Cyberspace MCQ 60 Tests With Answers (2026)

Incorrect·D: Physical, Logical, and Cyber-Persona (Social)

The three-layer model of cyberspace: (1) Physical Layer — the tangible hardware infrastructure (cables, routers, satellites, data centers); (2) Logical Layer — the intangible software, data, protocols, and network architecture that govern how the physical layer is used; (3) Cyber-Persona Layer — the human identities, accounts, and social interactions that occur within cyberspace.

Incorrect·B: Logical Layer

The Logical Layer of cyberspace consists of all the intangible elements that govern how data is processed, transmitted, and organized — including protocols (TCP/IP, HTTP, DNS), software applications, databases, and the logical structure of networks. It sits between physical infrastructure and human interaction.

Incorrect·C: To coordinate the maintenance and procedures of several databases related to the namespaces and numerical spaces of the Internet

ICANN is a non-profit organization responsible for coordinating the global Internet's naming system — managing the Domain Name System (DNS), allocating IP address spaces (through Regional Internet Registries), and accrediting domain name registrars. Without ICANN's coordination, the internet's namespace would fragment into incompatible systems.

Incorrect·A: That ISPs should treat all data on the internet the same, without discriminating or charging differently by user, content, or platform

Net Neutrality is the principle that ISPs must treat all internet traffic equally — they cannot throttle, block, or create "fast lanes" for specific websites or services based on content, source, or willingness to pay. Without Net Neutrality, ISPs could theoretically charge Netflix more for fast delivery and slow down competitors.

Incorrect·D: The Deep Web is unindexed by standard search engines; the Dark Web is a subset of the Deep Web requiring specific software (like Tor) to access

The Surface Web is indexed by search engines (~5% of the web). The Deep Web is all content not indexed by search engines — including private databases, academic journals, corporate intranets, and email inboxes (~95% of the web). The Dark Web is a small, intentionally hidden subset of the Deep Web accessible only via anonymizing software like Tor, hosting both legitimate privacy tools and illegal marketplaces.

Incorrect·B: Translates human-readable domain names (like www.example.com) into machine-readable IP addresses

DNS is the internet's phone book — it translates human-readable domain names (www.google.com) into machine-readable IP addresses (142.250.195.14) that routers use to direct traffic. DNS queries are resolved hierarchically through Root servers → TLD servers → Authoritative DNS servers. DNS cache poisoning and DNS tunneling are key attack vectors.

Incorrect·C: That data packets are delivered accurately and in the correct order

TCP (Transmission Control Protocol) is a connection-oriented protocol that ensures reliable, ordered, and error-checked delivery of data packets. It establishes connections via a three-way handshake (SYN, SYN-ACK, ACK), acknowledges receipt of packets, and retransmits lost ones. IP handles addressing and routing; TCP handles reliability. UDP is the faster but unreliable alternative.

Incorrect·A: Breaking data down into blocks (packets), sending them via the most efficient route, and reassembling them at the destination

Packet switching is the fundamental data transmission method of the internet. Data is broken into small packets, each independently routed through the network via the most efficient available path, then reassembled in the correct order at the destination. This contrasts with circuit switching (used in traditional telephony), which reserves a dedicated path for each connection.

Incorrect·D: IPv4 ran out of available unique IP addresses

IPv4 uses 32-bit addresses, providing approximately 4.3 billion unique addresses — which became exhausted as the internet grew globally. IANA declared IPv4 address exhaustion in 2011. IPv6 uses 128-bit addresses, providing 340 undecillion (3.4 × 10^38) unique addresses — essentially limitless for the foreseeable future.

Incorrect·C: The effort by state governments to exert control over the internet infrastructure and content within their physical borders

Cyber Sovereignty is the concept that nation-states have the right to govern their portion of cyberspace — controlling content, infrastructure, and data within their territorial borders. China's "Great Firewall," Russia's sovereign internet law (RuNet), and Iran's national intranet are examples. It conflicts with the open, global, borderless nature of the original internet.

Incorrect·A: It is the routing protocol that makes the internet work by determining the best paths for data to travel across different autonomous systems

BGP is the routing protocol that holds the internet together — it manages how data is routed between the roughly 70,000+ Autonomous Systems (ASes) that constitute the internet. BGP routers exchange routing tables to determine the most efficient paths for traffic. Because BGP was designed for trust rather than security, it is vulnerable to BGP Hijacking attacks.

Incorrect·B: The time it takes for a data packet to travel from its source to its destination

Latency is the time delay for a data packet to travel from source to destination, measured in milliseconds (ms). It is affected by distance (speed of light propagation through cables), number of hops (router processing delays), and network congestion. Low latency is critical for real-time applications (gaming, VoIP, financial trading); high bandwidth does not compensate for high latency.

Incorrect·D: By allowing multiple devices on a private local network to share a single public IP address

NAT allows an entire local network of devices (with private IP addresses like 192.168.x.x) to share a single public IP address when communicating with the internet. The NAT router maintains a translation table mapping private IP:port combinations to the public IP address. NAT has been the primary mechanism that delayed IPv4 exhaustion for over two decades.

Incorrect·C: An intermediary server that sits between a client and the internet, often used for privacy, filtering, or caching

A proxy server acts as a gateway between a client and the internet — forwarding requests on the client's behalf. Uses include: privacy (masking the client's real IP), content filtering (blocking certain sites), caching (storing frequently accessed content for faster delivery), and bypassing geographic restrictions. Forward proxies serve clients; reverse proxies protect servers.

Incorrect·B: United Nations (UN) - ITU (International Telecommunication Union)

The ITU (International Telecommunication Union) is a UN specialized agency responsible for global standards for telecommunications technologies that underpin cyberspace — including radio frequency allocation, satellite orbit coordination, and standards for broadband networks. The ITU also works on cybersecurity capacity-building in developing nations.

Incorrect·A: To provide a standard 7-layer conceptual framework for understanding how different networking protocols interact

The OSI model is a 7-layer conceptual framework that standardizes how different network protocols interact: Physical (1), Data Link (2), Network (3), Transport (4), Session (5), Presentation (6), Application (7). It allows diverse networking technologies from different vendors to interoperate. The mnemonic is "Please Do Not Throw Sausage Pizza Away."

Incorrect·D: Application Layer (Layer 7)

HTTP (HyperText Transfer Protocol) operates at Layer 7 — the Application Layer — the topmost layer of the OSI model. This layer is closest to the end user and handles application-level communications. Other Layer 7 protocols include HTTPS, FTP, SMTP, DNS, and SSH. IP operates at Layer 3; Ethernet operates at Layer 2.

Incorrect·C: A large network or group of networks that has a unified routing policy (often managed by an ISP or a large enterprise)

An Autonomous System (AS) is a large network or collection of networks under a single administrative domain with a unified routing policy — assigned a unique AS Number (ASN) by IANA. ISPs, large enterprises, universities, and content delivery networks each manage their own AS. BGP is used to exchange routing information between ASes on the internet.

Incorrect·B: TLS/SSL encryption

TLS (Transport Layer Security) and its predecessor SSL encrypt data in transit between clients and servers, preventing eavesdropping and tampering. HTTPS = HTTP over TLS. TLS uses asymmetric cryptography for key exchange and symmetric encryption for bulk data transfer. Hardware firewalls filter traffic but do not encrypt it; DNS servers resolve names; switches forward packets at Layer 2.

Incorrect·A: Submarine cable landing stations

Submarine cable landing stations — where undersea fiber-optic cables come ashore — are critical physical choke points in global cyberspace infrastructure. A small number of these facilities handle the majority of intercontinental internet traffic. They are high-value targets for state-sponsored surveillance, sabotage, and physical interdiction threats.

Incorrect·D: The Fifth Domain (after Land, Sea, Air, and Space)

The US Department of Defense officially recognized Cyberspace as the Fifth Domain of warfare in 2016 (following Land, Sea, Air, and Space). US Cyber Command (USCYBERCOM) was established in 2009 and elevated to a Unified Combatant Command in 2018. Many NATO allies have similarly established dedicated cyber military commands.

Incorrect·B: An academic, non-binding study on how international law applies to cyber conflicts and cyber warfare

The Tallinn Manual (published by the NATO Cooperative Cyber Defence Centre of Excellence) is an academic, non-binding expert study on how existing international law — including the law of armed conflict — applies to cyber operations. Tallinn Manual 1.0 (2013) focused on cyber warfare; Tallinn Manual 2.0 (2017) expanded to peacetime cyber operations. It has no binding legal effect but heavily influences state policy.

Incorrect·C: Supervisory Control and Data Acquisition; it connects cyberspace to physical industrial systems like power grids and water plants

SCADA (Supervisory Control and Data Acquisition) systems monitor and control industrial infrastructure — power grids, water treatment plants, oil pipelines, and manufacturing systems. They sit at the critical intersection of cyberspace and physical infrastructure (cyber-physical systems). SCADA systems were historically not designed with cybersecurity in mind, making them prime targets for attacks like Stuxnet.

Incorrect·A: It was the first known cyberweapon designed to cause physical destruction to critical infrastructure (Iranian nuclear centrifuges)

Stuxnet (discovered 2010) was a joint US-Israeli cyberweapon that physically destroyed approximately 1,000 uranium-enrichment centrifuges at Iran's Natanz facility by sabotaging Siemens PLCs. It was the first cyberweapon known to cause real-world physical destruction, fundamentally changing the geopolitical understanding of cyber warfare and demonstrating that cyberattacks can have kinetic effects.

Incorrect·D: The fragmentation of the global internet into divided, nationalistic networks controlled by individual governments

The Splinternet describes the fragmentation of the global, open internet into separate, government-controlled national networks — driven by cyber sovereignty policies. China's Great Firewall, Russia's sovereign internet (RuNet) legislation, and Iran's national intranet are leading examples. The Splinternet threatens the interoperability, freedom, and global commerce that depend on a unified cyberspace.

Incorrect·B: Maliciously rerouting internet traffic by falsely broadcasting ownership of groups of IP addresses

BGP Hijacking occurs when a malicious Autonomous System broadcasts false BGP route announcements — claiming ownership of IP address prefixes they don't control — causing internet traffic to be rerouted through the attacker's network. Notable incidents include the 2010 China Telecom BGP hijack that redirected 15% of global internet traffic for 18 minutes. RPKI (Resource Public Key Infrastructure) is the primary mitigation.

Incorrect·C: To maintain communication with compromised systems within a victim's network to send instructions and extract data

C2 (Command and Control) infrastructure is the communication backbone of an APT campaign — it allows the attacker to issue commands to malware installed on compromised systems and exfiltrate data. C2 channels use various techniques to evade detection: encrypted HTTPS traffic, DNS tunneling, steganography in images, and fast-flux DNS to rapidly cycle through infrastructure.

Incorrect·A: By wrapping data in multiple layers of encryption and routing it through a decentralized network of volunteer relays

Tor achieves anonymity through onion routing: data is wrapped in multiple encryption layers (like an onion) and routed through a circuit of at least three volunteer relay nodes. Each relay decrypts only one layer to learn the next hop — no single node knows both the origin and destination. The exit node sends traffic to the final destination, but doesn't know the origin.

Incorrect·D: A highly secure network that is physically isolated from the public internet and any other unclassified networks

An air-gapped network is physically isolated from the public internet and all other unclassified networks — there is a literal "air gap" (no physical or wireless connection) between it and external networks. Used for top-secret military systems, nuclear facility controls, and classified government networks. Stuxnet famously bridged an air gap via an infected USB drive.

Incorrect·C: An attack that utilizes a software vulnerability unknown to the vendor, meaning there is "zero days" of protection or patching available

A zero-day exploit leverages a software vulnerability that is unknown to the software vendor — meaning zero days have elapsed since the vendor learned of it, leaving zero days for a defensive patch. Zero-days are the most valuable offensive cyber tools: government agencies (NSA, GCHQ) and criminal groups pay millions for undiscovered vulnerabilities. Stuxnet used four zero-days simultaneously.

Incorrect·B: Discouraging cyberattacks by convincing adversaries that the costs or consequences of an attack will outweigh the benefits

Cyber Deterrence applies the logic of nuclear deterrence to cyberspace: convincing adversaries that launching a cyberattack will result in unacceptable consequences — either through credible offensive cyber retaliation or other diplomatic, economic, or kinetic responses. Effective cyber deterrence requires attribution capability, demonstrated retaliatory capacity, and clear communication of redlines.

Incorrect·A: An attacker subverting the reputation system of a network by creating a massive number of pseudonymous identities

A Sybil Attack targets decentralized networks (P2P, blockchain, social networks) by creating a large number of fake identities (nodes) to gain disproportionate influence over the network's consensus mechanism or reputation system. Named after the book "Sybil" about multiple personality disorder. In blockchain, this is addressed by Proof-of-Work/Proof-of-Stake mechanisms that make creating many identities computationally expensive.

Incorrect·D: By sending a small query with a spoofed IP address to an open DNS resolver, which then sends a massive response to the victim's IP

DNS Amplification attacks exploit open DNS resolvers: the attacker sends small DNS queries (spoofed to appear from the victim's IP) requesting large responses (like ANY queries). The resolver sends the amplified response to the victim, generating traffic up to 70x the original query size. Combined with botnets sending millions of queries, this produces massive DDoS traffic against the victim.

Incorrect·C: Providing a globally accessible knowledge base of adversary tactics, techniques, and procedures (TTPs) based on real-world observations

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a curated knowledge base of real-world adversary behaviors organized into a matrix of tactics (the "why") and techniques (the "how"). Defenders use it to understand attacker methodologies, prioritize defensive investments, improve detection rules in SIEM/EDR tools, and develop threat hunting strategies.

Incorrect·B: A cyberattack that results in direct physical damage, injury, or death

A Kinetic Cyber Attack uses cyber means to cause real-world physical consequences — damage, injury, or death — by compromising cyber-physical systems. Examples: Stuxnet damaging nuclear centrifuges, attacks on industrial control systems causing equipment explosions (such as the German steel mill attack in 2014), or cyberattacks on power grids causing physical blackouts (Ukraine 2015/2016).

Incorrect·B: A DNS evasion technique where botnets rapidly swap the IP addresses associated with a single malicious domain name to avoid takedowns

Fast Flux is a DNS evasion technique used by botnets and malware operators: they rapidly cycle through hundreds or thousands of IP addresses (with very short DNS TTLs) for a single domain, making it nearly impossible for defenders or law enforcement to take down malicious infrastructure by blocking individual IPs. Double Fast Flux also cycles through proxy nameservers.

Incorrect·D: The synchronized employment of capabilities across all domains (Land, Sea, Air, Space, and Cyberspace) to achieve an objective

Multi-Domain Operations (MDO) is a US Army concept (and broader NATO doctrine) for synchronizing military capabilities across all five domains — Land, Sea, Air, Space, and Cyberspace — to create convergence effects at decisive points against an adversary. Cyberspace is central: cyber operations can degrade adversary C2, enable deception, and support kinetic strikes in all other domains simultaneously.

Incorrect·C: It could easily break current public-key cryptography (like RSA), rendering most internet encryption obsolete

Quantum computers running Shor's Algorithm can factor large integers exponentially faster than classical computers, threatening to break RSA and ECC (Elliptic Curve Cryptography) — which underpin the encryption securing the entire internet (HTTPS, VPNs, digital signatures). This is the "harvest now, decrypt later" threat: adversaries record encrypted traffic today to decrypt once quantum computers are powerful enough.

Incorrect·B: A method of cyberattack that encodes the data of other programs or protocols in DNS queries and responses to bypass firewalls

DNS Tunneling encodes data from non-DNS protocols inside DNS query/response packets to exfiltrate data or maintain a C2 channel through firewalls that permit DNS traffic. Since DNS is a seemingly benign, necessary protocol that most firewalls allow, it is commonly abused. Defenders detect it by monitoring unusually large DNS packets, high DNS query rates, and abnormal query patterns.

Incorrect·D: Because attackers use spoofing, proxies, and false flags, making it incredibly difficult to prove with 100% certainty who actually ordered the attack

Attribution in cyberspace is exceptionally difficult because sophisticated state actors use multi-hop proxy chains, compromised infrastructure in third countries, false flag operations (malware strings in foreign languages, use of other nations' tools), and IP spoofing. Technical forensic evidence supports attribution but rarely provides the legal certainty required for a sovereign state to justify a military response under international law.