ThatQuiz Test Library Take this test now
IASEC2 MIDTERM REVIEWER: PASS AWAY EDITION - Quiz
Contributed by: Fernandez
  • 1. Fillin the blank: Papa__
A) Papanaw
B) Papasa
C) Sinong 8080 gumawa nito?
D) Salamat Shopee
E) Long ass quiz...
  • 2. A team wants to scan its application's source code, bytecode, or binaries for security flaws without running the program. Which type of testing fits?
A) Dynamic Application Security Testing (DAST)
B) Software Composition Analysis (SCA)
C) Penetration testing
D) Interactive Application Security Testing (IAST)
E) Static Application Security Testing (SAST)
  • 3. A team wants to evaluate a running application from the outside by simulating real-world hacker attacks. Which type of testing fits?
A) Software Composition Analysis (SCA)
B) Vulnerability assessment
C) Static Application Security Testing (SAST)
D) Dynamic Application Security Testing (DAST)
E) Interactive Application Security Testing (IAST)
  • 4. Which type of testing combines features of SAST and DAST by placing security agents inside a running application's environment?
A) Penetration testing
B) Static Application Security Testing (SAST)
C) Dynamic Application Security Testing (DAST)
D) Interactive Application Security Testing (IAST)
E) Software Composition Analysis (SCA)
  • 5. An application relies on many third-party libraries and open-source dependencies. Which type of testing checks them for known vulnerabilities or licensing issues?
A) Penetration testing
B) Dynamic Application Security Testing (DAST)
C) Interactive Application Security Testing (IAST)
D) Static Application Security Testing (SAST)
E) Software Composition Analysis (SCA)
  • 6. Which open-source web application security testing tool automatically sends test requests and analyzes the responses for vulnerabilities?
A) SonarQube
B) Burp Suite
C) Nessus
D) OWASP ZAP
E) Wireshark
  • 7. A tester wants to capture a login request, then view, modify, and resend it using Proxy, Repeater, and Intruder. Which tool fits?
A) Nessus
B) OWASP ZAP
C) Burp Suite
D) Metasploit
E) SonarQube
  • 8. Which tool is a source code analysis tool that detects security vulnerabilities and coding problems in applications?
A) SonarQube
B) OWASP ZAP
C) Burp Suite
D) Nessus
E) AirCrack
  • 9. An admin needs to scan a server, a network device, and an application, compare the results with a database of known vulnerabilities, and get a report with Critical, High, Medium, and Low risk levels. Which tool fits?
A) Wireshark
B) Nessus
C) SonarQube
D) OWASP ZAP
E) Burp Suite
  • 10. True or False: In the application security testing process, Reporting comes before Vulnerability Identification.
A) True
B) False
  • 11. What is Network Access Control (NAC)?
A) A security system that controls and monitors who can access a network by allowing only verified users and compliant devices
B) A standard that secures credit and debit card transactions
C) A protocol that creates an encrypted tunnel over the internet
D) A tool that analyzes source code for security vulnerabilities
E) A platform that collects and correlates logs from every zone
  • 12. Which type of NAC occurs before a device joins the network?
A) Post-Admission NAC
B) Pre-Admission NAC
C) Network Access Server
D) Policy Server
E) Access Requestor
  • 13. A device is already on the network and tries to reach a sensitive area. Which type of NAC restricts this lateral movement by requiring re-authentication?
A) Pre-Admission NAC
B) Policy Server
C) Access Requestor
D) Network Access Server
E) Post-Admission NAC
  • 14. Which NAC element determines the access level based on identity, permissions, device posture, and request type?
A) Pre-Admission NAC
B) Policy Server
C) Access Requestor (AR)
D) Post-Admission NAC
E) Network Access Server (NAS)
  • 15. A remote employee connects to the internal network through a VPN gateway. Which NAC element acts as the access control point?
A) Post-Admission NAC
B) Access Requestor (AR)
C) Network Access Server (NAS)
D) Policy Server
E) Pre-Admission NAC
  • 16. Which NAC element includes laptops, servers, IP cameras, printers, and IoT devices that request network access?
A) Post-Admission NAC
B) Network Access Server (NAS)
C) Access Requestor (AR)
D) Policy Server
E) Pre-Admission NAC
  • 17. A device that only partially meets an organization's security policy tries to connect to the network. What can a NAC system do?
A) Disconnect every other device
B) Delete the device's data
C) Ignore its compliance status
D) Grant it full access automatically
E) Grant it restricted access
  • 18. True or False: According to the slides, NAC protects against threats that originate within the network, such as insider attacks.
A) True
B) False
  • 19. A team is performing threat modeling to identify possible attacks and weaknesses in its system architecture. Which SSDLC phase is this?
A) Planning Phase
B) Development Phase
C) Design Phase
D) Maintenance Phase
E) Testing Phase
  • 20. In which SSDLC phase are both functional and security requirements gathered and documented?
A) Deployment Phase
B) Maintenance Phase
C) Requirements Phase
D) Development Phase
E) Design Phase
  • 21. In which SSDLC phase does the project team identify business goals, security objectives, potential risks, and compliance requirements?
A) Deployment Phase
B) Planning Phase
C) Design Phase
D) Requirements Phase
E) Testing Phase
  • 22. In which SSDLC phase are code reviews, security guidelines, and automated scanning tools used to detect vulnerabilities such as SQL injection and cross-site scripting?
A) Planning Phase
B) Maintenance Phase
C) Deployment Phase
D) Requirements Phase
E) Development Phase
  • 23. In which SSDLC phase may vulnerability assessments, penetration testing, SAST, and DAST be carried out?
A) Design Phase
B) Deployment Phase
C) Maintenance Phase
D) Planning Phase
E) Testing Phase
  • 24. Before release, a team configures the application securely and sets up access controls, monitoring systems, and backups. Which SSDLC phase is this?
A) Planning Phase
B) Deployment Phase
C) Maintenance Phase
D) Testing Phase
E) Development Phase
  • 25. In which SSDLC phase must the software be continuously monitored and updated with security patches and bug fixes?
A) Maintenance Phase
B) Requirements Phase
C) Design Phase
D) Planning Phase
E) Testing Phase
  • 26. True or False: The Secure Software Development Life Cycle extends the traditional SDLC by adding security-focused practices.
A) True
B) False
  • 27. What is a Denial of Service (DoS) attack?
A) An attack that tricks a browser into sending an unwanted request
B) An attack that injects malicious client-side scripts into a trusted website
C) A malicious cyber threat that makes a computer, website, or network resource unavailable to its legitimate users
D) An attack where criminals pretend to be a trusted person or organization
E) An attack that injects malicious SQL queries through user inputs
  • 28. Which type of DoS attack saturates a targeted server with an overwhelming amount of packets?
A) Phishing attack
B) Reflected attack
C) Error-based attack
D) Flood attack
E) Buffer overflow attack
  • 29. According to the slides, which DoS prevention method is the simplest and least effective?
A) Internet Service Provider
B) Cloud mitigation provider
C) Multi-Factor Authentication
D) Firewall
E) Parameterized queries
  • 30. Which type of SQL injection occurs when an attacker intentionally causes the database to generate an error message?
A) Error-based SQL injection
B) Blind SQL injection
C) DOM-based XSS
D) Union-based SQL injection
E) Stored XSS
  • 31. Which type of SQL injection uses the UNION operator to combine the results of two or more SELECT statements?
A) Blind SQL injection
B) Union-based SQL injection
C) Error-based SQL injection
D) Reflected XSS
E) Stored XSS
  • 32. When does Blind SQL injection occur?
A) When attackers cannot see query results directly on the webpage
B) When the browser inserts user data into the page without sanitization
C) When user input is immediately returned in the server response
D) When the database is made to generate an error message on purpose
E) When malicious input is permanently stored by the application
  • 33. Which of the following is listed as a way to prevent SQL injection?
A) Disable input validation
B) Grant users full database privileges
C) Display detailed database errors to users
D) Trust all user input
E) Use prepared statements and parameterized queries
  • 34. Malicious input is permanently stored by an application and runs every time users visit the affected page. Which type of XSS is this?
A) Stored XSS
B) Error-based SQL injection
C) DOM-based XSS
D) Union-based SQL injection
E) Reflected XSS
  • 35. Which type of XSS occurs when user input is immediately returned in the server response without proper validation or encoding?
A) Union-based SQL injection
B) Blind SQL injection
C) Stored XSS
D) Reflected XSS
E) DOM-based XSS
  • 36. Which type of XSS occurs when JavaScript in the browser inserts user-controlled data into the page without proper sanitization?
A) Error-based SQL injection
B) Reflected XSS
C) DOM-based XSS
D) Blind SQL injection
E) Stored XSS
  • 37. A user is logged in to a website, and their browser is tricked into sending an unwanted request to that site. Which vulnerability is this?
A) Denial of Service
B) Phishing
C) CSRF
D) Cross-Site Scripting
E) SQL Injection
  • 38. Which cyberattack involves criminals pretending to be a trusted person or organization to trick people into sharing sensitive information, clicking a bad link, or downloading malware?
A) SQL Injection
B) CSRF
C) Phishing
D) Cross-Site Scripting
E) Denial of Service
  • 39. True or False: CSRF tokens and SameSite cookies are listed as ways to prevent CSRF.
A) False
B) True
  • 40. Which U.S. law criminalizes unauthorized access to computer systems?
A) GLBA
B) Computer Fraud & Abuse Act (CFAA)
C) FISMA
D) SOX
E) HIPAA
  • 41. Which U.S. law sets security and privacy standards for patient health data?
A) COPPA
B) GLBA
C) CFAA
D) FISMA
E) HIPAA
  • 42. Which U.S. law requires financial institutions to protect customer personal information?
A) SOX
B) HIPAA
C) COPPA
D) Gramm-Leach-Bliley Act (GLBA)
E) FISMA
  • 43. Which U.S. law governs data practices for services aimed at children?
A) HIPAA
B) COPPA
C) GLBA
D) SOX
E) CFAA
  • 44. Which U.S. agency regulates cybersecurity under its authority to police unfair or deceptive trade practices?
A) NIST
B) Information Commissioner's Office
C) DHS
D) Federal Trade Commission (FTC)
E) DOJ / FBI
  • 45. Which law gives California residents the right to know, access, delete, and opt out of the sale of their personal data?
A) NIS Directive
B) CCPA / CPRA
C) GDPR
D) PDPA
E) HIPAA
  • 46. Which standard provides protocols and guidelines that secure credit and debit card transactions?
A) NIST Cybersecurity Framework
B) ISO/IEC 27001
C) HIPAA
D) PCI-DSS
E) CMMC
  • 47. True or False: The NIST Cybersecurity Framework is a law.
A) True
B) False
  • 48. Which type of hacking is done with permission, finds security weaknesses, and follows rules and agreements?
A) Malicious hacking
B) Identity theft
C) Cyber fraud
D) Ethical hacking
E) Data theft
  • 49. Which type of hacking is done without permission and can steal or destroy information?
A) Compliance auditing
B) Ethical hacking
C) Vulnerability assessment
D) Data privacy
E) Malicious hacking
  • 50. What does data privacy mean?
A) Making all collected data public
B) Deleting all data every day
C) Protecting personal and sensitive information
D) Collecting as much data as possible
E) Sharing data with any organization
  • 51. Which of the following is a responsibility of a cybersecurity professional?
A) Stop learning about new threats
B) Share client data when convenient
C) Ignore company policies
D) Hide security incidents
E) Keep information confidential
  • 52. True or False: Hacking into a system without permission is illegal.
A) False
B) True
  • 53. Wireless Network Security refers to the protection of wireless networks, such as Wi-Fi, from which of the following?
A) Slow internet speeds only
B) Hardware price increases
C) Electricity outages
D) Software license expiry
E) Unauthorized access, cyber threats, and data theft
  • 54. Which encryption types are listed as security methods for wireless network access control?
A) SSL only
B) WEP only
C) PPTP
D) No encryption
E) WPA2 or WPA3
  • 55. A fake hotspot uses a name similar to a cafĂ©'s real Wi-Fi. Which wireless threat is this?
A) Unauthorized access
B) Malware
C) Eavesdropping
D) Rogue or fake access point
E) Weak passwords
  • 56. Which wireless threat is an attacker attempting to intercept wireless communications?
A) Rogue or fake access point
B) Malware
C) Weak passwords
D) Eavesdropping
E) Unauthorized access
  • 57. Which of the following is listed as a router and access point security measure?
A) Share the Wi-Fi password publicly
B) Stop updating router firmware
C) Change the default administrator password
D) Enable all unnecessary features
E) Disable the firewall
  • 58. Which best practice is listed for separating different groups of users on a wireless network?
A) Use one shared network for everyone
B) Give guests the staff password
C) Turn off the firewall
D) Disable authentication
E) Separate guest, student, and staff networks
  • 59. What does a Virtual Private Network (VPN) create between your device and a VPN server?
A) A physical cable
B) A firewall rule
C) An encrypted tunnel
D) A backup copy of your traffic
E) A shared public folder
  • 60. An employee works from home and needs safe access to company files. Which VPN type fits best?
A) Site-to-Site VPN
B) Personal VPN
C) Mobile VPN
D) Cloud VPN
E) Remote Access VPN
  • 61. A large business wants to link multiple office branches using network routers instead of apps on user devices. Which VPN type fits?
A) Double VPN
B) Remote Access VPN
C) Mobile VPN
D) Site-to-Site VPN
E) Personal VPN
  • 62. Which VPN type is optimized specifically for smartphones and tablets?
A) Remote Access VPN
B) Mobile VPN
C) Double VPN
D) Cloud VPN
E) Site-to-Site VPN
  • 63. Which VPN type is hosted entirely on cloud infrastructure rather than physical servers?
A) Site-to-Site VPN
B) Mobile VPN
C) Personal VPN
D) Remote Access VPN
E) Cloud VPN
  • 64. How does a Double VPN work?
A) It connects two offices through routers
B) It encrypts only half of the traffic
C) It routes and encrypts traffic through two separate servers instead of just one
D) It uses two different passwords to log in
E) It runs two VPN apps on the same phone
  • 65. Which VPN protocol does not encrypt data on its own and is almost always paired with IPSec?
A) SSTP
B) WireGuard
C) OpenVPN
D) IKEv2
E) L2TP
  • 66. Which VPN protocol was developed by Microsoft and is only available for Windows operating systems?
A) L2TP
B) WireGuard
C) SSTP
D) IKEv2
E) OpenVPN
  • 67. Which VPN protocol is highly effective at maintaining a connection when switching from Wi-Fi to mobile data?
A) IKEv2
B) PPTP
C) L2TP
D) SSTP
E) SSH
  • 68. True or False: According to the VPN conclusion, a VPN makes you entirely anonymous online.
A) False
B) True
  • 69. In the CIA triad, which goal means data stays accurate and unaltered in transit or storage?
A) Availability
B) Authentication
C) Integrity
D) Confidentiality
E) Accounting
  • 70. In the CIA triad, which goal means only authorized users can access information?
A) Authorization
B) Integrity
C) Confidentiality
D) Availability
E) Accounting
  • 71. Which design principle uses multiple, overlapping layers of security so that if one fails, others still protect the system?
A) Network segmentation
B) Zero trust
C) Defense in depth
D) Least privilege
E) Redundancy
  • 72. Which design principle gives users, apps, and devices only the minimum access they need?
A) Defense in depth
B) Zero trust
C) Network segmentation
D) Least privilege
E) Redundancy
  • 73. Which design approach divides the network into zones such as VLANs, subnets, and firewalls to limit how far an attacker can move?
A) Redundancy
B) Least privilege
C) Secure by default
D) Defense in depth
E) Network segmentation
  • 74. Which architecture follows the idea "Never trust, always verify"?
A) Zero Trust
B) Defense in depth
C) Network segmentation
D) Least privilege
E) Redundancy
  • 75. A company wants a buffer zone for its public services. Which architecture component fits?
A) VPN gateway
B) NAC
C) SIEM
D) DLP
E) DMZ
  • 76. Which platform collects logs from every zone, correlates events, detects anomalies, and supports incident response?
A) SIEM
B) DLP
C) NAC
D) DMZ
E) IDS/IPS
  • 77. In AAA, which part logs activity for audit and forensics?
A) Availability
B) Authorization
C) Authentication
D) Accounting
E) NAC
  • 78. A laptop tries to connect to the network, and the system first checks its device posture before granting access. Which component does this?
A) DMZ
B) NAC
C) SIEM
D) Backup system
E) DLP
  • 79. True or False: The NIST Cybersecurity Framework has five functions: Identify, Protect, Detect, Respond, and Recover.
A) True
B) False
  • 80. Network Application Security is based on identifying and fixing vulnerabilities that correspond to which weaknesses?
A) Certified Web Exploits
B) Cloud Web Endpoints
C) Critical Web Errors
D) Common Weakness Enumerations (CWEs)
E) Common Wireless Encryptions
  • 81. Which tools are listed for Network Application Security?
A) SAST, DAST, IAST
B) Firewalls and routers
C) Wireshark, AirCrack, Metasploit
D) Backups and failover links
E) VPN gateways and NAC servers
  • 82. Which tools are listed for Network Security, as opposed to Network Application Security?
A) Wireshark, AirCrack, Metasploit
B) Burp Suite only
C) SonarQube only
D) OWASP ZAP only
E) SAST, DAST, IAST
  • 83. Which risk is #1 on the OWASP Top 10 list as presented?
A) Injection
B) Cryptographic Failures
C) Broken Access Control
D) Insecure Design
E) Security Misconfiguration
  • 84. Which OWASP Top 10 risk covers data that is not properly protected in transit or at rest, exposing passwords, health records, and personal data?
A) Broken Access Control
B) Cryptographic Failures
C) Injection
D) SSRF
E) Security Logging & Monitoring Failures
  • 85. Which OWASP Top 10 risk occurs when a web app does not validate a user-supplied URL before pulling data from a remote resource?
A) Server-Side Request Forgery (SSRF)
B) Insecure Design
C) Broken Access Control
D) Cryptographic Failures
E) Injection
  • 86. Which tool monitors and filters HTTP traffic as an OSI layer-7 defense and works like a reverse proxy that shields the server?
A) CNAPP
B) Software Bill of Materials (SBOM)
C) Web Application Firewall (WAF)
D) Software Composition Analysis (SCA)
E) Runtime Application Self-Protection (RASP)
  • 87. Which solution analyzes user behavior and application traffic at runtime and can terminate sessions where weaknesses are being exploited?
A) Runtime Application Self-Protection (RASP)
B) CNAPP
C) Web Application Firewall (WAF)
D) Software Bill of Materials (SBOM)
E) Software Composition Analysis (SCA)
  • 88. What is a Software Bill of Materials (SBOM)?
A) A set of firewall rules
B) A backup copy of the software
C) A comprehensive list of a software's components, including open-source and proprietary libraries and modules
D) A list of employees who wrote the code
E) A report of all software licensing costs
  • 89. What does gray box testing involve?
A) No access to internals
B) Testing only after release
C) Limited internal access, such as login credentials as a signed-in user
D) Testing only the network cables
E) Full access to internals such as static code analysis
  • 90. A vulnerable open-source library has a high CVSS score, but the application never invokes the vulnerable code. What do the slides say about its risk?
A) It means the application has been breached
B) It must always be fixed first
C) CVSS scores are always inaccurate
D) The CVSS score carries no real risk
E) The whole application must be taken offline
  • 91. True or False: "Shift left" means integrating security earlier in the SDLC so vulnerabilities are cheaper and easier to fix.
A) False
B) True
  • 92. What does OWASP stand for?
A) Open Web Access Security Policy
B) Official Web Application Standards Panel
C) Organized Worldwide Application Safety Program
D) Online Web Application Security Protocol
E) Open Worldwide Application Security Project
  • 93. What is the common mistake in input validation?
A) Checking input before using it
B) Checking the input on the server
C) Validating the year before saving it
D) Rejecting invalid input
E) Only checking the input in the browser and not checking it on the server
  • 94. Which secure coding practice means making user data safe before showing it on a webpage?
A) Data Protection
B) Input Validation
C) Output Encoding
D) Session Management
E) System Configuration
  • 95. What is a common mistake in authentication and password management?
A) Hashing passwords
B) Storing passwords in plain text or using weak credential handling
C) Using appropriate password-hashing practices
D) Verifying credentials
E) Creating a secure session after login
  • 96. A student may view their own enrollment but cannot approve another student's enrollment. Which secure coding practice is this?
A) Output Encoding
B) Access Control
C) Input Validation
D) Cryptographic Practices
E) Session Management
  • 97. What is a common mistake in error handling and logging?
A) Failing safely
B) Recording useful security events
C) Showing stack traces, database details, passwords, or other sensitive technical information to users
D) Logging a login failure for monitoring
E) Showing a safe message to the user
  • 98. A production server keeps default credentials, unnecessary services, and development settings enabled. Which secure coding practice has been ignored?
A) System Configuration
B) Session Management
C) Input Validation
D) Access Control
E) Output Encoding
  • 99. What is a common mistake in session management?
A) Validating the session on requests
B) Protecting session identifiers
C) Creating a protected session
D) Invalidating the session on logout or timeout
E) Leaving sessions active unnecessarily or failing to protect session identifiers
  • 100. What is a common mistake in cryptographic practices?
A) Inventing your own encryption or using cryptography without understanding the security goal and key management
B) Using appropriate secure communication
C) Understanding the security goal
D) Selecting suitable cryptographic protection
E) Managing keys securely
Created with That Quiz — where test making and test taking are made easy for math and other subject areas.