What is the main purpose of a password?

Which is an example of malware?

When a computer becomes very slow because a program is copying itself repeatedly, this is likely caused by a:

What does encryption do?

Which of the following is a good security practice?

Which device is used to verify a fingerprint?

Which attack tries to overload a website so it becomes unavailable?

What is the main purpose of a firewall?

Social engineering mainly targets:

What is an example of personal data?

Cookies on a website are used to:

Unauthorized access means:

Which action helps protect your privacy online?

If your files suddenly become encrypted and you are asked to pay money, this is:

Information ethics mainly deals with:

A backup is used when:

Which is a safe behaviour online?

A digital certificate is used to:

Which of the following is a security threat?

Carpal Tunnel Syndrome is related to:

Which of the following is a privacy concern?

What is the first thing you should do when receiving a suspicious message?

Why do companies use access control?

What is an example of ethical behaviour in IT?

A password like “12345” is considered:

Which action helps avoid malware?

Why is two-factor authentication safer?

Which is an example of information theft?

What is the main goal of cybersecurity?

An organization implements an advanced firewall and intrusion detection system, yet attackers still manage to access sensitive files by obtaining the login details of a long-time employee through subtle psychological manipulation. Which statement BEST explains the deeper systemic vulnerability?

An IT department notices that despite strong security tools, employees continue to ignore software update notifications, increasing vulnerability windows. Which concept BEST describes this behavioural risk?

A company encrypts all stored data using strong cryptographic algorithms, yet attackers still manage to read the data by exploiting a memory dump after a program crash. Which theoretical security limitation does this illustrate?

Two organizations adopt identical antivirus software. One suffers frequent malware outbreaks, while the other experiences almost none. Both have similar hardware. Which factor MOST likely explains the difference?

A multinational company creates a privacy policy but provides it only in English, leaving non-English speaking workers unaware of its conditions. Which ethical problem arises?

An employee discovers a flaw allowing access to confidential data but does not report it, believing “no harm was done.” Which ethical framework does the employee violate MOST?

An organization uses a rule requiring employees to “handle all personal data minimally.” Which principle is being enforced?

A company redesigns its security architecture to assume everyone, including internal employees, is a potential threat. Which model is being adopted?

A CEO demands full monitoring of all employees’ digital activity “to maximize productivity,” but employees express strong discomfort, citing privacy concerns. What fundamental ethical tension arises?

A company refuses to update its Acceptable Use Policy despite new security threats emerging. Which issue does this create over time?

Remote employees frequently access corporate systems through personal devices. What theoretical risk does this environment exemplify?

A machine-learning fraud detection system locks valid users out during peak hours. The company argues, “false positives are acceptable for high security.” Which ethical concern is raised?

During an audit, it was found that only administrators understand how logs are generated and stored, making fraud detection difficult for the rest of the team. Which issue does this represent?

An organization encrypts all data, trains employees thoroughly, installs firewalls, and monitors internal behaviour, yet still suffers data leakage through screenshots taken on phones. What security reality does this illustrate?

A privacy officer argues that “data collection should always match the purpose it was gathered for.” Which privacy framework supports this argument?

An IT director insists on using extremely long, complex passwords without implementing password managers. Staff begin storing passwords on paper. Which unintended risk is introduced?

A company provides cybersecurity awareness training once a year. Research indicates most employees forget key information within weeks. Which theoretical weakness does this show?

Two-factor authentication is implemented across an organization. However, attackers still gain access using compromised session tokens. Which vulnerability does this highlight?

A critical server stores logs but overwrites old entries every 24 hours due to storage limitations. How does this undermine security?

Employees become overly reliant on biometric authentication and stop creating strong passwords. Which security risk emerges?

The board of directors requests minimal encryption to maintain performance levels. The security team disagrees, warning this may violate laws protecting user data. Which principle is in conflict?

A malware variant disables antivirus services before executing its payload. Which defence principle was MOST critically compromised?

A phishing campaign targets employees with personalized details collected from social media. Which concept explains why the attack is convincing?

A system restricts employees to viewing data relevant only to their tasks, preventing curiosity-driven browsing of confidential records. What key security idea does this follow?

A cybersecurity officer states that “every breach is also a failure of organizational culture.” What does this imply theoretically?

A company automates encryption but leaves key management to manual processes handled by one employee. What major risk exists?

A privacy assessment finds that a company collects more data than needed “just in case it becomes useful later.” Which theoretical risk does this create?

A cyberattack exploits the fact that users often click quickly without thinking. Which psychological factor is MOST relevant?

An organization depends heavily on automated monitoring but rarely verifies alerts manually. What vulnerability does this create?

A data center practices disaster recovery by running simulations without informing employees beforehand. What important benefit does this provide?

An organization implements an advanced firewall and intrusion detection system, yet attackers still manage to access sensitive files by obtaining the login details of a long-time employee through subtle psychological manipulation. Which statement BEST explains the deeper systemic vulnerability?

An IT department notices that despite strong security tools, employees continue to ignore software update notifications, increasing vulnerability windows. Which concept BEST describes this behavioural risk?

A company encrypts all stored data using strong cryptographic algorithms, yet attackers still manage to read the data by exploiting a memory dump after a program crash. Which theoretical security limitation does this illustrate?

Two organizations adopt identical antivirus software. One suffers frequent malware outbreaks, while the other experiences almost none. Both have similar hardware. Which factor MOST likely explains the difference?

A multinational company creates a privacy policy but provides it only in English, leaving non-English speaking workers unaware of its conditions. Which ethical problem arises?

An employee discovers a flaw allowing access to confidential data but does not report it, believing “no harm was done.” Which ethical framework does the employee violate MOST?

An organization uses a rule requiring employees to “handle all personal data minimally.” Which principle is being enforced?

A company redesigns its security architecture to assume everyone, including internal employees, is a potential threat. Which model is being adopted?

A CEO demands full monitoring of all employees’ digital activity “to maximize productivity,” but employees express strong discomfort, citing privacy concerns. What fundamental ethical tension arises?

A company refuses to update its Acceptable Use Policy despite new security threats emerging. Which issue does this create over time?

Remote employees frequently access corporate systems through personal devices. What theoretical risk does this environment exemplify?

A machine-learning fraud detection system locks valid users out during peak hours. The company argues, “false positives are acceptable for high security.” Which ethical concern is raised?

During an audit, it was found that only administrators understand how logs are generated and stored, making fraud detection difficult for the rest of the team. Which issue does this represent?

An organization encrypts all data, trains employees thoroughly, installs firewalls, and monitors internal behaviour, yet still suffers data leakage through screenshots taken on phones. What security reality does this illustrate?

A privacy officer argues that “data collection should always match the purpose it was gathered for.” Which privacy framework supports this argument?

A IT director insists on using extremely long, complex passwords without implementing password managers. Staff begin storing passwords on paper. Which unintended risk is introduced?

A company provides cybersecurity awareness training once a year. Research indicates most employees forget key information within weeks. Which theoretical weakness does this show?

Two-factor authentication is implemented across an organization. However, attackers still gain access using compromised session tokens. Which vulnerability does this highlight?

A critical server stores logs but overwrites old entries every 24 hours due to storage limitations. How does this undermine security?

Employees become overly reliant on biometric authentication and stop creating strong passwords. Which security risk emerges?

The board of directors requests minimal encryption to maintain performance levels. The security team disagrees, warning this may violate laws protecting user data. Which principle is in conflict?

A malware variant disables antivirus services before executing its payload. Which defence principle was MOST critically compromised?

A phishing campaign targets employees with personalized details collected from social media. Which concept explains why the attack is convincing?

A system restricts employees to viewing data relevant only to their tasks, preventing curiosity-driven browsing of confidential records. What key security idea does this follow?

A cybersecurity officer states that “every breach is also a failure of organizational culture.” What does this imply theoretically?

A company automates encryption but leaves key management to manual processes handled by one employee. What major risk exists?

A privacy assessment finds that a company collects more data than needed “just in case it becomes useful later.” Which theoretical risk does this create?

A cyberattack exploits the fact that users often click quickly without thinking. Which psychological factor is MOST relevant?

An organization depends heavily on automated monitoring but rarely verifies alerts manually. What vulnerability does this create?

A data center practices disaster recovery by running simulations without informing employees beforehand. What important benefit does this provide?