Cybersecurity MCQ 60 Practice Tests With Answers (2026)

Incorrect·B: An attacker secretly intercepts and potentially alters communication between two parties

In a MitM attack, the attacker secretly positions themselves between two communicating parties, intercepting and potentially altering their messages. Both parties believe they are communicating directly with each other. Common on unsecured public Wi-Fi.

Incorrect·A: Symmetric uses one shared key; asymmetric uses a public and private key pair

Symmetric encryption uses a single shared key for both encryption and decryption (e.g., AES) — fast but has a key distribution problem. Asymmetric encryption uses a public key to encrypt and a paired private key to decrypt (e.g., RSA) — solves key distribution but is slower.

Incorrect·B: A software flaw that is known to attackers but has zero available patches from the vendor

A zero-day vulnerability is a software security flaw unknown to the vendor with no available patch. Attackers who discover it can exploit it freely until a fix is issued. Zero-day exploits are highly valuable because there is no existing defense.

Incorrect·B: DDoS uses multiple compromised systems (a botnet) to flood a target; DoS uses a single source

A DoS (Denial of Service) attack originates from a single source and can often be mitigated by blocking one IP. A DDoS (Distributed DoS) attack uses thousands of compromised machines in a botnet, making it far harder to defend against.

Incorrect·B: Implementing multiple, overlapping layers of security controls throughout a system

Defense in Depth applies multiple overlapping security layers — firewalls, IDS/IPS, endpoint security, access control, encryption, and monitoring — so that if one control fails, others continue to provide protection. No single point of failure.

Incorrect·B: An attacker inserts malicious SQL code into input fields to manipulate the backend database

SQL injection inserts malicious SQL statements into application input fields that are passed directly to the database. This can bypass authentication, read all database contents, or delete data. Prevention: use parameterized queries (prepared statements).

Incorrect·B: To monitor network traffic and alert administrators of suspicious or malicious activity

An IDS passively monitors network traffic and generates alerts when suspicious activity is detected based on signatures or behavioral anomalies. Unlike an IPS, it does not automatically block threats — it only detects and notifies.

Incorrect·B: Hashing is one-way (not reversible); encryption is two-way (reversible with a key)

Hashing is a one-way function that produces a fixed-size digest (e.g., SHA-256). It cannot be reversed. Encryption is two-way — data is scrambled with a key and can be decrypted. Hashing is used for password storage; encryption is used for data confidentiality.

Incorrect·B: A network of compromised computers remotely controlled by an attacker

A botnet is a collection of internet-connected devices infected with malware and controlled remotely by an attacker (the "bot herder"). Botnets are used to conduct DDoS attacks, send spam, steal data, and mine cryptocurrency — often without the device owners knowing.

Incorrect·B: To simulate real-world cyberattacks to identify vulnerabilities before malicious actors do

Penetration testing (pen testing) is an authorized, simulated cyberattack performed by ethical hackers to evaluate the security of a system. It identifies exploitable vulnerabilities before real attackers find them, providing actionable remediation guidance.

Incorrect·B: Injecting malicious scripts into trusted web pages viewed by other users

XSS is a web application vulnerability where attackers inject malicious client-side scripts into web pages viewed by other users. It can steal session cookies, redirect users to malicious sites, or perform actions on behalf of the victim. Prevention: output encoding, Content Security Policy.

Incorrect·B: IDS detects and alerts; IPS detects and actively blocks/prevents the threat

An IDS (Intrusion Detection System) monitors traffic and generates alerts — it is passive. An IPS (Intrusion Prevention System) monitors traffic and automatically takes action to block or prevent detected threats — it is inline and active. IPS adds latency; IDS does not.

Incorrect·B: Giving users only the bare minimum access rights needed to perform their job functions

The Principle of Least Privilege (PoLP) limits user and system access rights to the absolute minimum necessary. This minimizes the attack surface — a compromised account with limited privileges can do far less damage than one with full administrative rights.

Incorrect·B: A weakness or flaw in a system that can be exploited by a threat

A vulnerability is a weakness in hardware, software, processes, or people that can be exploited by a threat actor. Examples include unpatched software, misconfigured servers, weak passwords, and untrained users. Risk = Threat × Vulnerability × Impact.

Incorrect·A: Threat × Vulnerability

In cybersecurity risk management, Risk is calculated as Threat × Vulnerability (multiplied by Impact in full models). A threat with no vulnerability to exploit poses no risk, and a vulnerability with no threat actor to exploit it poses minimal risk.

Incorrect·B: Falsifying the source IP address in a packet header to impersonate a trusted system

IP spoofing involves forging the source IP address in packet headers to make traffic appear to come from a trusted or different source. It is used in DDoS amplification attacks, session hijacking, and bypassing IP-based access controls.

Incorrect·B: The systematic process of acquiring, testing, and installing updates to fix software vulnerabilities

Patch management is the ongoing process of identifying, acquiring, testing, and deploying software updates (patches) to fix security vulnerabilities and bugs. Timely patching is one of the most effective defenses against known exploits.

Incorrect·A: Authentication verifies who you are; Authorization verifies what you are allowed to do

Authentication verifies the identity of a user or system ("Are you who you claim to be?") using passwords, tokens, or biometrics. Authorization determines what an authenticated user is permitted to access or do. Both are required for complete access control.

Incorrect·B: Systematically submitting many passwords or passphrases with the hope of eventually guessing correctly

A brute-force attack systematically tries every possible password or key combination until the correct one is found. It is most effective against short or simple passwords. Countermeasures include account lockouts, CAPTCHA, MFA, and strong password policies.

Incorrect·B: That data has not been unauthorizedly altered, modified, or destroyed

Data Integrity (the "I" in the CIA Triad) ensures that data is accurate, complete, and has not been tampered with. It is protected using checksums, hashing, digital signatures, and access controls. Violations include unauthorized modification or corruption.

Incorrect·B: Insider Threat

This is a classic Insider Threat — a malicious or negligent actor within the organization with legitimate access. Insider threats bypass perimeter defenses. Mitigation: DLP (Data Loss Prevention), access logging, and least privilege controls.

Incorrect·B: Implement salted hashing (e.g., bcrypt or Argon2) for password storage

Storing passwords in plaintext is critical — if the database is breached, all credentials are immediately compromised. Base64 is encoding, not encryption, and is trivially reversible. The fix is salted hashing using bcrypt or Argon2, which is computationally expensive and resistant to rainbow table attacks.

Incorrect·B: Isolate infected systems, assess the ransomware strain, attempt decryption with available tools, and restore from backups as a last resort

Standard incident response follows: Containment (isolate infected systems), Identification (analyze the strain — check NoMoreRansom.org for free decryptors), Eradication, Recovery (restore from backups), then Lessons Learned. Paying ransom is a last resort and not recommended by law enforcement.

Incorrect·B: Encrypting Protected Health Information (PHI) both at rest and in transit

HIPAA's Security Rule mandates technical safeguards to protect ePHI. Encryption of PHI both at rest and in transit is the most critical control — even if data is intercepted or stolen, it remains unreadable without the decryption key.

Incorrect·B: Distributed Brute Force / Credential Stuffing

This pattern — many failed logins from many different IPs — is characteristic of Distributed Brute Force or Credential Stuffing (trying leaked username/password pairs at scale). Distributed attacks bypass simple IP-rate-limiting. Mitigation: MFA, account lockout, CAPTCHA, and anomaly-based detection.

Incorrect·B: The high risk of Man-in-the-Middle attacks intercepting unencrypted traffic and session cookies

Public Wi-Fi is inherently untrusted. Attackers on the same network can execute MitM attacks, intercept unencrypted HTTP traffic, steal session cookies, and run evil-twin AP attacks. Policy fix: require VPN on all untrusted networks; always use HTTPS.

Incorrect·B: "Never trust, always verify" — authenticate and authorize every single access request regardless of the user's location

Zero Trust Architecture (ZTA), defined in NIST SP 800-207, eliminates implicit trust based on network location. Every access request — whether from inside or outside the network — must be authenticated, authorized, and continuously validated. It assumes breach has already occurred.

Incorrect·B: Revoke and rotate the API key immediately in AWS, and scan the cloud environment for unauthorized usage

Once a secret is publicly exposed — even for seconds — it must be treated as fully compromised. Automated bots continuously scan GitHub for exposed credentials. Immediately revoke and rotate in AWS, audit CloudTrail logs for unauthorized API calls. Making the repo private does not undo the exposure.

Incorrect·B: Isolate the employee's device from the network, reset their credentials, and analyze the phishing URL

Malware can execute within milliseconds of a link click. 2 minutes is more than enough time for a dropper to install. Immediate response: network-isolate the device (stop lateral movement), reset credentials, analyze the phishing URL for IOCs, and perform endpoint forensics.

Incorrect·B: A combination of network segmentation, behavioral analysis, proactive threat hunting, and continuous monitoring

APTs are sophisticated, long-term targeted campaigns by well-resourced actors (often nation-states). Defense requires: network segmentation (limit lateral movement), behavioral analytics (detect anomalies), proactive threat hunting, 24/7 SOC monitoring, and rapid incident response. No single tool stops them.

Incorrect·B: Critical risk; isolate the server and update immediately after testing in a staging environment, as unpatched legacy servers have known exploitable CVEs

An unpatched Apache server from 2010 has over a decade of publicly known CVEs with published exploits. Internal network location provides no meaningful protection — lateral movement from any internal compromise can reach it immediately. Critical risk; patch after staging validation.

Incorrect·B: It ensures that if a long-term private key is compromised in the future, past recorded session keys cannot be decrypted

PFS uses ephemeral session keys (via Diffie-Hellman key exchange) that are discarded after each session. Even if an attacker later compromises the server's long-term private key, they cannot decrypt previously recorded encrypted sessions. TLS 1.3 mandates PFS.

Incorrect·B: Malicious code intentionally inserted into software that executes only when specific conditions or dates are met

A Logic Bomb is malicious code hidden within legitimate software that remains dormant until a specific trigger — such as a date, user login, or file deletion — is met. Often planted by disgruntled insiders. Detection requires code review and integrity monitoring.

Incorrect·B: To inspect and filter Layer 7 (Application) traffic, protecting web apps from exploits like XSS and SQL injection

A WAF operates at OSI Layer 7 (Application layer) to inspect HTTP/HTTPS traffic and block malicious requests targeting web applications — including SQL injection, XSS, CSRF, and OWASP Top 10 vulnerabilities. Unlike network firewalls, it understands application-layer context.

Incorrect·B: The practice of hiding a secret message, file, or payload within an ordinary, non-secret file or image

Steganography conceals the existence of a message by embedding it within an innocuous carrier file (image, audio, video, or text). Unlike encryption (which makes data unreadable), steganography hides the fact that a secret message exists at all — used in covert communication and malware C2 channels.

Incorrect·C: The IDS alerts on normal, benign network traffic, mistaking it for an attack

A False Positive occurs when an IDS generates an alert for legitimate, benign activity that it incorrectly identifies as malicious. High false positive rates cause "alert fatigue," leading analysts to ignore alerts and miss real threats. Tuning IDS rules to reduce false positives is a critical SOC task.

Incorrect·B: To strictly limit "east-west" lateral movement within a network, ensuring a breach in one segment cannot spread to others

Micro-segmentation divides a network into small, isolated zones with fine-grained security policies controlling traffic between them. It limits an attacker's ability to move laterally ("east-west") after breaching one system. It is a core component of Zero Trust Architecture.

Incorrect·B: BGP Hijacking (maliciously rerouting internet traffic)

BGP Hijacking occurs when a malicious actor announces ownership of IP prefixes they do not control, rerouting internet traffic through their infrastructure. BGP Route Origin Validation using RPKI (Resource Public Key Infrastructure) cryptographically verifies that BGP route announcements are authorized by the legitimate IP address holder.

Incorrect·B: It automates repetitive triage tasks and response workflows, reducing "alert fatigue" and speeding up incident mitigation

SOAR platforms automate repetitive security tasks (log enrichment, threat correlation, ticket creation) and coordinate response playbooks across multiple security tools. This reduces Mean Time to Respond (MTTR), cuts alert fatigue, and allows human analysts to focus on complex threats requiring judgment.

Incorrect·B: The act of deliberately deleting the cryptographic keys used to encrypt a dataset, rendering the data permanently unrecoverable

Crypto-shredding (cryptographic erasure) makes data permanently inaccessible by deleting its encryption keys rather than overwriting every data block. It is widely used in cloud environments and for GDPR/CCPA compliance when full data deletion is technically impractical (e.g., SSDs, cloud storage).