall” means:
It can remember active sessions and connections
It only filters based on static rules
It never logs activity
It blocks all traffic
A virus differs from a worm because:
A virus spreads without human action
A worm needs a host file
A virus needs a host file while a worm spreads standalone
Both are exactly the same
A Trojan horse usually:
Disguises as legitimate software but hides malicious code
Only infects USB drives
Self-replicates
Encrypts files automatically
Which malware type locks your files until ransom is paid?
Spyware
Adware
Ransomware
Worm
Keyloggers are used to:
Monitor network bandwidth
Record user keystrokes
Encrypt data
Delete cookies
A common phishing attack method is:
Sending fake emails pretending to be banks
Brute-forcing passwords
Launching DDoS
Changing IP addresses
Spear phishing is:
Targeted phishing against a specific person or company
Sending to all people randomly
Physical spear attacks
Brute-forcing login
Whaling phishing targets:
Ordinary users
CEOs and executives
Hackers
Students
Which attack tricks users into clicking malicious ads?
Adware
Pharming
Typosquatting
SQL Injection
A vulnerability is best defined as:
A hacker tool
A weakness in a system that can be exploited
A virus infection
A firewall rule
Which tool is used for network vulnerability scanning?
OpenVAS
Paint
Excel
Word
XSS allows an attacker to:
Inject malicious scripts into web pages
Steal network packets
Crash servers via DoS
Enumerate DNS records only
SQL Injection happens when:
SQL queries are constructed with unvalidated user input
DNS servers are misconfigured
Users forget their passwords
A firewall is blocking ports
Which vulnerability lets attackers access files outside the web root folder?
Path Traversal (../)
SQL Injection
XSS
CSRF
CSRF stands for:
Client-Side Request Function
Cross-Site Request Forgery
Central Security Risk Factor
Cyber Security Routing Feature
The goal of vulnerability assessment methodology is:
Systematically identify, analyze, and prioritize vulnerabilities
Launch ransomware
Block phishing emails
Train employees only
Which step comes before “Exploitation” in PTES but overlaps with VA?
Threat Modeling
Vulnerability Analysis
Reporting
Post-exploitation
Which project maintains the OWASP Top 10 list?
Cisco
Microsoft
OWASP Foundation
The OWASP Top 10 focuses on:
Most critical web application security risks
Firewall configurations
Network speed
Software licenses
SQL Injection is part of OWASP Top 10. True or False?
True
False
Which tool is popular for intercepting and modifying HTTP requests?
Burp Suite
Excel
Photoshop
Telnet
Which scanning tool is open-source and similar to Burp?
OWASP ZAP
Wireshark
Hydra
Nmap
A web vulnerability scanner does what?
Finds misconfigurations and injection points in web apps
Cleans malware
Encrypts files
Designs websites
Broken Authentication means:
Weak login mechanisms allow account takeover
System crash
Server hardening
Certificate expired
Sensitive Data Exposure in OWASP refers to:
Unencrypted or poorly protected sensitive data (passwords, credit cards)
Only showing error pages
Bandwidth overuse
File compression
A common WordPress risk comes from:
Weak plugins
USB attacks
Cloud backups
MAC spoofing
Why are outdated themes dangerous?
They use more disk space
They may contain vulnerable code
They make the site look old
They slow internet speed
Brute-force login attack in WordPress means:
Repeatedly guessing username/password until success
Deleting user accounts
Uploading images
Changing domain records
Misconfigurations in WordPress include:
Default admin username, weak permissions
Using a custom theme
Using caching plugins
Hosting multiple sites
A good hardening practice is:
Keep WordPress core, plugins, themes updated
Never update plugins
Use “admin” as default user
Disable HTTPS
Which plugin type often introduces supply chain risks?
Downloaded from untrusted third-party sites
Official WordPress repository
Browser extensions
Antivirus
Limiting login attempts is an example of:
Brute-force protection
SQL Injection protection
Adware removal
Encryption
Disabling directory listing prevents:
Attackers from browsing your file structure
Emails from being sent
Password reuse
SSL certificates from working
PTES stands for:
Penetration Testing Execution Standard
Private Testing Evaluation System
Public Test Encryption Service
Pentest Evaluation Suite
Which phase is about collecting information about the target?
Intelligence Gathering
Exploitation
Post-exploitation
Reporting
Threat modeling helps identify:
High-value assets and possible attackers
The report template
The fastest scanning tool
Backup solutions
Vulnerability Analysis phase uses:
Scanners + manual verification
Only screenshots
Only passwords
Only Burp Suite
Exploitation must be:
Controlled and non-destructive
Always destructive
Skipped completely
Random
Post-exploitation includes:
Privilege escalation and lateral movement
Printing logs only
Writing the report
Cleaning cookies
Which section of the report is for managers, non-technical people?
Executive Summary
Technical Findings
Appendices
Raw logs
CVSS score tells:
Severity of a vulnerability
Number of logins
The scope
The size of the report
A retest after fixes is important because:
To confirm vulnerabilities are patched
To waste time
To change scope
To train new staff
The most important legal step before any pentest is:
Written authorization from the client
Using a fast laptop
Updating Burp Suite
Using multiple testers
