A) may kaliwa ba sa right? may kanan ba sa left? B) 4 C) Sure ka sa mga question na toh? D) are you gagoing me? E) hmmm depende kung 3 yan kasi kung 3 yan edi 5
A) To reduce hosting costs B) To make applications run faster C) To make applications more resistant to security threats by identifying security weaknesses and vulnerabilities in the source code D) To increase the number of users E) To design the user interface
A) A method that attacks a running application B) A backup strategy C) A tool that blocks network traffic D) A white-box method that scans source code, bytecode, or binaries for security flaws without actually running the program E) A way to monitor user behavior
A) A tool for managing passwords B) A black-box method that evaluates a running application from the outside by simulating real-world hacker attacks to find live vulnerabilities C) A type of firewall D) A method that only reads source code E) A way to train employees
A) It combines features of both by placing security agents inside a running application's environment to monitor code execution in real time B) It is used only after the software is retired C) It tests only network cables D) It does not test applications at all E) It only works on printed documents
A) DAST B) IAST C) Software Composition Analysis (SCA), which scans third-party libraries and open-source dependencies for known vulnerabilities or licensing issues D) Wi-Fi scanning E) SAST
A) OWASP ZAP, which automatically sends test requests to the application and analyzes the responses for vulnerabilities B) Microsoft Word C) Nessus D) Wireshark E) SonarQube
A) Nessus B) Burp Suite, an intercepting proxy that lets the tester view, modify, and resend HTTP requests C) SonarQube D) A spreadsheet E) A web browser
A) It scans Wi-Fi networks B) It encrypts files C) It intercepts HTTP requests D) It analyzes source code to detect security vulnerabilities, bugs, code smells, and poor coding practices E) It manages user accounts
A) A word processor B) Nessus, which compares scan results with a database of known vulnerabilities and generates a report with risk levels C) SonarQube D) A file archiver E) A password manager
A) False B) True
A) To speed up the network B) To store backups of files C) To track employee attendance D) To control and monitor who can access a network by allowing only verified users and compliant devices, enforcing security rules before access is granted E) To design websites
A) Only when a virus is found B) At the end of every month C) Before a device joins the network, when its identity and compliance are evaluated during the connection request D) After the device has left the network E) Only during system backups
A) Pre-Admission NAC B) A printer driver C) A screen saver D) A guest Wi-Fi password E) Post-Admission NAC, which restricts lateral movement by requiring re-authentication for sensitive areas
A) It prints network reports B) It writes source code C) It determines the access level based on identity, permissions, device posture, and request type, then authorizes, restricts, or denies access D) It cools the server room E) It sells network devices
A) Any device, user, or process requesting network access, such as laptops, servers, IP cameras, printers, and IoT devices B) A firewall rule C) A network cable D) A backup tape E) A software license
A) The office printer B) The Wi-Fi password C) The Network Access Server (NAS), which provides secure entry to internal networks for remote employees D) The company logo E) The employee's email
A) It cannot block any device B) It has low visibility and control over IoT devices or endpoints without specific user identities C) It works only on paper D) It has no policies E) It increases network speed
A) False B) True
A) To make software cheaper than competitors B) To replace all developers C) To remove testing from development D) To produce software that is reliable, secure, and resistant to cyberattacks while maintaining functionality and performance E) To finish projects faster than planned
A) The code is written B) The software is released C) The project team identifies business goals, security objectives, potential risks, and compliance requirements D) Bugs are patched E) Penetration testing is performed
A) The Testing Phase B) The Requirements Phase, where both functional and security requirements are gathered and documented C) The Maintenance Phase D) The Deployment Phase E) The Retirement Phase
A) Patches are applied B) Backups are deleted C) The software is retired D) Users are trained E) A secure system architecture is created, and threat modeling is performed to identify possible attacks and weaknesses
A) Business goals are set B) The code is written C) Requirements are collected D) The software is deployed E) Security testing verifies that the application is protected against threats, including vulnerability assessments, penetration testing, SAST, and DAST
A) Threat models are drawn B) The application is configured securely and released, with access controls, monitoring systems, and backup strategies in place C) The project idea is proposed D) The software is thrown away E) Requirements are collected
A) Because testing is not allowed B) Because it reduces user trust C) Because design is finished D) Because software never changes E) Because the software must be continuously monitored and updated with security patches to stay protected from newly discovered threats
A) False B) True
A) To update software B) To quietly steal passwords C) To encrypt all data D) To make a computer, website, or network resource unavailable to its legitimate users E) To improve website speed
A) It installs a new browser B) It deletes the user's account C) It saturates the targeted server with an overwhelming amount of packets so legitimate users cannot reach it D) It changes the website colors E) It sends a single small email
A) Turning off logging B) Ignoring unusual traffic C) Disabling the firewall D) Sharing admin passwords E) Using a cloud mitigation provider, which is more effective than relying on a firewall alone
A) A type of Wi-Fi attack B) A way to back up a database C) A method of encrypting databases D) A vulnerability where attackers inject malicious SQL queries through user inputs to manipulate the backend database E) A tool for designing tables
A) Trust all user input B) Display detailed database errors C) Give all users full privileges D) Use prepared statements and parameterized queries, and validate and restrict user input E) Remove the login form
A) Blind SQL injection B) DOM-based XSS C) Error-based SQL injection, where the attacker intentionally causes the database to generate an error message D) Union-based SQL injection E) Stored XSS
A) A vulnerability where an attacker injects malicious client-side scripts, usually JavaScript, into a trusted website that then run in other users' browsers B) An attack that floods a server with packets C) A hardware failure D) A database backup E) A fake email asking for passwords
A) Union-based injection B) Blind SQL injection C) Stored XSS, where the malicious input is permanently saved by the application and runs for every visitor D) DOM-based XSS E) Reflected XSS
A) It reduces the impact of XSS by restricting the sources from which scripts are allowed to execute B) It speeds up scripts C) It deletes cookies D) It blocks all users E) It encrypts the database
A) A cyberattack where criminals pretend to be a trusted person or organization to trick victims into sharing information, clicking bad links, or downloading malware B) A kind of antivirus C) A method for speeding up the internet D) A way to back up files E) A type of fishing app
A) Forward it to friends B) Avoid clicking links or sharing the OTP, verify the sender through official channels, and turn on Multi-Factor Authentication C) Click the link quickly D) Ignore all security tools E) Reply with the OTP
A) False B) True
A) It protects patient health records B) It criminalizes unauthorized access to computer systems in the United States C) It sets rules for credit cards D) It regulates online ads E) It governs children's websites
A) GLBA B) COPPA C) SOX D) CFAA E) HIPAA, the Health Insurance Portability and Accountability Act
A) The Gramm-Leach-Bliley Act (GLBA), which applies to financial institutions B) COPPA C) SOX D) HIPAA E) FISMA
A) GLBA B) HIPAA C) The Children's Online Privacy Protection Act (COPPA), which regulates how services handle children's data D) CFAA E) SOX
A) The NIST B) The FBI C) The DHS D) The Federal Trade Commission (FTC), through its authority over unfair or deceptive trade practices E) The Department of Agriculture
A) SOX B) The California Consumer Privacy Act and California Privacy Rights Act (CCPA/CPRA) C) HIPAA D) COPPA E) FISMA
A) SOX B) PCI-DSS, the Payment Card Industry Data Security Standard C) CMMC D) COPPA E) HIPAA
A) False B) True
A) Hacking done to harm users B) Hacking done with permission to find security weaknesses and help improve security, following rules and agreements C) Hacking done secretly to steal data D) Selling stolen passwords E) Breaking into accounts for fun
A) Sharing data with everyone B) Deleting all data daily C) Protecting personal and sensitive information so it is not accessed or shared without proper authorization D) Making data public E) Collecting as much data as possible
A) Ignoring policies B) Hiding incidents C) Sharing client data publicly D) Using weak passwords E) Keeping information confidential, following company policies, avoiding conflicts of interest, and reporting incidents properly
A) It is a safety measure B) It is ethical hacking C) It is a normal part of the job D) It is considered illegal and unethical because accessing an account without permission is unauthorized access E) It is allowed if no data is taken
A) True B) False
A) The protection of wireless networks, such as Wi-Fi, from unauthorized access, cyber threats, and data theft B) Making Wi-Fi faster C) Selling wireless devices D) Extending the signal range E) Installing more routers
A) Plain text B) An open network C) A shared public password D) No encryption E) WPA2 or WPA3, because they protect wireless access with strong encryption
A) A strong password B) A firmware update C) A guest network D) A rogue or fake access point, which is an unauthorized network that imitates a legitimate one E) Eavesdropping
A) Disable all security B) Keep the default password C) Share the password publicly D) Turn off encryption E) Change the default administrator password and keep devices updated with security updates
A) Creating separate guest, student, and staff networks so each group has only the access it needs B) Turning off the router C) Removing all passwords D) Giving guests the staff password E) Using one shared network for all
A) They slow down the router B) They reduce battery life C) They erase saved data D) Easy-to-guess passwords increase the risk of unauthorized access to the network E) They make the signal weaker
A) To increase Wi-Fi range B) To block all advertisements C) To make websites load faster D) To create an encrypted tunnel between your device and a VPN server that protects your data and hides your real IP address E) To store files online
A) It leaves it unchanged B) It publishes it online C) The VPN server replaces your real IP address with its own public IP address D) It deletes your device E) It sells it
A) A Double VPN B) No VPN at all C) A Remote Access VPN, which connects individual users securely to a remote private network D) A Site-to-Site VPN E) A wireless printer
A) A Remote Access VPN B) A Site-to-Site VPN, which connects entire networks using routers instead of apps on user devices C) A Personal VPN D) A Double VPN E) A Mobile VPN
A) A Cloud VPN B) A Double VPN C) A Site-to-Site VPN D) A Personal VPN E) A Mobile VPN, which is designed to stay secure as the user switches between networks
A) A VPN that encrypts half the data B) A VPN that links two offices C) Two phones on one VPN D) A VPN that routes and encrypts traffic through two separate servers instead of just one E) A VPN with two passwords
A) PPTP B) OpenVPN, which is open-source and highly configurable C) L2TP D) SSTP E) SSH
A) IKEv2 B) L2TP C) WireGuard, a newer protocol with a much smaller code base D) SSTP E) PPTP
A) OpenVPN B) WireGuard C) SSTP D) L2TP, which relies on IPSec to provide the encryption E) IKEv2
A) False B) True
A) Systems never go down B) Data is always backed up C) Data is deleted often D) Everyone can view data E) Only authorized users can access the information, keeping sensitive data protected from unauthorized people
A) Data is hidden from everyone B) Data remains accurate and unaltered whether it is in transit or in storage C) Systems are always online D) Data is deleted daily E) Users are always logged in
A) Data is never changed B) Only admins can log in C) Data is kept secret D) Systems shut down at night E) Systems and data are accessible whenever they are legitimately needed by authorized users
A) Using a single password B) Trusting all internal users C) Protecting only the perimeter D) Using multiple, overlapping layers of security so that if one layer fails, others still protect the system E) Relying on one strong firewall
A) Defense in depth B) Redundancy C) Least privilege, where users, apps, and devices receive only the access they need D) Open access E) Zero access
A) Storing backups B) Removing firewalls C) Dividing the network into zones, such as VLANs and subnets, to limit how far an attacker can move D) Increasing the number of users E) Making Wi-Fi faster
A) Never trust, always verify: every user and device must be authenticated and authorized for each access request B) Trust verified devices forever C) Trust everyone inside the network D) Trust only the firewall E) Trust all employees
A) A VPN client B) A DMZ, which acts as a buffer zone for public services C) A SIEM D) A password E) A backup tape
A) It collects logs from every zone, correlates events, detects anomalies, and supports incident response B) It creates user accounts C) It encrypts disks D) It prints reports E) It repairs hardware
A) It logs activity for audit and forensics so that actions can be traced later B) It verifies who the user is C) It grants permissions D) It encrypts data E) It blocks traffic
A) True B) False
A) Identifying and fixing vulnerabilities in applications, which correspond to Common Weakness Enumerations (CWEs) B) Managing office printers C) Designing logos D) Fixing broken cables E) Selling licenses
A) Backups only B) Routers and switches C) SAST, DAST, and IAST, which analyze application code and behavior for vulnerabilities D) Wireshark and AirCrack E) Firewalls only
A) SAST and DAST B) Burp Suite only C) SonarQube only D) IAST only E) Wireshark, AirCrack, and Metasploit, which focus on network-level testing
A) Injection B) Cryptographic Failures C) SSRF D) Broken Access Control, where users can act outside their intended permissions E) Insecure Design
A) Broken Access Control B) Cryptographic Failures, which can lead to exposure of passwords, health records, and personal data C) Insecure Design D) SSRF E) Injection
A) A broken login page B) A stolen password C) A faulty server fan D) An email scam E) A flaw where a web app pulls data from a remote resource without validating the user-supplied URL
A) It repairs software B) It encrypts email C) It monitors and filters HTTP traffic at OSI layer 7, working like a reverse proxy that shields the server D) It scans physical devices E) It manages passwords
A) It backs up databases B) It scans Wi-Fi networks C) It analyzes user behavior and application traffic at runtime and can terminate sessions that exploit weaknesses D) It installs updates E) It writes source code
A) A list of staff members B) A list of project costs C) A comprehensive list of a software's components, including open-source and proprietary libraries and modules D) A copy of the source code E) A set of firewall rules
A) Skipping testing B) Integrating security earlier in the software development life cycle so vulnerabilities are cheaper and easier to fix C) Removing developers D) Testing only in production E) Moving security to the end
A) It must be ignored forever B) The application must go offline C) It must always be fixed first D) It means a breach occurred E) The CVSS score carries no real risk because the vulnerable code is not actually used
A) True B) False
A) Open Worldwide Application Security Project B) Open Web Server Policy C) Online Web Access Security Plan D) Official Web Safety Panel E) Open Wireless App Standard
A) Validating on the server B) Checking input only in the browser and not validating it again on the server C) Rejecting invalid input D) Using strong passwords E) Checking the year entered
A) To create sessions B) To check logins C) To back up databases D) To make user data safe before it is displayed on a webpage so it cannot run as code E) To hash passwords
A) Hashing passwords B) Storing passwords in plain text instead of protecting them with appropriate password-hashing practices C) Using secure sessions D) Using strong passwords E) Verifying credentials
A) Cryptography B) Input Validation C) Output Encoding D) Access Control, which checks what an authenticated user is allowed to do E) Error Handling
A) Failing safely B) Logging failed logins C) Showing stack traces, database details, or other sensitive technical information to users D) Recording useful events E) Showing a safe error message
A) Input Validation B) System Configuration, which secures the environment the application runs in C) Output Encoding D) Access Control E) Session Management
A) Leaving sessions active unnecessarily or failing to protect session identifiers B) Creating a protected session C) Ending sessions after logout D) Validating the session E) Using timeouts
A) Understanding the goal B) Inventing your own encryption instead of using established, suitable cryptographic protection C) Using secure channels D) Managing keys securely E) Protecting data |