ThatQuiz
|
Test Library
|
Take this test now
IASEC2 MIDTERM REVIEWER: PASS AWAY EDITION - Quiz
  • 1. Fillin the blank: Papa__
A) Papanaw
B) Salamat Shopee
C) Sinong 8080 gumawa nito?
D) Long ass quiz...
E) Papasa
  • 2. A team wants to scan its application's source code, bytecode, or binaries for security flaws without running the program. Which type of testing fits?
A) Interactive Application Security Testing (IAST)
B) Dynamic Application Security Testing (DAST)
C) Static Application Security Testing (SAST)
D) Software Composition Analysis (SCA)
E) Penetration testing
  • 3. A team wants to evaluate a running application from the outside by simulating real-world hacker attacks. Which type of testing fits?
A) Software Composition Analysis (SCA)
B) Vulnerability assessment
C) Interactive Application Security Testing (IAST)
D) Dynamic Application Security Testing (DAST)
E) Static Application Security Testing (SAST)
  • 4. Which type of testing combines features of SAST and DAST by placing security agents inside a running application's environment?
A) Interactive Application Security Testing (IAST)
B) Static Application Security Testing (SAST)
C) Dynamic Application Security Testing (DAST)
D) Penetration testing
E) Software Composition Analysis (SCA)
  • 5. An application relies on many third-party libraries and open-source dependencies. Which type of testing checks them for known vulnerabilities or licensing issues?
A) Penetration testing
B) Software Composition Analysis (SCA)
C) Interactive Application Security Testing (IAST)
D) Dynamic Application Security Testing (DAST)
E) Static Application Security Testing (SAST)
  • 6. Which open-source web application security testing tool automatically sends test requests and analyzes the responses for vulnerabilities?
A) Nessus
B) OWASP ZAP
C) Burp Suite
D) Wireshark
E) SonarQube
  • 7. A tester wants to capture a login request, then view, modify, and resend it using Proxy, Repeater, and Intruder. Which tool fits?
A) Nessus
B) SonarQube
C) OWASP ZAP
D) Metasploit
E) Burp Suite
  • 8. Which tool is a source code analysis tool that detects security vulnerabilities and coding problems in applications?
A) AirCrack
B) Nessus
C) Burp Suite
D) SonarQube
E) OWASP ZAP
  • 9. An admin needs to scan a server, a network device, and an application, compare the results with a database of known vulnerabilities, and get a report with Critical, High, Medium, and Low risk levels. Which tool fits?
A) OWASP ZAP
B) Wireshark
C) SonarQube
D) Nessus
E) Burp Suite
  • 10. True or False: In the application security testing process, Reporting comes before Vulnerability Identification.
A) False
B) True
  • 11. What is Network Access Control (NAC)?
A) A standard that secures credit and debit card transactions
B) A security system that controls and monitors who can access a network by allowing only verified users and compliant devices
C) A protocol that creates an encrypted tunnel over the internet
D) A platform that collects and correlates logs from every zone
E) A tool that analyzes source code for security vulnerabilities
  • 12. Which type of NAC occurs before a device joins the network?
A) Network Access Server
B) Post-Admission NAC
C) Policy Server
D) Access Requestor
E) Pre-Admission NAC
  • 13. A device is already on the network and tries to reach a sensitive area. Which type of NAC restricts this lateral movement by requiring re-authentication?
A) Pre-Admission NAC
B) Network Access Server
C) Post-Admission NAC
D) Policy Server
E) Access Requestor
  • 14. Which NAC element determines the access level based on identity, permissions, device posture, and request type?
A) Network Access Server (NAS)
B) Policy Server
C) Post-Admission NAC
D) Pre-Admission NAC
E) Access Requestor (AR)
  • 15. A remote employee connects to the internal network through a VPN gateway. Which NAC element acts as the access control point?
A) Pre-Admission NAC
B) Policy Server
C) Post-Admission NAC
D) Access Requestor (AR)
E) Network Access Server (NAS)
  • 16. Which NAC element includes laptops, servers, IP cameras, printers, and IoT devices that request network access?
A) Post-Admission NAC
B) Policy Server
C) Pre-Admission NAC
D) Access Requestor (AR)
E) Network Access Server (NAS)
  • 17. A device that only partially meets an organization's security policy tries to connect to the network. What can a NAC system do?
A) Ignore its compliance status
B) Grant it restricted access
C) Grant it full access automatically
D) Delete the device's data
E) Disconnect every other device
  • 18. True or False: According to the slides, NAC protects against threats that originate within the network, such as insider attacks.
A) False
B) True
  • 19. A team is performing threat modeling to identify possible attacks and weaknesses in its system architecture. Which SSDLC phase is this?
A) Design Phase
B) Development Phase
C) Testing Phase
D) Maintenance Phase
E) Planning Phase
  • 20. In which SSDLC phase are both functional and security requirements gathered and documented?
A) Requirements Phase
B) Maintenance Phase
C) Deployment Phase
D) Design Phase
E) Development Phase
  • 21. In which SSDLC phase does the project team identify business goals, security objectives, potential risks, and compliance requirements?
A) Requirements Phase
B) Planning Phase
C) Deployment Phase
D) Design Phase
E) Testing Phase
  • 22. In which SSDLC phase are code reviews, security guidelines, and automated scanning tools used to detect vulnerabilities such as SQL injection and cross-site scripting?
A) Deployment Phase
B) Planning Phase
C) Requirements Phase
D) Development Phase
E) Maintenance Phase
  • 23. In which SSDLC phase may vulnerability assessments, penetration testing, SAST, and DAST be carried out?
A) Design Phase
B) Deployment Phase
C) Testing Phase
D) Planning Phase
E) Maintenance Phase
  • 24. Before release, a team configures the application securely and sets up access controls, monitoring systems, and backups. Which SSDLC phase is this?
A) Development Phase
B) Testing Phase
C) Maintenance Phase
D) Planning Phase
E) Deployment Phase
  • 25. In which SSDLC phase must the software be continuously monitored and updated with security patches and bug fixes?
A) Design Phase
B) Maintenance Phase
C) Testing Phase
D) Planning Phase
E) Requirements Phase
  • 26. True or False: The Secure Software Development Life Cycle extends the traditional SDLC by adding security-focused practices.
A) False
B) True
  • 27. What is a Denial of Service (DoS) attack?
A) An attack where criminals pretend to be a trusted person or organization
B) A malicious cyber threat that makes a computer, website, or network resource unavailable to its legitimate users
C) An attack that injects malicious client-side scripts into a trusted website
D) An attack that tricks a browser into sending an unwanted request
E) An attack that injects malicious SQL queries through user inputs
  • 28. Which type of DoS attack saturates a targeted server with an overwhelming amount of packets?
A) Phishing attack
B) Reflected attack
C) Error-based attack
D) Buffer overflow attack
E) Flood attack
  • 29. According to the slides, which DoS prevention method is the simplest and least effective?
A) Cloud mitigation provider
B) Multi-Factor Authentication
C) Internet Service Provider
D) Firewall
E) Parameterized queries
  • 30. Which type of SQL injection occurs when an attacker intentionally causes the database to generate an error message?
A) Union-based SQL injection
B) DOM-based XSS
C) Error-based SQL injection
D) Blind SQL injection
E) Stored XSS
  • 31. Which type of SQL injection uses the UNION operator to combine the results of two or more SELECT statements?
A) Stored XSS
B) Blind SQL injection
C) Union-based SQL injection
D) Reflected XSS
E) Error-based SQL injection
  • 32. When does Blind SQL injection occur?
A) When malicious input is permanently stored by the application
B) When the browser inserts user data into the page without sanitization
C) When attackers cannot see query results directly on the webpage
D) When user input is immediately returned in the server response
E) When the database is made to generate an error message on purpose
  • 33. Which of the following is listed as a way to prevent SQL injection?
A) Grant users full database privileges
B) Disable input validation
C) Trust all user input
D) Display detailed database errors to users
E) Use prepared statements and parameterized queries
  • 34. Malicious input is permanently stored by an application and runs every time users visit the affected page. Which type of XSS is this?
A) Stored XSS
B) Error-based SQL injection
C) Reflected XSS
D) DOM-based XSS
E) Union-based SQL injection
  • 35. Which type of XSS occurs when user input is immediately returned in the server response without proper validation or encoding?
A) Union-based SQL injection
B) DOM-based XSS
C) Stored XSS
D) Reflected XSS
E) Blind SQL injection
  • 36. Which type of XSS occurs when JavaScript in the browser inserts user-controlled data into the page without proper sanitization?
A) Reflected XSS
B) Stored XSS
C) DOM-based XSS
D) Error-based SQL injection
E) Blind SQL injection
  • 37. A user is logged in to a website, and their browser is tricked into sending an unwanted request to that site. Which vulnerability is this?
A) Cross-Site Scripting
B) Phishing
C) Denial of Service
D) CSRF
E) SQL Injection
  • 38. Which cyberattack involves criminals pretending to be a trusted person or organization to trick people into sharing sensitive information, clicking a bad link, or downloading malware?
A) Denial of Service
B) SQL Injection
C) Phishing
D) Cross-Site Scripting
E) CSRF
  • 39. True or False: CSRF tokens and SameSite cookies are listed as ways to prevent CSRF.
A) False
B) True
  • 40. Which U.S. law criminalizes unauthorized access to computer systems?
A) SOX
B) Computer Fraud & Abuse Act (CFAA)
C) HIPAA
D) GLBA
E) FISMA
  • 41. Which U.S. law sets security and privacy standards for patient health data?
A) HIPAA
B) GLBA
C) COPPA
D) CFAA
E) FISMA
  • 42. Which U.S. law requires financial institutions to protect customer personal information?
A) Gramm-Leach-Bliley Act (GLBA)
B) HIPAA
C) SOX
D) FISMA
E) COPPA
  • 43. Which U.S. law governs data practices for services aimed at children?
A) COPPA
B) SOX
C) GLBA
D) CFAA
E) HIPAA
  • 44. Which U.S. agency regulates cybersecurity under its authority to police unfair or deceptive trade practices?
A) DHS
B) Federal Trade Commission (FTC)
C) NIST
D) DOJ / FBI
E) Information Commissioner's Office
  • 45. Which law gives California residents the right to know, access, delete, and opt out of the sale of their personal data?
A) GDPR
B) NIS Directive
C) HIPAA
D) CCPA / CPRA
E) PDPA
  • 46. Which standard provides protocols and guidelines that secure credit and debit card transactions?
A) NIST Cybersecurity Framework
B) ISO/IEC 27001
C) PCI-DSS
D) HIPAA
E) CMMC
  • 47. True or False: The NIST Cybersecurity Framework is a law.
A) False
B) True
  • 48. Which type of hacking is done with permission, finds security weaknesses, and follows rules and agreements?
A) Data theft
B) Ethical hacking
C) Malicious hacking
D) Identity theft
E) Cyber fraud
  • 49. Which type of hacking is done without permission and can steal or destroy information?
A) Vulnerability assessment
B) Data privacy
C) Malicious hacking
D) Compliance auditing
E) Ethical hacking
  • 50. What does data privacy mean?
A) Protecting personal and sensitive information
B) Sharing data with any organization
C) Collecting as much data as possible
D) Deleting all data every day
E) Making all collected data public
  • 51. Which of the following is a responsibility of a cybersecurity professional?
A) Stop learning about new threats
B) Hide security incidents
C) Ignore company policies
D) Keep information confidential
E) Share client data when convenient
  • 52. True or False: Hacking into a system without permission is illegal.
A) False
B) True
  • 53. Wireless Network Security refers to the protection of wireless networks, such as Wi-Fi, from which of the following?
A) Slow internet speeds only
B) Software license expiry
C) Hardware price increases
D) Unauthorized access, cyber threats, and data theft
E) Electricity outages
  • 54. Which encryption types are listed as security methods for wireless network access control?
A) No encryption
B) WEP only
C) PPTP
D) WPA2 or WPA3
E) SSL only
  • 55. A fake hotspot uses a name similar to a cafĂ©'s real Wi-Fi. Which wireless threat is this?
A) Weak passwords
B) Unauthorized access
C) Eavesdropping
D) Rogue or fake access point
E) Malware
  • 56. Which wireless threat is an attacker attempting to intercept wireless communications?
A) Malware
B) Weak passwords
C) Rogue or fake access point
D) Eavesdropping
E) Unauthorized access
  • 57. Which of the following is listed as a router and access point security measure?
A) Change the default administrator password
B) Share the Wi-Fi password publicly
C) Stop updating router firmware
D) Disable the firewall
E) Enable all unnecessary features
  • 58. Which best practice is listed for separating different groups of users on a wireless network?
A) Turn off the firewall
B) Separate guest, student, and staff networks
C) Give guests the staff password
D) Use one shared network for everyone
E) Disable authentication
  • 59. What does a Virtual Private Network (VPN) create between your device and a VPN server?
A) A backup copy of your traffic
B) An encrypted tunnel
C) A physical cable
D) A firewall rule
E) A shared public folder
  • 60. An employee works from home and needs safe access to company files. Which VPN type fits best?
A) Remote Access VPN
B) Personal VPN
C) Cloud VPN
D) Mobile VPN
E) Site-to-Site VPN
  • 61. A large business wants to link multiple office branches using network routers instead of apps on user devices. Which VPN type fits?
A) Mobile VPN
B) Double VPN
C) Site-to-Site VPN
D) Personal VPN
E) Remote Access VPN
  • 62. Which VPN type is optimized specifically for smartphones and tablets?
A) Cloud VPN
B) Remote Access VPN
C) Double VPN
D) Mobile VPN
E) Site-to-Site VPN
  • 63. Which VPN type is hosted entirely on cloud infrastructure rather than physical servers?
A) Site-to-Site VPN
B) Mobile VPN
C) Personal VPN
D) Remote Access VPN
E) Cloud VPN
  • 64. How does a Double VPN work?
A) It uses two different passwords to log in
B) It routes and encrypts traffic through two separate servers instead of just one
C) It encrypts only half of the traffic
D) It runs two VPN apps on the same phone
E) It connects two offices through routers
  • 65. Which VPN protocol does not encrypt data on its own and is almost always paired with IPSec?
A) OpenVPN
B) L2TP
C) WireGuard
D) SSTP
E) IKEv2
  • 66. Which VPN protocol was developed by Microsoft and is only available for Windows operating systems?
A) L2TP
B) IKEv2
C) SSTP
D) OpenVPN
E) WireGuard
  • 67. Which VPN protocol is highly effective at maintaining a connection when switching from Wi-Fi to mobile data?
A) IKEv2
B) SSH
C) SSTP
D) L2TP
E) PPTP
  • 68. True or False: According to the VPN conclusion, a VPN makes you entirely anonymous online.
A) False
B) True
  • 69. In the CIA triad, which goal means data stays accurate and unaltered in transit or storage?
A) Integrity
B) Availability
C) Accounting
D) Confidentiality
E) Authentication
  • 70. In the CIA triad, which goal means only authorized users can access information?
A) Integrity
B) Availability
C) Accounting
D) Authorization
E) Confidentiality
  • 71. Which design principle uses multiple, overlapping layers of security so that if one fails, others still protect the system?
A) Network segmentation
B) Least privilege
C) Redundancy
D) Zero trust
E) Defense in depth
  • 72. Which design principle gives users, apps, and devices only the minimum access they need?
A) Least privilege
B) Network segmentation
C) Redundancy
D) Defense in depth
E) Zero trust
  • 73. Which design approach divides the network into zones such as VLANs, subnets, and firewalls to limit how far an attacker can move?
A) Defense in depth
B) Secure by default
C) Redundancy
D) Least privilege
E) Network segmentation
  • 74. Which architecture follows the idea "Never trust, always verify"?
A) Zero Trust
B) Network segmentation
C) Defense in depth
D) Least privilege
E) Redundancy
  • 75. A company wants a buffer zone for its public services. Which architecture component fits?
A) NAC
B) DLP
C) SIEM
D) VPN gateway
E) DMZ
  • 76. Which platform collects logs from every zone, correlates events, detects anomalies, and supports incident response?
A) SIEM
B) DMZ
C) NAC
D) DLP
E) IDS/IPS
  • 77. In AAA, which part logs activity for audit and forensics?
A) Accounting
B) NAC
C) Availability
D) Authorization
E) Authentication
  • 78. A laptop tries to connect to the network, and the system first checks its device posture before granting access. Which component does this?
A) SIEM
B) Backup system
C) DMZ
D) DLP
E) NAC
  • 79. True or False: The NIST Cybersecurity Framework has five functions: Identify, Protect, Detect, Respond, and Recover.
A) True
B) False
  • 80. Network Application Security is based on identifying and fixing vulnerabilities that correspond to which weaknesses?
A) Common Wireless Encryptions
B) Critical Web Errors
C) Certified Web Exploits
D) Cloud Web Endpoints
E) Common Weakness Enumerations (CWEs)
  • 81. Which tools are listed for Network Application Security?
A) Backups and failover links
B) SAST, DAST, IAST
C) Firewalls and routers
D) VPN gateways and NAC servers
E) Wireshark, AirCrack, Metasploit
  • 82. Which tools are listed for Network Security, as opposed to Network Application Security?
A) Burp Suite only
B) Wireshark, AirCrack, Metasploit
C) SAST, DAST, IAST
D) OWASP ZAP only
E) SonarQube only
  • 83. Which risk is #1 on the OWASP Top 10 list as presented?
A) Security Misconfiguration
B) Injection
C) Insecure Design
D) Broken Access Control
E) Cryptographic Failures
  • 84. Which OWASP Top 10 risk covers data that is not properly protected in transit or at rest, exposing passwords, health records, and personal data?
A) Broken Access Control
B) Cryptographic Failures
C) Injection
D) Security Logging & Monitoring Failures
E) SSRF
  • 85. Which OWASP Top 10 risk occurs when a web app does not validate a user-supplied URL before pulling data from a remote resource?
A) Broken Access Control
B) Insecure Design
C) Injection
D) Server-Side Request Forgery (SSRF)
E) Cryptographic Failures
  • 86. Which tool monitors and filters HTTP traffic as an OSI layer-7 defense and works like a reverse proxy that shields the server?
A) Software Composition Analysis (SCA)
B) Runtime Application Self-Protection (RASP)
C) CNAPP
D) Web Application Firewall (WAF)
E) Software Bill of Materials (SBOM)
  • 87. Which solution analyzes user behavior and application traffic at runtime and can terminate sessions where weaknesses are being exploited?
A) Software Composition Analysis (SCA)
B) CNAPP
C) Web Application Firewall (WAF)
D) Software Bill of Materials (SBOM)
E) Runtime Application Self-Protection (RASP)
  • 88. What is a Software Bill of Materials (SBOM)?
A) A backup copy of the software
B) A comprehensive list of a software's components, including open-source and proprietary libraries and modules
C) A set of firewall rules
D) A list of employees who wrote the code
E) A report of all software licensing costs
  • 89. What does gray box testing involve?
A) Testing only after release
B) Testing only the network cables
C) Full access to internals such as static code analysis
D) No access to internals
E) Limited internal access, such as login credentials as a signed-in user
  • 90. A vulnerable open-source library has a high CVSS score, but the application never invokes the vulnerable code. What do the slides say about its risk?
A) The whole application must be taken offline
B) It means the application has been breached
C) CVSS scores are always inaccurate
D) The CVSS score carries no real risk
E) It must always be fixed first
  • 91. True or False: "Shift left" means integrating security earlier in the SDLC so vulnerabilities are cheaper and easier to fix.
A) False
B) True
  • 92. What does OWASP stand for?
A) Open Web Access Security Policy
B) Organized Worldwide Application Safety Program
C) Open Worldwide Application Security Project
D) Online Web Application Security Protocol
E) Official Web Application Standards Panel
  • 93. What is the common mistake in input validation?
A) Validating the year before saving it
B) Only checking the input in the browser and not checking it on the server
C) Rejecting invalid input
D) Checking input before using it
E) Checking the input on the server
  • 94. Which secure coding practice means making user data safe before showing it on a webpage?
A) System Configuration
B) Data Protection
C) Session Management
D) Output Encoding
E) Input Validation
  • 95. What is a common mistake in authentication and password management?
A) Using appropriate password-hashing practices
B) Hashing passwords
C) Verifying credentials
D) Creating a secure session after login
E) Storing passwords in plain text or using weak credential handling
  • 96. A student may view their own enrollment but cannot approve another student's enrollment. Which secure coding practice is this?
A) Output Encoding
B) Cryptographic Practices
C) Input Validation
D) Session Management
E) Access Control
  • 97. What is a common mistake in error handling and logging?
A) Recording useful security events
B) Showing a safe message to the user
C) Showing stack traces, database details, passwords, or other sensitive technical information to users
D) Logging a login failure for monitoring
E) Failing safely
  • 98. A production server keeps default credentials, unnecessary services, and development settings enabled. Which secure coding practice has been ignored?
A) Input Validation
B) System Configuration
C) Access Control
D) Session Management
E) Output Encoding
  • 99. What is a common mistake in session management?
A) Protecting session identifiers
B) Invalidating the session on logout or timeout
C) Leaving sessions active unnecessarily or failing to protect session identifiers
D) Validating the session on requests
E) Creating a protected session
  • 100. What is a common mistake in cryptographic practices?
A) Understanding the security goal
B) Using appropriate secure communication
C) Managing keys securely
D) Selecting suitable cryptographic protection
E) Inventing your own encryption or using cryptography without understanding the security goal and key management
Created with That Quiz — where test making and test taking are made easy for math and other subject areas.