A) are you gagoing me? B) 4 C) hmmm depende kung 3 yan kasi kung 3 yan edi 5 D) Sure ka sa mga question na toh? E) may kaliwa ba sa right? may kanan ba sa left?
A) To make applications run faster B) To increase the number of users C) To make applications more resistant to security threats by identifying security weaknesses and vulnerabilities in the source code D) To reduce hosting costs E) To design the user interface
A) A tool that blocks network traffic B) A method that attacks a running application C) A white-box method that scans source code, bytecode, or binaries for security flaws without actually running the program D) A way to monitor user behavior E) A backup strategy
A) A tool for managing passwords B) A way to train employees C) A method that only reads source code D) A type of firewall E) A black-box method that evaluates a running application from the outside by simulating real-world hacker attacks to find live vulnerabilities
A) It is used only after the software is retired B) It tests only network cables C) It does not test applications at all D) It combines features of both by placing security agents inside a running application's environment to monitor code execution in real time E) It only works on printed documents
A) SAST B) Wi-Fi scanning C) DAST D) Software Composition Analysis (SCA), which scans third-party libraries and open-source dependencies for known vulnerabilities or licensing issues E) IAST
A) Nessus B) SonarQube C) OWASP ZAP, which automatically sends test requests to the application and analyzes the responses for vulnerabilities D) Wireshark E) Microsoft Word
A) A spreadsheet B) Nessus C) Burp Suite, an intercepting proxy that lets the tester view, modify, and resend HTTP requests D) A web browser E) SonarQube
A) It manages user accounts B) It analyzes source code to detect security vulnerabilities, bugs, code smells, and poor coding practices C) It intercepts HTTP requests D) It encrypts files E) It scans Wi-Fi networks
A) Nessus, which compares scan results with a database of known vulnerabilities and generates a report with risk levels B) SonarQube C) A password manager D) A file archiver E) A word processor
A) False B) True
A) To track employee attendance B) To design websites C) To store backups of files D) To speed up the network E) To control and monitor who can access a network by allowing only verified users and compliant devices, enforcing security rules before access is granted
A) After the device has left the network B) Only during system backups C) At the end of every month D) Before a device joins the network, when its identity and compliance are evaluated during the connection request E) Only when a virus is found
A) A printer driver B) A screen saver C) Post-Admission NAC, which restricts lateral movement by requiring re-authentication for sensitive areas D) Pre-Admission NAC E) A guest Wi-Fi password
A) It cools the server room B) It determines the access level based on identity, permissions, device posture, and request type, then authorizes, restricts, or denies access C) It sells network devices D) It writes source code E) It prints network reports
A) A firewall rule B) A software license C) Any device, user, or process requesting network access, such as laptops, servers, IP cameras, printers, and IoT devices D) A network cable E) A backup tape
A) The office printer B) The employee's email C) The company logo D) The Wi-Fi password E) The Network Access Server (NAS), which provides secure entry to internal networks for remote employees
A) It increases network speed B) It has no policies C) It works only on paper D) It has low visibility and control over IoT devices or endpoints without specific user identities E) It cannot block any device
A) False B) True
A) To replace all developers B) To produce software that is reliable, secure, and resistant to cyberattacks while maintaining functionality and performance C) To make software cheaper than competitors D) To remove testing from development E) To finish projects faster than planned
A) The software is released B) The project team identifies business goals, security objectives, potential risks, and compliance requirements C) The code is written D) Bugs are patched E) Penetration testing is performed
A) The Retirement Phase B) The Deployment Phase C) The Maintenance Phase D) The Testing Phase E) The Requirements Phase, where both functional and security requirements are gathered and documented
A) Patches are applied B) The software is retired C) A secure system architecture is created, and threat modeling is performed to identify possible attacks and weaknesses D) Backups are deleted E) Users are trained
A) The code is written B) Business goals are set C) The software is deployed D) Requirements are collected E) Security testing verifies that the application is protected against threats, including vulnerability assessments, penetration testing, SAST, and DAST
A) The project idea is proposed B) Threat models are drawn C) The software is thrown away D) Requirements are collected E) The application is configured securely and released, with access controls, monitoring systems, and backup strategies in place
A) Because design is finished B) Because the software must be continuously monitored and updated with security patches to stay protected from newly discovered threats C) Because testing is not allowed D) Because it reduces user trust E) Because software never changes
A) False B) True
A) To improve website speed B) To update software C) To encrypt all data D) To make a computer, website, or network resource unavailable to its legitimate users E) To quietly steal passwords
A) It sends a single small email B) It installs a new browser C) It deletes the user's account D) It saturates the targeted server with an overwhelming amount of packets so legitimate users cannot reach it E) It changes the website colors
A) Ignoring unusual traffic B) Turning off logging C) Using a cloud mitigation provider, which is more effective than relying on a firewall alone D) Sharing admin passwords E) Disabling the firewall
A) A method of encrypting databases B) A tool for designing tables C) A type of Wi-Fi attack D) A vulnerability where attackers inject malicious SQL queries through user inputs to manipulate the backend database E) A way to back up a database
A) Remove the login form B) Trust all user input C) Display detailed database errors D) Use prepared statements and parameterized queries, and validate and restrict user input E) Give all users full privileges
A) Error-based SQL injection, where the attacker intentionally causes the database to generate an error message B) Blind SQL injection C) Union-based SQL injection D) Stored XSS E) DOM-based XSS
A) A hardware failure B) A vulnerability where an attacker injects malicious client-side scripts, usually JavaScript, into a trusted website that then run in other users' browsers C) A database backup D) A fake email asking for passwords E) An attack that floods a server with packets
A) Reflected XSS B) Union-based injection C) Stored XSS, where the malicious input is permanently saved by the application and runs for every visitor D) Blind SQL injection E) DOM-based XSS
A) It deletes cookies B) It blocks all users C) It speeds up scripts D) It reduces the impact of XSS by restricting the sources from which scripts are allowed to execute E) It encrypts the database
A) A way to back up files B) A cyberattack where criminals pretend to be a trusted person or organization to trick victims into sharing information, clicking bad links, or downloading malware C) A method for speeding up the internet D) A kind of antivirus E) A type of fishing app
A) Reply with the OTP B) Forward it to friends C) Ignore all security tools D) Click the link quickly E) Avoid clicking links or sharing the OTP, verify the sender through official channels, and turn on Multi-Factor Authentication
A) True B) False
A) It governs children's websites B) It sets rules for credit cards C) It criminalizes unauthorized access to computer systems in the United States D) It protects patient health records E) It regulates online ads
A) GLBA B) SOX C) COPPA D) CFAA E) HIPAA, the Health Insurance Portability and Accountability Act
A) FISMA B) The Gramm-Leach-Bliley Act (GLBA), which applies to financial institutions C) HIPAA D) SOX E) COPPA
A) HIPAA B) The Children's Online Privacy Protection Act (COPPA), which regulates how services handle children's data C) GLBA D) CFAA E) SOX
A) The FBI B) The NIST C) The Federal Trade Commission (FTC), through its authority over unfair or deceptive trade practices D) The DHS E) The Department of Agriculture
A) SOX B) HIPAA C) FISMA D) COPPA E) The California Consumer Privacy Act and California Privacy Rights Act (CCPA/CPRA)
A) CMMC B) HIPAA C) SOX D) PCI-DSS, the Payment Card Industry Data Security Standard E) COPPA
A) False B) True
A) Breaking into accounts for fun B) Hacking done to harm users C) Selling stolen passwords D) Hacking done secretly to steal data E) Hacking done with permission to find security weaknesses and help improve security, following rules and agreements
A) Deleting all data daily B) Protecting personal and sensitive information so it is not accessed or shared without proper authorization C) Collecting as much data as possible D) Sharing data with everyone E) Making data public
A) Hiding incidents B) Using weak passwords C) Sharing client data publicly D) Keeping information confidential, following company policies, avoiding conflicts of interest, and reporting incidents properly E) Ignoring policies
A) It is ethical hacking B) It is a safety measure C) It is a normal part of the job D) It is allowed if no data is taken E) It is considered illegal and unethical because accessing an account without permission is unauthorized access
A) True B) False
A) Making Wi-Fi faster B) Selling wireless devices C) Installing more routers D) Extending the signal range E) The protection of wireless networks, such as Wi-Fi, from unauthorized access, cyber threats, and data theft
A) No encryption B) A shared public password C) An open network D) WPA2 or WPA3, because they protect wireless access with strong encryption E) Plain text
A) A firmware update B) A guest network C) A strong password D) Eavesdropping E) A rogue or fake access point, which is an unauthorized network that imitates a legitimate one
A) Share the password publicly B) Disable all security C) Keep the default password D) Change the default administrator password and keep devices updated with security updates E) Turn off encryption
A) Using one shared network for all B) Giving guests the staff password C) Removing all passwords D) Turning off the router E) Creating separate guest, student, and staff networks so each group has only the access it needs
A) Easy-to-guess passwords increase the risk of unauthorized access to the network B) They slow down the router C) They erase saved data D) They reduce battery life E) They make the signal weaker
A) To block all advertisements B) To increase Wi-Fi range C) To store files online D) To create an encrypted tunnel between your device and a VPN server that protects your data and hides your real IP address E) To make websites load faster
A) It sells it B) It publishes it online C) It leaves it unchanged D) The VPN server replaces your real IP address with its own public IP address E) It deletes your device
A) A wireless printer B) A Remote Access VPN, which connects individual users securely to a remote private network C) No VPN at all D) A Double VPN E) A Site-to-Site VPN
A) A Site-to-Site VPN, which connects entire networks using routers instead of apps on user devices B) A Double VPN C) A Mobile VPN D) A Remote Access VPN E) A Personal VPN
A) A Double VPN B) A Cloud VPN C) A Personal VPN D) A Site-to-Site VPN E) A Mobile VPN, which is designed to stay secure as the user switches between networks
A) A VPN that links two offices B) A VPN that routes and encrypts traffic through two separate servers instead of just one C) A VPN that encrypts half the data D) A VPN with two passwords E) Two phones on one VPN
A) PPTP B) L2TP C) OpenVPN, which is open-source and highly configurable D) SSH E) SSTP
A) SSTP B) WireGuard, a newer protocol with a much smaller code base C) PPTP D) IKEv2 E) L2TP
A) OpenVPN B) SSTP C) IKEv2 D) L2TP, which relies on IPSec to provide the encryption E) WireGuard
A) False B) True
A) Systems never go down B) Only authorized users can access the information, keeping sensitive data protected from unauthorized people C) Data is always backed up D) Everyone can view data E) Data is deleted often
A) Systems are always online B) Users are always logged in C) Data remains accurate and unaltered whether it is in transit or in storage D) Data is deleted daily E) Data is hidden from everyone
A) Systems shut down at night B) Data is kept secret C) Only admins can log in D) Data is never changed E) Systems and data are accessible whenever they are legitimately needed by authorized users
A) Using a single password B) Relying on one strong firewall C) Trusting all internal users D) Using multiple, overlapping layers of security so that if one layer fails, others still protect the system E) Protecting only the perimeter
A) Least privilege, where users, apps, and devices receive only the access they need B) Redundancy C) Zero access D) Open access E) Defense in depth
A) Removing firewalls B) Making Wi-Fi faster C) Increasing the number of users D) Storing backups E) Dividing the network into zones, such as VLANs and subnets, to limit how far an attacker can move
A) Trust only the firewall B) Trust verified devices forever C) Never trust, always verify: every user and device must be authenticated and authorized for each access request D) Trust everyone inside the network E) Trust all employees
A) A password B) A VPN client C) A backup tape D) A SIEM E) A DMZ, which acts as a buffer zone for public services
A) It prints reports B) It collects logs from every zone, correlates events, detects anomalies, and supports incident response C) It encrypts disks D) It creates user accounts E) It repairs hardware
A) It blocks traffic B) It logs activity for audit and forensics so that actions can be traced later C) It verifies who the user is D) It grants permissions E) It encrypts data
A) True B) False
A) Fixing broken cables B) Selling licenses C) Designing logos D) Managing office printers E) Identifying and fixing vulnerabilities in applications, which correspond to Common Weakness Enumerations (CWEs)
A) SAST, DAST, and IAST, which analyze application code and behavior for vulnerabilities B) Firewalls only C) Wireshark and AirCrack D) Routers and switches E) Backups only
A) Burp Suite only B) SonarQube only C) SAST and DAST D) IAST only E) Wireshark, AirCrack, and Metasploit, which focus on network-level testing
A) Broken Access Control, where users can act outside their intended permissions B) SSRF C) Insecure Design D) Injection E) Cryptographic Failures
A) SSRF B) Broken Access Control C) Injection D) Cryptographic Failures, which can lead to exposure of passwords, health records, and personal data E) Insecure Design
A) A stolen password B) An email scam C) A faulty server fan D) A broken login page E) A flaw where a web app pulls data from a remote resource without validating the user-supplied URL
A) It monitors and filters HTTP traffic at OSI layer 7, working like a reverse proxy that shields the server B) It repairs software C) It scans physical devices D) It encrypts email E) It manages passwords
A) It writes source code B) It scans Wi-Fi networks C) It analyzes user behavior and application traffic at runtime and can terminate sessions that exploit weaknesses D) It backs up databases E) It installs updates
A) A list of staff members B) A list of project costs C) A set of firewall rules D) A copy of the source code E) A comprehensive list of a software's components, including open-source and proprietary libraries and modules
A) Integrating security earlier in the software development life cycle so vulnerabilities are cheaper and easier to fix B) Moving security to the end C) Removing developers D) Skipping testing E) Testing only in production
A) The CVSS score carries no real risk because the vulnerable code is not actually used B) It means a breach occurred C) The application must go offline D) It must be ignored forever E) It must always be fixed first
A) True B) False
A) Official Web Safety Panel B) Open Web Server Policy C) Online Web Access Security Plan D) Open Wireless App Standard E) Open Worldwide Application Security Project
A) Rejecting invalid input B) Validating on the server C) Checking input only in the browser and not validating it again on the server D) Using strong passwords E) Checking the year entered
A) To check logins B) To make user data safe before it is displayed on a webpage so it cannot run as code C) To create sessions D) To hash passwords E) To back up databases
A) Verifying credentials B) Storing passwords in plain text instead of protecting them with appropriate password-hashing practices C) Using strong passwords D) Using secure sessions E) Hashing passwords
A) Error Handling B) Input Validation C) Cryptography D) Output Encoding E) Access Control, which checks what an authenticated user is allowed to do
A) Failing safely B) Recording useful events C) Showing a safe error message D) Logging failed logins E) Showing stack traces, database details, or other sensitive technical information to users
A) Output Encoding B) Access Control C) Input Validation D) Session Management E) System Configuration, which secures the environment the application runs in
A) Leaving sessions active unnecessarily or failing to protect session identifiers B) Ending sessions after logout C) Validating the session D) Creating a protected session E) Using timeouts
A) Using secure channels B) Understanding the goal C) Managing keys securely D) Protecting data E) Inventing your own encryption instead of using established, suitable cryptographic protection |