NEW
Font size
WorksheetsSC Quiz
Total questions: 40
Worksheet time: 20mins
OWASP Top 10 primarily lists:
Network vulnerabilities
Most critical web application security risks
Operating system flaws
Cryptographic weaknesses
Cross Site Scripting (XSS) mainly allows an attacker to:
Modify database schema
Execute client-side scripts in victim browsers
Bypass firewall rules
Perform buffer overflow
Injection vulnerabilities generally occur due to:
Weak encryption
Improper input validation
Poor session management
Missing TLS
Which HTTP method is most commonly abused for data modification attacks?
GET
HEAD
POST
OPTIONS
SAST tools are primarily used to:
Test running applications
Analyze source code without execution
Scan networks
Capture traffic
DAST tools differ from SAST because they:
Require source code
Test applications in runtime
Perform manual testing only
Focus on database security
Burp Suite is mainly used for:
Malware analysis
Web application security testing
Network routing
Password hashing
Threat risk modelling helps organizations to:
Eliminate all threats
Prioritize risks and controls
Encrypt applications
Patch operating systems
Denial of Service (DoS) attacks primarily affect:
Confidentiality
Integrity
Availability
Authentication
Buffer overflow vulnerabilities are mainly caused by:
Improper memory handling
Weak passwords
Poor encryption
Missing certificates
(Scenario) During testing, user input is directly concatenated into an SQL query. What vulnerability is most likely present?
XSS
SQL Injection
CSRF
DoS
(Scenario) A developer uses only client-side validation for form inputs. What is the primary security concern?
Increased latency
Bypass of validation controls
Poor UI design
Encryption failure
The human side of information security mainly focuses on:
Cryptography
User behavior and awareness
Firewall configuration
Malware analysis
Ethical hacking is best defined as:
Illegal system exploitation
Authorized security testing
Social engineering only
Malware development
(Scenario) An organization performs penetration testing without written permission. What is the legal implication?
No impact
Violation of cyber law
Improved compliance
Reduced risk
The first phase of ethical hacking methodology is:
Exploitation
Reconnaissance
Maintaining access
Reporting
Footprinting mainly aims to:
Launch attacks
Gather target information
Exploit vulnerabilities
Crack passwords
(Scenario) An attacker uses Google advanced queries to find exposed admin pages. This technique is known as:
Port scanning
Google Dorking
Banner grabbing
Enumeration
SYN scan is also referred to as:
Full connect scan
Half-open scan
XMAS scan
FIN scan
Banner grabbing helps attackers to identify:
Encryption keys
Operating systems and services
User passwords
Network topology
Enumeration is the process of:
Gaining initial access
Extracting detailed system information
Launching DoS attacks
Installing malware
(Scenario) A tester captures ARP packets and modifies MAC-IP mappings. Which attack is being performed?
DNS spoofing
ARP poisoning
IP fragmentation
MAC filtering
Password cracking using previously leaked hashes is classified as:
Online active attack
Offline attack
Passive sniffing
Social engineering
Trojans differ from viruses because trojans:
Self-replicate
Disguise as legitimate software
Require host files
Cannot create backdoors
(Scenario) A system shows unexpected outbound connections to unknown IPs after software installation. What is the most likely issue?
Worm infection
Trojan backdoor
Buffer overflow
DNS misconfiguration
Botnets are primarily used to:
Improve routing
Launch large-scale attacks
Encrypt communications
Detect intrusions
Session hijacking mainly targets:
Encryption algorithms
Active user sessions
Password databases
DNS records
WEP is considered insecure mainly due to:
Short IV reuse
Strong encryption
Certificate usage
Multi-factor authentication
(Scenario) A tester captures wireless traffic and cracks WPA using a handshake file. What prerequisite made this possible?
Weak signal strength
Weak passphrase
MAC filtering enabled
Hidden SSID
IDS systems are primarily used to:
Block traffic
Detect malicious activities
Encrypt data
Authenticate users
Honeypots are deployed to:
Replace firewalls
Lure and study attackers
Encrypt traffic
Improve availability
Physical security controls mainly protect against:
Software bugs
Unauthorized physical access
Network sniffing
Data leakage
(Scenario) An attacker gains access by following a person into a secure area without authentication. This is known as:
Shoulder surfing
Tailgating
Dumpster diving
Phishing
Android security model is primarily based on:
Shared user IDs
Application sandboxing
Root privileges
MAC filtering
Android Debug Bridge (ADB) is mainly used for:
Network scanning
Debugging and device communication
Malware encryption
Traffic sniffing
(Scenario) A rooted Android device allows apps unrestricted access. What security control is bypassed?
Encryption
Sandbox isolation
TLS
Code signing
OWASP Top 10 Mobile highlights risks related to:
Desktop applications
Mobile application vulnerabilities
Network routing
Cryptographic standards
Mobile malware primarily spreads through:
Secure app stores only
Malicious apps and links
Hardware defects
Firmware updates
(Scenario) An Android app stores sensitive data in plain text on external storage. Which vulnerability does this represent?
Insecure data storage
Code obfuscation
Root detection
Secure communication
Social engineering attacks primarily exploit:
Cryptographic flaws
Human trust and behavior
Network vulnerabilities
Software bugs
