Which three properties form the classic CIA triad in information security?
Security Concepts
Question · Easy
The 3-2-1 backup rule
Short
Which CIA property is most directly violated when an attacker silently modifies a database record without authorization?
Which threat actor type is best described as a highly resourced, often state-sponsored group that maintains long-term covert access to a target network?
Tech Exam Prep Podcast
Listen on Spotify
Podcast
What does CVE stand for in the context of vulnerability tracking?
What term describes a security flaw that is actively being exploited before the vendor releases a patch?
Which activity is the primary purpose of penetration testing?
Which group is typically convened to coordinate response to a major security incident across an organization or sector?
What practice describes a researcher privately reporting a vulnerability to the vendor and waiting an agreed period before public disclosure?
Question · Medium
Which legal area most directly governs unauthorized access to a computer system?
Which security goal ensures that a sender cannot later deny having sent a signed message?
An attacker exploits a flaw to move from a normal user account to root. Which technique class is this?
Which statement BEST describes a bug bounty program?
Which property distinguishes symmetric encryption from asymmetric encryption?
Encryption
Which algorithm is the modern standard for symmetric block encryption?
Which two algorithms are common asymmetric (public-key) cryptosystems?
Which protocol is specifically designed to securely establish a shared symmetric key over an insecure channel without ever sending the key?
What property does Perfect Forward Secrecy (PFS) provide to a TLS session?
Which hash function should NOT be used for new security work because practical collisions have been demonstrated?
Which output length does SHA-256 produce?
Which trust anchor is a browser ultimately relying on when it shows a padlock for an HTTPS site?
Which X.509 certificate field lists alternative DNS names a certificate is valid for, allowing one cert to cover multiple hostnames?
Which free, automated CA issues short-lived domain-validated TLS certificates via the ACME protocol?
A browser shows a 'NET::ERR_CERT_DATE_INVALID' warning. Which is the most likely cause?
Which standard is widely used for end-to-end encryption and signing of email between mail clients?
Which command-line tool is the standard implementation of OpenPGP on Linux and is used to encrypt files and sign messages?
Which statement about full-disk encryption is correct?
Which Linux subsystem is the standard for full-disk and partition encryption?
Which open-source tool is commonly used to create encrypted file containers across Windows, macOS, and Linux?
Which open-source tool encrypts files specifically for cloud-storage providers like Dropbox or OneDrive on a per-file basis?
Which protocol provides authenticated, encrypted transport for HTTP and is the basis of the HTTPS scheme?
Which version of TLS is the current modern standard, mandates Perfect Forward Secrecy, and removed obsolete ciphers like RC4 and 3DES?
Which OpenSSL command displays the certificate presented by a remote HTTPS server on port 443?
Which key length is the current minimum recommended size for new RSA keys in TLS certificates?
An attacker performs a real-time MITM and presents their own certificate signed by a CA the user does NOT trust. What does a properly configured browser do?
Question · Hard
Which feature of OpenPGP/GPG keys lets a user recover access if their primary key is lost or compromised?
Which class of devices typically falls under the 'Internet of Things (IoT)' label?
Node Device Storage Security
Which short-range wireless technology is commonly used for contactless cards, transit passes, and access badges?
Which standard hardware component stores cryptographic keys, performs measured boot, and is leveraged by BitLocker for transparent disk unlock?
Which physical attack risk is associated with leaving a USB port unattended in a public area?
Which practice MOST reduces the risk of installing malicious software through software updates?
Which class of bug occurs when a program writes more data into a buffer than it can hold, potentially overwriting adjacent memory?
Which attack exploits an application that builds database queries by concatenating untrusted user input into SQL strings?
Which Linux user-space tool provides a simple interface for managing iptables/nftables-based packet filtering on Ubuntu and Debian?
Which malware type self-replicates across networks without requiring user interaction or a host file?
Which malware type encrypts the victim's files and demands payment, typically in cryptocurrency, for the decryption key?
Which malware family modifies the operating system kernel or low-level components to hide its presence from standard tools?
Loading more…