Application Security (AppSec) and Information Security (InfoSec) are critical disciplines that help organizations protect applications, systems, networks, and sensitive data from cyber threats.
This collection of multiple-choice questions is designed for cybersecurity professionals, security analysts, penetration testers, developers, DevSecOps engineers, and interview candidates looking to strengthen their understanding of key security concepts.
The questions cover a wide range of topics including the CIA Triad, risk management, cryptography, network security, vulnerability assessment, penetration testing, web application security, API security, cloud security, OWASP vulnerabilities, secure development practices, and incident response, making it an excellent resource for interview preparation, certification study, and knowledge assessment.
1. What does the “I” in the CIA Triad stand for?
A. Inspection
B. Integrity
C. Intelligence
D. Isolation
Answer: B. Integrity
Explanation: Integrity ensures that data remains accurate and unaltered by unauthorized parties.
2. Which term represents a weakness that can be exploited by an attacker?
A. Threat
B. Risk
C. Vulnerability
D. Asset
Answer: C. Vulnerability
Explanation: A vulnerability is a weakness in a system that can be exploited by a hacker.
3. What is the primary function of an IPS?
A. Monitor logs only
B. Prevent and block attacks
C. Store security events
D. Encrypt network traffic
Answer: B. Prevent and block attacks
Explanation: IPS (Intrusion Prevention System) actively blocks malicious activity, while IDS mainly detects and alerts.
4. Which protocol provides stronger security features than SSL?
A. FTP
B. SSH
C. TLS
D. Telnet
Answer: C. TLS
Explanation: TLS is the successor to SSL and offers enhanced security protections.
5. Which attack involves secretly intercepting communication between two parties?
A. DoS
B. MITM
C. SQL Injection
D. XSS
Answer: B. MITM
Explanation: Man-in-the-Middle attacks occur when an attacker intercepts communications between two entities.
6. What is the primary goal of a Vulnerability Assessment?
A. Simulate attacks
B. Find and prioritize vulnerabilities
C. Decrypt passwords
D. Monitor employees
Answer: B. Find and prioritize vulnerabilities
Explanation: Vulnerability assessments identify weaknesses and rank them according to severity.
7. Which is more focused on simulating real-world attacks?
A. Vulnerability Scan
B. Penetration Test
C. Log Analysis
D. Risk Assessment
Answer: B. Penetration Test
Explanation: Penetration testing attempts to exploit vulnerabilities like a real attacker.
8. In symmetric encryption:
A. Different keys are used for encryption and decryption
B. A single key is used for both operations
C. No key is required
D. Only public keys are used
Answer: B. A single key is used for both operations
Explanation: Symmetric cryptography uses the same key for encryption and decryption.
9. Which of the following is a commonly used symmetric encryption algorithm?
A. RSA
B. Diffie-Hellman
C. AES
D. DSA
Answer: C. AES
Explanation: AES (128/192/256-bit) is one of the most widely used symmetric encryption algorithms.
10. What is the purpose of an Initialization Vector (IV)?
A. Replace encryption keys
B. Prevent pattern repetition in encrypted data
C. Generate passwords
D. Compress data
Answer: B. Prevent pattern repetition in encrypted data
Explanation: IVs help make encrypted output unique, reducing the risk of pattern-based attacks.
11. Which block cipher mode is generally considered less secure because it does not use an IV?
A. CBC
B. GCM
C. ECB
D. CTR
Answer: C. ECB
Explanation: ECB encrypts identical plaintext blocks into identical ciphertext blocks, revealing patterns.
12. What is a Rainbow Table primarily used for?
A. Firewall configuration
B. Password cracking
C. Packet analysis
D. Encryption
Answer: B. Password cracking
Explanation: Rainbow tables contain precomputed hash values used to crack passwords.
13. Social Engineering targets:
A. Hardware flaws
B. Network protocols
C. Human behavior
D. Encryption algorithms
Answer: C. Human behavior
Explanation: Social engineering manipulates people into revealing sensitive information.
14. What is a Zero-Day Exploit?
A. Attack against old software
B. Exploit used before a patch is available
C. DOS attack
D. Password attack
Answer: B. Exploit used before a patch is available
Explanation: A zero-day exploit targets a vulnerability before a fix is released.
15. ARP Spoofing can result in:
A. Improved encryption
B. Data interception on LANs
C. Database optimization
D. Faster routing
Answer: B. Data interception on LANs
Explanation: ARP spoofing maps the attacker’s MAC address to a legitimate IP address, allowing traffic interception.
16. Which of the following helps mitigate ARP poisoning?
A. Telnet
B. Static ARP Entries
C. FTP
D. DNS Cache
Answer: B. Static ARP Entries
Explanation: Static ARP mappings reduce the possibility of forged ARP responses.
17. What is a VLAN?
A. Encrypted connection
B. Virtual LAN grouping hosts logically
C. Routing protocol
D. Authentication server
Answer: B. Virtual LAN grouping hosts logically
Explanation: VLANs allow devices to communicate as though they are on the same LAN regardless of physical location.
18. Which protocol is commonly associated with secure remote access?
A. HTTP
B. SMTP
C. VPN
D. ARP
Answer: C. VPN
Explanation: VPNs securely connect users to private networks over public networks.
19. In penetration testing, which approach provides the tester with full source code access?
A. Black Box
B. Gray Box
C. White Box
D. Blind Box
Answer: C. White Box
Explanation: White-box testing provides complete access to source code and architecture details.
20. What is Forward Secrecy?
A. Password rotation mechanism
B. Encryption using ephemeral session keys
C. Data compression method
D. Firewall rule
Answer: B. Encryption using ephemeral session keys
Explanation: Forward Secrecy ensures past encrypted sessions remain secure even if a private key is compromised later.
21. Which authentication factor is represented by biometrics?
A. Something you know
B. Something you have
C. Something you are
D. Something you own
Answer: C. Something you are
Explanation: Biometrics are physical characteristics such as fingerprints or facial recognition.
22. Which vulnerability allows malicious scripts to execute in a user’s browser?
A. CSRF
B. SQL Injection
C. XSS
D. ARP Spoofing
Answer: C. XSS
Explanation: Cross-Site Scripting (XSS) injects malicious client-side scripts into web pages.
23. What is the most common defense against CSRF?
A. VPN
B. Captcha
C. CSRF Tokens
D. Port Blocking
Answer: C. CSRF Tokens
Explanation: Unique CSRF tokens validate that requests originate from legitimate users.
24. To prevent SQL Injection, which practice is recommended?
A. Hard-coded credentials
B. Detailed error messages
C. Input sanitization and stored procedures
D. Disable HTTPS
Answer: C. Input sanitization and stored procedures
Explanation: Sanitized inputs and parameterized queries/stored procedures help prevent SQL Injection attacks.
25. If data must be compressed and encrypted before transmission, what should be done first?
A. Encrypt then compress
B. Compress then encrypt
C. Encrypt only
D. Compress only
Answer: B. Compress then encrypt
Explanation: Compression removes redundancy before encryption, making transmission more efficient.
