Table of Contents

🔐 Chapter 1: Network Security & Firewalls

Q1: What are the two main benefits of deploying a DMZ in this scenario? [Select any TWO]

Option A: Improved performance of the public website.
Option B: Increased security of the internal network.
Option C: Simplified access control for the database server.
Option D: Reduced administrative overhead for network management.
✅ Correct Answer: B, C

🔍 Justification: A DMZ (Demilitarized Zone) acts as a buffer between untrusted external networks and trusted internal networks. It increases internal network security by isolating public-facing services

(B) and simplifies access control by allowing granular policies for servers like databases that shouldn’t be directly exposed

(C). Performance improvement

(A) and reduced overhead (D) are not primary DMZ benefits.

Q2: Which of the following is NOT a parameter checked by packet filtering firewalls?

Option A: Source IP address
Option B: Destination IP address
Option C: The network protocol used by the data packet.
Option D: Timeframe data
✅ Correct Answer: D

🔍 Justification: Packet-filtering firewalls operate at Layers 3-4 and inspect header information: source/destination IP, ports, and protocol. “Timeframe data” is not a standard packet header field evaluated by basic packet filters; time-based rules require more advanced stateful or next-gen firewalls.

Q3: A packet arrives at a stateful inspection firewall with: Source IP: 192.168.1.10, Destination IP: 8.8.8.8, Source Port: 53, Destination Port: 53, Protocol: UDP. Which action will the firewall most likely take?

Option A: Allow the packet.
Option B: Drop the packet.
Option C: Request retransmission of the packet.
Option D: Send an ICMP message back to the source.
✅ Correct Answer: A

🔍 Justification: Port 53/UDP is standard for DNS queries. A stateful firewall tracks connection state; if this is a legitimate outbound DNS request from an internal host (192.168.1.10) to a public DNS server (8.8.8.8), it matches an established/related state and is allowed. No malicious indicators are present.

Q4: What does a stateful inspection firewall track in addition to IP addresses and port numbers? [Select any TWO]

Option A: The specific content of data packets
Option B: The sequence of communication sessions
Option C: The state of communication sessions
Option D: The history of past network events
✅ Correct Answer: B, C

🔍 Justification: Stateful firewalls maintain a state table tracking session context—sequence of packets (B) and connection state (e.g., NEW, ESTABLISHED, RELATED) (C).

Deep content inspection (A) is done by DPI/NGFW; historical logging (D) is a separate audit function.

Q5: Stark is a network administrator and has done One-to-one mapping of particular private IP address to public IP address. Which type of NAT mechanism is used?

Option A: Dynamic NAT
Option B: Static NAT
Option C: Overloading NAT with PAT
Option D: Overloading NAT
✅ Correct Answer: B

🔍 Justification: Static NAT provides a fixed, one-to-one mapping between a private IP and a public IP—ideal for servers needing consistent external access. Dynamic NAT uses a pool; PAT/Overloading maps many private IPs to one public IP using ports.

Q6: Imagine you are the IT administrator for a small company with 20 employees… ISP assigned only one public IP address. Choose the BEST reason to use NAT.

Option A: NAT offers significant cost saving by reducing need for multiple public IPs.
Option B: NAT simplifies network administration by centralizing internet access control.
Option C: NAT enhances network security by hiding internal IP addresses and preventing direct attacks.
Option D: NAT improves internet access performance by optimizing bandwidth.
✅ Correct Answer: C

🔍 Justification: While cost savings (A) is a benefit, the best security-focused reason is that NAT provides implicit security by obscuring internal addressing (C), making direct inbound attacks harder without port forwarding. This aligns with infrastructure security fundamentals.

Q7: Ann wants to permit access to resources using source IP address. Which ACL mechanism can be implemented?

Option A: Standard ACL
Option B: Dynamic ACL
Option C: Reflexive ACL
Option D: Extended ACL
✅ Correct Answer: A

🔍 Justification: Standard ACLs filter traffic based only on source IP address. Extended ACLs use source/destination IP, ports, and protocol. Since the requirement is source IP only, Standard ACL is sufficient and most efficient.

Q8: Arya wants to filter traffic entering organization network based on source and destination IP address. Which can be used?

Option A: Access control list
Option B: Dynamic NAT
Option C: Static NAT
Option D: Using DHCP
✅ Correct Answer: A

🔍 Justification: ACLs (specifically Extended ACLs) can filter based on both source and destination IP addresses. NAT translates addresses; DHCP assigns them—neither performs filtering.

Q9: Ben wants to permit or deny access using specific ports and protocols to his network. Which ACL mechanism should be used?

Option A: Reflection ACL
Option B: Standard ACL
Option C: Extended ACL
Option D: Dynamic ACL
✅ Correct Answer: C

🔍 Justification: Extended ACLs support filtering by source/destination IP, port numbers, and protocol (TCP/UDP/ICMP), making them ideal for granular port/protocol-based rules. Standard ACLs only use source IP.

Q10: Monica is a network administrator and wants to check the access list assigned for an interface f0/1. What command has to be used?

Option A: Show ip interface f0/1
Option B: Show ip access-list f0/1
Option C: show ip access-list interface f0/1
Option D: Show ip interface f0/1 access-list
✅ Correct Answer: A

🔍 Justification: In Cisco IOS, show ip interface [interface] displays interface details including which ACLs (inbound/outbound) are applied. The other syntax options are invalid commands.

Q11: Which device is most critical for connecting in a WAN?

Option A: Hub
Option B: Switch
Option C: Router
Option D: Access point
✅ Correct Answer: C

🔍 Justification: Routers operate at Layer 3 and connect different networks (LAN to WAN), performing path selection, NAT, and firewall functions. Hubs/Switches are LAN devices; APs provide wireless LAN access.

Q12: What is the range of Class C IP addresses?

Option A: 1.0.0.0 to 127.255.255.255
Option B: 128.0.0.0 to 191.255.255.255
Option C: 192.0.0.0 to 223.255.255.255
Option D: 224.0.0.0 to 239.255.255.255
✅ Correct Answer: C

🔍 Justification: Classful addressing: Class A (1-126), Class B (128-191), Class C (192-223). Class C supports up to 254 hosts per network. Option D is Class D (multicast).

Q13: Jill wants to use Class A IP address range for internal communication. Which range is used?

Option A: 172.16.0.0 to 172.31.255.255
Option B: 192.168.0.0 to 192.168.255.255
Option C: 10.0.0.0 to 10.255.255.255
Option D: 2245.3.0.0 to 254.255.255.255 (typo in source)
✅ Correct Answer: C

🔍 Justification: RFC 1918 private IP ranges: Class A private = 10.0.0.0/8 (C). Option A is Class B private; B is Class C private. D contains invalid octets.

Q14: What is the range of IP Address reserved for Automatic Private IP Addressing (APIPA)?

Option A: 169.254.0.1 through 169.254.255.254
Option B: 128.1.0.1 through 191.255.255.254
Option C: 192.0.1.1 through 223.255.254.254
Option D: 224.0.0.0 through 239.255.255.255
✅ Correct Answer: A

🔍 Justification: APIPA auto-assigns addresses in 169.254.0.0/16 when DHCP fails. This link-local range ensures basic local connectivity without manual config.

Q15: Which of the below “A Record” is valid?

ac.com –> 128.128.155.254
tu.co.in –> 256.256.256.256
se.edu –> 224.224.224.255
mr.in –> 1.0.0.0
Option A: ac.com
Option B: tu.co.in
Option C: se.edu
Option D: mr.in
✅ Correct Answer: A

🔍 Justification: Valid IPv4 addresses have octets 0-255. tu.co.in has 256 (invalid);

se.edu uses 224.x (Class D multicast, not for host A records);

mr.in’s 1.0.0.0 is a network address. ac.com’s 128.128.155.254 is valid unicast.

Q16: What is the purpose of the Ping utility in a network?

Option A: To check the latency between systems
Option B: To check the connectivity between systems
Option C: To check the speed of the network
Option D: To check the security of the network
✅ Correct Answer: B

🔍 Justification: Ping uses ICMP Echo Request/Reply to verify connectivity (reachability) between hosts. While it shows round-trip time (latency), its primary purpose is connectivity testing.

Q17: A home user wants to connect multiple devices… ensure smooth online gaming and video streaming without interference. Which device would be most appropriate?

Option A: Hub
Option B: Switch
Option C: Router
Option D: Access point
✅ Correct Answer: B

🔍 Justification: A switch provides dedicated bandwidth per port (full-duplex), reducing collisions and interference vs. a hub (shared bandwidth). For wired LAN segmentation with QoS support, a managed switch is ideal. Router handles WAN; AP handles wireless.

Q18: A factory floor requires a network to connect machines… robust and resilient to cable breaks or device failures. Which topology would be best?

Option A: Ring
Option B: Star (Source shows “Start” – assumed typo)
Option C: Bus
Option D: Mesh
✅ Correct Answer: B (Star)

🔍 Justification: ⚠️ Note: Source answer is “b” but justification favors Mesh (D) for resilience.
Correction: For maximum resilience to failures, Mesh (D) is technically superior (multiple redundant paths). However, if source insists on “b”, Star topology offers easier troubleshooting and single-point failure isolation vs. Bus/Ring. Recommend verifying source answer.

Q19: What happens in a Ring topology if a device fails?

Option A: The entire network is affected.
Option B: The network continues to function normally.
Option C: The network becomes less efficient.
Option D: The network becomes more efficient.
✅ Correct Answer: A

🔍 Justification: In a basic ring topology (e.g., Token Ring), a single node/link failure can break the entire loop, disrupting communication. Dual-ring or resilient protocols mitigate this, but the fundamental weakness is single-point failure impact.

Q20: What is the main disadvantage of using a Mesh topology in a network?

Option A: It is easy to install and manage
Option B: The amount of cabling and the number of ports required is too high.
Option C: It is difficult to install and manage.
Option D: It is easy to install and manage
✅ Correct Answer: B

🔍 Justification: Full mesh requires n(n-1)/2 connections—exponential growth in cabling, ports, and cost. While resilient, scalability is poor. Option C is also true but B is the primary technical disadvantage cited in fundamentals.

Q21: An example of a mesh topology in real life is:

Option A: A power grid.
Option B: A telephone network.
Option C: A computer network with hubs
Option D: A star network with switches
✅ Correct Answer: A

🔍 Justification: Power grids use mesh-like redundant paths to ensure reliability—if one line fails, electricity reroutes. Telephone networks historically used hierarchical star; modern backbones may use partial mesh.

Q22: You are tasked with setting up a resilient wireless network for 10 security cameras… each camera can communicate directly with every other camera (mesh topology). How many wireless links will you need?

Option A: 45 links
Option B: 22 links
Option C: 30 links
Option D: 55 links
✅ Correct Answer: A

🔍 Justification: Full mesh formula: n(n-1)/2 = 10×9/2 = 45 links. Each node connects to every other node exactly once.

Q23: What is the main disadvantage of a bus topology?

Option A: Single point of failure
Option B: Inefficient for long distances
Option C: Difficult to troubleshoot.
Option D: Requires complex cabling.
✅ Correct Answer: B

🔍 Justification: Bus topology uses a single backbone cable; signal degradation over distance limits scalability (B). A cable break does cause single-point failure (A), but inefficiency over distance is a fundamental physical layer limitation.

🔐 Chapter 2: Cryptography & Encryption

Q1: How many keys are required for a public key cryptosystem with ‘n’ users?

Option A: 2n keys (1 public key + 1 private key per user)
Option B: n keys (1 public key per user)
Option C: n keys (1 private key per user)
Option D: n keys (1 public key + 1 private key per user + 1 key for each user)
✅ Correct Answer: A

🔍 Justification: In asymmetric cryptography, each user has a key pair: one public (shared) + one private (secret). For n users: n public + n private = 2n total keys. Symmetric would require n(n-1)/2 shared keys.

Q2: A large e-commerce company needs to securely store customers’ credit card information. Which encryption type meets the criteria?

Option A: DES (Data Encryption Standard)
Option B: TPM
Option C: AES (Advanced Encryption Standard)
Option D: Caesar Cipher
✅ Correct Answer: C

🔍 Justification: AES is a strong, NIST-approved symmetric algorithm (128/192/256-bit) suitable for sensitive data like PCI data. DES is deprecated (56-bit key); Caesar is trivial; TPM is hardware, not an algorithm.

Q3: What is the purpose of salting in conjunction with hashing for password protection?

Option A: Increase the hash function output size
Option B: Make the hash value more predictable
Option C: Add randomness to the hashed password
Option D: Simplify rainbow table creation
✅ Correct Answer: C

🔍 Justification: A salt is random data added to a password before hashing. It ensures identical passwords produce different hashes, defeating precomputed rainbow tables and forcing per-password brute-force attacks.

Q4: What is a message digest in the context of hashing?

Option A: The original message before hashing
Option B: The fixed-length output of a hash function
Option C: A random value added to the message for security
Option D: A secret key used to decrypt hashed data
✅ Correct Answer: B

🔍 Justification: A message digest is the deterministic, fixed-size output (e.g., 256-bit for SHA-256) produced by a hash function, used for integrity verification. It is not reversible.

Q5: What is the relationship between collision resistance and message integrity?

Option A: Higher collision resistance reduces the accuracy of integrity verification.
Option B: Strong collision resistance ensures unique hash values for distinct messages.
Option C: Higher collision resistance makes message verification computationally expensive.
Option D: Strong collision resistance simplifies storing and comparing message digests.
✅ Correct Answer: B

🔍 Justification: Collision resistance means it’s computationally infeasible to find two different inputs producing the same hash. This ensures that if a message changes, its hash will change—enabling reliable integrity checks.

Q6: Which property of a hash function makes it ideal for password storage?

Option A: Fixed-length output
Option B: One-way function
Option C: Collision resistance
Option D: Message integrity
✅ Correct Answer: B

🔍 Justification: The one-way (preimage resistance) property ensures that given a hash, it’s infeasible to recover the original password. This protects stored credentials even if the hash database is breached.

Q7: Which of the following is NOT a common example of a hashing algorithm?

Option A: MD5 (Message Digest 5)
Option B: RSA (Rivest–Shamir–Adleman)
Option C: SHA-1 (Secure Hash Algorithm 1)
Option D: Whirlpool
✅ Correct Answer: B

🔍 Justification: RSA is an asymmetric encryption/signature algorithm, not a hash function. MD5, SHA-1, and Whirlpool are cryptographic hash algorithms (though MD5/SHA-1 are now deprecated for security uses).

Q8: Which of the following is NOT a property of a good hash function?

Option A: Collision resistance
Option B: Preimage resistance
Option C: Second preimage resistance
Option D: Reversibility
✅ Correct Answer: D

🔍 Justification: Hash functions must be one-way (non-reversible). Reversibility would break their core security properties. Collision, preimage, and second-preimage resistance are essential cryptographic requirements.

Q9: A potential security risk associated with hash functions?

Option A: They can be used to generate brute-force attacks.
Option B: They are susceptible to rainbow table attacks.
Option C: They can be used to steal private keys.
Option D: They can be used to forge digital signatures.
✅ Correct Answer: B

🔍 Justification: Rainbow tables are precomputed tables of hash values for common passwords. Without salting, unsalted hashes can be reversed via lookup. Brute-force (A) targets passwords, not hashes themselves.

Q10: Consider a scenario where a malicious attacker intercepts a digitally signed message and modifies its content. What impact does this have on signature verification?

Option A: The signature will remain valid, allowing impersonation.
Option B: The signature will become invalid, revealing tampering, and alerting the recipient.
Option C: Signature validation will be inconclusive, requiring additional methods.
Option D: The attacker can generate a new valid signature for the tampered message.
✅ Correct Answer: B

🔍 Justification: Digital signatures sign the hash of the message. Any modification changes the hash; verification using the sender’s public key will fail, detecting tampering (integrity + non-repudiation).

Q11: What happens if a message is altered during encrypted transmission?

Option A: The originally encrypted message will remain the same.
Option B: The original message will still be readable.
Option C: The message digest will be different.
Option D: The sender and receiver will not be able to communicate.
✅ Correct Answer: C

🔍 Justification: If integrity protection (e.g., HMAC, authenticated encryption) is used, alteration changes the computed digest/MAC. Verification fails, alerting to tampering. Pure encryption without integrity may still decrypt to garbage.

Q12: Which encryption algorithm does disk encryption typically use?

Option A: Blowfish
Option B: Advanced Encryption Standard (AES)
Option C: RC4
Option D: RSA
✅ Correct Answer: B

🔍 Justification: AES is the industry standard for full-disk encryption (BitLocker, FileVault, LUKS) due to its strength, efficiency, and hardware acceleration support. RSA is asymmetric and too slow for bulk data.

Q13: A company encrypts its customer data to protect it from unauthorized access. Which cyber security objective in CIA triad is defined here?

Option A: Confidentiality
Option B: Integrity
Option C: Availability
Option D: Authorization
✅ Correct Answer: A

🔍 Justification: Encryption ensures that only authorized parties with the key can read data—directly supporting Confidentiality. Integrity prevents unauthorized modification; Availability ensures access when needed.

Q14: A website is using weak encryption algorithms to transmit user data. Which principle of the CIA triad might get violated?

Option A: Confidentiality
Option B: Integrity
Option C: Availability
Option D: Non-repudiation
✅ Correct Answer: A

🔍 Justification: Weak encryption can be broken, allowing eavesdroppers to read transmitted data—violating Confidentiality. Integrity could also be at risk if encryption doesn’t include authentication, but confidentiality is the primary concern.

Q15: What does the “Secure padlock” symbol in a browser address bar indicate?

Option A: The website is owned by a reputable company.
Option B: The website is safe for children.
Option C: The website uses advertising cookies.
Option D: The communication between the browser and website is encrypted.
✅ Correct Answer: D

🔍 Justification: The padlock indicates HTTPS/TLS is active, meaning data in transit is encrypted and server identity is verified via certificate. It does not guarantee site legitimacy, content safety, or privacy practices.

Q16: A multinational corporation uses BitLocker for data encryption… only half the laptops have TPM chips. During ransomware attack, data encrypted on laptops without TPMs. Which TPM benefit would have most effectively prevented this?

Option A: TPMs allow secure MFA during BitLocker startup…
Option B: TPMs offer centralized key management…
Option C: TPMs provide hardware-based secure storage for BitLocker keys, making them more resistant to physical tampering
Option D: TPMs enable secure boot, ensuring only trusted OS can load, preventing execution of malicious software that could bypass BitLocker
✅ Correct Answer: D

🔍 Justification: Secure Boot (via TPM) prevents pre-boot malware (e.g., bootkits) from loading and capturing BitLocker keys or disabling encryption. Without TPM, keys may be stored less securely, allowing ransomware to access raw disk.

Q17: You’ve enabled BitLocker on your Windows laptop, but now you’re locked out due to a forgotten password. Which actions can potentially help recover access? [Select TWO]

Option A: Check your Microsoft account, Active Directory, or printed recovery key if saved during setup
Option B: Use the BitLocker recovery key ID on the recovery screen to retrieve the full key
Option C: Attempt to login using regular account password…
Option D: Format the drive to remove BitLocker encryption
✅ Correct Answer: A, B

🔍 Justification: BitLocker recovery requires the 48-digit recovery key, which can be backed up to Microsoft Account, AD, or printed. The Recovery Key ID helps locate the correct key. Formatting (D) destroys data; regular password (C) won’t unlock BitLocker.

Q18: A security consultant is working with a healthcare organization to implement EFS encryption… Which file systems would prevent successful deployment of EFS? [Select THREE]

Option A: NTFS
Option B: ReFS
Option C: FAT
Option D: FAT32
Option E: (Implied) exFAT or other non-NTFS
✅ Correct Answer: C, D, E (Source shows “cde”)

🔍 Justification: EFS (Encrypting File System) is an NTFS feature. FAT, FAT32, and exFAT lack support for file-level encryption, ACLs, and other NTFS metadata required by EFS. ReFS has limited EFS support depending on Windows version.

☁️ Chapter 3: Cloud Security & Deployment Models

Q1: What type of deployment model will suit a defence equipment manufacturer who needs maximum security using dedicated datacenter hardware and scalability/performance benefits?

Option A: Community cloud
Option B: Private cloud
Option C: Public cloud
Option D: Hybrid cloud
✅ Correct Answer: B

🔍 Justification: Private cloud provides dedicated infrastructure (on-prem or hosted) with maximum control, isolation, and security—critical for defense. It can still offer cloud benefits (elasticity, self-service) via virtualization.

Q2: An organization requires to customize its resources to meet specific IT requirements and all services/infrastructure should be managed internally. Which cloud deployment model helps?

Option A: Public cloud
Option B: Private cloud
Option C: Community cloud
Option D: Hybrid cloud
✅ Correct Answer: B

🔍 Justification: Private cloud is exclusively used by one organization, allowing full customization, control, and internal management—aligning with the requirement for tailored, internally-managed infrastructure.

Q3: InfoTech Ltd has two subsidiaries with shared concerns on mission, objectives, and security policies for cloud environment. Which deployment model is best suited?

Option A: IaaS
Option B: Community Cloud
Option C: Hybrid Cloud
Option D: Private Cloud
✅ Correct Answer: B

🔍 Justification: Community cloud is shared by several organizations with common concerns (e.g., security, compliance, mission). It balances shared cost/infrastructure with tailored policies for the community.

Q4: Which ipconfig command option displays a detailed list of all network adapters and their configurations?

Option A: /all
Option B: /a
Option C: /network
Option D: /flushdns
✅ Correct Answer: A

🔍 Justification: ipconfig /all shows comprehensive adapter details: IP, subnet, gateway, DNS, MAC, DHCP status, etc. /flushdns clears resolver cache; other options are invalid.

Q5: IL Solutions Ltd formed a cloud for all branches but due to resource limitations decided to attain services of a public cloud platform. The cloud so formed is an example of _______?

Option A: Public cloud
Option B: Private cloud
Option C: Community cloud
Option D: Hybrid cloud
✅ Correct Answer: D

🔍 Justification: Combining a private cloud (for branches) with public cloud services creates a Hybrid cloud, enabling workload portability, burst capacity, and optimized resource use across environments.

Q6: Which cloud service model provides the least amount of in-built security for the customer?

Option A: SaaS
Option B: IaaS
Option C: PaaS
Option D: CaaS
✅ Correct Answer: B

🔍 Justification: In IaaS, the customer manages OS, apps, data, and runtime—bearing most security responsibility. CSP secures only physical infrastructure/hypervisor. SaaS/PaaS shift more security to the provider.

Q7: Which statements are true with respect to the SaaS cloud service model? [Select correct options]

Option A: The cloud consumer needs to develop and manage the application.
Option B: The infrastructure and the platform are managed by the cloud service provider.
Option C: The cloud service provider provides a fully functional software service to the consumers.
Option D: Only storage is managed by the cloud service provider.
✅ Correct Answer: B, C

🔍 Justification: In SaaS, the provider manages everything (infrastructure, platform, app); users consume the software via browser/API. Consumers do not develop/manage the app (A is false); D is incorrect as all layers are provider-managed.

Q8: A team of managers need to collaborate in real-time, share progress, create/finalize reports. Which service model should they opt for?

Option A: PaaS
Option B: SaaS
Option C: IaaS
Option D: HaaS
✅ Correct Answer: B

🔍 Justification: SaaS delivers ready-to-use applications (e.g., Microsoft 365, Google Workspace) for collaboration, document editing, and reporting—no development or infrastructure management required.

Q9: Tom wishes to test his .NET application he developed. Which is the best Cloud service model which helps him?

Option A: Hardware as a Service
Option B: Platform as a Service
Option C: Software as a Service
Option D: Infrastructure as a Service
✅ Correct Answer: B (Note: Source shows “c” but PaaS is more appropriate for app testing)

🔍 Justification: ⚠️ Source answer is “c” (SaaS), but PaaS (B) is technically correct.
PaaS (e.g., Azure App Services, AWS Elastic Beanstalk) provides dev/test environments with runtime, middleware, and tools—ideal for deploying/testing custom apps. SaaS is for end-user software consumption. Recommend verifying source.

Q10: ABC Cart is an e-commerce website experiencing peak traffic… servers experienced downtime. Which feature of cloud service model would help?

Option A: Virtualization
Option B: Containerization
Option C: Scalability
Option D: Pay as you use
✅ Correct Answer: C

🔍 Justification: Cloud scalability (auto-scaling) allows resources to dynamically expand during traffic spikes and contract afterward, preventing downtime. Virtualization/containerization enable scalability but aren’t the direct solution.

Q11: Computer processors have become cheaper but faster… often under-utilized. Which cloud computing feature ensures better utilization of such processor hardware?

Option A: Elasticity
Option B: Resource pooling
Option C: Pay as you go
Option D: Network accessibility
✅ Correct Answer: B

🔍 Justification: Resource pooling allows CSPs to serve multiple customers from shared physical resources, statistically multiplexing demand to maximize hardware utilization—core to cloud economics.

Q12: A small cybersecurity training company plans to provide VMs to students… need flexibility of managing OS, networks, runtime environments. Choose two most appropriate statements.

Option A: Since they need to manage OS/networks, recommended to use private cloud instead of public cloud.
Option B: Not recommended to use public cloud due to increased cyber-attack risk.
Option C: IaaS from a public cloud service provider is the preferred choice.
Option D: Existing SaaS applications for online labs usually provide no/very limited control over OS, networks, JRE etc.
✅ Correct Answer: C, D

🔍 Justification: IaaS (e.g., AWS EC2, Azure VMs) gives full control over OS, network config, and runtime—ideal for custom labs (C). SaaS lab platforms are turnkey but restrict low-level control (D). Public cloud is viable with proper security (B is overstated); private cloud isn’t required (A).

Q13: You are a developer working on a large e-commerce platform… struggling with peak traffic. Migrating to cloud-native architecture. Which approach would be most beneficial?

Option A: Refactoring the monolithic application into microservices
Option B: Increasing the size of existing virtual machines
Option C: Implementing a load balancer to distribute traffic
Option D: Upgrading the database to a more performant engine
✅ Correct Answer: A

🔍 Justification: Microservices enable independent scaling, resilience, and agile updates—addressing scalability/reliability at the architecture level. Vertical scaling (B), load balancing (C), or DB tuning (D) are tactical but don’t solve monolithic limitations.

Q14: Which among the following statements represent key differences between serverless services and PaaS? [Select TWO]

Option A: PaaS is used for deploying applications that run 24/7, while serverless is for asynchronous events.
Option B: Serverless services can run longer than PaaS applications.
Option C: Serverless services offer more control over the deployment environment.
Option D: Serverless services can scale automatically based on incoming requests.
✅ Correct Answer: A, D

🔍 Justification: Serverless (e.g., AWS Lambda) is event-driven, scales to zero, and has execution time limits—ideal for sporadic workloads (A, D). PaaS typically runs long-lived apps. Serverless offers less control (C is false); execution duration is shorter, not longer (B is false).

Q15: ABC Ltd company is considering migrating data to cloud. Which statement best describes key benefit of cloud adoption?

Option A: High upfront investment
Option B: Limited control
Option C: Reduced operational costs
Option D: Limited scalability
✅ Correct Answer: C

🔍 Justification: Cloud shifts CapEx to OpEx via pay-as-you-go, reducing costs for hardware maintenance, power, cooling, and idle capacity. A, B, D are challenges, not benefits.

Q16: A CTO consults you for migrating on-prem ERP to cloud. Choose two statements to help convince management.

Option A: Cost savings in terms of reduction of skilled workforce requirements.
Option B: Cloud services are exempted from privacy regulations.
Option C: Cloud services are insulated from cyber threats due to high scalability.
Option D: Upgrading in-house applications is time-consuming in comparison with SaaS.
✅ Correct Answer: A, D

🔍 Justification: Cloud reduces need for in-house infrastructure specialists (A) and SaaS updates are managed by provider vs. manual in-house upgrades (D). B is false (cloud must comply with regulations); C is false (cloud introduces shared responsibility, not immunity).

Q17: Which phase is NOT part of the cloud migration process?

Option A: Discovery
Option B: Assessment
Option C: Migration
Option D: Optimization
✅ Correct Answer: D (Note: Optimization IS part of migration lifecycle; source may have error)

🔍 Justification: ⚠️ Standard cloud migration frameworks (e.g., AWS MAP, Azure Migration) include: Discover → Assess → Migrate → Optimize. If source insists “d”, it may refer to a simplified 3-phase model. Recommend verifying context.

Q18: Organizations are initiating cloud migration for more security, data protection, lower cost, high flexibility. What are the different phases of migration that developers must go through?

Option A: Discovery -> Assessment -> Migration
Option B: Discovery -> Maintenance -> Migration
Option C: Discovery -> Migration -> Assessment
Option D: Discovery -> Assessment -> Maintenance -> Migration
✅ Correct Answer: A

🔍 Justification: Standard sequence: Discover (inventory), Assess (feasibility, TCO), Migrate (execute). Maintenance is post-migration; assessment must precede migration (C is illogical).

Q19: ABC Ltd company is planning to migrate legacy applications to cloud but concerned about security implications of running in shared environment. How can virtualization help address security concerns?

Option A: By using a type-two hypervisor that provides better isolation between virtual machines.
Option B: By encrypting all data stored in the cloud.
Option C: By choosing a cloud provider with strong security track record.
Option D: By purchasing dedicated cloud resources instead of shared resources.
✅ Correct Answer: A

🔍 Justification: ⚠️ Source answer is “a”, but Type-1 (bare-metal) hypervisors provide stronger isolation than Type-2 (hosted).
Virtualization’s security value comes from strong isolation between VMs. Type-1 hypervisors (running directly on hardware) have smaller attack surface than Type-2 (running on OS). Recommend verifying source intent.

Q20: Which type of hypervisor will you prefer when you must develop applications with low latency and high performance?

Option A: Type 1 or bare metal virtualization
Option B: Type 2 or hosted virtualization
Option C: Dedicated rack server
Option D: All the above
✅ Correct Answer: A

🔍 Justification: Type-1 hypervisors (e.g., VMware ESXi, Hyper-V) run directly on hardware, minimizing overhead and latency—critical for high-performance apps. Type-2 adds host OS layer, increasing latency.

Q21: Your organization hires a cloud service provider to move on-premises infrastructure to a private cloud. Select security responsibilities taken care of by cloud provider during initial setup stage. [Select THREE]

Option A: Protection from vandalism
Option B: Incident Response
Option C: Audit logging
Option D: Identity and access management
✅ Correct Answer: B, C, D (Source shows “bcd”)

🔍 Justification: In private cloud (especially managed), CSP often handles: physical security (A may apply), but during setup, provider typically configures IAM (D), audit logging infrastructure (C), and incident response processes (B). Shared responsibility model applies.

Q22: Which service does Azure Active Directory provide?

Option A: Vulnerability management
Option B: Identity and access management
Option C: Infrastructure management
Option D: Enterprise security
✅ Correct Answer: B

🔍 Justification: Azure AD is Microsoft’s cloud-based Identity and Access Management (IAM) service—handling authentication, SSO, MFA, conditional access, and directory services. It is not a full vulnerability or infrastructure management tool.

Q23: Select the License designed for managing privileged identities or Privileged Identity Management (PIM).

Option A: Azure Active Directory Free
Option B: Azure Active Directory Basic
Option C: Azure Active Directory Premium P1
Option D: Azure Active Directory Premium P2
✅ Correct Answer: D

🔍 Justification: Azure AD P2 includes Privileged Identity Management (PIM) for just-in-time privileged access, approval workflows, and access reviews. P1 lacks PIM; Free/Basic have minimal IAM features.

Q24: What are the mandatory details that you should provide to create users in Azure Active Directory? [Select three options]

Option A: Username
Option B: Name
Option C: Password
Option D: Role
✅ Correct Answer: A, B, C

🔍 Justification: To create a cloud-only user in Azure AD, you must provide: User principal name (username), Display name, and initial password (or force password change). Role assignment is optional post-creation.

Q25: When a guest user is trying to access your organization’s resources by authenticating through Azure Active Directory, he can use:

Option A: Only enterprise identity
Option B: Newly created identity with your organization
Option C: Only Microsoft identity as Azure AD is a Microsoft product
Option D: Any enterprise, social or local identity
✅ Correct Answer: D

🔍 Justification: Azure AD B2B collaboration supports guest authentication via: existing work/school accounts (enterprise), Microsoft accounts (social), or email-based one-time passcodes (local)—providing flexible external access.

📜 Chapter 4: Compliance & Regulations

Q1: To whom does PCI DSS apply?

Option A: Only to merchants who own a Point-of-Sale (PoS) terminal device.
Option B: To all entities involved in payment card processing.
Option C: Only to acquirers
Option D: Only to payment service providers
✅ Correct Answer: B

🔍 Justification: PCI DSS applies universally to all entities in the payment chain: merchants, processors, acquirers, issuers, service providers—anyone handling cardholder data.

Q2: Which of the following is NOT a type of cardholder data that must be protected according to PCI DSS?

Option A: Primary Account Number (PAN)
Option B: Cardholder name
Option C: Email address
Option D: Cardholder’s birthdate
✅ Correct Answer: C

🔍 Justification: PCI DSS mandates protection of PAN, cardholder name, service code, expiration date. Email address and birthdate are not defined as cardholder data under PCI DSS (though they may be PII under other regulations).

Q3: What is the primary purpose of HIPAA?

Option A: To improve the quality of healthcare services
Option B: To reduce healthcare costs
Option C: To protect patients’ medical information
Option D: To increase access to healthcare insurance
✅ Correct Answer: C

🔍 Justification: HIPAA’s Privacy and Security Rules specifically aim to protect Protected Health Information (PHI)—ensuring confidentiality, integrity, and availability of patient medical data.

Q4: What is the significance of the “business associate” concept under HIPAA?

Option A: Entities that perform certain functions for covered entities must also comply with HIPAA regulations.
Option B: Business associates are exempt from HIPAA if they only handle de-identified PHI.
Option C: Covered entities are not responsible for breaches caused by their business associates.
Option D: HIPAA does not apply to non-healthcare entities.
✅ Correct Answer: A

🔍 Justification: HIPAA requires Business Associate Agreements (BAAs) because vendors handling PHI on behalf of covered entities (e.g., cloud providers, billing services) must also comply with HIPAA safeguards.

Q5: You work as a nurse at a hospital. A police officer requests access to a patient’s medical records for a criminal investigation. Can you release the records without the patient’s consent?

Option A: Yes, you can release the records with a court order or subpoena.
Option B: No, you cannot release the records without the patient’s written authorization.
Option C: You can release if info is relevant and you’ve notified the patient.
Option D: Depends on hospital policies and local regulations.
✅ Correct Answer: A

🔍 Justification: HIPAA permits disclosure of PHI for law enforcement purposes with a court order, subpoena, or warrant (45 CFR § 164.512(f)). Patient consent is not required in these legally compelled scenarios.

Q6: What are the potential consequences of non-compliance with GDPR? [Select Three correct options]

Option A: The non-compliant company will be fined.
Option B: Mandatory data breach notification to all affected individuals.
Option C: Suspension of data processing activities.
Option D: Suspension of all business operations
✅ Correct Answer: A, B, C (Source shows “abe” – likely typo; E not listed)

🔍 Justification: GDPR enforcement includes: fines up to 4% global turnover (A), mandatory breach notifications within 72h (B), and corrective orders including processing suspension (C). Full business suspension (D) is extreme and rare.

Q7: Acme Inc. is a multinational e-commerce company… headquartered in Germany… collect customer data… leverage for targeted marketing… comply with GDPR. Which actions are NOT required by GDPR? [Select Three]

Option A: Implement clear privacy notices…
Option B: Implement technical/organizational measures for data security.
Option C: Obtain explicit consent for each specific purpose (e.g., targeted marketing).
Option D: Transfer data to third-party processors only under strict contractual agreements…
✅ Correct Answer: A, C, D (Source shows “acd”)

🔍 Justification: ⚠️ This is nuanced:

A is REQUIRED (transparency principle, Art. 12-14)
B is REQUIRED (security, Art. 32)
C: For marketing, consent or legitimate interest may apply; explicit consent is not always mandatory if legitimate interest is properly balanced (Art. 6)
D is REQUIRED for international transfers (Art. 28, 44+)
Source answer “acd” suggests A, C, D are “not required”, which conflicts with GDPR text. Likely source error; B is definitely required.

Q8: You’re a marketing manager for global e-commerce… run targeted ad campaign for European customers based on browsing history. Do you need explicit consent under GDPR?

Option A: Yes, explicit consent is required for any personalized advertising based on user data.
Option B: No, you can rely on legitimate interest… if you provide opt-out.
Option C: It depends… anonymized data may not require consent.
Option D: No, you can rely on implied consent…
✅ Correct Answer: A

🔍 Justification: For personalized advertising using personal data, GDPR generally requires explicit consent (especially under ePrivacy Directive for cookies/tracking). Legitimate interest is hard to justify for marketing without consent (EDPB guidelines). Anonymized data (C) is outside GDPR scope, but browsing history is typically personal data.

Q9: Which personal data requires more protection as per GDPR? [Choose two options]

Option A: Trade union membership
Option B: Data concerning health
Option C: Username and password
Option D: IP address and Geolocation
✅ Correct Answer: A, B

🔍 Justification: GDPR Article 9 defines Special Category Data requiring heightened protection: racial/ethnic origin, political opinions, religious beliefs, trade union membership, genetic/biometric data, health data, sex life/orientation. Username/password (C) and IP/geolocation (D) are personal data but not “special category”.

Q10: How long must companies retain business records and communications under SOX?

Option A: 1 year
Option B: 3 years
Option C: 5 years
Option D: Indefinitely
✅ Correct Answer: C

🔍 Justification: Sarbanes-Oxley Act Section 802 mandates retention of audit/workpapers and relevant records for 5 years from the end of the fiscal period to which they relate.

Q11: Which statement accurately describes a key requirement for achieving SOX compliance?

Option A: All financial transactions must be approved by external auditors before being recorded.
Option B: Risks to financial reporting must be identified and appropriate controls must be in place to mitigate them.
Option C: The company’s internal control framework must be identical to others in same industry.
Option D: Financial statements must only be disclosed to investors who signed NDAs.
✅ Correct Answer: B

🔍 Justification: SOX Section 404 requires management to assess and report on internal controls over financial reporting (ICFR), including risk identification and control implementation. External auditor attestation is required, but not pre-approval of transactions (A).

Q12: What is the “CEO and CFO certification” requirement under SOX? [Select TWO]

Option A: CEOs and CFOs must personally prepare the company’s financial statements.
Option B: They must sign off on the accuracy of the financial statements.
Option C: A company requires the signature of the CEO to file tax returns.
Option D: They must certify the accuracy of all company data.
Option E: (Implied) They must certify effectiveness of internal controls
✅ Correct Answer: B, C

🔍 Justification: SOX Section 302 requires CEO/CFO to certify: (1) accuracy of financial statements (B), and (2) effectiveness of disclosure controls/internal controls (E). They don’t prepare statements (A); tax filing (C) is separate; “all company data” (D) is too broad.

Q13: You are the CFO of a publicly traded tech company… CEO pressures you to accelerate revenue recognition… recognize entire revenue upfront despite only delivering first phase. What are potential consequences of complying under SOX? [Select Two]

Option A: No consequences if revenue eventually recognized later.
Option B: Financial restatements, SEC fines, potential criminal charges for fraud.
Option C: Increased internal control oversight and requirement for additional disclosures.
Option D: Loss of investor confidence and reputational damage, regardless of future recognition.
✅ Correct Answer: B, D

🔍 Justification: Premature revenue recognition violates GAAP and SOX. Consequences include: SEC enforcement (fines, restatements, criminal liability) (B), and irreversible reputational/investor trust damage (D). “No consequences” (A) is false; increased oversight (C) may occur but isn’t the primary penalty.

Q14: Which international standard defines the requirements for an ISMS?

Option A: ISO/IEC 27000
Option B: PCI DSS
Option C: HIPAA
Option D: GDPR
✅ Correct Answer: A

🔍 Justification: ISO/IEC 27001 (part of 27000 family) specifies requirements for establishing, implementing, and maintaining an Information Security Management System (ISMS). PCI DSS, HIPAA, GDPR are sector-specific regulations.

Q15: Payd Payments was attacked… exposing details of over 100,000 credit cards… due to vulnerability leading to spyware installation. Payd Payments can be deemed out of compliance of which Security Standard/Regulation?

Option A: HIPAA
Option B: Sarbanes-Oxley (SOX)
Option C: PCI DSS
Option D: None of the above
✅ Correct Answer: C

🔍 Justification: PCI DSS applies to any entity storing, processing, or transmitting cardholder data. A breach exposing credit card details directly implicates PCI DSS non-compliance. HIPAA covers health data; SOX covers financial reporting.

Q16: Which of the following are NOT requirements of the PCI DSS? [Select two correct options]

Option A: To regularly monitor and test networks.
Option B: To regularly monitor and test networks. (duplicate of A)
Option C: To maintain a policy that addresses information security for all personnel.
Option D: To install and maintain a firewall configuration to protect cardholder data.
Option E: (Implied) Something not in PCI DSS
✅ Correct Answer: C, E (Source shows “ce”)

🔍 Justification: ⚠️ Source has duplicate options (A/B). PCI DSS does require: firewall config (D), network monitoring (A/B), and security policy (C). If “ce” is correct, “e” likely refers to a non-requirement like “encrypt all internal traffic” (not mandated). Recommend verifying exact options.

Q17: Which statements are FALSE about PCI DSS?

I. Refers to policies framed jointly in 2004 by Visa, MasterCard, Discover, AmEx
II. Framed solely for preventing financial scandals and frauds
III. Mandates organizations to have a Vulnerability Management System
IV. Mandates planning, implementation, maintenance of InfoSec Policy by all entities

Option A: 1 and 2
Option B: 1,2,3 and 4
Option C: 1 and 4
Option D: 1,3 and 4
✅ Correct Answer: D (Source shows “d”)

🔍 Justification: Statement I is true (PCI SSC was formed by those brands). II is false (PCI DSS focuses on cardholder data protection, not all frauds). III is true (Req 11). IV is true (Req 12). So false statements are only II, but source answer “d” (1,3,4 false) contradicts. Likely source error; correct answer should be “only II” or option not listed.

🛡️ Chapter 5: Web Application Security

Q1: Which statements are TRUE regarding WAFs working in Negative Security Model? [Select THREE]

Option A: Best for web applications on internal network.
Option B: Best for web applications on public internet.
Option C: Easier to implement.
Option D: No false positives
✅ Correct Answer: B, C, D (Source shows “bcd”)

🔍 Justification: ⚠️ Negative model = block known bad (signatures).

B: Suitable for public apps facing known threats
C: Easier than positive model (allow known good)
D: False – negative model does have false positives (blocking legitimate traffic matching signatures)
Source answer likely contains error; D is not true. Positive model has fewer false positives but higher false negatives.

Q2: Which statements are TRUE regarding WAFs working in Positive Security Model? [Select THREE]

Option A: Also blocks a lot of legitimate traffic.
Option B: Best for web applications on internal network.
Option C: Does not prevent zero-day attacks.
Option D: More false positives.
✅ Correct Answer: A, B, D (Source shows “abd”)

🔍 Justification: ⚠️ Positive model = allow only known good (whitelisting).

A: True – strict policies may block legitimate new behaviors
B: True – ideal for controlled internal apps with predictable traffic
D: True – over-restriction causes false positives
C: False – positive model can block zero-days if they deviate from allowed patterns
Source answer “abd” aligns if C is excluded.

Q3: In which deployment mode of WAF, WAF connects via the span port?

Option A: Bridge mode
Option B: Transparent proxy mode
Option C: Reverse proxy mode
Option D: Monitoring mode
✅ Correct Answer: D

🔍 Justification: Monitoring (passive) mode uses SPAN/mirror port to observe traffic without inline blocking—ideal for tuning, auditing, or low-risk environments. Inline modes (bridge, proxy) actively intercept traffic.

Q4: In which deployment mode of WAF, all features are available thereby latency is also high?

Option A: Bridge mode
Option B: Transparent proxy mode
Option C: Reverse proxy mode
Option D: Monitoring mode
✅ Correct Answer: C

🔍 Justification: Reverse proxy mode terminates client connections, inspects full HTTP/S traffic, and forwards to backend—enabling all WAF features (SSL offload, content rewriting) but adding latency due to full proxying.

Q5: If you want to easily deploy a WAF achieving high performance, which mode would you prefer?

Option A: Bridge mode
Option B: Transparent proxy mode
Option C: Reverse proxy mode
Option D: Monitoring mode
✅ Correct Answer: A

🔍 Justification: Bridge (inline tap) mode operates at Layer 2, forwarding packets with minimal processing—lower latency than proxy modes. Suitable for high-throughput environments where deep inspection isn’t needed.

Q6: Which deployment mode of WAF can help us in fine tuning false positives/negatives?

Option A: Bridge mode
Option B: Transparent proxy mode
Option C: Reverse proxy mode
Option D: Monitoring mode
✅ Correct Answer: D

🔍 Justification: Monitoring mode allows observing traffic and WAF alerts without blocking, enabling safe tuning of rules to reduce false positives/negatives before switching to inline enforcement.

Q7: What is the best position of Web Application Firewall (WAF) in a typical on-premises infrastructure?

Option A: Behind the load balancing tier
Option B: Ahead of the load balancing tier
Option C: In line with the load balancing tier
Option D: (Blank)
✅ Correct Answer: A

🔍 Justification: Placing WAF behind the load balancer allows: (1) LB handles SSL termination/DDoS, (2) WAF inspects decrypted traffic, (3) easier scaling. Placing ahead may expose WAF to direct attacks; inline with LB adds complexity.

Q8: A web application firewall (WAF) can be a —– appliance that prevents vulnerabilities in web applications from being exploited by outside threats.

Option A: virtual and physical
Option B: virtual
Option C: physical
Option D: virtual or physical
✅ Correct Answer: D

🔍 Justification: WAFs can be deployed as physical appliances (on-prem hardware), virtual appliances (VM in datacenter), or cloud-based SaaS—flexibility to match architecture. “Virtual or physical” (D) covers the main on-prem options.

Q9: The web traffic carried through the network by HTTPS SSL protocols specifically is analyzed by the —-.

Option A: IPS
Option B: IDS
Option C: NGFW
Option D: WAF
✅ Correct Answer: D

🔍 Justification: WAFs specialize in inspecting application-layer (Layer 7) HTTP/S traffic, including SSL/TLS decrypted content, to detect web attacks. IPS/IDS focus on network/transport layers; NGFW includes WAF features but WAF is purpose-built.

Q10: Which of the following statements are TRUE?

Option A: WAF acts as a reverse proxy protecting the server from the client.
Option B: WAF acts as a reverse proxy protecting the client from the server.
Option C: Proxy server acts as a proxy protecting the identity of the client.
Option D: Proxy server acts as a proxy protecting the identity of the server.
✅ Correct Answer: A, C

🔍 Justification:

A: True – WAF in reverse proxy mode sits in front of web servers, filtering malicious client requests
C: True – Forward proxy hides client IP from external servers
B/D: False – WAF doesn’t protect clients from servers; proxy doesn’t hide server identity

Q11: What specific vulnerabilities typically found in web services, remote and inter-process communication (RPC/IPC), could potentially lead to arbitrary remote code execution?

Option A: Sensitive Data Exposure
Option B: Cross Site Scripting
Option C: Insecure Deserialization
Option D: Cross Site Request Forgery
✅ Correct Answer: C

🔍 Justification: Insecure Deserialization (e.g., Java, .NET, PHP) allows attackers to manipulate serialized objects to execute arbitrary code during deserialization—critical in RPC/API contexts. XSS (B) and CSRF (D) target browsers; sensitive data exposure (A) is confidentiality issue.

Q12: You are developing a web application that uses a third-party API… API requires you to provide your application’s secret key in the API calls. What vulnerability might this be?

Option A: Insecure Deserialization
Option B: Broken Authentication
Option C: Sensitive Data Exposure
Option D: Insufficient Logging and Monitoring
✅ Correct Answer: C

🔍 Justification: Embedding API keys in client-side code or URLs risks exposure via logs, browser history, or network sniffing—a Sensitive Data Exposure issue (OWASP A3). Keys should be stored server-side or use token-based delegation.

Q13: Web Applications can be protected from attacks by ensuring:

Option A: Up-to-date encryption
Option B: Proper authentication
Option C: Developing a holistic security strategy
Option D: Following a good software development hygiene
Option E: (Implied) All of the above
✅ Correct Answer: E

🔍 Justification: Comprehensive web security requires defense in depth: encryption (A), strong auth (B), strategic planning (C), and secure SDLC practices (D). No single measure suffices.

Q14: What are the most important steps you would recommend for securing a new web server?

a) Input Validation enforced within code – Security QA testing
b) Configured to display generic error messages
c) Implement a software security policy
d) Remove or protect hidden files and directories

Option A: a and c
Option B: b and d
Option C: a,b and d
Option D: a,b,c and d
✅ Correct Answer: D

🔍 Justification: All listed steps are critical:

input validation prevents injection (a);

generic errors avoid info leakage (b);

security policy guides configuration (c);

hiding files prevents enumeration (d).

Holistic hardening is essential.

Q15: How would you perform a security/penetration test on a web application covering the “Authenticated tests with one user account” scenario?

Option A: Test for brute forcing, password cracking, rainbow table attacks, account lockouts, clickjacking, session fixation…
Option B: Test for the usual suspects from the OWASP Top 10
Option C: Test for horizontal privilege escalation, vertical privilege escalation, and forceful browsing
Option D: (Blank)
✅ Correct Answer: B

🔍 Justification: For authenticated testing with one account, focus on OWASP Top 10 vulnerabilities (e.g., broken access control, XSS, insecure direct object references) that can be tested within a single authenticated session. Privilege escalation (C) requires multiple accounts; brute-force (A) targets auth, not post-login.

Q16: A web application allows users to search for products using keywords… search functionality can be used to get list of all products based on keywords entered. What type of vulnerability is this?

Option A: Cross-Site Request Forgery (CSRF)
Option B: Cross-Site Scripting (XSS) attack
Option C: SQL Injection Attack
Option D: XML External Entity (XXE) attack
✅ Correct Answer: C

🔍 Justification: If user input in search is concatenated into SQL query without parameterization, attackers can inject SQL to extract all products (or more)—classic SQL Injection. XSS (B) would execute script in browser; CSRF (A) tricks user into submitting requests.

Q17: What are two common secure coding practices that can help prevent XSS attacks?

Option A: Disabling the use of escape characters and inline scripting.
Option B: Implementing input validation and output sanitization.
Option C: Implementing secure authentication and authorization.
Option D: Using a web application firewall (WAF).
✅ Correct Answer: B (Source shows “ab” – likely typo; B is primary)

🔍 Justification: Input validation (reject malicious input) and output encoding/sanitization (escape data before rendering) are core secure coding practices to prevent XSS. WAF (D) is a compensating control, not coding practice. Disabling escape chars (A) would increase XSS risk.

Q18: What is XSS or “Cross-Site Scripting”?

Option A: Attack that forces website to echo client-supplied data, which executes in user’s browser
Option B: Attempt to flood service with excessive traffic so it’s inaccessible
Option C: Cyberattack inserting SQL query to read/modify data, spoof identity, etc.
Option D: Attack manipulating cookie sent back to server to bypass security or steal info
✅ Correct Answer: A

🔍 Justification: XSS occurs when untrusted data is injected into a web page and executed in victim’s browser (e.g., stealing cookies, session hijacking). B is DoS; C is SQLi; D describes cookie tampering/session fixation.

Q19: Which statements are TRUE regarding Web Application Firewalls (WAF)? [Select three CORRECT options]

Option A: They have lower false positive rate.
Option B: They have higher false positive rate.
Option C: They tend to perform very slow when too many rules are added.
Option D: They tend to perform effectively when all possible rules are added.
Option E: (Implied) They require tuning
Option F: (Implied) Rules affect user experience
✅ Correct Answer: B, C, F (Source shows “bcf”)

🔍 Justification: WAFs often have higher false positives (B) due to signature matching; performance degrades with rule count (C); and rules can block legitimate traffic, affecting UX (F). “All rules” (D) increases false positives; lower FP (A) is not typical without tuning.

Q20: A web application allows users to upload files. The application does not verify content type of uploaded files. What type of vulnerability is this?

Option A: SQL Injection
Option B: Cross-Site Scripting (XSS)
Option C: Insecure Direct Object References
Option D: Insecure Cryptographic Storage
✅ Correct Answer: B (Note: Unrestricted file upload can lead to XSS, RCE, etc.)

🔍 Justification: ⚠️ Source answer is “b” (XSS), but unrestricted file upload is broader.
If uploaded files contain malicious scripts and are served with executable MIME type, they can trigger stored XSS. However, this vulnerability can also lead to RCE, phishing, etc. Best practice: validate file type, scan, store outside web root.

Q21: A Web site that allows users to enter text… stores and later displays to other users, is potentially vulnerable to ______ attack.

Option A: SQL injection
Option B: Cross-site scripting (XSS)
Option C: Sensitive Data Exposure
Option D: Broken Authentication
✅ Correct Answer: B

🔍 Justification: User-generated content displayed to others without proper output encoding is classic stored XSS vector. SQLi (A) targets database queries; sensitive data exposure (C) involves unprotected data at rest/in transit.

Q22: Select the attack/vulnerability against which a typical Web Application Firewall does NOT provide protection?

Option A: Business Logic manipulation attacks
Option B: Bot attacks
Option C: XSS
Option D: SQL injection
✅ Correct Answer: A

🔍 Justification: WAFs use rule-based/signature-based detection for known attacks (XSS, SQLi, bots).

Business logic flaws (e.g., skipping payment steps, coupon abuse) require understanding application workflow—beyond typical WAF capabilities.

🔑 Chapter 6: Identity, Access & Endpoint Security

Q1: Identify the wrong statement(s).

(i) Domain computers can be either in different subnets or same subnet.
(ii) All computers act like peers and no computer has control over the other in a workgroup.
(iii) The accounts in SAM database will replicate over all server machines.

Option A: only (iii)
Option B: only (i)
Option C: (i) and (ii)
Option D: (ii) and (i)
✅ Correct Answer: A

🔍 Justification:

(i) True: Domain-joined computers can be on any subnet with DC connectivity
(ii) True: Workgroup is peer-to-peer; no central authority
(iii) False: SAM (Security Accounts Manager) is local to each machine; only Active Directory replicates accounts across domain controllers.

Q2: Robin is part of two Groups:

“Educators-All” and “Managers-All”.

Folder “Finance-ETA” permissions: “Educators-All”: Deny ‘Modify’;

“Managers-All”: Allow ‘Full Control’.

What is Robin’s effective permission?

Option A: Robin can read but can’t modify the folder
Option B: Robin will have full control
Option C: Robin can read but can’t write
Option D: Robin can’t access the folder
✅ Correct Answer: D

🔍 Justification: In Windows permissions, Deny always overrides Allow. Since Robin is in “Educators-All” with Deny Modify, this blocks write/modify/delete—even if “Managers-All” grants Full Control. Result: No access (or read-only if Deny is only for Modify; but source answer D suggests complete denial).

Q3: Enny noticed most employees in Retric.ltd frequently use Windows Store App. As Windows administrator, she wants to restrict access so only Sales Group can access it. How can she accomplish this?

Option A: Using AppLocker by allowing Sales group to access the Windows Store App
Option B: Set NTFS security permission as ‘Allow’ to Sales group for accessing the Windows Store App
Option C: Set NTFS security permission as ‘Deny’ to other groups for not accessing the Windows Store App
Option D: Set account lockout policies to other groups
✅ Correct Answer: A

🔍 Justification: AppLocker (or Windows Defender Application Control) controls which apps users/groups can run based on publisher, path, or hash—ideal for restricting Store apps. NTFS permissions (B,C) control file access, not app execution; lockout policies (D) are for auth failures.

Q4: Which of the following are true with respect to cloud-based password managers?

Option A: Cloud based password manager is an example of SaaS.
Option B: Since passwords of multiple users are stored in cloud, it’s an example of community cloud.
Option C: Cloud based password managers eliminate possibility of password theft.
Option D: User passwords must be protected from unauthorized access from CSP using encryption and access control.
✅ Correct Answer: A, D

🔍 Justification:

A: True – Password managers like LastPass, 1Password are SaaS applications
D: True – Shared responsibility: user encrypts vault with master key; CSP must secure infrastructure
B: False – Multi-tenancy doesn’t make it “community cloud” (which is for specific communities with shared concerns)
C: False – No system eliminates theft risk; master password compromise or client-side malware can still expose passwords

Q5: Which of the following statement(s) is/are true?

(1) Active Directory Domain Service has a centralized database.
(2) Child domain name is combined with parent domain name to form its own unique DNS.
(3) When a new child domain is created, it automatically trusts the parent domain, and vice versa

Option A: Only (1)
Option B: Only (1) and (2)
Option C: (1), (2), (3)
Option D: Only (1) and (3)
✅ Correct Answer: C

🔍 Justification:

(1) True: AD DS uses a centralized, multi-master replicated database (NTDS.dit)
(2) True: child.contoso.com inherits parent namespace
(3) True: Parent-child domains have automatic two-way transitive trust in AD forest

Q6: Many applications use _______ where two independent factors are used to identify a user.

Option A: Two-factor authentication
Option B: Single Sign On
Option C: Cross-site scripting
Option D: SQL Injection
✅ Correct Answer: A

🔍 Justification: Two-factor authentication (2FA/MFA) requires two distinct factors: something you know (password), have (token), or are (biometric)—significantly reducing account compromise risk vs. single-factor auth.

Q7: What is the goal of implementing security controls?

Option A: To eliminate all risk
Option B: To comply with regulations
Option C: To mitigate risks to an acceptable level
Option D: To deter hackers
✅ Correct Answer: C

🔍 Justification: Security controls aim to reduce risk to an acceptable level (risk treatment), not eliminate all risk (impossible) or solely comply/deter. Cost-benefit analysis guides control selection.

Q8: Which of the following statements accurately describes the purpose of endpoint security?

Option A: To provide a centralized platform for managing and controlling multiple computers.
Option B: To emphasize the need for individual antivirus programs on each device.
Option C: To provide access to specific applications or websites on managed endpoints.
Option D: To replace the traditional perimeter-based security model entirely.
✅ Correct Answer: A

🔍 Justification: Modern endpoint security (EDR, XDR) provides centralized visibility, policy enforcement, and threat response across distributed devices—critical with remote work. It complements, not replaces (D), perimeter security.

Q9: You’re the security architect for a global investment bank… need robust endpoint security balancing centralized management, scalability, data protection… complex network with legacy systems. Which endpoint security models/features would best address needs? [Select TWO]

Option A: Hybrid Model – Managing both on-premise agents and cloud services is less complex
Option B: SaaS Model – Compatible with legacy system
Option C: Hybrid Model – combines centralized management benefits of cloud-based solution with on-premise control
Option D: Zero Trust Network Access (ZTNA) – Integrating ZTNA with existing infrastructure is easy
Option E: (Implied) Another correct option
✅ Correct Answer: C, E (Source shows “ce”)

🔍 Justification:

C: Hybrid model offers flexibility for mixed environments (cloud management + on-prem control for legacy)
E: Likely refers to agent-based EDR with offline capabilities or ZTNA for secure access
A is false (hybrid adds complexity); B is misleading (SaaS may not support legacy); D is false (ZTNA integration can be complex)

Q10: Jack is working on Symantec endpoint security. He wants a third-party vendor to remotely manage the host server and its security programs. Which model must he implement?

Option A: Client Server Model
Option B: Software-as-a-Service (SaaS) Model
Option C: Model View Controller (MVC) Model
Option D: Hardware-as-a-Service (HaaS) Model
✅ Correct Answer: B

🔍 Justification: SaaS allows vendors to remotely manage security software via cloud console—ideal for managed security services. Client-server (A) is on-prem architecture; MVC (C) is app design pattern; HaaS (D) is hardware rental.

Q11: Bruno is working on Symantec endpoint security. He wants to manage endpoints by centrally hosting the security program and installing an accompanying program on each endpoint device. Which mode of operation should Bruno adopt?

Option A: SaaS Model
Option B: Model View Controller (MVC)
Option C: Client Server Model
Option D: Hybrid Model
✅ Correct Answer: C

🔍 Justification: Client-Server model: Central management server hosts policies/console; lightweight agents (clients) on endpoints report and enforce policies. Classic architecture for on-prem endpoint management.

Q12: Which model of endpoint security involves remote maintenance of security software by the vendor?

Option A: SaaS (Software-as-a-Service) Model
Option B: Client-Server Model
Option C: Cloud-based Model
Option D: Hybrid Model
✅ Correct Answer: A

🔍 Justification: SaaS implies the vendor hosts, updates, and maintains the security software; customers access via subscription. Client-server (B) typically requires customer-maintained infrastructure.

Q13: Your company has adopted remote work model with employees using personal laptops to access sensitive data. How can you ensure secure access while minimizing intrusion on employee privacy? [Select TWO]

Option A: Deploy cloud-based Endpoint Detection and Response (EDR) solution
Option B: Implement Single Sign-On (SSO) with Multi-Factor Authentication (MFA)
Option C: Utilize data loss prevention (DLP) technologies
Option D: Enforce mandatory full disk encryption on all devices
✅ Correct Answer: A, B

🔍 Justification:

A: Cloud EDR provides threat detection without deep personal data inspection (privacy-preserving)
B: SSO+MFA secures access without monitoring device content
C (DLP) and D (encryption) are important but more intrusive on personal devices; A/B balance security and privacy.

Q14: Consider that you are working as a security analyst and want to prevent data breach if company-provided laptops get stolen. Which endpoint security techniques must you implement? [Select TWO]

Option A: EFS
Option B: Antivirus
Option C: BitLocker
Option D: IDS
✅ Correct Answer: A, C

🔍 Justification: EFS (Encrypting File System) and BitLocker provide full-disk or file-level encryption, protecting data at rest if device is stolen. Antivirus (B) and IDS (D) address malware/network threats, not physical theft.

Q15: How does secure design help mitigate risk of session hijacking attacks?

Option A: By implementing secure communication protocols like HTTPS and TLS
Option B: By employing session cookies with strong encryption and short expiration times
Option C: By requiring two-factor authentication for all user login attempts
Option D: By regularly monitoring user activity for suspicious behaviour
✅ Correct Answer: B

🔍 Justification: Session hijacking exploits stolen session tokens. Mitigations include: secure cookie flags (HttpOnly, Secure), short timeouts, token regeneration after login. HTTPS (A) protects in transit but not if token is stolen; MFA (C) protects login, not active sessions.

Q16: What is a threat agent?

Option A: A person or organization that wants to harm an organization or individual.
Option B: A weakness in a system or application that can be exploited.
Option C: An attack that has been successfully launched.
Option D: A security control that is not working properly.
✅ Correct Answer: A

🔍 Justification: Threat agent (or threat actor) = entity capable of carrying out a threat (e.g., hacker, insider, nation-state). Vulnerability (B) is a weakness; attack (C) is the action; control failure (D) is a risk factor.

Q17: Which of the following things can be used to determine if an individual or group is a threat agent?

Option A: Threat agent = Exploit + Intentions + Capabilities
Option B: Threat agent = Vulnerability + Exploit + Capabilities
Option C: Threat agent = Exploit + Capabilities + Past Impact
Option D: Threat agent = Intentions + Capabilities + Past activities
✅ Correct Answer: D

🔍 Justification: Threat assessment considers: Intent (motivation), Capability (skills/resources), and History (past activities) to gauge likelihood of threat agent action. Exploits/vulnerabilities are tools/weaknesses, not agent attributes.

Q18: Which tool do you use to determine whether there are any malfunctioning devices connected to the system and to disable any specific hardware components attached to it?

Option A: Performance counter
Option B: Troubleshooter
Option C: Device manager
Option D: Resource monitor
✅ Correct Answer: C

🔍 Justification: Device Manager (Windows) lists all hardware, shows status (errors, conflicts), and allows enabling/disabling devices—essential for hardware troubleshooting. Others monitor performance or guide fixes but don’t control hardware directly.

Q19: Kelly, a system administrator receives a ticket: “Unable to find critical files due to resizing of storage device”. What is the possible action Kelly can take?

Option A: Creating Partitions
Option B: Mounting
Option C: Unmounting
Option D: Both a and b
✅ Correct Answer: A

🔍 Justification: After resizing storage, partitions may need recreation/extension to utilize new space, and filesystems may need resizing. Mounting (B) is for making filesystems accessible; if partition table is outdated, files won’t be found.

Q20: Maria wants to restart her PC within 10 seconds. Which command should be used if OS is Windows Server 2012 Core?

Option A: Shutdown /r /t 10
Option B: Restart /r /t 0
Option C: Shutdown /r /t 0
Option D: Restart /r /t 10
✅ Correct Answer: A

🔍 Justification: Windows shutdown command: /r = restart, /t xx = time in seconds. shutdown /r /t 10 schedules restart in 10 seconds. “Restart” is not a valid command; /t 0 is immediate.

Q21: A company has decided to install a server core machine for monitoring a new setup. What could be the possible reason/s to select core machine?

(i) Very less management overhead for core machine.
(ii) Since it’s “set and forget” installation, after initial config deployments, overdue works would not be there.

Option A: Both (i) and (ii)
Option B: Only (i)
Option C: Only (ii)
Option D: Neither (i) nor (ii)
✅ Correct Answer: A

🔍 Justification: Server Core has no GUI, reducing attack surface, patching frequency, and resource usage—lower management overhead (i). Ideal for dedicated roles (DNS, monitoring) requiring minimal interaction (“set and forget”) (ii).

Q22: Carly was checking users created by running command cat /etc/shadow for user Brian. Entry: Brian:!!:13786:0:99999:10:::. What can Carly infer?

Option A: Brian has not set the password yet
Option B: Brian is no longer a part of organization
Option C: Brian’s password is not encrypted
Option D: Brian’s password is expired
✅ Correct Answer: A

🔍 Justification: In /etc/shadow, !! or ! in password field indicates locked account or no password set. !! specifically means password is disabled—user cannot authenticate with password (may use SSH key).

Q23: Laxmi found entries of 2 employees who tried to download software from blocked sites: cat /etc/shadow | grep -e “Tom” -e “Jerry” | cut -d “:” -f2 ; Tom:!!djkfhsduahyfuishyfi ; Jerry:!gfhjgfjefhjkegdfugfk ; What is the action taken against Tom and Jerry?

Option A: Tom’s account is locked using passwd command and Jerry’s account is locked using usermod command
Option B: Accounts of Tom and Jerry are deleted
Option C: Tom’s account is deleted and Jerry’s account is locked using usermod command
Option D: Tom’s account is locked using usermod command and Jerry’s account is locked using passwd command
✅ Correct Answer: A

🔍 Justification:

Tom:!!… → !! = account locked via passwd -l (adds ! to hashed password)
Jerry:!… → single ! = locked via usermod -L (prefixes ! to password hash)
Both indicate locked accounts, but the prefix pattern suggests different commands were used.

Q24: Alex wants to install rpm software package called pidgin-4.7.9-5.el6.2.796.rpm, but doesn’t want to print hash marks as the package archive is unpacked. Which command must Alex execute?

Option A: rpm -iv pidgin-4.7.9-5.el6.2.796.rpm
Option B: rpm -ivh pidgin-4.7.9-5.el6.2.796.rpm
Option C: rpm -vh pidgin-4.7.9-5.el6.2.796.rpm
Option D: rpm -ih pidgin-4.7.9-5.el6.2.796.rpm
✅ Correct Answer: A

🔍 Justification: RPM flags: -i = install, -v = verbose, -h = print hash marks during install. To suppress hash marks, omit -h: use rpm -iv (A). -ivh (B) shows hashes; -vh (C) is for query, not install.

Q25: Which of the below can be used to install packages when Red Hat Package Manager fails to resolve dependencies on its own?

Option A: YUM Package Manager
Option B: Node.js Package Manager
Option C: dpkg Package Manager
Option D: APT package manager
✅ Correct Answer: A

🔍 Justification: YUM (and DNF) are higher-level package managers for RHEL/CentOS that automatically resolve and install dependencies from configured repositories—unlike rpm which handles single packages manually.

Q26: Which ipconfig command option displays a detailed list of all network adapters and their configurations?

Option A: /all
Option B: /a
Option C: /network
Option D: /flushdns
✅ Correct Answer: A

🔍 Justification: ipconfig /all shows full adapter details: IP, subnet, gateway, DNS, MAC, DHCP lease, etc. /flushdns clears resolver cache; other options are invalid.

Q27: As an administrator, you do not want to assign the IP address 10.0.0.50 to any machines. Which option needs to be updated while creating a DHCP scope?

Option A: Reservations
Option B: Exclusions
Option C: Router’s IP address
Option D: WINS Server’s IP address
✅ Correct Answer: B

🔍 Justification: Exclusions define IP addresses within a DHCP scope that the server will not assign to clients—reserving them for static assignment (e.g., servers, printers). Reservations (A) assign specific IPs to specific MACs.

Q28: Kevin is administrator of Global.org. He changed default lease period of IP address to 20 days. Now he wants to change lease period back to default value. What is the default value?

Option A: 180 days
Option B: 8 days
Option C: 30 days
Option D: 31 days
✅ Correct Answer: B

🔍 Justification: In Windows DHCP Server, the default lease duration is 8 days for wired clients. This balances address reuse with network stability. Wireless clients often have shorter defaults (e.g., 1 hour).

Q29: Steve as administrator is managing a domain with 200 users across 2 locations. He has only one domain controller. He has been asked to implement a fail-over plan for the DC. What can be the feasible solution?

Option A: Create an additional domain controller
Option B: Create a member server and run ADDS role
Option C: Create a backup of the domain controller
Option D: The dc should be up and running all the time there is no solution for this
✅ Correct Answer: A

🔍 Justification: Adding a second domain controller provides redundancy: if one fails, the other authenticates users and replicates AD data. Backups (C) aid recovery but don’t provide real-time failover. Member server (B) isn’t a DC unless ADDS is promoted.

🎯 Chapter 7: Security Operations & Advanced Topics

Q137: Select the best choice of honeypot for scenarios:

i. ACE Bank: concerned about cyberattacks targeting financial institutions… implement robust security solution to identify and analyze attacks.
ii. ADE Clothing Company: concerned about unauthorized access… need cost-effective, easy-to-manage solution to detect attempts.
iii. Secure Bank: security team keeps genuine-looking data in machines and monitors accesses with sensors.

Option A: i-High Interaction, ii-Low interaction, iii-Pure Honeypots
Option B: i-Low, ii-High, iii-Pure
Option C: i-Pure, ii-Low, iii-High
Option D: i-Low, ii-Pure, iii-High
✅ Correct Answer: A

🔍 Justification:

i (Bank, high-risk): High-interaction for deep threat intel
ii (Clothing, cost-sensitive): Low-interaction (emulated services) for lightweight detection
iii (Bank, decoy data): Pure honeypot (real system with fake data) to study attacker behavior

Q138: A NIDS is monitoring network traffic and encounters packet: Source IP: 10.0.0.1, Destination IP: 192.168.1.1, Protocol: TCP, Source Port: 65535, Destination Port: 22. Rules: 1. Drop any inbound TCP packets on port 22 from external networks. 2. Alert on any outbound TCP packets on high-privileged ports (>1023) to external IPs. How will NIDS handle this packet?

Option A: Drop the packet due to Rule 1.
Option B: Alert on the packet due to Rule 2.
Option C: Allow the packet as it originates from internal network.
Option D: NIDS cannot determine origin and requires further analysis.
✅ Correct Answer: B

🔍 Justification: Source IP 10.0.0.1 is private/internal (RFC 1918). Packet is outbound from internal to external (192.168.1.1 may be misstated; assuming external). Source port 65535 (>1023) to destination port 22 (SSH) matches Rule 2: alert on outbound high-port to external. Rule 1 applies to inbound from external.

Q139: How does Microsoft Enhanced Mitigation Experience Toolkit (EMET) strengthen endpoint security?

Option A: It provides a layered defense against memory-based attacks.
Option B: It encrypts sensitive data stored on endpoint devices.
Option C: It prevents unauthorized access to network resources.
Option D: It monitors user activity and detects suspicious behavior.
✅ Correct Answer: A

🔍 Justification: EMET (now deprecated, replaced by Windows Defender Exploit Guard) applied mitigations like DEP, ASLR, CFG to harden applications against memory corruption exploits (buffer overflows, ROP). It did not handle encryption (B), network access (C), or behavioral monitoring (D).

Q140: You are managing a network for a small business with departments: Sales, Marketing, Accounting, IT… using pfSense firewall. Which firewall rule would NOT be appropriate?

Option A: Allow Sales subnet to CRM server subnet on port 443
Option B: Allow Marketing subnet to internet on ports 80/443
Option C: Allow Accounting subnet to internet on 80/443 + specific banking IPs on 443
Option D: Allow IT subnet to any internal subnet and internet on any port
✅ Correct Answer: D

🔍 Justification: Principle of least privilege: IT needs broad access for management, but “any port” to internet (D) is excessive and risky. Rules should restrict to necessary ports (e.g., SSH, RDP, SNMP). A, B, C follow least privilege for business needs.

Q1: Your company has dedicated internal network… concerned about unauthorized access and malicious activity within network. Which firewall would you recommend?

Option A: Packet Filtering firewall
Option B: Circuit-level gateway
Option C: Application Firewall
Option D: Packet Capturing Firewall
✅ Correct Answer: B (Note: Source answer is “b”, but Application Firewall (C) is more appropriate for internal threats)

🔍 Justification: ⚠️ Source answer is “b” (Circuit-level), but:

Circuit-level gateways (Layer 5) validate TCP handshakes but don’t inspect payload—weak against internal app-layer attacks.
Application firewall (C) inspects Layer 7 traffic, detecting malicious payloads even from internal sources.
Recommend verifying source intent; for internal threat detection, NGFW/App firewall is preferred.

Q2: Which of the following statements is TRUE regarding data security within cloud environment?

Option A: CSP is solely accountable for securing both infrastructure and data stored within it.
Option B: Security of infrastructure and data is a shared responsibility between CSP and company.
Option C: Security is solely responsibility of company.
Option D: Data security is not primary concern as it’s in-built.
✅ Correct Answer: B

🔍 Justification: Shared Responsibility Model: CSP secures cloud infrastructure (physical, hypervisor); customer secures data, apps, OS, IAM. This varies by service model (IaaS/PaaS/SaaS) but is never solely one party’s duty.

Q3: A growing company with multiple departments needs to segment network to improve security and performance… prevent sensitive data traveling between departments, ensure dedicated bandwidth. Which device best addresses this?

Option A: Repeater
Option B: Router
Option C: Hub
Option D: Switch
✅ Correct Answer: B

🔍 Justification: Routers segment networks at Layer 3, enabling:

Inter-VLAN routing with ACLs to control inter-department traffic
QoS policies for dedicated bandwidth
Firewall integration for security
Switches (D) segment at Layer 2 but require router/firewall for policy enforcement.

Q4: What are two major benefits of using threat modelling in secure design?

Option A: Identify potential threats and vulnerabilities early in development process.
Option B: Prioritize security requirements and allocate resources effectively.
Option C: Improve communication and collaboration between developers and security professionals.
Option D: Reduce time and cost of security testing and compliance activities.
✅ Correct Answer: A, C (Source shows “ac”)

🔍 Justification: Threat modeling (e.g., STRIDE) enables:

Early identification of design flaws (A)
Cross-team alignment on risks and mitigations (C)
Prioritization (B) and cost reduction (D) are secondary benefits.

Q5: You are investigating a suspected file system intrusion… discover hidden directory “.xfiles” with unknown executables. What are MOST likely indicators of intrusion attempts? [Select FOUR]

Option A: Directory is only accessible with root privileges.
Option B: Files have timestamps from several months ago.
Option C: Files have cryptic names and no accompanying documentation.
Option D: File permissions has been modified.
Option E: (Implied) Files are in unusual location
Option F: (Implied) Files have suspicious hashes/signatures
✅ Correct Answer: C, D, E, F (Source shows “cdef”)

🔍 Justification: Indicators of compromise (IoCs):

C: Obfuscated filenames hide malicious intent
D: Permission changes may enable persistence/privilege escalation
E: Hidden dirs (.xfiles) in non-standard paths suggest stealth
F: Unknown binaries with malicious hashes are red flags
A (root-only) is normal for system dirs; B (old timestamps) may be legitimate.

Q6: Which of the following are characteristics of a High Interaction Honeypot? [Select FOUR correct options]

Option A: Deeply realistic emulation of real systems and services.
Option B: Ability to engage attackers in extended interactions and activities.
Option C: Low resource footprint and minimal maintenance requirements.
Option D: Extensive logging and data collection capabilities for attacker analysis.
Option E: (Implied) High risk if compromised
Option F: (Implied) Used for research/threat intel
✅ Correct Answer: A, B, D, E/F (Source shows “abde”)

🔍 Justification: High-interaction honeypots (e.g., full OS) offer: realistic environments (A), prolonged attacker engagement (B), rich telemetry (D), but have high resource use and risk (C is false – that describes low-interaction). Used for threat research (F).

Q7: A job executes on 4th and 15th day of September and May every 20 minutes between 10am and 10pm. Choose correct crontab entry.

Option A: 0,20,40 10-20 4,15 5,6 * /script.sh
Option B: 4-15 5,6 0,20,40 10-20 * /script.sh
Option C: 4,15 5-6 0,20,40 10-20 * /script.sh
Option D: 4,15 5,6 0,20,40 10,20 * /script.sh
✅ Correct Answer: A

🔍 Justification: Crontab format: minute hour day month weekday command

Minutes: 0,20,40 (every 20 mins)
Hours: 10-20 (10am to 8pm; 20 = 8pm in 24h)
Days: 4,15
Months: 5,6 (May=5, September=9 – ⚠️ source has 5,6 which is May/June; likely typo; should be 5,9)
Weekday: * (any)
Assuming source intended months 5 and 9, answer A is structurally correct.

Q8: Octal notation representation of permission set is 4464. What is permissions in symbolic mode?

Option A: u-rs,g-rw,o-r
Option B: g-rs,u-rw,o-r
Option C: u-r,g-rsw,o-r
Option D: u-r,g-rw,o-rs
✅ Correct Answer: A

🔍 Justification: Octal 4464 = binary 100 100 110 100

Special bits (first digit 4): setuid (s on user execute)
Owner (4): r– but setuid makes it r-s if execute bit set; here execute is 0 → r–? Wait, 4 = r–
Actually, 4-digit octal: 4 (special) + 4 (user) + 6 (group) + 4 (other)
Special 4 = setuid
User 4 = r– → with setuid: r– (no execute, so S uppercase)
Group 6 = rw-
Other 4 = r–
Symbolic: u=rS,g=rw,o=r → but options use – for missing bits. Option A: u-rs likely means user has read and setuid (but no execute → S). Interpretation varies; source answer A is accepted.

Q9: Ben wants to access Amazon EC2 instance directly using ssh. Which authentication helps?

Option A: EC2 Key pairs
Option B: MFA Tokens
Option C: AWS Account Username and Password
Option D: AWS IAM Username and Password
✅ Correct Answer: A

🔍 Justification: EC2 Key Pairs (SSH key pairs) are the standard method for SSH access to Linux instances. IAM credentials (D) are for AWS API/console; MFA (B) adds protection to IAM login; console password (C) doesn’t enable SSH.

Q10: Stephan wants to check IAM actions, STS actions and AWS management console sign-ins. Which AWS service should be used?

Option A: Cloud Trial
Option B: Trusted advisor
Option C: Cloud Watch
Option D: Cloud formation
✅ Correct Answer: C (Note: CloudTrail is correct; source likely has typo)

🔍 Justification: ⚠️ CloudTrail (not listed) logs IAM, STS, and console sign-in events. CloudWatch (C) is for metrics/logs monitoring but doesn’t natively store audit logs. Source answer “c” likely intends CloudTrail; verify options.

Q11: Which among the below is correct format of an IAM user ARN for user with name Ryan?

Option A: arn:aws:iam:::user/Ryan
Option B: arn:aws:iam::user:/Ryan
Option C: arn:aws::user:user/Ryan
Option D: arn:aws::iam::user:user/Ryan
✅ Correct Answer: A

🔍 Justification: IAM User ARN format: arn:aws:iam::account-id:user/username. Option A has empty account ID (valid for current account context). Others have syntax errors (extra colons, misplaced slashes).

Q12: Katherine is a security administrator and wants to implement secure access of resources to users in AWS tenant. What feature in AWS can be used?

Option A: Virtual MFA using AWS Cognito Service
Option B: Virtual MFA using AWS CloudWatch service
Option C: Virtual MFA using AWS CloudTrail service
Option D: Virtual Multifactor authentication using AWS IAM service
✅ Correct Answer: D

🔍 Justification: AWS IAM natively supports enabling Virtual MFA devices (e.g., Google Authenticator) for users/roles. Cognito (A) is for app user identity; CloudWatch (B) and CloudTrail (C) are monitoring/logging services.

Q13: A popular online store uses simple password hashing algorithm easily cracked… many accounts compromised. Which vulnerability is exploited?

Option A: Broken Authentication
Option B: Broken Access Control
Option C: Insecure Direct Object References
Option D: Security Misconfiguration
✅ Correct Answer: A

🔍 Justification: Broken Authentication (OWASP A2) includes weak credential recovery, session management, and insecure password storage (e.g., unsalted MD5). Cracked hashes lead to account takeover—core auth failure.

Q14: Ursula implement PAT using private port range. Which port range should be chosen?

Option A: 1024-4761
Option B: 0-1023
Option C: 4762-49151
Option D: 49152-65535
✅ Correct Answer: D

🔍 Justification: PAT (Port Address Translation) uses ephemeral ports for outbound connections. IANA recommends 49152-65535 (Dynamic/Private Ports) for this purpose to avoid conflicts with well-known (0-1023) and registered (1024-49151) ports.

Q15: In —- mode of Web Application Firewall deployment, the interfaces of LAN and WAN must be on different physical networks. And same logic switch must be used for both web servers and LAN interface.

Option A: Bridge mode
Option B: Transparent proxy mode
Option C: Reverse proxy mode
Option D: Monitoring mode
✅ Correct Answer: A

🔍 Justification: Bridge mode (Layer 2 inline) requires WAF to sit between two network segments (WAN/LAN) on separate physical interfaces, often sharing a switch with protected servers for seamless traffic forwarding without IP reconfiguration.

Q16: Which of the following statements are TRUE regarding Web Application Firewall (WAF)? [Select THREE]

Option A: It is one-time configuration system.
Option B: Its performance is inversely proportional to number of rules.
Option C: It needs to be upgraded frequently.
Option D: Its rules will indirectly affect user experience.
✅ Correct Answer: B, C, D

🔍 Justification:

B: More rules = more processing = lower throughput
C: Threat landscape evolves; rules/signatures need updates
D: Overly strict rules may block legitimate traffic (false positives)
A: False – WAF requires ongoing tuning and maintenance

Q17: A company wants to automatically deploy their application to cloud using CI/CD. Which technologies would they use? [Select correct options]

Option A: Jenkins
Option B: Docker
Option C: Kubernetes
Option D: Maven
✅ Correct Answer: A, C (Source shows “ac”)

🔍 Justification:

Jenkins (A): CI/CD orchestration server
Kubernetes (C): Container orchestration for deployment automation
Docker (B) is containerization; Maven (D) is build tool—both support CI/CD but Jenkins+K8s form a complete deployment pipeline.

Q18: A software development team finds it difficult to manage complex infrastructure configurations and deployments across multiple environments. They want a solution that simplifies deployment and reduces manual effort. Which technology is most likely to provide desired benefits?

Option A: Infrastructure as Code (IaC)
Option B: GitOps
Option C: Container orchestration platform
Option D: Serverless computing
✅ Correct Answer: A

🔍 Justification: Infrastructure as Code (e.g., Terraform, CloudFormation) defines infrastructure in declarative files, enabling version control, repeatability, and automated deployments across environments—directly addressing configuration management complexity.

Q19: Which of the following is a software interface through which a computer communicates with a printer?

Option A: Printer port
Option B: Printer driver
Option C: Logical Printer
Option D: Print Server
✅ Correct Answer: B

🔍 Justification: Printer driver translates application print jobs into printer-specific language (PCL, PostScript), acting as the OS-to-hardware interface. Printer port (A) is physical/logical connection; logical printer (C) is OS abstraction; print server (D) manages network printing.

Q20: Cryptomining is an activity of producing cryptocurrency… malware performs cryptomining on other people’s computers… Cloud computers are often victims. Which feature of cloud computing will be adversely affected?

Option A: Metered billing
Option B: On demand self-service portal
Option C: Network accessibility
Option D: Resource pooling
✅ Correct Answer: A

🔍 Justification: Cryptojacking consumes CPU/GPU cycles, increasing compute usage. In cloud’s metered billing model (pay-per-use), this leads to unexpected cost spikes—direct financial impact. Other features aren’t directly monetized per usage.

Q21: MNO Ltd company’s data center experienced server failure… need to recover applications quickly. Which feature of virtualization would have been most helpful?

Option A: Live migration
Option B: Fault tolerance
Option C: High availability
Option D: Scalability
✅ Correct Answer: B

🔍 Justification: Fault Tolerance (e.g., VMware FT) maintains a live shadow VM that takes over instantly on host failure—zero downtime. High Availability (C) restarts VM on another host (brief downtime); live migration (A) is for maintenance, not failure recovery.

Q22: Name the containerization platform that packages application and all its dependencies…

Option A: DevOps
Option B: Agile
Option C: Microservices
Option D: Dockers
✅ Correct Answer: D

🔍 Justification: Docker is the leading containerization platform that bundles app + dependencies into portable containers, ensuring consistency across dev/test/prod. DevOps/Agile are methodologies; microservices is an architecture style.

Q23: When asking how to test a web application firewall, it is best to use a WAF testing framework that follows these steps:

a. Test application without WAF in front.
b. Verify if attacks still succeed with WAF in default configuration.
c. Configure WAF to determine if it can block attacks in first two steps.
d. Verify if attacks still go through after WAF configured to block them.
Please select suitable options.

Option A: a and c
Option B: b and d
Option C: a, b and d
Option D: a, b, c and d
✅ Correct Answer: D

🔍 Justification: Comprehensive WAF testing requires: baseline without WAF (a), default config test (b), tuning (c), and post-tuning validation (d)—full lifecycle validation ensures effectiveness.

Q24: What is the name of type of cloud managed by CSP and available for individual/enterprise customers?

Option A: Private cloud
Option B: Public cloud
Option C: Community cloud
Option D: Shared cloud
✅ Correct Answer: B

🔍 Justification: Public cloud (AWS, Azure, GCP) is owned/managed by CSP and offered to general public/enterprises on pay-as-you-go basis. Private (A) is single-tenant; community (C) is shared by specific group; “shared cloud” (D) is not a standard term.

Q25: You are the IT security manager for a large e-commerce platform… PCI compliance audit finds outdated firmware… How can you best address this? [Select Two]

Option A: Document situation and justify risk in risk assessment…
Option B: Implement compensating controls such as increased vulnerability scanning and network segmentation…
Option C: (Duplicate of B)
Option D: Immediately shut down affected devices and prioritize replacing them…
✅ Correct Answer: A, B

🔍 Justification: PCI DSS allows risk-based approach:

A: Formal risk acceptance with documentation is permitted if compensating controls exist
B: Compensating controls (segmentation, enhanced monitoring) mitigate risk of unpatchable devices
D: Shutting down critical payment systems may cause business disruption; not always feasible
Note: Source shows “be” – likely B and E (not listed); A+B is standard practice.

Q26: A user device on a network receives an unsolicited packet with sequence number higher than expected… Which firewall is most likely to detect and drop?

Option A: Packet-filtering firewall
Option B: Stateful inspection firewall
Option C: Deep packet inspection firewall
Option D: Application-level firewall
✅ Correct Answer: B

🔍 Justification: Stateful firewalls track TCP sequence numbers and connection state. An unsolicited packet with unexpected sequence violates state table, indicating spoofing/session hijacking—dropped as invalid. Packet filters (A) don’t track state; DPI (C) and app firewalls (D) focus on payload.

Q27: What is a potential downside of using a stateful inspection firewall?

Option A: It requires more processing power and memory resources.
Option B: It can be more challenging to configure and maintain.
Option C: It may introduce vulnerabilities if the state table is compromised.
Option D: It can be more susceptible to denial-of-service attacks.
✅ Correct Answer: A

🔍 Justification: Stateful inspection maintains connection state tables, requiring more CPU/memory than stateless packet filtering—potential performance bottleneck under high traffic. Other options are situational but not the primary trade-off.

Q28: Your organization deploys endpoint vulnerability management… attacker exploits zero-day vulnerability… Which endpoint security strategies would be most effective? [Select TWO]

Option A: Increase application whitelisting
Option B: Implementing application control to only allow authorized applications
Option C: Perform vulnerability scanning more frequently
Option D: Enable IDS/IPS with zero-day attack signatures
✅ Correct Answer: B, D

🔍 Justification: For zero-days (no patch available):

B: Application control/whitelisting blocks execution of unauthorized binaries, including zero-day payloads
D: Modern IDS/IPS use behavioral/heuristic detection for zero-day patterns
A: Similar to B but less granular; source likely groups them
C: Scanning finds known vulns, not zero-days

Q29: Select CORRECT statements from below options. [Select 2]

Option A: In SaaS you will not have visibility over backend infrastructure
Option B: In PaaS you have infrastructure management overhead
Option C: In IaaS you will not have control over choice of operating system
Option D: Google compute engine is an IaaS offering
✅ Correct Answer: A, D

🔍 Justification:

A: True – SaaS abstracts infrastructure; customer sees only app
D: True – Google Compute Engine is IaaS (VMs, storage, networking)
B: False – PaaS removes infrastructure management overhead
C: False – IaaS gives full OS choice (customer manages OS)

Q30: Rachel is using an access control list type which should be placed close to the destination. What is the type of ACL used?

Option A: Standard ACL
Option B: Static ACL
Option C: Dynamic ACL
Option D: Extended ACL
✅ Correct Answer: A

🔍 Justification: Standard ACLs (filter by source IP only) should be placed close to destination to avoid over-blocking. Extended ACLs (source/dest/port) are placed close to source to filter early. This is Cisco best practice.

Q31: With respect to ISO/OSI model, WAFs operate at —— level whereas network firewalls operate at ——- level

Option A: 7th, 3rd
Option B: 3rd, 7th
Option C: 1st, 3rd
Option D: 3rd, 4th
✅ Correct Answer: A

🔍 Justification: WAFs inspect HTTP/S traffic at Layer 7 (Application). Traditional network firewalls filter IP/port at Layer 3 (Network) and Layer 4 (Transport). NGFWs bridge both layers.

Q32: Which is NOT a common application of cryptography?

Option A: Online banking
Option B: Video conferencing
Option C: Text messaging
Option D: Cloud storage
✅ Correct Answer: C

🔍 Justification: ⚠️ Source answer is “c”, but all options use cryptography.
Modern text messaging (Signal, WhatsApp) uses end-to-end encryption. If referring to SMS, it lacks encryption—but the question says “text messaging” generically. Likely source error; all are valid crypto applications.

Q33: What information does an application-level gateway analyze to make decisions about traffic?

Option A: Source and destination IP addresses
Option B: Port numbers
Option C: Content of the data packets
Option D: (Blank)
✅ Correct Answer: C

🔍 Justification: Application-level gateways (proxies) operate at Layer 7, inspecting payload content (HTTP headers, commands, data) to enforce policy—unlike packet filters (A,B) that only check headers.