FBLA Cybersecurity Practice Questions with Explanations
Questions
The three core principles of information security, known as the CIA triad, are:
- Confidentiality, integrity, and availability
- Control, inspection, and authentication
- Cryptography, identity, and access
- Compliance, investigation, and auditing
Ensuring that information is accessible only to authorized people is:
- Confidentiality
- Integrity
- Availability
- Non-repudiation
Ensuring that data has not been altered without authorization is:
- Integrity
- Confidentiality
- Availability
- Authorization
Ensuring systems and data are accessible to authorized users when needed is:
- Availability
- Integrity
- Confidentiality
- Accounting
Ensuring a sender cannot deny having sent a message is:
- Non-repudiation
- Confidentiality
- Availability
- Obfuscation
The AAA framework in security stands for:
- Authentication, authorization, and accounting
- Access, availability, and auditing
- Analysis, alerting, and action
- Assets, attacks, and alerts
Proving that a user is who they claim to be is:
- Authentication
- Authorization
- Accounting
- Identification
Determining what an authenticated user is allowed to access is:
- Authorization
- Authentication
- Auditing
- Encryption
Giving users only the minimum access they need to perform their jobs is the principle of:
- Least privilege
- Defense in depth
- Separation of duties
- Implicit trust
Using multiple layers of security controls so that if one fails others still protect the system is:
- Defense in depth
- Least privilege
- Single point of failure
- Security through obscurity
A security model that assumes no user or device should be trusted by default, even inside the network, is:
- Zero trust
- Perimeter security
- Implicit trust
- Open access
Requiring two people to complete a sensitive task so no one person has full control is:
- Separation of duties
- Least privilege
- Job rotation
- Mandatory vacation
A weakness in a system that could be exploited is a(n):
- Vulnerability
- Threat
- Risk
- Exploit kit
Any potential danger that could take advantage of a vulnerability is a(n):
- Threat
- Vulnerability
- Control
- Asset
The likelihood that a threat will exploit a vulnerability and the resulting impact is:
- Risk
- Threat
- Exploit
- Patch
Code or a technique that takes advantage of a vulnerability is a(n):
- Exploit
- Patch
- Control
- Hash
A vulnerability unknown to the vendor, with no patch available, is a:
- Zero-day vulnerability
- Legacy vulnerability
- Patched vulnerability
- False positive
Safeguards put in place to reduce risk are called:
- Security controls
- Threat actors
- Vulnerabilities
- Exploits
A security policy, employee training, and background checks are examples of:
- Administrative controls
- Technical controls
- Physical controls
- Compensating controls
Firewalls, encryption, and antivirus software are examples of:
- Technical controls
- Administrative controls
- Physical controls
- Deterrent signs
Locks, fences, security guards, and badge readers are examples of:
- Physical controls
- Technical controls
- Administrative controls
- Logical controls
A control that discourages an attack, such as a warning sign or visible camera, is a:
- Deterrent control
- Corrective control
- Detective control
- Compensating control
A control that identifies an incident while or after it occurs, such as an intrusion detection system, is a:
- Detective control
- Preventive control
- Deterrent control
- Directive control
A hacker who breaks into systems illegally for personal gain or to cause harm is a:
- Black hat hacker
- White hat hacker
- Gray hat hacker
- Penetration tester
An authorized security professional hired to find vulnerabilities by attacking systems is a:
- Penetration tester
- Script kiddie
- Hacktivist
- Insider threat
An unskilled attacker who uses tools and scripts written by others is a:
- Script kiddie
- Nation-state actor
- Penetration tester
- Security architect
An attacker motivated by political or social causes is a:
- Hacktivist
- Script kiddie
- Competitor
- White hat
A highly skilled, well-funded group sponsored by a government that conducts long-term attacks is a(n):
- Nation-state actor
- Script kiddie
- Hacktivist
- Insider
A current or former employee who misuses authorized access is a(n):
- Insider threat
- External threat
- Script kiddie
- Hacktivist
Manipulating people into breaking security procedures or revealing information is:
- Social engineering
- Brute force
- Packet sniffing
- SQL injection
A fraudulent email designed to trick recipients into revealing information or clicking malicious links is:
- Phishing
- Vishing
- Smishing
- Whaling
A targeted phishing attack aimed at a specific person or organization is:
- Spear phishing
- Whaling
- Vishing
- Pharming
A phishing attack that targets senior executives is:
- Whaling
- Spear phishing
- Smishing
- Tailgating
Phishing carried out through voice calls is:
- Vishing
- Smishing
- Pharming
- Spoofing
Phishing carried out through text messages is:
- Smishing
- Vishing
- Whaling
- Pretexting
Creating a made-up scenario, such as pretending to be IT support, to obtain information is:
- Pretexting
- Tailgating
- Baiting
- Dumpster diving
Leaving infected USB drives in a parking lot hoping someone will plug one in is:
- Baiting
- Pretexting
- Whaling
- Vishing
Searching through trash for discarded information such as passwords or account numbers is:
- Dumpster diving
- Shoulder surfing
- Pharming
- Tailgating
Following an authorized person through a secure door without badging in is:
- Tailgating
- Shoulder surfing
- Baiting
- Spoofing
Compromising a website that a target group frequently visits to infect them is a:
- Watering hole attack
- Whaling attack
- Smishing attack
- Brute-force attack
A fraudulent request, often by email, impersonating an executive to get employees to wire money is:
- Business email compromise
- Ransomware
- Cross-site scripting
- Credential stuffing
Registering domain names that are slight misspellings of real sites, such as "gooogle.com," is:
- Typosquatting
- Pharming
- Spoofing an IP
- Watering hole
Malware that attaches to a legitimate file and spreads when the file is run is a:
- Virus
- Worm
- Trojan
- Rootkit
Malware that replicates itself across networks without user action is a:
- Worm
- Virus
- Trojan horse
- Keylogger
Malware disguised as legitimate software is a:
- Trojan horse
- Worm
- Logic bomb
- Adware
Malware that encrypts files and demands payment for the decryption key is:
- Ransomware
- Spyware
- Adware
- Rootkit
Malware that secretly gathers information about a user is:
- Spyware
- Ransomware
- Worm
- Logic bomb
Malware that records every keystroke a user types is a:
- Keylogger
- Rootkit
- Worm
- Botnet
Malware that hides deep in the operating system to give an attacker hidden administrator-level access is a:
- Rootkit
- Adware
- Worm
- Virus hoax
Malicious code that activates when a specific condition is met, such as a certain date, is a:
- Logic bomb
- Worm
- Trojan horse
- Keylogger