Font size
WorksheetsCOMSEC-FINALS
Total questions: 100
Worksheet time: 50mins
Which of the following best describes the main function of a firewall?
It filters access to a protected network.
It stores frequently used files for faster access.
It provides internet connectivity to devices.
It encrypts all outgoing emails.
What is a proxy server primarily used for?
Acting as a middleman between users and websites.
Encrypting all network traffic.
Generating random passwords for users.
Managing user accounts on a network.
Which of the following is NOT an objective of a firewall?
Keep out intruders and unwanted traffic.
Protect private information from leaking.
Provide a secure boundary between networks.
Increase internet speed for all users.
Firewalls require both hardware and software to function. What is the role of software in a firewall?
Filters and proxies that allow or block traffic.
Physical devices that connect to the network.
Cables that transmit data.
Power supply for the firewall.
Which of the following is a limitation of firewalls?
They can't stop attacks that bypass the firewall.
They can block unauthorized access.
They monitor suspicious activity.
They provide secure communication using IPsec.
Why is it more practical to place a firewall at one central point in a network?
It creates a single checkpoint where all traffic is controlled and monitored.
It allows every device to have its own firewall.
It increases the number of security policies.
It eliminates the need for network passwords.
Which of the following is NOT a use of proxy servers?
Encrypting all emails sent from the network.
Improving security by blocking harmful sites.
Hiding location for private browsing.
Saving bandwidth by caching files.
Malware is best defined as:
Software designed to harm or steal without the user's consent.
A tool for improving network speed.
A device that filters network traffic.
A program for creating secure passwords.
Which capability does a firewall provide to a network?
Blocks unauthorized access.
Automatically repairs damaged files.
Increases bandwidth for all users.
Provides free antivirus software.
What is a characteristic of all network traffic in relation to firewalls?
All network traffic must pass through the firewall.
All network traffic is encrypted by default.
All network traffic is stored for future use.
All network traffic is automatically compressed.
A company wants to prevent employees from accessing certain websites. Which solution is most appropriate?
Use proxy servers to control access.
Increase the network bandwidth.
Install more physical devices.
Remove all firewalls from the network.
Which of the following is a limitation of firewalls regarding internal threats?
Firewalls do not protect against internal threats such as a malicious employee.
Firewalls can block all viruses.
Firewalls encrypt all internal communications.
Firewalls automatically detect all suspicious emails.
A network administrator wants to balance network traffic to avoid crashes. Which tool should they use?
Proxy server
Malware
Firewall hardware only
Antivirus software
Which of the following is a design principle for firewalls in organizations?
Place the firewall at one central point for all traffic.
Install a firewall on every device separately.
Use only software firewalls.
Allow all traffic without monitoring.
What is a possible effect of malware on a computer system?
Slow down performance and steal sensitive data.
Increase network speed.
Block all unauthorized access.
Encrypt all files for security.
Which type of malware displays unwanted ads, pop-ups, or redirects and is often financially supported by companies advertising products?
Adware
Spyware
Worms
Trojan Horse
What is the main function of spyware?
Secretly steals information such as browsing history or banking details
Changes browser settings
Spreads automatically without user action
Pretends to be useful software
Which type of malware can change your browser settings and redirect you to malicious or unwanted websites?
Browser Hijackers
Virus
Worms
Scareware
What is the correct order of the virus lifecycle stages?
Dormant, Propagation, Triggering, Execution
Propagation, Dormant, Execution, Triggering
Execution, Dormant, Propagation, Triggering
Triggering, Execution, Dormant, Propagation
How do worms differ from viruses?
Worms spread automatically without user action
Worms require human action to activate
Worms only display ads
Worms steal banking information
Which of the following is a sign of Trojan infection?
Slower performance and frequent crashes
Displaying unwanted ads
Spreading through USB drives
Changing browser settings
Which type of Trojan locks your files until a ransom is paid?
Ransomware Trojans
DDoS Trojans
Exploit Trojans
Banking Trojans
Scareware tricks users with fake warnings and may force them to download fake software or pay money. What is an example of scareware?
Fake tech support pop-ups
Keylogger
Botnet
USB virus
A botnet is best described as:
A group of hacked computers controlled by hackers
A type of virus that spreads through emails
A fake antivirus alert
A browser redirect to unwanted sites
Why is clicking "close" on a scareware pop-up potentially dangerous?
It can secretly download malware
It disables your antivirus
It changes your browser settings
It spreads through USB drives
Which of the following is a key element for improving security according to the document?
A flexible strategy that adapts to new risks
Having only one security policy
Ignoring new technologies
Never updating procedures
What is the main purpose of administrative security guidelines?
To set rules based on strategy and policy
To create encryption keys
To monitor network traffic
To design user interfaces
Which prevention tool is used to find weaknesses like weak passwords and malware?
Vulnerability analysis tools
Antivirus software
Firewalls
One-time passwords (OTPs)
Why is it important to use a website with 'https://' and a padlock icon for safe browsing?
It protects personal information and credit card details
It loads pages faster
It allows access to more content
It blocks advertisements
Which of the following is NOT a recommended tip for buying online?
Ignore privacy and share all your information
Pay securely on https:// sites
Check the product for warranty and compatibility
Keep records of receipts and order forms
What is the main reason for clearing your browser cache?
To remove stored webpage data for faster loading
To delete your browsing history
To block pop-up ads
To update your passwords
Why should you be cautious when posting personal details on social networking sites?
It can lead to identity theft, monitoring, or misuse
It increases your popularity
It improves your account security
It makes your profile more attractive
Which technological security tool isolates suspicious programs to prevent harm?
Malware sandbox
Firewall
One-time password (OTP)
Cryptography
How can you enhance your safety on social networks according to the document?
Use strong, regularly changed passwords
Share your passwords with friends
Post all your personal details publicly
Never adjust privacy settings
If you are planning an event to promote information security awareness, which strategy should you use?
Strengthening promotion through a variety of events
Ignoring employee training
Disabling security software
Posting all company data online
Which of the following is a recommended practice when connecting with people online?
Connect with everyone who sends you a request
Only connect with people you know and trust
Accept requests from strangers to expand your network
Ignore privacy settings when adding contacts
Why is it important to check your privacy settings on social media?
To make your profile look attractive
To control who sees your updates
To increase the number of followers
To automatically delete old posts
What can happen if you post status updates carelessly on social media?
You will get more likes
You may lose your job
Your account will be deleted
You will receive free gifts
Which information can social networks reveal through your online content?
Your favorite color
Your location via GPS or photo data
Your password
Your bank account number
Why should you always get consent before posting photos or videos of others online?
To avoid copyright issues
To respect their privacy
To increase your followers
To make your posts more popular
What is a safer way to communicate using instant chats?
Use built-in chat features
Use encrypted apps
Share your password
Post your messages publicly
How can joining or creating online groups put you at risk?
It makes you popular
It reveals your interests and beliefs
It increases your followers
It improves your computer security
A worker lost their job because of a post about their employer. What does this example illustrate about social media use?
Social media posts are always private
Posts can be used against you
Employers do not monitor social media
Status updates are harmless
If you want to share a photo online, what should you do to protect the privacy of others?
Post it without asking anyone
Always get consent from the people in the photo
Edit the photo to remove everyone
Only share it with your close friends
Why might governments monitor your social media posts?
To help you gain followers
If your posts go against their stance
To give you job opportunities
To send you advertisements
How can photos and videos shared online reveal hidden details?
They only show what is visible
They can reveal time, place, and camera info
They erase all metadata automatically
They are always anonymous
What is a potential risk of joining political or sensitive groups online?
You will get free merchandise
You may be put at risk due to your association
You will receive more friend requests
Your account will be upgraded
Why is it recommended to use encrypted apps for instant chats instead of built-in chat features?
Encrypted apps are easier to use
Built-in chat features are often insecure and easy to trace, while encrypted apps provide safer communication
Encrypted apps are more popular
Built-in chat features have better graphics
Not checking location settings on photos could lead to which privacy issue?
Your photo will look blurry
Your exact location could be revealed to strangers, putting you at risk
Your friends will not see your photo
Your phone will run out of battery
One risk of others assuming you agree with everything a group stands for when you join an online community is:
It can lead to misunderstandings and may put you at risk if the group is political or sensitive
It will make you more popular
It will increase your job opportunities
It will improve your computer security
Which of the following is considered "Illegal Access" under cybercrime law?
Accessing a computer without permission
Accessing a computer with permission
Creating a backup of your own data
Using a computer for gaming
What is the penalty range for "Hacking/Data Crimes" according to the cybercrime law?
6–12 years or fine ₱200k+
1–6 months or fine ₱50k+
20–40 years or fine ₱1M+
12–20 years or fine ₱500k+
Which act involves secretly listening or recording private data transmissions?
Illegal Interception
Data Interference
System Interference
Forgery
If a crime is committed using technology, how does the penalty change?
Punishment is heavier
Punishment is lighter
No change in punishment
Punishment is removed
Which of the following is NOT a computer-related offense under cybercrime law?
Libel
Forgery
Fraud
Identity Theft
A company can be fined up to how much if crimes are committed on their behalf?
₱10M
₱1M
₱500k
₱250k
What is the main purpose of the State in recognizing the role of ICT in national development?
To create an environment for safe ICT use and protect systems, networks, and data
To ban the use of computers in business
To encourage illegal access to data
To promote only entertainment uses of ICT
Which offense involves registering a domain name in bad faith to profit, mislead, or damage others?
Cyber-squatting
Identity Theft
Libel
Forgery
What must service providers do according to Sec. 13 of the cybercrime law?
Preserve data for 6 months (extendable)
Delete all user data immediately
Share data without a court order
Encrypt all data transmissions
Which of the following is an example of a content-related offense?
Cybersex
Illegal Interception
System Interference
Forgery
Why is aiding or abetting someone in committing cybercrime punishable?
Because even helping or attempting cybercrime is illegal
Because only the main offender is punished
Because it is not considered a crime
Because it is allowed under cybercrime law
Which of the following requires a court order according to Sec. 12 of the cybercrime law?
Accessing data content
Accessing traffic data (origin, time, size)
Accessing public websites
Accessing social media profiles
According to Sec. 17, what must happen to data after the case or period ends?
Data must be archived for future reference.
Data must be destroyed.
Data must be published online.
Data must be transferred to another agency.
What is the consequence for evidence collected without a warrant, as stated in Sec. 18?
It is admissible in court.
It is considered valid.
It is inadmissible.
It is automatically destroyed.
Which government agency may block illegal content or sites according to Sec. 19?
Department of Education (DepEd)
Department of Justice (DOJ)
Department of Health (DOH)
Department of Finance (DOF)
What is the penalty for non-compliance as stated in Sec. 20?
1 month imprisonment or ₱10k fine
6 months–6 years imprisonment or ₱100k fine
10 years imprisonment or ₱1M fine
No penalty
Law enforcers can collect, preserve, and analyze data, but what must they follow to ensure evidence is valid?
Their own procedures
Court orders
Public opinion
Media guidelines
What is the yearly budget allocated for implementation according to Sec. 27?
₱10M
₱100M
₱50M
₱1M
Which agencies are responsible for making implementing rules within 90 days as per Sec. 28?
DOJ, DOST-ICTO, DILG
DOH, DepEd, DOF
DTI, DA, DENR
NBI, PNP, AFP
(DoK Level 2) Why is it important for law enforcers to follow court orders when collecting, preserving, and analyzing data?
To ensure evidence is legal and valid in court
To speed up investigations
To avoid paperwork
To increase public awareness
(DoK Level 2) How does the allocation of a yearly budget (Sec. 27) contribute to the proper implementation of the law?
It allows for regular training of law enforcers
It ensures there are sufficient resources for enforcement
It increases the number of cases prosecuted
It reduces the need for government oversight
(DoK Level 3) If the DOJ fails to block illegal content/sites as stated in Sec. 19, what potential risks could arise for computer security and information assurance?
Increased access to illegal content and cyber threats
Improved internet speed
Reduced government spending
Enhanced privacy for users
(DoK Level 3) Imagine a scenario where evidence is collected without a warrant and used in court. What could be the legal and ethical implications based on Sec. 18?
The evidence would be inadmissible, potentially leading to dismissal of the case and violation of rights
The evidence would strengthen the prosecution’s case
The evidence would be ignored by the judge
The evidence would be used for public awareness campaigns
Which Republic Act is known as the Data Privacy Act of 2012 in the Philippines?
Republic Act No. 10173
Republic Act No. 9003
Republic Act No. 9165
Republic Act No. 8792
According to the Data Privacy Act, what is the main reason the state protects privacy and communication?
To ensure free flow of information and promote innovation and growth
To restrict access to information
To encourage data breaches
To eliminate communication between citizens
Which of the following is NOT a general data privacy principle under the Data Privacy Act?
Data must be kept longer than needed
Data must be collected for a clear purpose
Data must be processed fairly and lawfully
Data must be accurate and updated
Under what condition can journalists be forced to reveal confidential sources according to the Data Privacy Act?
They cannot be forced to reveal confidential sources
If the government requests it
If the information is about public safety
If the source is a criminal
Which of the following is a criterion for lawful processing of personal data?
With consent
Without any reason
Only for entertainment
For personal curiosity
If a company outsources data processing, who is responsible for ensuring safeguards?
The main controller
The subcontractor only
The government
The data subject
Which right allows you to correct errors in your personal data?
Rights of the Data Subject
Right to Data Portability
Non-Applicability
Security Measures
What can heirs do after the data subject’s death or incapacity according to the Data Privacy Act?
Invoke rights over the data
Delete all data immediately
Sell the data to third parties
Ignore the data
Which section of the Data Privacy Act allows you to get a copy of your data in electronic format for reuse?
Right to Data Portability
Security Measures
Subcontracting Personal Information
Protection for Journalists
Rights under the Data Privacy Act do NOT apply if data is used only for which of the following?
Research or investigations
Commercial purposes
Marketing
Social media sharing
What is one organizational safeguard that companies must implement to protect personal information?
Have a security policy
Ignore breaches
Share passwords
Allow unauthorized access
If a breach happens, what must companies do according to the Data Privacy Act?
Notify the Commission and affected people
Hide the breach from everyone
Delete all data immediately
Ignore the incident
A company stores personal data longer than necessary. Which principle of the Data Privacy Act is being violated?
Data should be kept only as long as needed
Data should be processed fairly
Data should be accurate
Data should be stored in a way that protects identity
Why is it important for data controllers to monitor for breaches?
To detect unauthorized access and prevent misuse
To allow more data leaks
To avoid following the law
To increase data collection
How does the Data Privacy Act protect journalists and their sources?
Journalists are protected and do not have to reveal their news sources
Journalists must always reveal their sources
Journalists can only protect sources in criminal cases
Journalists are not mentioned in the Act
Which of the following is a responsibility of controllers under the Accountability Principle in computer security?
They must ensure all employees have encryption software.
They are responsible for all personal data under them, even if outsourced.
They must dispose of data every year.
They are required to create new data protection laws.
What is required for whoever collects data according to the Accountability Principle?
Must have a data protection officer (DPO).
Must encrypt all data immediately.
Must share data with contractors.
Must delete data after one year.
Which of the following is NOT a requirement for government handling of sensitive data?
Employees need clearance for access.
Only 1,000 records can be accessed at a time for off-site use.
Off-site access must use encryption.
All data must be made public.
Why must government agencies apply strict security, clearance, and encryption rules to contractors?
To ensure contractors can access all data freely.
To maintain the same level of data protection as within the agency.
To allow contractors to bypass security protocols.
To reduce the cost of data management.
What is the penalty for unauthorized processing of sensitive data?
1–3 years imprisonment + ₱500k–₱2M fine
3–6 years imprisonment + ₱500k–₱4M fine
6 months–2 years imprisonment + ₱100k–₱500k fine
1–5 years imprisonment + ₱500k–₱1M fine
Which act carries a higher penalty if the data involved is sensitive?
Negligent access
Unauthorized purpose use
Improper disposal
All of the above
If a public official is found guilty of a crime under these provisions, what is one possible consequence?
They are promoted to a higher office.
They are disqualified from office if guilty.
They receive a bonus.
They are given more data access.
What happens if a crime affects more than 100 people?
The penalty is reduced.
The maximum penalty is applied.
The crime is ignored.
Only a warning is given.
Strategic Thinking: What penalties might apply if a contractor fails to comply with government data protection standards and unauthorized access occurs, and why would the punishment be heavier if sensitive data is involved?
Penalties could include fines and imprisonment, with heavier punishment for sensitive data due to increased risk and impact.
Only a warning would be issued, regardless of data sensitivity.
The contractor would be promoted for honesty.
No penalties would apply if the contractor was unaware of the rules.
Skill/Concept: Why is encryption required for off-site access to government data?
To make data easier to share with the public.
To protect sensitive information from unauthorized access.
To reduce the cost of data storage.
To allow employees to access data without clearance.
What is the first step in creating an information security policy?
Conducting a penetration test
Setting a budget
Creating an organization
Information gathering
Which of the following is NOT typically collected during information gathering from other countries?
Security organizations and their operations
Policies, laws, and regulations
International methodologies and best practices
Personal financial records
