ThatQuiz Test Library Take this test now
IASEC2 MIDTERM REVIEWER: PASS AWAY EDITION - Quiz
Contributed by: Fernandez
  • 1. Fillin the blank: Papa__
A) Papasa
B) Sinong 8080 gumawa nito?
C) Long ass quiz...
D) Salamat Shopee
E) Papanaw
  • 2. A team wants to scan its application's source code, bytecode, or binaries for security flaws without running the program. Which type of testing fits?
A) Dynamic Application Security Testing (DAST)
B) Interactive Application Security Testing (IAST)
C) Penetration testing
D) Static Application Security Testing (SAST)
E) Software Composition Analysis (SCA)
  • 3. A team wants to evaluate a running application from the outside by simulating real-world hacker attacks. Which type of testing fits?
A) Interactive Application Security Testing (IAST)
B) Software Composition Analysis (SCA)
C) Static Application Security Testing (SAST)
D) Vulnerability assessment
E) Dynamic Application Security Testing (DAST)
  • 4. Which type of testing combines features of SAST and DAST by placing security agents inside a running application's environment?
A) Static Application Security Testing (SAST)
B) Dynamic Application Security Testing (DAST)
C) Interactive Application Security Testing (IAST)
D) Software Composition Analysis (SCA)
E) Penetration testing
  • 5. An application relies on many third-party libraries and open-source dependencies. Which type of testing checks them for known vulnerabilities or licensing issues?
A) Interactive Application Security Testing (IAST)
B) Dynamic Application Security Testing (DAST)
C) Static Application Security Testing (SAST)
D) Penetration testing
E) Software Composition Analysis (SCA)
  • 6. Which open-source web application security testing tool automatically sends test requests and analyzes the responses for vulnerabilities?
A) Burp Suite
B) Nessus
C) Wireshark
D) SonarQube
E) OWASP ZAP
  • 7. A tester wants to capture a login request, then view, modify, and resend it using Proxy, Repeater, and Intruder. Which tool fits?
A) Burp Suite
B) SonarQube
C) Nessus
D) Metasploit
E) OWASP ZAP
  • 8. Which tool is a source code analysis tool that detects security vulnerabilities and coding problems in applications?
A) OWASP ZAP
B) SonarQube
C) AirCrack
D) Nessus
E) Burp Suite
  • 9. An admin needs to scan a server, a network device, and an application, compare the results with a database of known vulnerabilities, and get a report with Critical, High, Medium, and Low risk levels. Which tool fits?
A) SonarQube
B) Burp Suite
C) OWASP ZAP
D) Nessus
E) Wireshark
  • 10. True or False: In the application security testing process, Reporting comes before Vulnerability Identification.
A) True
B) False
  • 11. What is Network Access Control (NAC)?
A) A standard that secures credit and debit card transactions
B) A platform that collects and correlates logs from every zone
C) A security system that controls and monitors who can access a network by allowing only verified users and compliant devices
D) A tool that analyzes source code for security vulnerabilities
E) A protocol that creates an encrypted tunnel over the internet
  • 12. Which type of NAC occurs before a device joins the network?
A) Post-Admission NAC
B) Network Access Server
C) Pre-Admission NAC
D) Access Requestor
E) Policy Server
  • 13. A device is already on the network and tries to reach a sensitive area. Which type of NAC restricts this lateral movement by requiring re-authentication?
A) Access Requestor
B) Policy Server
C) Network Access Server
D) Pre-Admission NAC
E) Post-Admission NAC
  • 14. Which NAC element determines the access level based on identity, permissions, device posture, and request type?
A) Policy Server
B) Post-Admission NAC
C) Network Access Server (NAS)
D) Access Requestor (AR)
E) Pre-Admission NAC
  • 15. A remote employee connects to the internal network through a VPN gateway. Which NAC element acts as the access control point?
A) Network Access Server (NAS)
B) Access Requestor (AR)
C) Policy Server
D) Post-Admission NAC
E) Pre-Admission NAC
  • 16. Which NAC element includes laptops, servers, IP cameras, printers, and IoT devices that request network access?
A) Network Access Server (NAS)
B) Post-Admission NAC
C) Pre-Admission NAC
D) Access Requestor (AR)
E) Policy Server
  • 17. A device that only partially meets an organization's security policy tries to connect to the network. What can a NAC system do?
A) Delete the device's data
B) Grant it full access automatically
C) Grant it restricted access
D) Disconnect every other device
E) Ignore its compliance status
  • 18. True or False: According to the slides, NAC protects against threats that originate within the network, such as insider attacks.
A) True
B) False
  • 19. A team is performing threat modeling to identify possible attacks and weaknesses in its system architecture. Which SSDLC phase is this?
A) Testing Phase
B) Maintenance Phase
C) Design Phase
D) Development Phase
E) Planning Phase
  • 20. In which SSDLC phase are both functional and security requirements gathered and documented?
A) Maintenance Phase
B) Requirements Phase
C) Development Phase
D) Deployment Phase
E) Design Phase
  • 21. In which SSDLC phase does the project team identify business goals, security objectives, potential risks, and compliance requirements?
A) Testing Phase
B) Deployment Phase
C) Requirements Phase
D) Design Phase
E) Planning Phase
  • 22. In which SSDLC phase are code reviews, security guidelines, and automated scanning tools used to detect vulnerabilities such as SQL injection and cross-site scripting?
A) Maintenance Phase
B) Planning Phase
C) Requirements Phase
D) Development Phase
E) Deployment Phase
  • 23. In which SSDLC phase may vulnerability assessments, penetration testing, SAST, and DAST be carried out?
A) Planning Phase
B) Testing Phase
C) Design Phase
D) Deployment Phase
E) Maintenance Phase
  • 24. Before release, a team configures the application securely and sets up access controls, monitoring systems, and backups. Which SSDLC phase is this?
A) Planning Phase
B) Maintenance Phase
C) Development Phase
D) Deployment Phase
E) Testing Phase
  • 25. In which SSDLC phase must the software be continuously monitored and updated with security patches and bug fixes?
A) Planning Phase
B) Maintenance Phase
C) Design Phase
D) Requirements Phase
E) Testing Phase
  • 26. True or False: The Secure Software Development Life Cycle extends the traditional SDLC by adding security-focused practices.
A) False
B) True
  • 27. What is a Denial of Service (DoS) attack?
A) A malicious cyber threat that makes a computer, website, or network resource unavailable to its legitimate users
B) An attack that tricks a browser into sending an unwanted request
C) An attack that injects malicious SQL queries through user inputs
D) An attack that injects malicious client-side scripts into a trusted website
E) An attack where criminals pretend to be a trusted person or organization
  • 28. Which type of DoS attack saturates a targeted server with an overwhelming amount of packets?
A) Reflected attack
B) Flood attack
C) Error-based attack
D) Buffer overflow attack
E) Phishing attack
  • 29. According to the slides, which DoS prevention method is the simplest and least effective?
A) Multi-Factor Authentication
B) Firewall
C) Cloud mitigation provider
D) Parameterized queries
E) Internet Service Provider
  • 30. Which type of SQL injection occurs when an attacker intentionally causes the database to generate an error message?
A) Union-based SQL injection
B) Blind SQL injection
C) Error-based SQL injection
D) DOM-based XSS
E) Stored XSS
  • 31. Which type of SQL injection uses the UNION operator to combine the results of two or more SELECT statements?
A) Error-based SQL injection
B) Stored XSS
C) Union-based SQL injection
D) Blind SQL injection
E) Reflected XSS
  • 32. When does Blind SQL injection occur?
A) When the browser inserts user data into the page without sanitization
B) When attackers cannot see query results directly on the webpage
C) When malicious input is permanently stored by the application
D) When the database is made to generate an error message on purpose
E) When user input is immediately returned in the server response
  • 33. Which of the following is listed as a way to prevent SQL injection?
A) Use prepared statements and parameterized queries
B) Disable input validation
C) Display detailed database errors to users
D) Trust all user input
E) Grant users full database privileges
  • 34. Malicious input is permanently stored by an application and runs every time users visit the affected page. Which type of XSS is this?
A) DOM-based XSS
B) Stored XSS
C) Reflected XSS
D) Union-based SQL injection
E) Error-based SQL injection
  • 35. Which type of XSS occurs when user input is immediately returned in the server response without proper validation or encoding?
A) Union-based SQL injection
B) Stored XSS
C) DOM-based XSS
D) Blind SQL injection
E) Reflected XSS
  • 36. Which type of XSS occurs when JavaScript in the browser inserts user-controlled data into the page without proper sanitization?
A) Error-based SQL injection
B) Blind SQL injection
C) Stored XSS
D) DOM-based XSS
E) Reflected XSS
  • 37. A user is logged in to a website, and their browser is tricked into sending an unwanted request to that site. Which vulnerability is this?
A) Cross-Site Scripting
B) Denial of Service
C) Phishing
D) CSRF
E) SQL Injection
  • 38. Which cyberattack involves criminals pretending to be a trusted person or organization to trick people into sharing sensitive information, clicking a bad link, or downloading malware?
A) CSRF
B) Phishing
C) Denial of Service
D) SQL Injection
E) Cross-Site Scripting
  • 39. True or False: CSRF tokens and SameSite cookies are listed as ways to prevent CSRF.
A) False
B) True
  • 40. Which U.S. law criminalizes unauthorized access to computer systems?
A) GLBA
B) HIPAA
C) FISMA
D) SOX
E) Computer Fraud & Abuse Act (CFAA)
  • 41. Which U.S. law sets security and privacy standards for patient health data?
A) COPPA
B) CFAA
C) FISMA
D) HIPAA
E) GLBA
  • 42. Which U.S. law requires financial institutions to protect customer personal information?
A) FISMA
B) HIPAA
C) Gramm-Leach-Bliley Act (GLBA)
D) COPPA
E) SOX
  • 43. Which U.S. law governs data practices for services aimed at children?
A) HIPAA
B) GLBA
C) COPPA
D) CFAA
E) SOX
  • 44. Which U.S. agency regulates cybersecurity under its authority to police unfair or deceptive trade practices?
A) DOJ / FBI
B) Information Commissioner's Office
C) NIST
D) DHS
E) Federal Trade Commission (FTC)
  • 45. Which law gives California residents the right to know, access, delete, and opt out of the sale of their personal data?
A) HIPAA
B) PDPA
C) CCPA / CPRA
D) GDPR
E) NIS Directive
  • 46. Which standard provides protocols and guidelines that secure credit and debit card transactions?
A) ISO/IEC 27001
B) NIST Cybersecurity Framework
C) PCI-DSS
D) CMMC
E) HIPAA
  • 47. True or False: The NIST Cybersecurity Framework is a law.
A) True
B) False
  • 48. Which type of hacking is done with permission, finds security weaknesses, and follows rules and agreements?
A) Malicious hacking
B) Data theft
C) Ethical hacking
D) Cyber fraud
E) Identity theft
  • 49. Which type of hacking is done without permission and can steal or destroy information?
A) Vulnerability assessment
B) Data privacy
C) Ethical hacking
D) Compliance auditing
E) Malicious hacking
  • 50. What does data privacy mean?
A) Making all collected data public
B) Protecting personal and sensitive information
C) Deleting all data every day
D) Sharing data with any organization
E) Collecting as much data as possible
  • 51. Which of the following is a responsibility of a cybersecurity professional?
A) Stop learning about new threats
B) Ignore company policies
C) Keep information confidential
D) Hide security incidents
E) Share client data when convenient
  • 52. True or False: Hacking into a system without permission is illegal.
A) False
B) True
  • 53. Wireless Network Security refers to the protection of wireless networks, such as Wi-Fi, from which of the following?
A) Electricity outages
B) Unauthorized access, cyber threats, and data theft
C) Hardware price increases
D) Slow internet speeds only
E) Software license expiry
  • 54. Which encryption types are listed as security methods for wireless network access control?
A) WPA2 or WPA3
B) PPTP
C) WEP only
D) No encryption
E) SSL only
  • 55. A fake hotspot uses a name similar to a cafĂ©'s real Wi-Fi. Which wireless threat is this?
A) Unauthorized access
B) Rogue or fake access point
C) Eavesdropping
D) Weak passwords
E) Malware
  • 56. Which wireless threat is an attacker attempting to intercept wireless communications?
A) Malware
B) Weak passwords
C) Unauthorized access
D) Rogue or fake access point
E) Eavesdropping
  • 57. Which of the following is listed as a router and access point security measure?
A) Change the default administrator password
B) Stop updating router firmware
C) Share the Wi-Fi password publicly
D) Disable the firewall
E) Enable all unnecessary features
  • 58. Which best practice is listed for separating different groups of users on a wireless network?
A) Turn off the firewall
B) Use one shared network for everyone
C) Separate guest, student, and staff networks
D) Give guests the staff password
E) Disable authentication
  • 59. What does a Virtual Private Network (VPN) create between your device and a VPN server?
A) A shared public folder
B) A physical cable
C) An encrypted tunnel
D) A firewall rule
E) A backup copy of your traffic
  • 60. An employee works from home and needs safe access to company files. Which VPN type fits best?
A) Personal VPN
B) Cloud VPN
C) Remote Access VPN
D) Mobile VPN
E) Site-to-Site VPN
  • 61. A large business wants to link multiple office branches using network routers instead of apps on user devices. Which VPN type fits?
A) Site-to-Site VPN
B) Remote Access VPN
C) Double VPN
D) Mobile VPN
E) Personal VPN
  • 62. Which VPN type is optimized specifically for smartphones and tablets?
A) Mobile VPN
B) Remote Access VPN
C) Double VPN
D) Cloud VPN
E) Site-to-Site VPN
  • 63. Which VPN type is hosted entirely on cloud infrastructure rather than physical servers?
A) Personal VPN
B) Mobile VPN
C) Site-to-Site VPN
D) Cloud VPN
E) Remote Access VPN
  • 64. How does a Double VPN work?
A) It routes and encrypts traffic through two separate servers instead of just one
B) It connects two offices through routers
C) It uses two different passwords to log in
D) It runs two VPN apps on the same phone
E) It encrypts only half of the traffic
  • 65. Which VPN protocol does not encrypt data on its own and is almost always paired with IPSec?
A) OpenVPN
B) IKEv2
C) SSTP
D) L2TP
E) WireGuard
  • 66. Which VPN protocol was developed by Microsoft and is only available for Windows operating systems?
A) SSTP
B) WireGuard
C) IKEv2
D) OpenVPN
E) L2TP
  • 67. Which VPN protocol is highly effective at maintaining a connection when switching from Wi-Fi to mobile data?
A) PPTP
B) L2TP
C) SSH
D) IKEv2
E) SSTP
  • 68. True or False: According to the VPN conclusion, a VPN makes you entirely anonymous online.
A) True
B) False
  • 69. In the CIA triad, which goal means data stays accurate and unaltered in transit or storage?
A) Confidentiality
B) Authentication
C) Integrity
D) Accounting
E) Availability
  • 70. In the CIA triad, which goal means only authorized users can access information?
A) Confidentiality
B) Accounting
C) Availability
D) Authorization
E) Integrity
  • 71. Which design principle uses multiple, overlapping layers of security so that if one fails, others still protect the system?
A) Redundancy
B) Network segmentation
C) Least privilege
D) Defense in depth
E) Zero trust
  • 72. Which design principle gives users, apps, and devices only the minimum access they need?
A) Least privilege
B) Network segmentation
C) Redundancy
D) Zero trust
E) Defense in depth
  • 73. Which design approach divides the network into zones such as VLANs, subnets, and firewalls to limit how far an attacker can move?
A) Secure by default
B) Least privilege
C) Redundancy
D) Network segmentation
E) Defense in depth
  • 74. Which architecture follows the idea "Never trust, always verify"?
A) Redundancy
B) Zero Trust
C) Least privilege
D) Network segmentation
E) Defense in depth
  • 75. A company wants a buffer zone for its public services. Which architecture component fits?
A) DMZ
B) NAC
C) VPN gateway
D) DLP
E) SIEM
  • 76. Which platform collects logs from every zone, correlates events, detects anomalies, and supports incident response?
A) DLP
B) SIEM
C) DMZ
D) IDS/IPS
E) NAC
  • 77. In AAA, which part logs activity for audit and forensics?
A) Accounting
B) Authentication
C) Availability
D) Authorization
E) NAC
  • 78. A laptop tries to connect to the network, and the system first checks its device posture before granting access. Which component does this?
A) DLP
B) NAC
C) Backup system
D) SIEM
E) DMZ
  • 79. True or False: The NIST Cybersecurity Framework has five functions: Identify, Protect, Detect, Respond, and Recover.
A) False
B) True
  • 80. Network Application Security is based on identifying and fixing vulnerabilities that correspond to which weaknesses?
A) Common Weakness Enumerations (CWEs)
B) Cloud Web Endpoints
C) Critical Web Errors
D) Common Wireless Encryptions
E) Certified Web Exploits
  • 81. Which tools are listed for Network Application Security?
A) VPN gateways and NAC servers
B) Wireshark, AirCrack, Metasploit
C) Backups and failover links
D) Firewalls and routers
E) SAST, DAST, IAST
  • 82. Which tools are listed for Network Security, as opposed to Network Application Security?
A) SonarQube only
B) SAST, DAST, IAST
C) Wireshark, AirCrack, Metasploit
D) OWASP ZAP only
E) Burp Suite only
  • 83. Which risk is #1 on the OWASP Top 10 list as presented?
A) Insecure Design
B) Broken Access Control
C) Security Misconfiguration
D) Cryptographic Failures
E) Injection
  • 84. Which OWASP Top 10 risk covers data that is not properly protected in transit or at rest, exposing passwords, health records, and personal data?
A) Broken Access Control
B) Cryptographic Failures
C) Injection
D) SSRF
E) Security Logging & Monitoring Failures
  • 85. Which OWASP Top 10 risk occurs when a web app does not validate a user-supplied URL before pulling data from a remote resource?
A) Cryptographic Failures
B) Broken Access Control
C) Injection
D) Insecure Design
E) Server-Side Request Forgery (SSRF)
  • 86. Which tool monitors and filters HTTP traffic as an OSI layer-7 defense and works like a reverse proxy that shields the server?
A) CNAPP
B) Software Composition Analysis (SCA)
C) Runtime Application Self-Protection (RASP)
D) Software Bill of Materials (SBOM)
E) Web Application Firewall (WAF)
  • 87. Which solution analyzes user behavior and application traffic at runtime and can terminate sessions where weaknesses are being exploited?
A) CNAPP
B) Software Composition Analysis (SCA)
C) Runtime Application Self-Protection (RASP)
D) Web Application Firewall (WAF)
E) Software Bill of Materials (SBOM)
  • 88. What is a Software Bill of Materials (SBOM)?
A) A backup copy of the software
B) A list of employees who wrote the code
C) A comprehensive list of a software's components, including open-source and proprietary libraries and modules
D) A set of firewall rules
E) A report of all software licensing costs
  • 89. What does gray box testing involve?
A) Limited internal access, such as login credentials as a signed-in user
B) Testing only the network cables
C) No access to internals
D) Testing only after release
E) Full access to internals such as static code analysis
  • 90. A vulnerable open-source library has a high CVSS score, but the application never invokes the vulnerable code. What do the slides say about its risk?
A) The whole application must be taken offline
B) CVSS scores are always inaccurate
C) It must always be fixed first
D) It means the application has been breached
E) The CVSS score carries no real risk
  • 91. True or False: "Shift left" means integrating security earlier in the SDLC so vulnerabilities are cheaper and easier to fix.
A) True
B) False
  • 92. What does OWASP stand for?
A) Organized Worldwide Application Safety Program
B) Online Web Application Security Protocol
C) Open Web Access Security Policy
D) Official Web Application Standards Panel
E) Open Worldwide Application Security Project
  • 93. What is the common mistake in input validation?
A) Checking input before using it
B) Checking the input on the server
C) Validating the year before saving it
D) Only checking the input in the browser and not checking it on the server
E) Rejecting invalid input
  • 94. Which secure coding practice means making user data safe before showing it on a webpage?
A) System Configuration
B) Output Encoding
C) Input Validation
D) Session Management
E) Data Protection
  • 95. What is a common mistake in authentication and password management?
A) Hashing passwords
B) Using appropriate password-hashing practices
C) Storing passwords in plain text or using weak credential handling
D) Creating a secure session after login
E) Verifying credentials
  • 96. A student may view their own enrollment but cannot approve another student's enrollment. Which secure coding practice is this?
A) Output Encoding
B) Access Control
C) Input Validation
D) Session Management
E) Cryptographic Practices
  • 97. What is a common mistake in error handling and logging?
A) Recording useful security events
B) Showing stack traces, database details, passwords, or other sensitive technical information to users
C) Showing a safe message to the user
D) Failing safely
E) Logging a login failure for monitoring
  • 98. A production server keeps default credentials, unnecessary services, and development settings enabled. Which secure coding practice has been ignored?
A) Access Control
B) System Configuration
C) Output Encoding
D) Input Validation
E) Session Management
  • 99. What is a common mistake in session management?
A) Leaving sessions active unnecessarily or failing to protect session identifiers
B) Creating a protected session
C) Protecting session identifiers
D) Invalidating the session on logout or timeout
E) Validating the session on requests
  • 100. What is a common mistake in cryptographic practices?
A) Inventing your own encryption or using cryptography without understanding the security goal and key management
B) Understanding the security goal
C) Selecting suitable cryptographic protection
D) Managing keys securely
E) Using appropriate secure communication
Created with That Quiz — where test making and test taking are made easy for math and other subject areas.