Cybersecurity Placement Test

Question 1 of 40

What is the primary role of an operating system?

To create Internet domain names

To replace the computer processor

To encrypt every file automatically

To manage computer hardware and provide services for applications

Please select an answer before continuing.

Question 2 of 40

What is an IP address primarily used for?

Creating user passwords

Identifying a device or network interface on an IP network

Compressing files

Physically locking a computer

Please select an answer before continuing.

Question 3 of 40

What is the main function of a router?

Forwarding network traffic between different networks

Storing only encrypted backups

Creating local user passwords

Scanning paper documents

Please select an answer before continuing.

Question 4 of 40

What does DNS commonly do?

Blocks all incoming email

Translates domain names into IP addresses

Creates operating system accounts

Encrypts the computer hard drive

Please select an answer before continuing.

Question 5 of 40

Which statement best describes TCP?

It provides connection-oriented and reliable data delivery

It is a type of computer virus

It is a physical network cable

It is used only to encrypt passwords

Please select an answer before continuing.

Question 6 of 40

What is a firewall primarily designed to do?

Control network traffic according to security rules

Increase hard drive capacity

Repair damaged computer hardware

Create website graphics

Please select an answer before continuing.

Question 7 of 40

Which term describes software intentionally designed to cause harm, steal information, or perform unauthorized actions?

Firmware

Freeware

Middleware

Malware

Please select an answer before continuing.

Question 8 of 40

A message pretending to be from a trusted organization asks you to click a link and enter your password. What type of attack is this most likely?

Load balancing

Software patching

Phishing

Data compression

Please select an answer before continuing.

Question 9 of 40

What is the main security benefit of multi-factor authentication (MFA)?

It removes the need for user accounts

It makes every password publicly visible

It automatically grants administrator access

It requires more than one type of evidence to authenticate a user

Please select an answer before continuing.

Question 10 of 40

Which password practice is generally the most secure?

Using a long, unique password or passphrase for each important account

Writing the password in a public profile

Sharing passwords with colleagues for convenience

Using the same short password for every account

Please select an answer before continuing.

Question 11 of 40

What is the primary purpose of encryption?

Delete all copies of data permanently

Transform data so that unauthorized parties cannot easily read it

Automatically create administrator accounts

Increase Internet connection speed

Please select an answer before continuing.

Question 12 of 40

Which statement best describes cryptographic hashing?

It physically destroys a storage device

It always allows the original input to be recovered directly

It produces a fixed-size digest commonly used to verify data integrity

It is primarily used to route packets between networks

Please select an answer before continuing.

Question 13 of 40

In cybersecurity, what is a vulnerability?

A physical network address

A guaranteed successful attack

A weakness that could potentially be exploited

A type of backup schedule

Please select an answer before continuing.

Question 14 of 40

Why are security patches important?

They eliminate the need for backups

They can fix known vulnerabilities in software

They replace all security policies

They guarantee that phishing emails cannot arrive

Please select an answer before continuing.

Question 15 of 40

What does the principle of least privilege mean?

Anonymous users should control security settings

Passwords should never be required

Users should receive only the access needed to perform their tasks

Every user should receive administrator privileges

Please select an answer before continuing.

Question 16 of 40

In the CIA security triad, what does confidentiality focus on?

Deleting all historical records

Increasing network bandwidth

Ensuring a server is always physically large

Preventing unauthorized disclosure of information

Please select an answer before continuing.

Question 17 of 40

In information security, integrity primarily means:

Using only wireless connections

Protecting information from unauthorized or improper modification

Making information available to everyone

Keeping all systems disconnected from networks

Please select an answer before continuing.

Question 18 of 40

Why are tested backups important in cybersecurity?

They make authentication unnecessary

They prevent every cyberattack from occurring

They automatically identify every attacker

They can help restore data and operations after data loss or certain incidents

Please select an answer before continuing.

Question 19 of 40

You suspect that a workstation has been compromised. Which action is generally most appropriate?

Publish all passwords on the Internet

Ignore the warning until the computer stops working

Follow the organization's incident response process and contain the threat as appropriate

Delete every system log immediately

Please select an answer before continuing.

Question 20 of 40

What is social engineering in cybersecurity?

Designing social media page colors

Manipulating people into revealing information or performing unsafe actions

Installing additional computer memory

Compressing network packets

Please select an answer before continuing.

Question 21 of 40

A host has the address 192.168.10.130/26. Which network address contains this host?

192.168.10.128

192.168.10.64

192.168.10.192

192.168.10.0

Please select an answer before continuing.

Question 22 of 40

During a normal TCP connection establishment, which sequence represents the three-way handshake?

SYN, FIN, ACK

SYN, SYN-ACK, ACK

RST, ACK, SYN

ACK, SYN, FIN

Please select an answer before continuing.

Question 23 of 40

A browser receives a TLS certificate whose hostname does not match the website being visited. What security property has primarily failed?

The client cannot reliably authenticate the identity of the intended server

The server cannot calculate an IP checksum

DNS can no longer resolve any domain

The TCP connection cannot contain encrypted payloads

Please select an answer before continuing.

Question 24 of 40

A web application safely parameterizes all SQL queries, but places untrusted user input directly into HTML responses without context-appropriate output encoding. Which vulnerability remains most relevant?

ARP spoofing

DNS zone transfer

SQL injection

Cross-site scripting (XSS)

Please select an answer before continuing.

Question 25 of 40

A SIEM observes a successful login immediately after hundreds of failed authentication attempts against the same account from one external source. What should an analyst investigate first?

Whether DNS TTL values are too high

Whether the monitor resolution changed

Whether the workstation needs disk defragmentation

Whether the account may have been compromised through password guessing or credential abuse

Please select an answer before continuing.

Question 26 of 40

EDR detects a suspicious process spawning PowerShell with an encoded command followed by outbound communication to an unusual host. What is the most appropriate immediate defensive action when organizational procedures allow it?

Immediately reinstall every endpoint in the organization

Delete all security logs before investigating

Disable the corporate firewall

Contain or isolate the endpoint while preserving evidence and begin investigation

Please select an answer before continuing.

Question 27 of 40

Why is membership in a highly privileged Active Directory administrative group particularly sensitive?

It automatically disables Kerberos

Compromise of such an account can provide extensive control over domain resources

It prevents the account from authenticating to Windows

It limits the account to read-only access

Please select an answer before continuing.

Question 28 of 40

An attacker compromises a standard user account and then exploits a local misconfiguration to obtain SYSTEM-level privileges. Which stage best describes the second action?

Data compression

Reconnaissance only

DNS resolution

Privilege escalation

Please select an answer before continuing.

Question 29 of 40

A security analyst observes unusually large numbers of Kerberos service-ticket requests for many service accounts from a single workstation. Which activity should be considered during investigation?

Potential Kerberos service-ticket abuse such as Kerberoasting-related activity

A standard TLS certificate renewal

Normal ARP cache expiration

Routine DHCP address renewal

Please select an answer before continuing.

Question 30 of 40

After compromising one workstation, an attacker uses stolen credentials to authenticate to additional internal systems. Which term best describes this behavior?

Network address translation

Certificate pinning

Lateral movement

Data deduplication

Please select an answer before continuing.

Question 31 of 40

Two vulnerabilities have similar CVSS scores. One is Internet-exposed, has reliable exploitation observed in the wild, and affects a critical authentication server. The other exists only on an isolated test system. Which should normally receive higher remediation priority?

The isolated test-system vulnerability solely because both CVSS scores are similar

Neither vulnerability because CVSS scores cannot be used at all

Always the vulnerability with the newest publication date regardless of exposure

The Internet-exposed vulnerability affecting the critical authentication server

Please select an answer before continuing.

Question 32 of 40

An internal workstation makes small encrypted outbound connections to the same uncommon external host at highly regular intervals, including when no user is active. Which hypothesis deserves investigation?

Local file fragmentation

Routine keyboard driver activity

Normal monitor power management

Possible command-and-control beaconing

Please select an answer before continuing.

Question 33 of 40

A threat hunter has an indicator for one malicious domain but wants to identify related activity even if the adversary changes domains. Which approach is generally more resilient?

Disable all endpoint logging

Ignore process and authentication telemetry

Hunt for behavioral patterns and correlated telemetry associated with the intrusion technique

Search only for the exact domain forever

Please select an answer before continuing.

Question 34 of 40

During incident response, malware is suspected of injecting code into another running process without leaving a clear executable on disk. Which evidence source is especially valuable?

Only the monitor configuration

Only the printer queue

A properly acquired memory image from the affected system

Only the DNS registrar contact information

Please select an answer before continuing.

Question 35 of 40

A cloud workload normally reads objects from one storage bucket. Its identity suddenly receives a broad wildcard permission across multiple services. What is the strongest security concern?

The storage objects will automatically become public regardless of all other controls

The workload will necessarily lose network connectivity

TLS will automatically become disabled

Excessive IAM privileges could significantly increase the impact of workload compromise

Please select an answer before continuing.

Question 36 of 40

An enterprise root certificate authority private key is confirmed compromised. Why is this a severe incident?

Kerberos automatically changes every user password

An attacker may be able to issue certificates that appear trusted within the affected trust hierarchy

All IPv4 addresses immediately stop functioning

Every encrypted historical file can always be decrypted directly from the CA key

Please select an answer before continuing.

Question 37 of 40

A workstation shows a burst of Kerberos service-ticket requests for privileged service accounts, followed shortly by successful remote logons to several servers using one of those accounts. Which interpretation best connects the evidence?

A DNS cache refresh caused legitimate administrative authentication

Normal DHCP behavior generated Kerberos credentials

Credential-focused Kerberos abuse may have enabled credential recovery or misuse followed by lateral movement

A TLS handshake automatically authenticated the workstation to all servers

Please select an answer before continuing.

Question 38 of 40

A compromised endpoint may contain fileless malware, active network sessions, injected processes, and short-lived credentials. The system must eventually be rebuilt. Which evidence collection priority best preserves volatile investigative value?

Delete event logs to reduce disk usage

Power-cycle the system repeatedly to clear suspicious processes

Reinstall the operating system immediately before collecting any evidence

Acquire volatile evidence such as memory and relevant live-state data before destructive remediation when operationally safe

Please select an answer before continuing.

Question 39 of 40

An adversary frequently changes filenames, hashes, IP addresses, and domains but repeatedly uses the same unusual parent-child process chain and credential-access behavior. Which detection strategy is likely to remain effective longest?

Behavior-based detection using stable execution and credential-access patterns

Detection based exclusively on one known file hash

Matching only the original malware filename

Blocking only the first observed IP address

Please select an answer before continuing.

Question 40 of 40

An organization observes a suspicious document spawning a script interpreter, credential-access alerts on the endpoint, unusual privileged authentication to multiple servers, and periodic encrypted outbound connections from those servers. Which response best reflects expert incident handling?

Correlate endpoint, identity, and network evidence; scope affected assets and accounts; contain the intrusion; preserve evidence; eradicate persistence; and rotate compromised credentials according to the incident plan

Reset one user password without investigating the affected servers

Block only the first external IP address and close the incident

Delete the suspicious document and assume the incident is resolved

Please select an answer before continuing.

Cybersecurity Fundamentals Diploma

Cybersecurity Placement Test

Contact

Contact

Services

Examination Centers

Cybersecurity Training

Arabic Language Programs

Professional Diplomas

Virtual Learning

Services

Resources

Student Dashboard

Virtual Classrooms

Certificate Verification

Examination Centers

Help & Support

Resources

Legal

Impressum

Privacy Policy

Terms & Conditions

Refund Policy

Certificate Policy

Legal