An administrator notices thousands of requests per second hitting the school’s website, slowing it to a crawl. Which attack is likely happening?

A forensic investigator needs to ensure evidence collected from a laptop is admissible in court. What should they do first?

A student configures a router and needs to prevent unauthorized outside traffic from reaching internal services. What should they use?

A teacher complains that their password was stolen even though they never shared it. The logs show suspicious keystrokes were recorded. What malware is responsible?

During a network investigation, you find that packets are being intercepted between a user and a website. What type of attack is this?

The school introduces fingerprint scanners for computer lab entry. What authentication factor does this represent?

A user wants to secure their home Wi-Fi. Which setting should they enable?

After a cyberattack, an investigator must verify no data has been tampered with. Which cryptographic tool helps verify file integrity?

A company wants to block certain IP ranges from accessing the network. What should the security team implement?

A student exploring network cables accidentally unplugs one device and the whole network collapses. Which device was most likely disconnected?

During an investigation, logs show repeated failed login attempts over 5 minutes. What attack is occurring?

A hacker controls thousands of infected computers and uses them to attack a target. What is this network of systems called?

You notice the school servers have not been updated for 2 years. Which risk is most likely increased?

A security engineer wants to ensure only administrators can change system settings. What principle applies?

A forensic examiner must avoid altering timestamps on a seized phone. What should they do?

You discover that a coworker uses “School123” as their password for every website. What is the issue?

A school wants internet filtering and malware blocking for all student devices. Which device helps most?

An attacker modifies DNS settings so traffic is redirected to a fake banking site. What is this attack?

A student connects to public Wi‑Fi without encryption. What risk increases?

A system requires a password and a facial scan to log in. Which concept does this represent?

A laptop is infected with ransomware. What is the FIRST action the security team should take?

After reviewing logs, a forensic analyst notices unexpected outbound traffic from a server to unknown IP addresses. What might this indicate?

Students report slow internet. The network engineer runs “ping” and gets long response times. What is being tested?

A user tries to access a restricted folder and gets denied even with correct credentials. What is most likely misconfigured?

A school wants to prevent students from installing unauthorized software. Which method helps most?

A website uses HTTPS instead of HTTP. What benefit does this provide?

The cybersecurity team wants to ensure all user activity is recorded. What should they enable?

A file found on a suspect's computer has a hash value that does not match the original. What does this indicate?

A student notices a Wi‑Fi network named “Free_School_WiFi” which requires no password. What should they suspect?

The IT department wants to reduce the attack surface on Windows machines. Which action helps most?

An examiner must ensure chain of custody is preserved. What must they document?

A server is receiving packets from an IP address that does not exist. What attack might this be?

To secure a Linux server, an admin must limit who can execute certain scripts. What command helps with permissions?

During forensics, you must recover deleted files on a Windows drive. Which tool category is needed?

A student sees unexpected Bluetooth connections popping up on their phone. What attack may be happening?

The school blocks social media during class hours. What type of control is this?

A suspicious USB is found near the staff parking lot. What should the IT team do?

A cyber risk assessment identifies that outdated switches could fail under heavy traffic, causing downtime. What is this an example of?

A student is sending harmful code disguised as homework attachments. What attack technique is being used?

You find that an attacker gained access because a default router password was never changed. Which concept failed?

While analyzing a drive, an investigator spots time gaps in the logs. What might this indicate?

The school wants to restrict who can access specific Wi-Fi networks. What should they implement?

After a breach, an investigator isolates the affected machine but wants to monitor ongoing malicious traffic safely. What should they use?

A student shares their account login with a friend. What security principle is violated?

An attacker physically enters the server room by following someone through a restricted door. What attack is this?

A forensic examiner calculates a hash before and after imaging a drive. The values match. What does this confirm?

A cybersecurity analyst wants to monitor live network threats and alerts on a dashboard. Which system is needed?