A) 4 B) may kaliwa ba sa right? may kanan ba sa left? C) hmmm depende kung 3 yan kasi kung 3 yan edi 5 D) Sure ka sa mga question na toh? E) are you gagoing me?
A) To reduce hosting costs B) To design the user interface C) To make applications more resistant to security threats by identifying security weaknesses and vulnerabilities in the source code D) To increase the number of users E) To make applications run faster
A) A white-box method that scans source code, bytecode, or binaries for security flaws without actually running the program B) A tool that blocks network traffic C) A method that attacks a running application D) A backup strategy E) A way to monitor user behavior
A) A type of firewall B) A way to train employees C) A method that only reads source code D) A tool for managing passwords E) A black-box method that evaluates a running application from the outside by simulating real-world hacker attacks to find live vulnerabilities
A) It only works on printed documents B) It tests only network cables C) It is used only after the software is retired D) It does not test applications at all E) It combines features of both by placing security agents inside a running application's environment to monitor code execution in real time
A) DAST B) Software Composition Analysis (SCA), which scans third-party libraries and open-source dependencies for known vulnerabilities or licensing issues C) SAST D) Wi-Fi scanning E) IAST
A) Wireshark B) Nessus C) OWASP ZAP, which automatically sends test requests to the application and analyzes the responses for vulnerabilities D) Microsoft Word E) SonarQube
A) A web browser B) Burp Suite, an intercepting proxy that lets the tester view, modify, and resend HTTP requests C) A spreadsheet D) SonarQube E) Nessus
A) It intercepts HTTP requests B) It scans Wi-Fi networks C) It manages user accounts D) It encrypts files E) It analyzes source code to detect security vulnerabilities, bugs, code smells, and poor coding practices
A) SonarQube B) A file archiver C) Nessus, which compares scan results with a database of known vulnerabilities and generates a report with risk levels D) A password manager E) A word processor
A) True B) False
A) To speed up the network B) To control and monitor who can access a network by allowing only verified users and compliant devices, enforcing security rules before access is granted C) To track employee attendance D) To design websites E) To store backups of files
A) After the device has left the network B) At the end of every month C) Only during system backups D) Only when a virus is found E) Before a device joins the network, when its identity and compliance are evaluated during the connection request
A) A screen saver B) A printer driver C) Pre-Admission NAC D) Post-Admission NAC, which restricts lateral movement by requiring re-authentication for sensitive areas E) A guest Wi-Fi password
A) It prints network reports B) It determines the access level based on identity, permissions, device posture, and request type, then authorizes, restricts, or denies access C) It cools the server room D) It writes source code E) It sells network devices
A) A network cable B) A firewall rule C) Any device, user, or process requesting network access, such as laptops, servers, IP cameras, printers, and IoT devices D) A software license E) A backup tape
A) The Wi-Fi password B) The employee's email C) The company logo D) The office printer E) The Network Access Server (NAS), which provides secure entry to internal networks for remote employees
A) It has low visibility and control over IoT devices or endpoints without specific user identities B) It works only on paper C) It cannot block any device D) It increases network speed E) It has no policies
A) True B) False
A) To replace all developers B) To remove testing from development C) To finish projects faster than planned D) To produce software that is reliable, secure, and resistant to cyberattacks while maintaining functionality and performance E) To make software cheaper than competitors
A) The project team identifies business goals, security objectives, potential risks, and compliance requirements B) The software is released C) The code is written D) Bugs are patched E) Penetration testing is performed
A) The Testing Phase B) The Maintenance Phase C) The Deployment Phase D) The Requirements Phase, where both functional and security requirements are gathered and documented E) The Retirement Phase
A) Users are trained B) The software is retired C) Patches are applied D) A secure system architecture is created, and threat modeling is performed to identify possible attacks and weaknesses E) Backups are deleted
A) Business goals are set B) The code is written C) Requirements are collected D) The software is deployed E) Security testing verifies that the application is protected against threats, including vulnerability assessments, penetration testing, SAST, and DAST
A) The software is thrown away B) Threat models are drawn C) The project idea is proposed D) Requirements are collected E) The application is configured securely and released, with access controls, monitoring systems, and backup strategies in place
A) Because the software must be continuously monitored and updated with security patches to stay protected from newly discovered threats B) Because it reduces user trust C) Because design is finished D) Because testing is not allowed E) Because software never changes
A) True B) False
A) To make a computer, website, or network resource unavailable to its legitimate users B) To improve website speed C) To encrypt all data D) To update software E) To quietly steal passwords
A) It installs a new browser B) It changes the website colors C) It saturates the targeted server with an overwhelming amount of packets so legitimate users cannot reach it D) It sends a single small email E) It deletes the user's account
A) Sharing admin passwords B) Ignoring unusual traffic C) Turning off logging D) Using a cloud mitigation provider, which is more effective than relying on a firewall alone E) Disabling the firewall
A) A way to back up a database B) A method of encrypting databases C) A vulnerability where attackers inject malicious SQL queries through user inputs to manipulate the backend database D) A tool for designing tables E) A type of Wi-Fi attack
A) Remove the login form B) Display detailed database errors C) Trust all user input D) Use prepared statements and parameterized queries, and validate and restrict user input E) Give all users full privileges
A) DOM-based XSS B) Union-based SQL injection C) Blind SQL injection D) Stored XSS E) Error-based SQL injection, where the attacker intentionally causes the database to generate an error message
A) A fake email asking for passwords B) A vulnerability where an attacker injects malicious client-side scripts, usually JavaScript, into a trusted website that then run in other users' browsers C) A hardware failure D) A database backup E) An attack that floods a server with packets
A) Union-based injection B) Reflected XSS C) Stored XSS, where the malicious input is permanently saved by the application and runs for every visitor D) Blind SQL injection E) DOM-based XSS
A) It speeds up scripts B) It blocks all users C) It encrypts the database D) It reduces the impact of XSS by restricting the sources from which scripts are allowed to execute E) It deletes cookies
A) A way to back up files B) A kind of antivirus C) A method for speeding up the internet D) A cyberattack where criminals pretend to be a trusted person or organization to trick victims into sharing information, clicking bad links, or downloading malware E) A type of fishing app
A) Click the link quickly B) Reply with the OTP C) Forward it to friends D) Avoid clicking links or sharing the OTP, verify the sender through official channels, and turn on Multi-Factor Authentication E) Ignore all security tools
A) False B) True
A) It regulates online ads B) It protects patient health records C) It sets rules for credit cards D) It criminalizes unauthorized access to computer systems in the United States E) It governs children's websites
A) HIPAA, the Health Insurance Portability and Accountability Act B) COPPA C) GLBA D) SOX E) CFAA
A) FISMA B) SOX C) COPPA D) The Gramm-Leach-Bliley Act (GLBA), which applies to financial institutions E) HIPAA
A) HIPAA B) SOX C) CFAA D) The Children's Online Privacy Protection Act (COPPA), which regulates how services handle children's data E) GLBA
A) The DHS B) The FBI C) The NIST D) The Department of Agriculture E) The Federal Trade Commission (FTC), through its authority over unfair or deceptive trade practices
A) SOX B) The California Consumer Privacy Act and California Privacy Rights Act (CCPA/CPRA) C) HIPAA D) FISMA E) COPPA
A) CMMC B) SOX C) PCI-DSS, the Payment Card Industry Data Security Standard D) COPPA E) HIPAA
A) False B) True
A) Selling stolen passwords B) Hacking done secretly to steal data C) Hacking done with permission to find security weaknesses and help improve security, following rules and agreements D) Breaking into accounts for fun E) Hacking done to harm users
A) Protecting personal and sensitive information so it is not accessed or shared without proper authorization B) Deleting all data daily C) Collecting as much data as possible D) Making data public E) Sharing data with everyone
A) Using weak passwords B) Keeping information confidential, following company policies, avoiding conflicts of interest, and reporting incidents properly C) Ignoring policies D) Sharing client data publicly E) Hiding incidents
A) It is a safety measure B) It is considered illegal and unethical because accessing an account without permission is unauthorized access C) It is a normal part of the job D) It is ethical hacking E) It is allowed if no data is taken
A) True B) False
A) Installing more routers B) Selling wireless devices C) Extending the signal range D) The protection of wireless networks, such as Wi-Fi, from unauthorized access, cyber threats, and data theft E) Making Wi-Fi faster
A) A shared public password B) WPA2 or WPA3, because they protect wireless access with strong encryption C) No encryption D) Plain text E) An open network
A) Eavesdropping B) A guest network C) A firmware update D) A rogue or fake access point, which is an unauthorized network that imitates a legitimate one E) A strong password
A) Keep the default password B) Disable all security C) Turn off encryption D) Change the default administrator password and keep devices updated with security updates E) Share the password publicly
A) Removing all passwords B) Creating separate guest, student, and staff networks so each group has only the access it needs C) Turning off the router D) Using one shared network for all E) Giving guests the staff password
A) They erase saved data B) They make the signal weaker C) They slow down the router D) They reduce battery life E) Easy-to-guess passwords increase the risk of unauthorized access to the network
A) To block all advertisements B) To store files online C) To create an encrypted tunnel between your device and a VPN server that protects your data and hides your real IP address D) To make websites load faster E) To increase Wi-Fi range
A) It publishes it online B) It leaves it unchanged C) It sells it D) The VPN server replaces your real IP address with its own public IP address E) It deletes your device
A) No VPN at all B) A Double VPN C) A Site-to-Site VPN D) A wireless printer E) A Remote Access VPN, which connects individual users securely to a remote private network
A) A Personal VPN B) A Remote Access VPN C) A Site-to-Site VPN, which connects entire networks using routers instead of apps on user devices D) A Double VPN E) A Mobile VPN
A) A Cloud VPN B) A Double VPN C) A Personal VPN D) A Mobile VPN, which is designed to stay secure as the user switches between networks E) A Site-to-Site VPN
A) A VPN with two passwords B) A VPN that routes and encrypts traffic through two separate servers instead of just one C) Two phones on one VPN D) A VPN that encrypts half the data E) A VPN that links two offices
A) SSTP B) PPTP C) OpenVPN, which is open-source and highly configurable D) SSH E) L2TP
A) PPTP B) L2TP C) SSTP D) IKEv2 E) WireGuard, a newer protocol with a much smaller code base
A) WireGuard B) IKEv2 C) L2TP, which relies on IPSec to provide the encryption D) OpenVPN E) SSTP
A) True B) False
A) Only authorized users can access the information, keeping sensitive data protected from unauthorized people B) Everyone can view data C) Data is deleted often D) Systems never go down E) Data is always backed up
A) Data is deleted daily B) Users are always logged in C) Data remains accurate and unaltered whether it is in transit or in storage D) Systems are always online E) Data is hidden from everyone
A) Data is kept secret B) Data is never changed C) Only admins can log in D) Systems shut down at night E) Systems and data are accessible whenever they are legitimately needed by authorized users
A) Using a single password B) Using multiple, overlapping layers of security so that if one layer fails, others still protect the system C) Trusting all internal users D) Relying on one strong firewall E) Protecting only the perimeter
A) Least privilege, where users, apps, and devices receive only the access they need B) Defense in depth C) Open access D) Zero access E) Redundancy
A) Dividing the network into zones, such as VLANs and subnets, to limit how far an attacker can move B) Storing backups C) Making Wi-Fi faster D) Increasing the number of users E) Removing firewalls
A) Trust everyone inside the network B) Trust only the firewall C) Trust verified devices forever D) Trust all employees E) Never trust, always verify: every user and device must be authenticated and authorized for each access request
A) A DMZ, which acts as a buffer zone for public services B) A SIEM C) A VPN client D) A backup tape E) A password
A) It collects logs from every zone, correlates events, detects anomalies, and supports incident response B) It repairs hardware C) It creates user accounts D) It encrypts disks E) It prints reports
A) It encrypts data B) It verifies who the user is C) It blocks traffic D) It grants permissions E) It logs activity for audit and forensics so that actions can be traced later
A) True B) False
A) Identifying and fixing vulnerabilities in applications, which correspond to Common Weakness Enumerations (CWEs) B) Managing office printers C) Selling licenses D) Designing logos E) Fixing broken cables
A) Firewalls only B) Backups only C) Routers and switches D) SAST, DAST, and IAST, which analyze application code and behavior for vulnerabilities E) Wireshark and AirCrack
A) Burp Suite only B) SonarQube only C) SAST and DAST D) IAST only E) Wireshark, AirCrack, and Metasploit, which focus on network-level testing
A) SSRF B) Insecure Design C) Broken Access Control, where users can act outside their intended permissions D) Cryptographic Failures E) Injection
A) Broken Access Control B) Cryptographic Failures, which can lead to exposure of passwords, health records, and personal data C) SSRF D) Insecure Design E) Injection
A) A faulty server fan B) A stolen password C) A flaw where a web app pulls data from a remote resource without validating the user-supplied URL D) An email scam E) A broken login page
A) It scans physical devices B) It encrypts email C) It repairs software D) It manages passwords E) It monitors and filters HTTP traffic at OSI layer 7, working like a reverse proxy that shields the server
A) It writes source code B) It scans Wi-Fi networks C) It installs updates D) It analyzes user behavior and application traffic at runtime and can terminate sessions that exploit weaknesses E) It backs up databases
A) A comprehensive list of a software's components, including open-source and proprietary libraries and modules B) A set of firewall rules C) A copy of the source code D) A list of staff members E) A list of project costs
A) Moving security to the end B) Skipping testing C) Removing developers D) Integrating security earlier in the software development life cycle so vulnerabilities are cheaper and easier to fix E) Testing only in production
A) It means a breach occurred B) It must always be fixed first C) It must be ignored forever D) The application must go offline E) The CVSS score carries no real risk because the vulnerable code is not actually used
A) True B) False
A) Open Wireless App Standard B) Open Worldwide Application Security Project C) Open Web Server Policy D) Official Web Safety Panel E) Online Web Access Security Plan
A) Checking input only in the browser and not validating it again on the server B) Validating on the server C) Checking the year entered D) Rejecting invalid input E) Using strong passwords
A) To make user data safe before it is displayed on a webpage so it cannot run as code B) To back up databases C) To hash passwords D) To check logins E) To create sessions
A) Verifying credentials B) Storing passwords in plain text instead of protecting them with appropriate password-hashing practices C) Using secure sessions D) Hashing passwords E) Using strong passwords
A) Access Control, which checks what an authenticated user is allowed to do B) Input Validation C) Output Encoding D) Error Handling E) Cryptography
A) Logging failed logins B) Showing a safe error message C) Recording useful events D) Failing safely E) Showing stack traces, database details, or other sensitive technical information to users
A) Input Validation B) Session Management C) Access Control D) System Configuration, which secures the environment the application runs in E) Output Encoding
A) Validating the session B) Using timeouts C) Ending sessions after logout D) Leaving sessions active unnecessarily or failing to protect session identifiers E) Creating a protected session
A) Understanding the goal B) Using secure channels C) Protecting data D) Managing keys securely E) Inventing your own encryption instead of using established, suitable cryptographic protection |