An attacker exploits a previously unknown vulnerability in a company’s VPN system before the vendor releases any patch. The attack spreads silently and installs backdoors across multiple servers. This attack best describes:

A finance company’s website suddenly displays political messages protesting government policies. No data is stolen, but the attack damages public trust. The attackers are MOST likely:

Employees receive a phone call from someone claiming to be from IT support, asking them to reset their passwords urgently due to a “security breach.” This is an example of:

An organization detects malware that constantly changes its code structure while keeping the same malicious behavior, making signature-based detection ineffective. This malware is classified as:

A university’s research data is encrypted, and attackers demand payment in cryptocurrency. The data is still intact but inaccessible. Which CIA element is MOST affected?

A malicious program disguises itself as a free productivity tool. Once installed, it opens a hidden backdoor for attackers. This malware is a:

A government agency discovers that sensitive files were completely erased with no possibility of recovery after a cyberattack. This attack most likely involved:

A system becomes part of a botnet and begins communicating with an external server to receive instructions for future attacks. Which stage of the cyber attack lifecycle is this?

After rebooting an infected system, the malware automatically reappears without user interaction. Which attack phase does this demonstrate?

A company deploys a system that monitors network traffic and alerts administrators when suspicious activity is detected, but it does not block traffic automatically. This system is a:

Another system actively blocks malicious traffic in real time without human intervention. This is an example of:

An attacker sends an email pretending to be HR, offering a “salary bonus” if the employee provides login credentials. This attack method is:

A cybercriminal offers free “technical support” in exchange for system access. This is best described as:

A company encrypts customer data so that even if attackers steal it, they cannot read the contents. This primarily protects:

Penetration testing differs because it:

A UK business adopts a government-backed framework to improve baseline cybersecurity hygiene. This framework is likely:

The main goal of the Cyber Essentials Scheme is to:

A company assigns one executive full responsibility for cybersecurity decisions and accountability. This is known as:

A policy that requires employees to follow documented procedures instead of trusting verbal instructions demonstrates:

An attacker gains normal user access, then exploits system flaws to gain admin rights. This is called:

To reduce privilege escalation risks, organizations should apply:

A company detects suspicious behavior because system logs recorded abnormal login times. Logging primarily supports:

Monitoring network traffic continuously improves:

An Incident Response Policy defines:

The main purpose of an Incident Response Plan is to:

A company ensures essential services continue operating during a cyberattack. This is part of:

Restoring systems after a ransomware attack is mainly covered by:

An attacker uses automated tools downloaded from the internet with little understanding of how they work. This attacker is likely a:

A highly funded group silently targets government infrastructure for months. This describes:

A multinational company discovers that attackers accessed confidential financial data through a misconfigured cloud storage service. The data was copied but not altered or deleted. The system remained operational throughout the incident. Which security objective failed most directly?

An attacker exploits an unknown flaw in a VPN appliance, installs hidden backdoors, and maintains access for months without detection. No ransom is demanded, and no data is immediately stolen. This attack is best described as:

A company receives a phone call from someone claiming to be a regulator. The caller threatens legal action unless sensitive compliance documents are emailed immediately. This attack combines:

After a ransomware attack, encrypted files remain intact but inaccessible. Backups were not properly tested, and restoration fails. Which principle is MOST critically impacted in practice?

A malware sample changes its binary signature every time it spreads, while performing the same malicious actions. Traditional antivirus fails to detect it. This behavior indicates:

An attacker sends a fake "security update" that installs spyware. The file looks legitimate and requires user installation. Which malware category applies?

A system becomes part of a botnet and starts receiving encrypted instructions from a remote server. Which stage of the cyber attack lifecycle is this?

A hospital’s systems reboot after patching, but malicious software automatically reinstalls itself without user action. This indicates:

An IDS alerts security staff about unusual traffic but does not stop the attack. A separate system blocks malicious packets in real time. Which statement is correct?

A company encrypts customer data before storing it in the cloud. Attackers later steal the encrypted files. Which security goal was successfully maintained?

A vulnerability assessment report lists weaknesses but does not exploit them. A penetration test actively attacks those weaknesses. Which statement MOST accurate?

A UK-based SME adopts a government-backed framework to meet baseline cybersecurity requirements. Which framework is this?

An organization assigns a single executive full responsibility for cybersecurity decisions and accountability. This approach is known as:

An employee follows a documented verification process instead of trusting a verbal request for sensitive data. This demonstrates:

An attacker gains user access and then exploits system flaws to gain administrator privileges. This is an example of:

A company limits users to only the access required for their job roles. Which principle is being applied?

System logs reveal repeated failed login attempts at unusual hours, helping detect an intrusion. Logging primarily supports:

Continuous network monitoring improves:

An Incident Response Policy outlines roles, communication plans, and recovery steps during cyber incidents. Its main purpose is to:

A company ensures essential services continue operating during a cyberattack. This is part of:

Restoring systems after ransomware is mainly covered by:

A highly funded group silently targets government systems for long-term espionage. This describes:

A worm spreads across a network without user interaction. Its defining characteristic is:

A rootkit is dangerous mainly because it:

A DDoS attack primarily affects:

Website defacement mainly impacts:

Data leakage without modification affects:

Which protocol ensures secure web communication?

HTTPS security relies on:

Which protocol prioritizes speed over reliability?

Which protocol is mainly used for Windows file sharing?

The OSI model has:

Encryption mainly occurs at the:

An attacker deletes system logs to hide evidence. This primarily affects:

An employee clicks a malicious attachment that installs malware. This stage is:

Malware contacting a remote server for instructions is:

A fake software update installs spyware. This is:

An attacker convinces a receptionist to let them into a secure building. This is:

Which control category includes firewalls and antivirus?

Security policies fall under:

Incident response steps are:

Data protection laws are:

What is a zero-day exploit?

What is stuxnet?

What is the command to get IP Address in Linux System

TCP Full form

What is the primary purpose of data encryption in backups?

Which of the following is NOT a task of the Red Team?

What do biometric authentication systems use to authenticate identity?

What is a brute force attack?

What is a common target for brute force attacks?

What is a rootkit?

Why are rootkits difficult to detect?

Why are rootkits difficult to detect?

Which function in the NIST CSF involves creating a communication plan for cybersecurity incidents?

What is VPN tunneling?

What does a VPN do to prevent ISP tracking?

What can inadvertently cause a Denial of Service attack, as mentioned in the text?

Which method helps ensure network availability during a DDoS attack?