Cybersecurity Final Exam – Batch 1

What is the first step after an IDS alert on unusual outbound traffic?

Which tool helps analyze outbound traffic patterns?

A single host making connections to many random IPs likely indicates:

Which log is most useful to trace a suspicious process making connections?

Best immediate containment step for one infected workstation is to:

How can you determine whether the traffic is malicious?

What logs are most helpful in network-based incident response?

How can you isolate the infected machine safely?

What is the role of a honeypot in such scenarios?

After the incident is contained, what should be done next?

During recon on a web app, which tool is best for intercepting/modifying HTTP traffic?

A parameter tampering leading to viewing another user’s data is:

Defending against SQL Injection primarily requires:

Which header helps mitigate clickjacking?

The most effective fix for reflected XSS is:

How can you test for SQL Injection manually?

Define Cross-Site Scripting (XSS).

What’s the difference between reflected and stored XSS?

How can secure authentication help web app security?

What is CSRF, and how do you defend against it?

Difference between symmetric and asymmetric encryption:

A secure way to exchange keys over an insecure channel is:

Which is a strong hashing algorithm for integrity?

TLS ensures:

Best practice for email signing is:

Which command in OpenSSL generates a new RSA key pair?

What is a digital certificate?

How is confidentiality ensured in email communication?

Which hash function is considered secure: MD5 or SHA-256?

What is the role of a digital certificate authority?

An endpoint suddenly spawns PowerShell contacting an external IP. First action?

Which artifact best reveals persistence on Windows?

To capture volatile evidence you should first:

A ransomware note appears. The safest first step is to:

EDR tools like Defender for Endpoint primarily provide:

Define “forensic image.”

What is the purpose of a playbook in incident response?

What’s the role of hashing in forensics?

Should ransom demands be paid? Why or why not?

What should be included in an incident report?

Which law primarily protects health information in the U.S.?

Annualized Loss Expectancy (ALE) equals:

Principle of least privilege helps to:

Best control type for enforcing password rotation policy:

A compliance audit primarily aims to:

Define risk assessment.

Name a tool that assists in compliance management.

What is risk mitigation?

How does “least privilege” relate to risk?

Why is regular training important in compliance?