بنك أسئلة الوحدة 2: الأمن السيبراني

1. After the secure HTTPS connection is set up, which type of cryptography encrypts the session data quickly?

1. Common-key (symmetric) cryptography
2. Public-key cryptography per packet
3. A digital signature on each packet
4. A digital certificate from the CA

2. What do we call the procedure in which a browser and a server start a secure connection and the server proves its identity?

1. Common-key data exchange
2. The TLS handshake
3. Two-factor authentication
4. A digital signature check

3. A bank asks for two factors from two different categories. Which pair meets this condition?

1. A fingerprint scan and a face scan
2. A username and a password typed twice
3. A password and a one-time code on the phone
4. A password and a second, longer password

4. Which description fits multi-factor authentication (MFA)?

1. Using one long and complex password
2. Logging in with a fingerprint and nothing else
3. Typing an email address and a password
4. Combining two or more factors of different types

5. When a browser connects to a site, what lets it check that the server really belongs to that domain?

1. The digital certificate
2. The common session key
3. The digital signature
4. The one-time password

6. Which technology reveals that a message was altered or faked and stops the sender from denying it?

1. Two-factor login
2. The digital signature
3. Common-key encryption
4. The TLS handshake step

7. Someone on the same network captures your traffic. What keeps them from reading its content?

1. Multi-factor login
2. A certificate authority
3. Encrypting the traffic
4. A digital signature

8. Which login is NOT real two-factor authentication because both factors are of the knowledge type?

1. A password plus a code sent by SMS
2. A password plus a fingerprint scan
3. A password plus a code from an authenticator app
4. A password plus a second secret password

9. Which protocol is HTTP sent over a TLS-encrypted connection?

1. HTTPS
2. FTP
3. Telnet
4. DNS

10. Checking identity with two independent factors from different categories is called…

1. a certificate issued by a CA
2. two-factor authentication
3. symmetric common-key cryptography
4. a digital signature

11. A contract is signed electronically, and later the sender claims they never sent it. Which technology gives proof against this claim?

1. A shared common key
2. A network firewall
3. A digital signature
4. An encrypted VPN tunnel

12. Which list names the three categories of authentication factors?

1. Public key, private key, password
2. Speed, cost and efficiency
3. Wi-Fi, LAN and cloud
4. Knowledge, possession and biometric

13. Which kind of cryptography uses a linked pair made of a public key and a private key?

1. Public-key cryptography
2. Common-key cryptography
3. Quantum qubit cryptography
4. Classical bit coding

14. What does the browser check to confirm that the certificate matches the site name and the server is genuine?

1. The second factor of the login
2. The digital certificate issued by a CA
3. The digital signature of the user
4. The common key of the session

15. Which is an example of the possession factor?

1. Your fingerprint on the sensor
2. Your face in front of the camera
3. A code sent to your phone
4. The answer to a secret question

16. How does an online shop protect sign-up and payment?

1. By relying on one technology so that it runs faster
2. By removing passwords and keys from payment steps
3. By using common-key encryption with no authentication
4. By combining encryption, certificates, signatures and MFA

17. In which part of HTTPS do the browser and server agree on the common key that later protects the session?

1. The TLS handshake
2. The data exchange stage
3. The digital signature
4. The second login factor

18. A login needs a password, a smart card and a fingerprint. What is this called?

1. Common-key cryptography
2. Multi-factor authentication
3. Public-key cryptography
4. The TLS handshake

19. Which is an example of the biometric factor?

1. A bank ATM card
2. A code received by SMS on your phone
3. A fingerprint or face scan
4. A text password

20. What does safe online communication mainly depend on?

1. One single technology that is strong enough to cover every threat
2. Short and simple passwords that users can remember easily
3. Removing public and private keys from all secure connections
4. Combining encryption, authentication, certificates and signatures

1. Which statement best explains defense in depth?

1. Several layers of protection, so others still help if one fails
2. One strong firewall at the edge, with nothing else behind it
3. Trusting every device that sits inside the company building
4. Encrypting the traffic only when staff use public Wi-Fi networks

2. Which system inspects network traffic and lets it pass or stops it according to set rules?

1. Zero trust
2. A firewall
3. A VPN
4. A DMZ segment

3. What do we call a private, encrypted link built across a public network such as the Internet?

1. A DMZ
2. A perimeter
3. A VPN
4. A firewall

4. Which is a typical use of a VPN at work today?

1. Cleaning viruses from laptops without extra software
2. Blocking spam email on the local office network
3. Publishing content to users at very high speed
4. Reaching the company network safely from home or on a trip

5. In network design, what is a DMZ?

1. A zone for outside-facing servers, kept apart from the internal network
2. An open public network where anyone can reach the internal databases
3. A program that rewrites the firewall rules by itself
4. An encrypted link that joins company branches over the Internet

6. What is the core idea of the zero trust approach?

1. Encrypt email messages and ignore who can access which data
2. Never trust a user or device just because it is inside; always verify
3. Any device inside the network is trusted fully by default
4. Protect the outer edge only and skip checks on internal apps

7. Which term names the old boundary that treats the inside of a network as safe and the outside as dangerous?

1. The edge computing layer
2. The quantum superposition
3. The security perimeter
4. The demilitarized zone

8. Installing antivirus and updating the operating system belong to which defense in depth layer?

1. The network entry point
2. The communication path
3. The server location
4. The endpoint devices

9. A company wants a rule that blocks outside users from reaching its database server directly. Which tool applies such rules?

1. A firewall
2. A VPN
3. An antivirus
4. A backup copy

10. What is the zone where public servers are kept away from the internal network to limit the harm of an attack?

1. The endpoint layer
2. A DMZ segment
3. The perimeter
4. The VPN tunnel

11. Which security approach refuses to trust a device automatically even when it is on the internal network?

1. A firewall
2. A VPN
3. Zero trust
4. Defense in depth

12. Why would a company use a VPN to link its branch offices and remote staff?

1. To remove viruses from every hard drive
2. To speed up the Internet without passwords
3. To give staff a visual tool for managing big databases
4. To encrypt traffic that crosses untrusted networks

13. An engineer at home opens an encrypted tunnel to the office network. Which technology is this?

1. A VPN
2. A DMZ
3. A firewall
4. Zero trust

14. Keeping employees' laptops patched and protected by antivirus covers which layer?

1. Layer 3: server location
2. Layer 4: endpoints
3. Layer 1: network entry
4. Layer 2: communication path

15. Traditional network security protected mainly the border between inside and outside. What is that border called?

1. The tunnel
2. The endpoint
3. The perimeter
4. The demilitarized zone

16. Which tool sits at the network entry and decides by rules which traffic may enter?

1. A VPN
2. A qubit
3. Edge computing
4. A firewall

17. A company puts its web and mail servers in a separate area away from its internal network. What is this area?

1. A DMZ
2. A VPN
3. A perimeter
4. An endpoint

18. A device owned by the company still has to prove who it is before using a resource. Which approach does this follow?

1. A firewall
2. Zero trust
3. Defense in depth
4. The perimeter

19. Which measure belongs to Layer 1, the network entry point?

1. Placing outside-facing servers in a DMZ
2. Installing antivirus software on all endpoint devices
3. Blocking unauthorized connections with a firewall
4. Encrypting the communication path with a VPN

20. Which technology uses tunneling and encryption to create a private network over the Internet?

1. A DMZ
2. A firewall
3. Zero trust
4. A VPN

1. Which incident type stops users from reaching a service?

1. A service outage after a server attack
2. A leak of personal data to outsiders
3. Unauthorized changes to stored data
4. Writing response procedures ahead of time

2. Which incident response phase comes first and sets up the procedures and team in advance?

1. Recovery
2. Preparation
3. Detection
4. Containment

3. Which phase limits the incident by isolating the affected part so the problem does not spread?

1. Detection
2. Recovery
3. Containment
4. Preparation

4. How is risk size worked out in the simple model?

1. Impact + Likelihood
2. Impact − Likelihood
3. Impact ÷ Likelihood
4. Impact × Likelihood

5. Which phase brings systems back to normal, for example from a clean backup?

1. Recovery
2. Preparation
3. Containment
4. Detection

6. Which phase ends the response by analyzing the cause and adding measures so it does not happen again?

1. Recovery of the systems
2. Prevention of recurrence
3. Detection of the incident
4. Eradication of the cause

7. In risk assessment, which risk should be treated first?

1. Medium impact and medium likelihood
2. Low impact and high likelihood
3. High impact and high likelihood
4. Low impact and low likelihood

8. What does 'Impact' measure in risk assessment?

1. The chance that the risk will happen
2. How quickly the team responds
3. How often the incident has occurred
4. The harm caused if the risk happens

9. A situation where real damage happens because of an information security problem is called…

1. a security incident
2. a risk assessment
3. threat containment
4. a lesson learned

10. A team cuts an infected server off the network to stop the damage from spreading. Which phase is this?

1. Eradication
2. Containment
3. Preparation
4. Recovery

11. Which pair gives the highest risk priority?

1. Low impact and low likelihood
2. Medium impact and zero likelihood
3. High impact and high likelihood
4. Low impact and quick containment

12. What happens in the Eradication phase?

1. Writing the response plan in advance
2. Restoring the systems from a backup copy
3. Writing down lessons learned at the end
4. Removing the cause, such as deleting malware

13. Someone changes records in a system without permission. Which incident type is this?

1. Data tampering
2. Service outage
3. Information leak
4. Preparation

14. After the malware is removed, the team restores the server so it works safely again. Which phase is this?

1. Preparation
2. Recovery
3. Containment
4. Detection

15. A risk has Impact 2 and Likelihood 3. What is its risk size?

1. 1
2. 8
3. 6
4. 5

16. What does 'Likelihood' mean in risk assessment?

1. How much harm is expected if it occurs
2. How many devices the attack reaches
3. How fast the response phases are done
4. How probable it is that the risk occurs

17. Customers' private data reaches people outside the company. Which incident type is this?

1. Information leak
2. Service outage
3. Data tampering
4. Recovery

18. In which phase does the team study what happened and improve controls so the same incident is less likely?

1. Eradication of the cause
2. Prevention of recurrence
3. Preparation of the team
4. Containment of the damage

19. On a 1 to 3 scale, a risk has Impact 3 but Likelihood 1. How does it compare with a risk of Impact 3 and Likelihood 3?

1. Its size is 4, so it should be treated first
2. Its size is 0, so it can be ignored fully
3. Its size is 3, lower than the other risk's 9
4. Its size is 9, the same as the other risk

20. Which phase comes right after Preparation and confirms that an incident has really happened?

1. Recovery
2. Eradication
3. Containment
4. Detection