ThatQuiz
|
Test Library
|
Take this test now
IASEC2 MIDTERM REVIEWER: PASS AWAY EDITION - Quiz
  • 1. Fillin the blank: Papa__
A) Long ass quiz...
B) Salamat Shopee
C) Sinong 8080 gumawa nito?
D) Papanaw
E) Papasa
  • 2. A team wants to scan its application's source code, bytecode, or binaries for security flaws without running the program. Which type of testing fits?
A) Penetration testing
B) Software Composition Analysis (SCA)
C) Static Application Security Testing (SAST)
D) Interactive Application Security Testing (IAST)
E) Dynamic Application Security Testing (DAST)
  • 3. A team wants to evaluate a running application from the outside by simulating real-world hacker attacks. Which type of testing fits?
A) Interactive Application Security Testing (IAST)
B) Static Application Security Testing (SAST)
C) Vulnerability assessment
D) Software Composition Analysis (SCA)
E) Dynamic Application Security Testing (DAST)
  • 4. Which type of testing combines features of SAST and DAST by placing security agents inside a running application's environment?
A) Static Application Security Testing (SAST)
B) Dynamic Application Security Testing (DAST)
C) Software Composition Analysis (SCA)
D) Interactive Application Security Testing (IAST)
E) Penetration testing
  • 5. An application relies on many third-party libraries and open-source dependencies. Which type of testing checks them for known vulnerabilities or licensing issues?
A) Software Composition Analysis (SCA)
B) Dynamic Application Security Testing (DAST)
C) Static Application Security Testing (SAST)
D) Interactive Application Security Testing (IAST)
E) Penetration testing
  • 6. Which open-source web application security testing tool automatically sends test requests and analyzes the responses for vulnerabilities?
A) OWASP ZAP
B) Burp Suite
C) SonarQube
D) Wireshark
E) Nessus
  • 7. A tester wants to capture a login request, then view, modify, and resend it using Proxy, Repeater, and Intruder. Which tool fits?
A) Nessus
B) Metasploit
C) OWASP ZAP
D) SonarQube
E) Burp Suite
  • 8. Which tool is a source code analysis tool that detects security vulnerabilities and coding problems in applications?
A) Nessus
B) Burp Suite
C) AirCrack
D) OWASP ZAP
E) SonarQube
  • 9. An admin needs to scan a server, a network device, and an application, compare the results with a database of known vulnerabilities, and get a report with Critical, High, Medium, and Low risk levels. Which tool fits?
A) Wireshark
B) Nessus
C) Burp Suite
D) OWASP ZAP
E) SonarQube
  • 10. True or False: In the application security testing process, Reporting comes before Vulnerability Identification.
A) True
B) False
  • 11. What is Network Access Control (NAC)?
A) A standard that secures credit and debit card transactions
B) A tool that analyzes source code for security vulnerabilities
C) A platform that collects and correlates logs from every zone
D) A protocol that creates an encrypted tunnel over the internet
E) A security system that controls and monitors who can access a network by allowing only verified users and compliant devices
  • 12. Which type of NAC occurs before a device joins the network?
A) Policy Server
B) Post-Admission NAC
C) Network Access Server
D) Access Requestor
E) Pre-Admission NAC
  • 13. A device is already on the network and tries to reach a sensitive area. Which type of NAC restricts this lateral movement by requiring re-authentication?
A) Network Access Server
B) Post-Admission NAC
C) Policy Server
D) Access Requestor
E) Pre-Admission NAC
  • 14. Which NAC element determines the access level based on identity, permissions, device posture, and request type?
A) Pre-Admission NAC
B) Policy Server
C) Network Access Server (NAS)
D) Post-Admission NAC
E) Access Requestor (AR)
  • 15. A remote employee connects to the internal network through a VPN gateway. Which NAC element acts as the access control point?
A) Policy Server
B) Post-Admission NAC
C) Access Requestor (AR)
D) Network Access Server (NAS)
E) Pre-Admission NAC
  • 16. Which NAC element includes laptops, servers, IP cameras, printers, and IoT devices that request network access?
A) Post-Admission NAC
B) Pre-Admission NAC
C) Network Access Server (NAS)
D) Policy Server
E) Access Requestor (AR)
  • 17. A device that only partially meets an organization's security policy tries to connect to the network. What can a NAC system do?
A) Delete the device's data
B) Ignore its compliance status
C) Disconnect every other device
D) Grant it full access automatically
E) Grant it restricted access
  • 18. True or False: According to the slides, NAC protects against threats that originate within the network, such as insider attacks.
A) False
B) True
  • 19. A team is performing threat modeling to identify possible attacks and weaknesses in its system architecture. Which SSDLC phase is this?
A) Design Phase
B) Maintenance Phase
C) Development Phase
D) Planning Phase
E) Testing Phase
  • 20. In which SSDLC phase are both functional and security requirements gathered and documented?
A) Development Phase
B) Maintenance Phase
C) Design Phase
D) Deployment Phase
E) Requirements Phase
  • 21. In which SSDLC phase does the project team identify business goals, security objectives, potential risks, and compliance requirements?
A) Planning Phase
B) Requirements Phase
C) Design Phase
D) Deployment Phase
E) Testing Phase
  • 22. In which SSDLC phase are code reviews, security guidelines, and automated scanning tools used to detect vulnerabilities such as SQL injection and cross-site scripting?
A) Development Phase
B) Deployment Phase
C) Maintenance Phase
D) Requirements Phase
E) Planning Phase
  • 23. In which SSDLC phase may vulnerability assessments, penetration testing, SAST, and DAST be carried out?
A) Maintenance Phase
B) Design Phase
C) Deployment Phase
D) Planning Phase
E) Testing Phase
  • 24. Before release, a team configures the application securely and sets up access controls, monitoring systems, and backups. Which SSDLC phase is this?
A) Testing Phase
B) Maintenance Phase
C) Planning Phase
D) Development Phase
E) Deployment Phase
  • 25. In which SSDLC phase must the software be continuously monitored and updated with security patches and bug fixes?
A) Design Phase
B) Testing Phase
C) Maintenance Phase
D) Planning Phase
E) Requirements Phase
  • 26. True or False: The Secure Software Development Life Cycle extends the traditional SDLC by adding security-focused practices.
A) True
B) False
  • 27. What is a Denial of Service (DoS) attack?
A) A malicious cyber threat that makes a computer, website, or network resource unavailable to its legitimate users
B) An attack that injects malicious client-side scripts into a trusted website
C) An attack where criminals pretend to be a trusted person or organization
D) An attack that tricks a browser into sending an unwanted request
E) An attack that injects malicious SQL queries through user inputs
  • 28. Which type of DoS attack saturates a targeted server with an overwhelming amount of packets?
A) Buffer overflow attack
B) Flood attack
C) Reflected attack
D) Phishing attack
E) Error-based attack
  • 29. According to the slides, which DoS prevention method is the simplest and least effective?
A) Firewall
B) Internet Service Provider
C) Cloud mitigation provider
D) Multi-Factor Authentication
E) Parameterized queries
  • 30. Which type of SQL injection occurs when an attacker intentionally causes the database to generate an error message?
A) Blind SQL injection
B) Union-based SQL injection
C) Stored XSS
D) Error-based SQL injection
E) DOM-based XSS
  • 31. Which type of SQL injection uses the UNION operator to combine the results of two or more SELECT statements?
A) Blind SQL injection
B) Stored XSS
C) Error-based SQL injection
D) Union-based SQL injection
E) Reflected XSS
  • 32. When does Blind SQL injection occur?
A) When user input is immediately returned in the server response
B) When attackers cannot see query results directly on the webpage
C) When the database is made to generate an error message on purpose
D) When malicious input is permanently stored by the application
E) When the browser inserts user data into the page without sanitization
  • 33. Which of the following is listed as a way to prevent SQL injection?
A) Display detailed database errors to users
B) Grant users full database privileges
C) Disable input validation
D) Use prepared statements and parameterized queries
E) Trust all user input
  • 34. Malicious input is permanently stored by an application and runs every time users visit the affected page. Which type of XSS is this?
A) Union-based SQL injection
B) DOM-based XSS
C) Reflected XSS
D) Stored XSS
E) Error-based SQL injection
  • 35. Which type of XSS occurs when user input is immediately returned in the server response without proper validation or encoding?
A) Stored XSS
B) Blind SQL injection
C) DOM-based XSS
D) Union-based SQL injection
E) Reflected XSS
  • 36. Which type of XSS occurs when JavaScript in the browser inserts user-controlled data into the page without proper sanitization?
A) Stored XSS
B) Blind SQL injection
C) DOM-based XSS
D) Error-based SQL injection
E) Reflected XSS
  • 37. A user is logged in to a website, and their browser is tricked into sending an unwanted request to that site. Which vulnerability is this?
A) Denial of Service
B) SQL Injection
C) CSRF
D) Cross-Site Scripting
E) Phishing
  • 38. Which cyberattack involves criminals pretending to be a trusted person or organization to trick people into sharing sensitive information, clicking a bad link, or downloading malware?
A) SQL Injection
B) Phishing
C) CSRF
D) Cross-Site Scripting
E) Denial of Service
  • 39. True or False: CSRF tokens and SameSite cookies are listed as ways to prevent CSRF.
A) False
B) True
  • 40. Which U.S. law criminalizes unauthorized access to computer systems?
A) Computer Fraud & Abuse Act (CFAA)
B) FISMA
C) GLBA
D) HIPAA
E) SOX
  • 41. Which U.S. law sets security and privacy standards for patient health data?
A) GLBA
B) HIPAA
C) FISMA
D) COPPA
E) CFAA
  • 42. Which U.S. law requires financial institutions to protect customer personal information?
A) COPPA
B) HIPAA
C) SOX
D) FISMA
E) Gramm-Leach-Bliley Act (GLBA)
  • 43. Which U.S. law governs data practices for services aimed at children?
A) SOX
B) COPPA
C) GLBA
D) CFAA
E) HIPAA
  • 44. Which U.S. agency regulates cybersecurity under its authority to police unfair or deceptive trade practices?
A) NIST
B) DHS
C) Federal Trade Commission (FTC)
D) DOJ / FBI
E) Information Commissioner's Office
  • 45. Which law gives California residents the right to know, access, delete, and opt out of the sale of their personal data?
A) NIS Directive
B) GDPR
C) HIPAA
D) PDPA
E) CCPA / CPRA
  • 46. Which standard provides protocols and guidelines that secure credit and debit card transactions?
A) NIST Cybersecurity Framework
B) CMMC
C) PCI-DSS
D) ISO/IEC 27001
E) HIPAA
  • 47. True or False: The NIST Cybersecurity Framework is a law.
A) True
B) False
  • 48. Which type of hacking is done with permission, finds security weaknesses, and follows rules and agreements?
A) Data theft
B) Ethical hacking
C) Cyber fraud
D) Malicious hacking
E) Identity theft
  • 49. Which type of hacking is done without permission and can steal or destroy information?
A) Compliance auditing
B) Ethical hacking
C) Data privacy
D) Malicious hacking
E) Vulnerability assessment
  • 50. What does data privacy mean?
A) Protecting personal and sensitive information
B) Sharing data with any organization
C) Collecting as much data as possible
D) Making all collected data public
E) Deleting all data every day
  • 51. Which of the following is a responsibility of a cybersecurity professional?
A) Ignore company policies
B) Hide security incidents
C) Stop learning about new threats
D) Share client data when convenient
E) Keep information confidential
  • 52. True or False: Hacking into a system without permission is illegal.
A) True
B) False
  • 53. Wireless Network Security refers to the protection of wireless networks, such as Wi-Fi, from which of the following?
A) Slow internet speeds only
B) Unauthorized access, cyber threats, and data theft
C) Software license expiry
D) Hardware price increases
E) Electricity outages
  • 54. Which encryption types are listed as security methods for wireless network access control?
A) WPA2 or WPA3
B) SSL only
C) PPTP
D) No encryption
E) WEP only
  • 55. A fake hotspot uses a name similar to a cafĂ©'s real Wi-Fi. Which wireless threat is this?
A) Eavesdropping
B) Rogue or fake access point
C) Unauthorized access
D) Malware
E) Weak passwords
  • 56. Which wireless threat is an attacker attempting to intercept wireless communications?
A) Weak passwords
B) Unauthorized access
C) Rogue or fake access point
D) Eavesdropping
E) Malware
  • 57. Which of the following is listed as a router and access point security measure?
A) Share the Wi-Fi password publicly
B) Disable the firewall
C) Enable all unnecessary features
D) Stop updating router firmware
E) Change the default administrator password
  • 58. Which best practice is listed for separating different groups of users on a wireless network?
A) Use one shared network for everyone
B) Turn off the firewall
C) Disable authentication
D) Give guests the staff password
E) Separate guest, student, and staff networks
  • 59. What does a Virtual Private Network (VPN) create between your device and a VPN server?
A) A shared public folder
B) A firewall rule
C) A backup copy of your traffic
D) A physical cable
E) An encrypted tunnel
  • 60. An employee works from home and needs safe access to company files. Which VPN type fits best?
A) Cloud VPN
B) Remote Access VPN
C) Personal VPN
D) Site-to-Site VPN
E) Mobile VPN
  • 61. A large business wants to link multiple office branches using network routers instead of apps on user devices. Which VPN type fits?
A) Double VPN
B) Mobile VPN
C) Remote Access VPN
D) Site-to-Site VPN
E) Personal VPN
  • 62. Which VPN type is optimized specifically for smartphones and tablets?
A) Mobile VPN
B) Double VPN
C) Cloud VPN
D) Site-to-Site VPN
E) Remote Access VPN
  • 63. Which VPN type is hosted entirely on cloud infrastructure rather than physical servers?
A) Remote Access VPN
B) Site-to-Site VPN
C) Personal VPN
D) Mobile VPN
E) Cloud VPN
  • 64. How does a Double VPN work?
A) It uses two different passwords to log in
B) It routes and encrypts traffic through two separate servers instead of just one
C) It connects two offices through routers
D) It runs two VPN apps on the same phone
E) It encrypts only half of the traffic
  • 65. Which VPN protocol does not encrypt data on its own and is almost always paired with IPSec?
A) OpenVPN
B) L2TP
C) IKEv2
D) WireGuard
E) SSTP
  • 66. Which VPN protocol was developed by Microsoft and is only available for Windows operating systems?
A) L2TP
B) WireGuard
C) IKEv2
D) SSTP
E) OpenVPN
  • 67. Which VPN protocol is highly effective at maintaining a connection when switching from Wi-Fi to mobile data?
A) SSH
B) IKEv2
C) PPTP
D) L2TP
E) SSTP
  • 68. True or False: According to the VPN conclusion, a VPN makes you entirely anonymous online.
A) True
B) False
  • 69. In the CIA triad, which goal means data stays accurate and unaltered in transit or storage?
A) Availability
B) Accounting
C) Authentication
D) Integrity
E) Confidentiality
  • 70. In the CIA triad, which goal means only authorized users can access information?
A) Availability
B) Confidentiality
C) Accounting
D) Authorization
E) Integrity
  • 71. Which design principle uses multiple, overlapping layers of security so that if one fails, others still protect the system?
A) Zero trust
B) Least privilege
C) Defense in depth
D) Redundancy
E) Network segmentation
  • 72. Which design principle gives users, apps, and devices only the minimum access they need?
A) Redundancy
B) Network segmentation
C) Least privilege
D) Defense in depth
E) Zero trust
  • 73. Which design approach divides the network into zones such as VLANs, subnets, and firewalls to limit how far an attacker can move?
A) Defense in depth
B) Least privilege
C) Redundancy
D) Network segmentation
E) Secure by default
  • 74. Which architecture follows the idea "Never trust, always verify"?
A) Zero Trust
B) Network segmentation
C) Defense in depth
D) Redundancy
E) Least privilege
  • 75. A company wants a buffer zone for its public services. Which architecture component fits?
A) DMZ
B) SIEM
C) DLP
D) NAC
E) VPN gateway
  • 76. Which platform collects logs from every zone, correlates events, detects anomalies, and supports incident response?
A) IDS/IPS
B) SIEM
C) NAC
D) DMZ
E) DLP
  • 77. In AAA, which part logs activity for audit and forensics?
A) Availability
B) NAC
C) Accounting
D) Authentication
E) Authorization
  • 78. A laptop tries to connect to the network, and the system first checks its device posture before granting access. Which component does this?
A) SIEM
B) DMZ
C) NAC
D) Backup system
E) DLP
  • 79. True or False: The NIST Cybersecurity Framework has five functions: Identify, Protect, Detect, Respond, and Recover.
A) False
B) True
  • 80. Network Application Security is based on identifying and fixing vulnerabilities that correspond to which weaknesses?
A) Critical Web Errors
B) Cloud Web Endpoints
C) Common Wireless Encryptions
D) Common Weakness Enumerations (CWEs)
E) Certified Web Exploits
  • 81. Which tools are listed for Network Application Security?
A) SAST, DAST, IAST
B) Wireshark, AirCrack, Metasploit
C) Backups and failover links
D) Firewalls and routers
E) VPN gateways and NAC servers
  • 82. Which tools are listed for Network Security, as opposed to Network Application Security?
A) SAST, DAST, IAST
B) OWASP ZAP only
C) Wireshark, AirCrack, Metasploit
D) Burp Suite only
E) SonarQube only
  • 83. Which risk is #1 on the OWASP Top 10 list as presented?
A) Insecure Design
B) Cryptographic Failures
C) Security Misconfiguration
D) Broken Access Control
E) Injection
  • 84. Which OWASP Top 10 risk covers data that is not properly protected in transit or at rest, exposing passwords, health records, and personal data?
A) SSRF
B) Cryptographic Failures
C) Broken Access Control
D) Security Logging & Monitoring Failures
E) Injection
  • 85. Which OWASP Top 10 risk occurs when a web app does not validate a user-supplied URL before pulling data from a remote resource?
A) Insecure Design
B) Broken Access Control
C) Cryptographic Failures
D) Injection
E) Server-Side Request Forgery (SSRF)
  • 86. Which tool monitors and filters HTTP traffic as an OSI layer-7 defense and works like a reverse proxy that shields the server?
A) Web Application Firewall (WAF)
B) Runtime Application Self-Protection (RASP)
C) Software Bill of Materials (SBOM)
D) CNAPP
E) Software Composition Analysis (SCA)
  • 87. Which solution analyzes user behavior and application traffic at runtime and can terminate sessions where weaknesses are being exploited?
A) Software Composition Analysis (SCA)
B) Software Bill of Materials (SBOM)
C) CNAPP
D) Web Application Firewall (WAF)
E) Runtime Application Self-Protection (RASP)
  • 88. What is a Software Bill of Materials (SBOM)?
A) A backup copy of the software
B) A report of all software licensing costs
C) A set of firewall rules
D) A list of employees who wrote the code
E) A comprehensive list of a software's components, including open-source and proprietary libraries and modules
  • 89. What does gray box testing involve?
A) Full access to internals such as static code analysis
B) Limited internal access, such as login credentials as a signed-in user
C) No access to internals
D) Testing only after release
E) Testing only the network cables
  • 90. A vulnerable open-source library has a high CVSS score, but the application never invokes the vulnerable code. What do the slides say about its risk?
A) It must always be fixed first
B) It means the application has been breached
C) The CVSS score carries no real risk
D) CVSS scores are always inaccurate
E) The whole application must be taken offline
  • 91. True or False: "Shift left" means integrating security earlier in the SDLC so vulnerabilities are cheaper and easier to fix.
A) True
B) False
  • 92. What does OWASP stand for?
A) Official Web Application Standards Panel
B) Online Web Application Security Protocol
C) Open Worldwide Application Security Project
D) Organized Worldwide Application Safety Program
E) Open Web Access Security Policy
  • 93. What is the common mistake in input validation?
A) Only checking the input in the browser and not checking it on the server
B) Rejecting invalid input
C) Validating the year before saving it
D) Checking input before using it
E) Checking the input on the server
  • 94. Which secure coding practice means making user data safe before showing it on a webpage?
A) Output Encoding
B) Data Protection
C) Input Validation
D) Session Management
E) System Configuration
  • 95. What is a common mistake in authentication and password management?
A) Using appropriate password-hashing practices
B) Creating a secure session after login
C) Hashing passwords
D) Storing passwords in plain text or using weak credential handling
E) Verifying credentials
  • 96. A student may view their own enrollment but cannot approve another student's enrollment. Which secure coding practice is this?
A) Session Management
B) Access Control
C) Output Encoding
D) Input Validation
E) Cryptographic Practices
  • 97. What is a common mistake in error handling and logging?
A) Showing a safe message to the user
B) Logging a login failure for monitoring
C) Recording useful security events
D) Failing safely
E) Showing stack traces, database details, passwords, or other sensitive technical information to users
  • 98. A production server keeps default credentials, unnecessary services, and development settings enabled. Which secure coding practice has been ignored?
A) Output Encoding
B) Input Validation
C) Access Control
D) System Configuration
E) Session Management
  • 99. What is a common mistake in session management?
A) Validating the session on requests
B) Creating a protected session
C) Protecting session identifiers
D) Leaving sessions active unnecessarily or failing to protect session identifiers
E) Invalidating the session on logout or timeout
  • 100. What is a common mistake in cryptographic practices?
A) Inventing your own encryption or using cryptography without understanding the security goal and key management
B) Using appropriate secure communication
C) Managing keys securely
D) Selecting suitable cryptographic protection
E) Understanding the security goal
Created with That Quiz — where test making and test taking are made easy for math and other subject areas.