1. Which cryptographic algorithm operates as a symmetric block cipher using 64-bit blocks with
key lengths ranging from 32 to 448 bits?
A) AES
B) Blowfish
C) RC6
D) Twofish
Correct Answer: B) Blowfish
Blowfish is a symmetric block cipher that processes 64-bit blocks and supports variable key lengths
from 32 to 448 bits, making it flexible for different security requirements.
2. What property ensures that compromising a single encryption key does not expose previously
encrypted communications?
A) Non-repudiation
B) Perfect Forward Secrecy
C) End-to-end encryption
D) Cryptographic agility
Correct Answer: B) Perfect Forward Secrecy
Perfect Forward Secrecy guarantees that session keys are ephemeral and independent, so the
compromise of one key does not affect the security of past communications.
3. Which protocol from the IPSec suite provides confidentiality, connectionless integrity, and
protection against replay attacks?
A) AH
B) ESP
C) IKE
D) L2TP
Correct Answer: B) ESP
Encapsulated Security Payload provides encryption for confidentiality, authentication for integrity,
and sequence numbers to prevent replay attacks within IPSec implementations.
4. When a cloud service provider fails to maintain adequate financial stability, which vendor risk
factor becomes the primary concern for an organization?
A) Vendor lock-in
B) Vendor lock-out
,C) Vendor viability
D) Support availability
Correct Answer: C) Vendor viability
Vendor viability addresses whether the provider has the financial resources and market presence to
remain operational and support their products over time.
5. What type of cryptographic attack substitutes DNS addresses to redirect users to malicious
websites without their knowledge?
A) DNS poisoning
B) DNS amplification
C) DNS tunneling
D) DNS hijacking
Correct Answer: A) DNS poisoning
DNS poisoning involves injecting false DNS records into a resolver's cache, causing users to be
redirected to attacker-controlled systems instead of legitimate destinations.
6. Which access control model uses security clearance levels and labels to determine subject
access to objects?
A) DAC
B) RBAC
C) MAC
D) ABAC
Correct Answer: C) MAC
Mandatory Access Control enforces access based on system-wide policies where subjects and objects
are assigned labels or clearance levels that determine allowed interactions.
7. In the risk management lifecycle, what is the correct sequence of phases?
A) Assess, Identify, Control, Review
B) Identify, Assess, Control, Review
C) Control, Identify, Review, Assess
D) Review, Control, Assess, Identify
Correct Answer: B) Identify, Assess, Control, Review
The risk management lifecycle follows a structured approach starting with identifying risks, assessing
their impact, implementing controls, and continuously reviewing effectiveness.
8. Which hashing algorithm produces a 128-bit output but is considered vulnerable due to high
collision probability?
A) SHA-1
B) SHA-256
,C) MD5
D) RIPEMD-160
Correct Answer: C) MD5
MD5 generates 128-bit hashes and has known collision vulnerabilities, making it unsuitable for
cryptographic security applications despite its historical popularity.
9. What security mechanism validates operating system and application file integrity by comparing
current states to known good baselines?
A) HIDS
B) FIM
C) DLP
D) NAC
Correct Answer: B) FIM
File Integrity Monitoring continuously verifies that system and application files match their approved
baseline states, alerting when unauthorized changes occur.
10. Which cloud deployment model serves only one organization and may be located either on-
premises or off-premises?
A) Public cloud
B) Private cloud
C) Community cloud
D) Hybrid cloud
Correct Answer: B) Private cloud
Private clouds are dedicated to a single organization, offering enhanced control and security, and can
be hosted internally or externally with exclusive resource allocation.
11. What protocol framework defines message formats and methods for transporting
authentication parameters and keying material?
A) RADIUS
B) EAP
C) TACACS+
D) LDAP
Correct Answer: B) EAP
Extensible Authentication Protocol is an authentication framework that supports multiple
authentication methods and defines how authentication data is transported.
12. Which disaster recovery site provides a fully equipped facility where operations can resume
within minutes after activation?
, A) Cold site
B) Warm site
C) Hot site
D) Mobile site
Correct Answer: C) Hot site
Hot sites maintain fully operational hardware, software, and data replication, enabling immediate
failover and business continuity with minimal downtime.
13. What type of firewall operates at the application level and specifically protects web
applications from attacks like SQL injection?
A) Traditional firewall
B) NGFW
C) WAF
D) UTM
Correct Answer: C) WAF
Web Application Firewalls inspect HTTP traffic at the application layer, using sophisticated rules to
block attacks such as SQL injection and cross-site scripting.
14. Which cryptographic algorithm is based on the Diffie-Hellman concept and is commonly used
in PGP implementations?
A) RSA
B) ElGamal
C) ECC
D) DSA
Correct Answer: B) ElGamal
ElGamal is an asymmetric encryption algorithm derived from Diffie-Hellman that supports encryption
and digital signatures, widely used in PGP and GPG.
15. What metric calculates the annual financial loss expectation by multiplying single loss
expectancy by annual rate of occurrence?
A) SLE
B) ARO
C) ALE
D) MTBF
Correct Answer: C) ALE
Annual Loss Expectancy quantifies expected annual financial impact from a specific risk, calculated as
SLE multiplied by ARO for risk prioritization.
key lengths ranging from 32 to 448 bits?
A) AES
B) Blowfish
C) RC6
D) Twofish
Correct Answer: B) Blowfish
Blowfish is a symmetric block cipher that processes 64-bit blocks and supports variable key lengths
from 32 to 448 bits, making it flexible for different security requirements.
2. What property ensures that compromising a single encryption key does not expose previously
encrypted communications?
A) Non-repudiation
B) Perfect Forward Secrecy
C) End-to-end encryption
D) Cryptographic agility
Correct Answer: B) Perfect Forward Secrecy
Perfect Forward Secrecy guarantees that session keys are ephemeral and independent, so the
compromise of one key does not affect the security of past communications.
3. Which protocol from the IPSec suite provides confidentiality, connectionless integrity, and
protection against replay attacks?
A) AH
B) ESP
C) IKE
D) L2TP
Correct Answer: B) ESP
Encapsulated Security Payload provides encryption for confidentiality, authentication for integrity,
and sequence numbers to prevent replay attacks within IPSec implementations.
4. When a cloud service provider fails to maintain adequate financial stability, which vendor risk
factor becomes the primary concern for an organization?
A) Vendor lock-in
B) Vendor lock-out
,C) Vendor viability
D) Support availability
Correct Answer: C) Vendor viability
Vendor viability addresses whether the provider has the financial resources and market presence to
remain operational and support their products over time.
5. What type of cryptographic attack substitutes DNS addresses to redirect users to malicious
websites without their knowledge?
A) DNS poisoning
B) DNS amplification
C) DNS tunneling
D) DNS hijacking
Correct Answer: A) DNS poisoning
DNS poisoning involves injecting false DNS records into a resolver's cache, causing users to be
redirected to attacker-controlled systems instead of legitimate destinations.
6. Which access control model uses security clearance levels and labels to determine subject
access to objects?
A) DAC
B) RBAC
C) MAC
D) ABAC
Correct Answer: C) MAC
Mandatory Access Control enforces access based on system-wide policies where subjects and objects
are assigned labels or clearance levels that determine allowed interactions.
7. In the risk management lifecycle, what is the correct sequence of phases?
A) Assess, Identify, Control, Review
B) Identify, Assess, Control, Review
C) Control, Identify, Review, Assess
D) Review, Control, Assess, Identify
Correct Answer: B) Identify, Assess, Control, Review
The risk management lifecycle follows a structured approach starting with identifying risks, assessing
their impact, implementing controls, and continuously reviewing effectiveness.
8. Which hashing algorithm produces a 128-bit output but is considered vulnerable due to high
collision probability?
A) SHA-1
B) SHA-256
,C) MD5
D) RIPEMD-160
Correct Answer: C) MD5
MD5 generates 128-bit hashes and has known collision vulnerabilities, making it unsuitable for
cryptographic security applications despite its historical popularity.
9. What security mechanism validates operating system and application file integrity by comparing
current states to known good baselines?
A) HIDS
B) FIM
C) DLP
D) NAC
Correct Answer: B) FIM
File Integrity Monitoring continuously verifies that system and application files match their approved
baseline states, alerting when unauthorized changes occur.
10. Which cloud deployment model serves only one organization and may be located either on-
premises or off-premises?
A) Public cloud
B) Private cloud
C) Community cloud
D) Hybrid cloud
Correct Answer: B) Private cloud
Private clouds are dedicated to a single organization, offering enhanced control and security, and can
be hosted internally or externally with exclusive resource allocation.
11. What protocol framework defines message formats and methods for transporting
authentication parameters and keying material?
A) RADIUS
B) EAP
C) TACACS+
D) LDAP
Correct Answer: B) EAP
Extensible Authentication Protocol is an authentication framework that supports multiple
authentication methods and defines how authentication data is transported.
12. Which disaster recovery site provides a fully equipped facility where operations can resume
within minutes after activation?
, A) Cold site
B) Warm site
C) Hot site
D) Mobile site
Correct Answer: C) Hot site
Hot sites maintain fully operational hardware, software, and data replication, enabling immediate
failover and business continuity with minimal downtime.
13. What type of firewall operates at the application level and specifically protects web
applications from attacks like SQL injection?
A) Traditional firewall
B) NGFW
C) WAF
D) UTM
Correct Answer: C) WAF
Web Application Firewalls inspect HTTP traffic at the application layer, using sophisticated rules to
block attacks such as SQL injection and cross-site scripting.
14. Which cryptographic algorithm is based on the Diffie-Hellman concept and is commonly used
in PGP implementations?
A) RSA
B) ElGamal
C) ECC
D) DSA
Correct Answer: B) ElGamal
ElGamal is an asymmetric encryption algorithm derived from Diffie-Hellman that supports encryption
and digital signatures, widely used in PGP and GPG.
15. What metric calculates the annual financial loss expectation by multiplying single loss
expectancy by annual rate of occurrence?
A) SLE
B) ARO
C) ALE
D) MTBF
Correct Answer: C) ALE
Annual Loss Expectancy quantifies expected annual financial impact from a specific risk, calculated as
SLE multiplied by ARO for risk prioritization.
