A) may kaliwa ba sa right? may kanan ba sa left? B) Sure ka sa mga question na toh? C) are you gagoing me? D) 4 E) hmmm depende kung 3 yan kasi kung 3 yan edi 5
A) To make applications more resistant to security threats by identifying security weaknesses and vulnerabilities in the source code B) To make applications run faster C) To reduce hosting costs D) To increase the number of users E) To design the user interface
A) A way to monitor user behavior B) A backup strategy C) A method that attacks a running application D) A white-box method that scans source code, bytecode, or binaries for security flaws without actually running the program E) A tool that blocks network traffic
A) A method that only reads source code B) A black-box method that evaluates a running application from the outside by simulating real-world hacker attacks to find live vulnerabilities C) A tool for managing passwords D) A way to train employees E) A type of firewall
A) It does not test applications at all B) It is used only after the software is retired C) It tests only network cables D) It only works on printed documents E) It combines features of both by placing security agents inside a running application's environment to monitor code execution in real time
A) IAST B) Software Composition Analysis (SCA), which scans third-party libraries and open-source dependencies for known vulnerabilities or licensing issues C) DAST D) SAST E) Wi-Fi scanning
A) SonarQube B) Nessus C) Microsoft Word D) Wireshark E) OWASP ZAP, which automatically sends test requests to the application and analyzes the responses for vulnerabilities
A) SonarQube B) A web browser C) Nessus D) Burp Suite, an intercepting proxy that lets the tester view, modify, and resend HTTP requests E) A spreadsheet
A) It intercepts HTTP requests B) It encrypts files C) It analyzes source code to detect security vulnerabilities, bugs, code smells, and poor coding practices D) It scans Wi-Fi networks E) It manages user accounts
A) A word processor B) A file archiver C) SonarQube D) Nessus, which compares scan results with a database of known vulnerabilities and generates a report with risk levels E) A password manager
A) True B) False
A) To speed up the network B) To design websites C) To track employee attendance D) To control and monitor who can access a network by allowing only verified users and compliant devices, enforcing security rules before access is granted E) To store backups of files
A) Only when a virus is found B) Before a device joins the network, when its identity and compliance are evaluated during the connection request C) Only during system backups D) At the end of every month E) After the device has left the network
A) A printer driver B) A screen saver C) Post-Admission NAC, which restricts lateral movement by requiring re-authentication for sensitive areas D) Pre-Admission NAC E) A guest Wi-Fi password
A) It cools the server room B) It writes source code C) It sells network devices D) It prints network reports E) It determines the access level based on identity, permissions, device posture, and request type, then authorizes, restricts, or denies access
A) A backup tape B) A software license C) Any device, user, or process requesting network access, such as laptops, servers, IP cameras, printers, and IoT devices D) A firewall rule E) A network cable
A) The company logo B) The Network Access Server (NAS), which provides secure entry to internal networks for remote employees C) The office printer D) The Wi-Fi password E) The employee's email
A) It works only on paper B) It cannot block any device C) It has no policies D) It has low visibility and control over IoT devices or endpoints without specific user identities E) It increases network speed
A) False B) True
A) To replace all developers B) To make software cheaper than competitors C) To produce software that is reliable, secure, and resistant to cyberattacks while maintaining functionality and performance D) To finish projects faster than planned E) To remove testing from development
A) Bugs are patched B) Penetration testing is performed C) The project team identifies business goals, security objectives, potential risks, and compliance requirements D) The software is released E) The code is written
A) The Maintenance Phase B) The Retirement Phase C) The Requirements Phase, where both functional and security requirements are gathered and documented D) The Testing Phase E) The Deployment Phase
A) Patches are applied B) The software is retired C) A secure system architecture is created, and threat modeling is performed to identify possible attacks and weaknesses D) Users are trained E) Backups are deleted
A) The code is written B) Business goals are set C) Security testing verifies that the application is protected against threats, including vulnerability assessments, penetration testing, SAST, and DAST D) The software is deployed E) Requirements are collected
A) The software is thrown away B) Threat models are drawn C) Requirements are collected D) The project idea is proposed E) The application is configured securely and released, with access controls, monitoring systems, and backup strategies in place
A) Because the software must be continuously monitored and updated with security patches to stay protected from newly discovered threats B) Because software never changes C) Because it reduces user trust D) Because design is finished E) Because testing is not allowed
A) False B) True
A) To improve website speed B) To make a computer, website, or network resource unavailable to its legitimate users C) To encrypt all data D) To quietly steal passwords E) To update software
A) It installs a new browser B) It changes the website colors C) It saturates the targeted server with an overwhelming amount of packets so legitimate users cannot reach it D) It deletes the user's account E) It sends a single small email
A) Using a cloud mitigation provider, which is more effective than relying on a firewall alone B) Turning off logging C) Ignoring unusual traffic D) Sharing admin passwords E) Disabling the firewall
A) A method of encrypting databases B) A tool for designing tables C) A vulnerability where attackers inject malicious SQL queries through user inputs to manipulate the backend database D) A way to back up a database E) A type of Wi-Fi attack
A) Display detailed database errors B) Use prepared statements and parameterized queries, and validate and restrict user input C) Trust all user input D) Give all users full privileges E) Remove the login form
A) Error-based SQL injection, where the attacker intentionally causes the database to generate an error message B) Blind SQL injection C) DOM-based XSS D) Stored XSS E) Union-based SQL injection
A) A vulnerability where an attacker injects malicious client-side scripts, usually JavaScript, into a trusted website that then run in other users' browsers B) A hardware failure C) A fake email asking for passwords D) A database backup E) An attack that floods a server with packets
A) Union-based injection B) Stored XSS, where the malicious input is permanently saved by the application and runs for every visitor C) Blind SQL injection D) DOM-based XSS E) Reflected XSS
A) It speeds up scripts B) It blocks all users C) It encrypts the database D) It deletes cookies E) It reduces the impact of XSS by restricting the sources from which scripts are allowed to execute
A) A method for speeding up the internet B) A cyberattack where criminals pretend to be a trusted person or organization to trick victims into sharing information, clicking bad links, or downloading malware C) A way to back up files D) A type of fishing app E) A kind of antivirus
A) Forward it to friends B) Click the link quickly C) Ignore all security tools D) Reply with the OTP E) Avoid clicking links or sharing the OTP, verify the sender through official channels, and turn on Multi-Factor Authentication
A) False B) True
A) It protects patient health records B) It governs children's websites C) It criminalizes unauthorized access to computer systems in the United States D) It regulates online ads E) It sets rules for credit cards
A) GLBA B) CFAA C) SOX D) COPPA E) HIPAA, the Health Insurance Portability and Accountability Act
A) The Gramm-Leach-Bliley Act (GLBA), which applies to financial institutions B) HIPAA C) FISMA D) SOX E) COPPA
A) HIPAA B) GLBA C) CFAA D) SOX E) The Children's Online Privacy Protection Act (COPPA), which regulates how services handle children's data
A) The Federal Trade Commission (FTC), through its authority over unfair or deceptive trade practices B) The Department of Agriculture C) The FBI D) The NIST E) The DHS
A) The California Consumer Privacy Act and California Privacy Rights Act (CCPA/CPRA) B) COPPA C) FISMA D) SOX E) HIPAA
A) CMMC B) PCI-DSS, the Payment Card Industry Data Security Standard C) SOX D) HIPAA E) COPPA
A) False B) True
A) Hacking done to harm users B) Selling stolen passwords C) Hacking done with permission to find security weaknesses and help improve security, following rules and agreements D) Hacking done secretly to steal data E) Breaking into accounts for fun
A) Deleting all data daily B) Sharing data with everyone C) Making data public D) Protecting personal and sensitive information so it is not accessed or shared without proper authorization E) Collecting as much data as possible
A) Sharing client data publicly B) Hiding incidents C) Keeping information confidential, following company policies, avoiding conflicts of interest, and reporting incidents properly D) Ignoring policies E) Using weak passwords
A) It is ethical hacking B) It is allowed if no data is taken C) It is considered illegal and unethical because accessing an account without permission is unauthorized access D) It is a safety measure E) It is a normal part of the job
A) False B) True
A) Selling wireless devices B) Installing more routers C) The protection of wireless networks, such as Wi-Fi, from unauthorized access, cyber threats, and data theft D) Making Wi-Fi faster E) Extending the signal range
A) An open network B) No encryption C) WPA2 or WPA3, because they protect wireless access with strong encryption D) A shared public password E) Plain text
A) A rogue or fake access point, which is an unauthorized network that imitates a legitimate one B) Eavesdropping C) A firmware update D) A strong password E) A guest network
A) Share the password publicly B) Change the default administrator password and keep devices updated with security updates C) Keep the default password D) Disable all security E) Turn off encryption
A) Turning off the router B) Using one shared network for all C) Removing all passwords D) Creating separate guest, student, and staff networks so each group has only the access it needs E) Giving guests the staff password
A) Easy-to-guess passwords increase the risk of unauthorized access to the network B) They make the signal weaker C) They erase saved data D) They reduce battery life E) They slow down the router
A) To create an encrypted tunnel between your device and a VPN server that protects your data and hides your real IP address B) To block all advertisements C) To store files online D) To increase Wi-Fi range E) To make websites load faster
A) The VPN server replaces your real IP address with its own public IP address B) It leaves it unchanged C) It sells it D) It deletes your device E) It publishes it online
A) A Remote Access VPN, which connects individual users securely to a remote private network B) A wireless printer C) A Site-to-Site VPN D) No VPN at all E) A Double VPN
A) A Site-to-Site VPN, which connects entire networks using routers instead of apps on user devices B) A Personal VPN C) A Double VPN D) A Remote Access VPN E) A Mobile VPN
A) A Personal VPN B) A Mobile VPN, which is designed to stay secure as the user switches between networks C) A Site-to-Site VPN D) A Double VPN E) A Cloud VPN
A) A VPN that routes and encrypts traffic through two separate servers instead of just one B) A VPN that links two offices C) A VPN that encrypts half the data D) Two phones on one VPN E) A VPN with two passwords
A) PPTP B) L2TP C) SSTP D) SSH E) OpenVPN, which is open-source and highly configurable
A) SSTP B) IKEv2 C) PPTP D) WireGuard, a newer protocol with a much smaller code base E) L2TP
A) OpenVPN B) L2TP, which relies on IPSec to provide the encryption C) SSTP D) WireGuard E) IKEv2
A) False B) True
A) Only authorized users can access the information, keeping sensitive data protected from unauthorized people B) Systems never go down C) Everyone can view data D) Data is deleted often E) Data is always backed up
A) Data remains accurate and unaltered whether it is in transit or in storage B) Systems are always online C) Data is hidden from everyone D) Users are always logged in E) Data is deleted daily
A) Systems shut down at night B) Only admins can log in C) Data is never changed D) Data is kept secret E) Systems and data are accessible whenever they are legitimately needed by authorized users
A) Protecting only the perimeter B) Trusting all internal users C) Using multiple, overlapping layers of security so that if one layer fails, others still protect the system D) Using a single password E) Relying on one strong firewall
A) Least privilege, where users, apps, and devices receive only the access they need B) Open access C) Defense in depth D) Zero access E) Redundancy
A) Storing backups B) Increasing the number of users C) Making Wi-Fi faster D) Dividing the network into zones, such as VLANs and subnets, to limit how far an attacker can move E) Removing firewalls
A) Trust everyone inside the network B) Trust only the firewall C) Never trust, always verify: every user and device must be authenticated and authorized for each access request D) Trust verified devices forever E) Trust all employees
A) A password B) A DMZ, which acts as a buffer zone for public services C) A SIEM D) A backup tape E) A VPN client
A) It encrypts disks B) It creates user accounts C) It repairs hardware D) It collects logs from every zone, correlates events, detects anomalies, and supports incident response E) It prints reports
A) It logs activity for audit and forensics so that actions can be traced later B) It blocks traffic C) It encrypts data D) It grants permissions E) It verifies who the user is
A) True B) False
A) Managing office printers B) Fixing broken cables C) Selling licenses D) Identifying and fixing vulnerabilities in applications, which correspond to Common Weakness Enumerations (CWEs) E) Designing logos
A) Routers and switches B) Backups only C) Wireshark and AirCrack D) Firewalls only E) SAST, DAST, and IAST, which analyze application code and behavior for vulnerabilities
A) Burp Suite only B) Wireshark, AirCrack, and Metasploit, which focus on network-level testing C) IAST only D) SonarQube only E) SAST and DAST
A) Cryptographic Failures B) SSRF C) Broken Access Control, where users can act outside their intended permissions D) Insecure Design E) Injection
A) Broken Access Control B) Cryptographic Failures, which can lead to exposure of passwords, health records, and personal data C) Injection D) SSRF E) Insecure Design
A) An email scam B) A broken login page C) A flaw where a web app pulls data from a remote resource without validating the user-supplied URL D) A faulty server fan E) A stolen password
A) It manages passwords B) It repairs software C) It encrypts email D) It monitors and filters HTTP traffic at OSI layer 7, working like a reverse proxy that shields the server E) It scans physical devices
A) It installs updates B) It writes source code C) It scans Wi-Fi networks D) It analyzes user behavior and application traffic at runtime and can terminate sessions that exploit weaknesses E) It backs up databases
A) A comprehensive list of a software's components, including open-source and proprietary libraries and modules B) A list of staff members C) A list of project costs D) A copy of the source code E) A set of firewall rules
A) Skipping testing B) Moving security to the end C) Testing only in production D) Removing developers E) Integrating security earlier in the software development life cycle so vulnerabilities are cheaper and easier to fix
A) It means a breach occurred B) The CVSS score carries no real risk because the vulnerable code is not actually used C) It must be ignored forever D) It must always be fixed first E) The application must go offline
A) True B) False
A) Official Web Safety Panel B) Open Wireless App Standard C) Open Web Server Policy D) Online Web Access Security Plan E) Open Worldwide Application Security Project
A) Checking the year entered B) Using strong passwords C) Checking input only in the browser and not validating it again on the server D) Rejecting invalid input E) Validating on the server
A) To hash passwords B) To check logins C) To make user data safe before it is displayed on a webpage so it cannot run as code D) To back up databases E) To create sessions
A) Verifying credentials B) Using secure sessions C) Hashing passwords D) Storing passwords in plain text instead of protecting them with appropriate password-hashing practices E) Using strong passwords
A) Input Validation B) Output Encoding C) Cryptography D) Error Handling E) Access Control, which checks what an authenticated user is allowed to do
A) Showing stack traces, database details, or other sensitive technical information to users B) Showing a safe error message C) Logging failed logins D) Recording useful events E) Failing safely
A) Output Encoding B) Session Management C) System Configuration, which secures the environment the application runs in D) Access Control E) Input Validation
A) Leaving sessions active unnecessarily or failing to protect session identifiers B) Using timeouts C) Ending sessions after logout D) Creating a protected session E) Validating the session
A) Inventing your own encryption instead of using established, suitable cryptographic protection B) Protecting data C) Managing keys securely D) Using secure channels E) Understanding the goal |