Free Practice Questions for Engineer Information Security

Exam-style questions and explanations by OpenExamPrep.

✓ No registration✓ No credit card

100+ Questions

100% Free

Loading practice questions...

Exam Review

Key Facts: Engineer Information Security Exam

100 items

Official written paper length (5 subjects × 20)

KCA CQ examination specification

150 minutes

Written timing at 30 minutes per subject

KCA CQ Engineer-grade test regulations

40 / 60

Written per-subject floor (과락) and overall average

National Technical Qualifications Act Enforcement Decree

KRW 19,400

Written registration fee on KCA CQ portal

KCA CQ portal fee schedule (checked 2026)

KRW 22,600

Practical registration fee on KCA CQ portal

KCA CQ portal fee schedule (checked 2026)

2 years

Written-pass exemption period from pass announcement

National Technical Qualifications Act Enforcement Decree Article 21

정보보안기사 is South Korea's national technical qualification for information security engineers, administered by KCA on the KCA CQ portal under MSIT. The 2026 written CBT consists of 100 four-option MCQs across 5 subjects (150 minutes) requiring a 40-point subject floor and a 60-point overall average, followed by a 3-hour descriptive practical exam in 정보보안 실무. Official fees are KRW 19,400 written and KRW 22,600 practical on the KCA CQ portal. OpenExamPrep provides independent English MCQ study practice, not an official translation or practical subjective simulation.

Sample Engineer Information Security Practice Questions

Try these sample questions to review concepts for the Engineer Information Security exam. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.

1In Unix and Linux file permission architectures, what is the primary operational effect and security implication when the SetUID (Set User ID, 4000) permission bit is configured on an executable binary file?

A.The process executes with the effective privileges of the file owner rather than the user invoking the binary, creating privilege escalation risks if flawed

B.The process executes directly in kernel space (ring 0), completely bypassing user-space memory protection boundaries

C.The binary can be executed exclusively by members of the file's owning group, denying access to all other unprivileged users

D.The operating system prevents the process from spawning child subprocesses or writing data to standard output

Explanation: When the SetUID bit is set on an executable (e.g., `chmod 4755 /usr/bin/passwd`), any user running the binary executes it with the effective user ID (EUID) of the file's owner (often root). This mechanism is necessary for tasks requiring elevated privileges, but if the binary contains vulnerabilities such as buffer overflows or insecure shell calls, an unprivileged user can exploit it to gain root privileges.

2In modern Linux distributions, what does the identifier prefix `$6$` in the password field of the `/etc/shadow` file signify?

A.The password hash was generated using SHA-512 with a cryptographic salt

B.The account has been locked and deactivated by the system administrator

C.The password was encrypted using legacy single-DES with a 2-character salt

D.The password hash was generated using MD5 with an unseeded digest

Explanation: In standard Linux modular crypt password formats, the field `$id$salt$hash` uses numerical identifiers where `$6$` represents SHA-512 with salt (running 5,000 rounds by default). In contrast, `$1$` represents MD5, `$2a$` or `$2y$` represents Blowfish (bcrypt), and `$5$` represents SHA-256.

3In Linux Pluggable Authentication Modules (PAM) configuration, what is the precise behavior of a module designated with the `required` control flag if its authentication check fails?

A.PAM immediately aborts the authentication process and returns failure without executing any subsequent modules in the stack

B.PAM records the failure but continues executing all remaining modules in the stack before returning an overall failure to the application

C.PAM ignores the failure if at least one subsequent module configured with the `optional` control flag succeeds

D.PAM falls back to local `/etc/passwd` password checking while bypassing all remaining network directory checks

Explanation: Under PAM rules, a module marked `required` must succeed for the overall authentication stack to succeed. However, if it fails, PAM does not terminate execution immediately; it quietly records the failure and continues executing subsequent modules in the stack. This design prevents timing attacks that could reveal which specific verification step failed. If immediate termination on failure is required, the `requisite` flag is used.

4Which Linux system log file records all bad (failed) login attempts and must be inspected using the specialized `lastb` binary reader command?

A./var/log/wtmp

B./var/log/lastlog

C./var/log/btmp

D./var/log/secure

Explanation: The binary file `/var/log/btmp` records all failed login attempts and can only be read using the `lastb` command. By comparison, `/var/log/wtmp` records all historical successful logins, logouts, and system reboots (viewed via `last`), while `/var/log/lastlog` stores the single most recent login timestamp for each user (viewed via `lastlog`).

5How does the Stack Canary (StackGuard) compiler mitigation mechanism detect and prevent stack-based buffer overflow exploitation?

A.It places a pseudo-random integrity value between local stack variables and the saved return address, validating it before function return

B.It marks stack memory pages with the NX/XD bit to prevent injected shellcode from executing within user memory

C.It randomizes the base virtual memory addresses of the stack, heap, and loaded shared libraries at process launch

D.It encrypts function pointers and arguments using hardware AES instructions prior to pushing them onto the stack frame

Explanation: Stack canaries place a small guard value (canary) on the stack frame immediately preceding the saved frame pointer (EBP/RBP) and saved return address (EIP/RIP). When a contiguous buffer overflow occurs, the canary value is overwritten; before returning, the compiler-generated function epilogue verifies the canary against a master reference value and terminates the process immediately if a mismatch is detected.

6In the Windows security architecture, what is the core functional difference between a Discretionary Access Control List (DACL) and a System Access Control List (SACL) within an object's security descriptor?

A.DACL specifies which security principals are granted or denied access permissions, while SACL defines audit logging rules for access attempts

B.DACL applies exclusively to system services and kernel drivers, while SACL governs interactive human user accounts

C.DACL enforces cryptographic file integrity on NTFS volumes, while SACL manages network share permissions over SMB

D.DACL is managed strictly by Active Directory domain controllers, while SACL is evaluated only on local standalone workstations

Explanation: In Windows NT-based operating systems, an object's Security Descriptor contains both a DACL and a SACL. The DACL is controlled by the object owner and contains Access Control Entries (ACEs) that grant or deny specific access rights (read, write, execute) to users or groups. The SACL is controlled by security administrators and contains audit ACEs that instruct the system to record successful or failed access attempts in the Security Event Log.

7In standard Linux cron daemon security administration, how is user access evaluated when both `/etc/cron.allow` and `/etc/cron.deny` exist on the system?

A.Both files are parsed, and `/etc/cron.deny` always takes precedence to deny access if a user appears in both lists

B.Only `/etc/cron.allow` is evaluated; users listed within it are granted access, and `/etc/cron.deny` is completely ignored

C.Only `/etc/cron.deny` is evaluated; any user not explicitly listed within it is automatically permitted to use cron

D.The cron daemon blocks all non-root users from scheduling jobs whenever both files exist concurrently

Explanation: In standard Vixie cron implementations, the access control precedence is strictly hierarchical: if `/etc/cron.allow` exists, only the users explicitly listed in `/etc/cron.allow` are permitted to submit crontab jobs, and `/etc/cron.deny` is completely ignored. Only if `/etc/cron.allow` does not exist does the system consult `/etc/cron.deny`, where unlisted users are allowed.

8A privileged root daemon checks if `/tmp/report.tmp` exists using `access()`, and if absent, creates it using `open("/tmp/report.tmp", O_WRONLY | O_CREAT, 0644)`. How can a local unprivileged attacker exploit this Time-of-Check to Time-of-Use (TOCTOU) race condition?

A.Corrupt the daemon's stack frame by passing an overly long filename string to the `access()` system call

B.Create a symbolic link pointing to `/etc/shadow` named `/tmp/report.tmp` immediately after `access()` completes but before `open()` executes

C.Inject malicious commands into the daemon by overriding the global `LD_PRELOAD` shared library environment variable

D.Send an immediate SIGKILL signal to the daemon to force it to dump cleartext credentials into a public core file

Explanation: The time window between checking the file's status with `access()` and creating it with `open()` is a classic TOCTOU race vulnerability. An attacker can create a symbolic link named `/tmp/report.tmp` pointing to a critical system file like `/etc/shadow` during that window. When the privileged daemon invokes `open()`, it follows the symlink and overwrites the sensitive target with root privileges. Safe code uses atomic flags like `O_CREAT | O_EXCL` or `mkstemp()`.

9An administrator wants to ensure that a Linux security audit log file can only have new records appended, preventing any user—including root—from modifying, truncating, or deleting existing entries. Which command achieves this?

A.chmod 1777 /var/log/audit.log

B.chattr +a /var/log/audit.log

C.chattr +i /var/log/audit.log

D.chmod 0400 /var/log/audit.log

Explanation: The `chattr +a` command sets the append-only attribute on supported Linux filesystems (such as ext4 and xfs). Once applied, files can only be opened for writing in append mode (`O_APPEND`). No process—including the root user—can overwrite, truncate, or unlink the file without first explicitly removing the attribute using `chattr -a`.

10In modern Windows Server operating systems, which Event ID in the Security log specifically identifies a failed user account logon attempt?

A.Event ID 4624

B.Event ID 4625

C.Event ID 4672

D.Event ID 4720

Explanation: In Windows Vista/Server 2008 and later, Event ID 4625 is generated whenever an account logon attempt fails (due to an invalid password, disabled account, account lockout, or logon time restriction). Conversely, Event ID 4624 indicates a successful logon, Event ID 4672 indicates special privileges assigned to a new logon session, and Event ID 4720 records the creation of a new user account.

About the Engineer Information Security Exam

Engineer Information Security (정보보안기사) is South Korea's premier Engineer-grade national technical qualification in cybersecurity and information protection, administered by the Korea Communications Agency (KCA / 한국방송통신전파진흥원) on the KCA CQ portal under the Ministry of Science and ICT (MSIT). The written CBT paper tests candidates across five 20-question subjects: System Security, Network Security, Application Security, Information Security Fundamentals, and Security Management & Regulations. Candidates clearing the written stage undertake a demanding 3-hour descriptive practical examination in working-level cybersecurity practice (정보보안 실무). Note that administration was transferred from KISA to KCA in 2022 onto the KCA CQ portal. The practice bank provided here consists of independent English-language multiple-choice questions designed for study and review; it is not an official translation or practical subjective examination simulation.

Exam sponsor: Korea Communications Agency (KCA / 한국방송통신전파진흥원) / Ministry of Science and ICT. The requirements and fees below concern the certification or admission exam, separate from our free practice resources.

Assessment

Written paper covering 시스템 보안, 네트워크 보안, 어플리케이션 보안, 정보보안 일반, and 정보보안 관리 및 법규 (20 items and 30 minutes each, totaling 150 minutes), followed by a 3-hour written descriptive practical examination in 정보보안 실무. Administration was transferred from KISA to KCA in 2022 on the KCA CQ portal.

Time Limit

150 minutes written; 3 hours practical

Passing Score

Written: 40+ per subject floor and 60 average; practical: 60/100

Exam / Certification Fees

KRW 19,400 written / KRW 22,600 practical (KCA CQ portal (cq.or.kr), 2026)

Exam sponsor website

Fees, eligibility, and exam policies can change. Confirm them with the exam sponsor before applying or paying.

Official sources

KCA CQ Portal (한국방송통신전파진흥원 국가기술자격검정) · Source checked 2026-09-21Official qualifications portal for Engineer Information Security (정보보안기사), covering exam schedules, eligibility review, written CBT booking, and practical registration.
Ministry of Science and ICT (과학기술정보통신부 / MSIT) · Source checked 2026-09-21Supervising government ministry establishing national technical qualification standards and cybersecurity legal frameworks in South Korea.
KISA ISMS-P Certification Portal · Source checked 2026-09-21Official criteria, guidelines, and certification requirements for the Korea Information Security Management System & Personal Information Protection Management System (ISMS-P).
National Law Information Center (국가법령정보센터) · Source checked 2026-09-21Full statutory texts for the Personal Information Protection Act, Information and Communications Network Act, and Infrastructure Protection Act.
National Technical Qualifications Act Enforcement Decree Article 21 · Source checked 2026-09-21Two-year exemption rule from the date of written examination pass announcement.

Our practice resources: topics covered

We aim to reflect publicly available exam outlines and topic information in our study resources. Coverage, format, and difficulty may differ from the actual exam, and we cannot guarantee that every detail is accurate or current. Confirm exam requirements, fees, and policies with the official exam sponsor.

20%

System Security (시스템 보안)

Operating system architecture, OS hardening, Linux and Windows security administration, account and privilege management, access control matrices, system vulnerabilities, malware analysis, and system audit logging.

20%

Network Security (네트워크 보안)

OSI and TCP/IP protocol security, network attack vectors (DoS/DDoS, spoofing, sniffing, scanning), firewalls, IDS/IPS, UTM, VPN (IPsec, SSL/TLS), wireless network security (WPA2/WPA3, 802.1X), and network monitoring.

20%

Application Security (어플리케이션 보안)

OWASP Top 10 vulnerabilities (SQLi, XSS, CSRF, SSRF), secure software development lifecycle (Secure SDLC), database security controls, web server configuration, email security protocols (SPF, DKIM, DMARC, S/MIME, PGP), and electronic commerce security.

20%

Information Security Fundamentals (정보보안 일반)

Information security CIA triad, classical ciphers, symmetric key cryptography (DES, AES, SEED, ARIA), asymmetric cryptography (RSA, ECC, Diffie-Hellman), cryptographic hash functions and MAC, PKI and digital certificates, and access control models (DAC, MAC, RBAC, Bell-LaPadula, Biba).

20%

Security Management and Regulations (정보보안 관리 및 법규)

Information security management systems (ISMS-P, ISO/IEC 27001), risk assessment methodologies, business continuity planning and disaster recovery (BCP/DRP), Personal Information Protection Act (개인정보 보호법), Information and Communications Network Act (정보통신망법), and related Korean cybersecurity regulations.

Preparing for the Engineer Information Security Exam

What You Need to Know

Passing score: Written: 40+ per subject floor and 60 average; practical: 60/100
Assessment: Written paper covering 시스템 보안, 네트워크 보안, 어플리케이션 보안, 정보보안 일반, and 정보보안 관리 및 법규 (20 items and 30 minutes each, totaling 150 minutes), followed by a 3-hour written descriptive practical examination in 정보보안 실무. Administration was transferred from KISA to KCA in 2022 on the KCA CQ portal.
Time limit: 150 minutes written; 3 hours practical
Exam / certification fees: KRW 19,400 written / KRW 22,600 practical (KCA CQ portal (cq.or.kr), 2026) Official sources

Using Our Practice Resources

Work through all 100 available questions
Review every answer and explanation
Track weak areas and revisit them
Use our AI tutor for tough concepts

Engineer Information Security: Suggested Study Strategy

1Maintain balanced study across all five subjects to avoid the 40-point subject-failure floor (과락), particularly in Information Security Management & Regulations where exact statutory thresholds are tested.

2Master Korean domestic cryptographic algorithms (SEED, ARIA, HIGHT, LEA) alongside international standards (AES, RSA, ECC, SHA-2/3), noting block sizes, key lengths, and design architectures.

3Thoroughly memorize specific threshold numbers in Korean cybersecurity laws, including ISMS-P mandatory criteria, Personal Information Protection Act breach reporting triggers (1,000 users or sensitive data), and access log retention mandates (1 year standard, 2 years for large-scale/sensitive systems).

4Treat this English multiple-choice bank as conceptual foundation drill, while practicing manual Linux command-line log analysis, Snort rule drafting, and descriptive technical writing for the 3-hour practical exam.

Frequently Asked Questions

What is Engineer Information Security (정보보안기사)?

Engineer Information Security (정보보안기사) is South Korea's highest technical-level cybersecurity qualification under the National Technical Qualifications Act, certified under the Ministry of Science and ICT (MSIT). It validates expertise in safeguarding critical operating systems, network perimeters, enterprise applications, cryptographic implementations, and institutional compliance with Korean privacy and cyber laws.

Who administers the examination in 2026, and how was it transitioned?

The examination was originally developed and administered by the Korea Internet & Security Agency (KISA). Effective 2022, administration of both the Engineer Information Security and Industrial Engineer Information Security examinations was officially transferred to the Korea Communications Agency (KCA / 한국방송통신전파진흥원), with registrations and score records processed through the CQ portal (www.cq.or.kr).

How is the written CBT examination structured and scored?

The written paper consists of 100 multiple-choice questions divided equally across five subjects (20 items each): System Security, Network Security, Application Security, Information Security Fundamentals, and Security Management & Regulations. The test duration is 150 minutes (30 minutes per subject). To pass, candidates must score at least 40 points out of 100 in every single subject (avoiding 과락) and achieve an overall mean score of 60 points or higher.

What is the format of the practical stage (실기시험)?

The practical stage is a demanding 3-hour descriptive and short-answer written examination (필답형) in Information Security Practice (정보보안 실무). It consists of single-answer identification questions, short-answer technical scenario questions, and in-depth working-level essay questions covering log analysis, packet analysis, firewall/snort configuration, attack mitigation, and legal compliance procedures. A score of 60 out of 100 is required to pass.

How long is a passing written score valid, and what is this English practice bank?

Under National Technical Qualifications Act Enforcement Decree Article 21, a written pass exempts the candidate from the written examination for 2 years from the date the pass is announced. The questions on this platform are an independent English-language MCQ practice bank created to help candidates master core technical concepts and Korean regulatory frameworks. It is not an official translation, not a CBT simulation, and not a substitute for the practical written examination.