100+ Free CIISec Information and Cyber Security Foundation ICSF Practice Questions

Explanation: Availability guarantees that system resources, networks, and data are operational and accessible to authorized entities when needed. It is one of the three core pillars of the CIA triad alongside confidentiality and integrity. Countermeasures such as redundancy, failover mechanisms, and DDoS mitigation protect availability.

Explanation: Whaling is a specialized spear-phishing attack directed specifically at C-suite executives, senior management, or high-profile individuals. Attackers craft highly persuasive communications to trick executives into releasing sensitive corporate data or authorizing large wire transfers. Because victims hold elevated privileges, whaling poses severe operational and financial risks.

Explanation: Ransomware is malicious software designed to lock or encrypt files, systems, or storage drives until a ransom is paid to the attacker. Modern variants often employ double extortion by exfiltrating data prior to encryption and threatening public release. Regular offline backups and strict access controls are primary defenses.

Explanation: True Multi-Factor Authentication requires factors from distinct categories: something you know (password), something you have (registered smartphone receiving push notifications or TOTP), or something you are (biometrics). Combining a password (something you know) with a smartphone push notification (something you have) satisfies MFA. Using two items from the same category (e.g., password and PIN) constitutes multi-step, not multi-factor, authentication.

Explanation: The Principle of Least Privilege (PoLP) states that security subjects (users, services, or processes) should receive only the essential rights and authorizations needed to perform their specified tasks. Enforcing least privilege limits the blast radius of compromised credentials and restricts lateral movement during security incidents.

Explanation: Symmetric encryption utilizes one secret key shared between parties to perform both encryption and decryption (e.g., AES, ChaCha20). Because symmetric algorithms require low computational overhead, they are ideal for encrypting large volumes of data at rest or in transit.

Explanation: A network firewall acts as a boundary defense mechanism, inspecting network packets and enforcing defined access rules (allow or deny) between security zones (e.g., an internal corporate LAN and the untrusted internet). Firewalls filter traffic based on IP addresses, ports, protocols, or application behavior.

Explanation: Antivirus and antimalware software running on endpoint devices scans files, memory, and running processes to identify, block, isolate (quarantine), and remove malicious software. Modern endpoint security solutions combine signature detection with behavioral monitoring and heuristics.

Explanation: HTTPS (Hypertext Transfer Protocol Secure) incorporates Transport Layer Security (TLS) or SSL to encrypt communications between a web browser and a server. Encrypting the connection protects sensitive data (such as login credentials and financial transactions) against eavesdropping, interception, and tampering in transit.

Explanation: Preparation is the foundation of the incident response lifecycle. During preparation, organizations establish IR policies, assemble incident response teams, configure monitoring tools, define communication protocols, and conduct regular training exercises prior to an actual security incident.