ELITE UNIVERSAL TEST
BANK: CYBER SECURITY
FUNDAMENTALS
(PROTOCOL v11.0)
PART 0: TABLE OF CONTENTS
Section Cognitive Tier Focus Area
PART I: THE PREVIEW Axiomatic Framework Strategic Imperatives, Core
Laws, and Threat Models
PART II: THE ELITE TEST
BANK
Tier 1 (Questions 1–10) Foundational Syntax & Cryptographic Primitives,
Application Framework Syntax, Protocol
Mechanics
Tier 2 (Questions 11–20) Complex Application & Architecture Governance,
Simulation Compliance, and Applied
Threat Modeling
Tier 3 (Questions 21–30) Grandmaster Synthesis Multi-variable High-Stakes
Crisis Simulation
PART I: THE PREVIEW
Mastering this test bank translates directly into elite operational competence, stripping away
academic theory to forge decision-making frameworks that withstand board-level scrutiny and
real-world cyber warfare. You will evaluate competing variables, discard legacy misconceptions,
and architect solutions grounded in the definitive global standards of modern cryptography,
application security, and data governance.
The "Critical Axioms" Cheat Sheet
● The Post-Quantum Cryptography (PQC) Mandate: FIPS 203 (ML-KEM) replaces
RSA/ECC by relying on the Module Learning With Errors (LWE) problem over lattices,
neutralizing Shor's algorithm. Algorithm execution strictly requires a FIPS 140-3 validated
cryptographic module.
● The AI Governance Duality: The NIST AI RMF is a voluntary, risk-based methodology
(Govern, Map, Measure, Manage). ISO/IEC 42001 is an auditable, certifiable
organizational Artificial Intelligence Management System (AIMS) structured around a
, Plan-Do-Check-Act cycle.
● The OWASP 2025 Architectural Shift: A03: Software Supply Chain Failures and A10:
Mishandling of Exceptional Conditions dictate modern threat modeling. A01: Broken
Access Control now explicitly consumes Server-Side Request Forgery (SSRF).
● The Application Security (AppSec) Continuum: SAST identifies logic flaws statically at
rest; DAST tests perimeter exploitability dynamically at runtime; SCA maps third-party
dependency vulnerabilities; IAST instruments the application from within to track runtime
execution flaws natively.
● The ISO 27001:2022 Transformation: Annex A has collapsed from 114 to 93 controls,
pivoting to four distinct themes: Organizational, People, Physical, and Technological.
● Kenyan Cyber-Regulatory Lethality: The Data Protection Act (DPA) 2019 penalizes
privacy failures (currently up to KES 5M or 1% turnover, shifting to "whichever is higher"
under the 2025 amendment), while the Computer Misuse and Cybercrimes Act (CMCA)
penalizes active hacking and cyber harassment (Section 27) with up to KES 20M fines
and imprisonment.
Core Threat & Application Matrices
STRIDE Category Target Security Property Modern Defense / Mitigation
Spoofing Authentication Cryptographic tokens, MFA,
signed session IDs
Tampering Integrity Server-side validation, TLS
everywhere, digital signatures
Repudiation Non-repudiation Tamper-evident, append-only
centralized audit logging
Information Disclosure Confidentiality Parameterized queries, generic
error masking, encryption at
rest
Denial of Service Availability Resource rate limiting, WAF,
load distribution
Elevation of Privilege Authorization Server-derived RBAC/ABAC,
least privilege architecture
Lateral Movement Containment Zero Trust Network Access
(STRIDE-LM) (ZTNA), micro-segmentation
PART II: THE ELITE TEST BANK
Tier 1: Foundational Syntax & Application
Q1: A federal agency is executing a mandate to migrate classified communication channels to
quantum-resistant standards. Based on the principles of the NIST FIPS 203 standard, which
underlying mathematical foundation is the MOST ACCURATE basis for the ML-KEM algorithm?
A) Integer factorization and discrete logarithms mathematically scaled for quantum resistance.
B) The Learning With Errors (LWE) problem applied over module lattices. C) Stateless
hash-based cryptographic structures utilizing the SPHINCS+ framework. D) Elliptic Curve
Diffie-Hellman (ECDH) executing within a hybrid key exchange handshake.
● The Answer: B (The Learning With Errors (LWE) problem applied over module lattices.)
, ● Distractor Analysis:
○ A is incorrect: Integer factorization (RSA) and discrete logarithms (ECC) are the
exact legacy mathematical problems that Shor's algorithm running on a quantum
computer will solve efficiently, rendering them obsolete.
○ C is incorrect: SPHINCS+ and stateless hash functions form the basis of FIPS 205
(SLH-DSA), which is a digital signature algorithm, not the ML-KEM key
encapsulation mechanism.
○ D is incorrect: ECDH is a classical algorithm. While it is paired with ML-KEM in a
hybrid configuration during migration, it is not the foundation of ML-KEM itself.
The Mentor's Analysis: Post-quantum cryptography fundamentally shifts the mathematical
battleground. FIPS 203 utilizes ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism)
because the computational difficulty of finding short vectors in high-dimensional geometric
lattices (Module LWE) has no known efficient quantum attack. Professional/Academic
Intuition: Never confuse key establishment algorithms (ML-KEM/FIPS 203) with digital
signature algorithms (ML-DSA/FIPS 204); they secure entirely different phases of the
cryptographic lifecycle.
Q2: A multinational software vendor is comparing frameworks to formalize its internal Artificial
Intelligence governance before entering European markets. Based on international AI
governance standards, which distinction between ISO/IEC 42001 and the NIST AI RMF is the
MOST ACCURATE? A) ISO 42001 is a voluntary, non-certifiable risk methodology, whereas the
NIST AI RMF is an auditable management system mandating third-party certification. B) The
NIST AI RMF provides specific, legally binding controls that automatically ensure compliance
with the EU AI Act. C) ISO 42001 relies on 10 management clauses and 38 specific Annex A
controls within a Plan-Do-Check-Act cycle, while the NIST AI RMF operates as a voluntary,
four-function methodology (Govern, Map, Measure, Manage). D) Both frameworks are identical
in structure, but ISO 42001 applies exclusively to generative AI, whereas NIST applies to
deterministic machine learning.
● The Answer: C (ISO 42001 relies on 10 management clauses and 38 specific Annex A
controls within a Plan-Do-Check-Act cycle, while the NIST AI RMF operates as a
voluntary, four-function methodology (Govern, Map, Measure, Manage).)
● Distractor Analysis:
○ A is incorrect: This reverses the reality. ISO 42001 is the certifiable, formal Artificial
Intelligence Management System (AIMS), while the NIST AI RMF is the voluntary
framework.
○ B is incorrect: The NIST AI RMF is a voluntary U.S. guideline and does not carry
the force of law, nor does it automatically satisfy the EU AI Act.
○ D is incorrect: Both frameworks apply to all forms of AI; they differ entirely in their
structural execution (AIMS vs. Risk Framework).
The Mentor's Analysis: Understanding framework taxonomy is non-negotiable. The NIST AI
RMF is an operational methodology used to assess the specific risks of an individual AI system.
ISO/IEC 42001 is an organizational management standard that provides the auditable,
certifiable governance chassis required to prove to external stakeholders that the organization
manages AI responsibly. Professional/Academic Intuition: Operationalize AI risk
assessment internally with NIST; monetize B2B trust globally with ISO 42001 certification.
Q3: A digital marketing firm based in the United Kingdom launches a web application that
collects email addresses, geolocation, and purchasing habits from users exclusively residing in
Kenya. The firm has no servers or employees in Africa. Based on the Kenya Data Protection Act
(DPA) 2019, which conclusion is the MOST ACCURATE? A) The firm must register with the
BANK: CYBER SECURITY
FUNDAMENTALS
(PROTOCOL v11.0)
PART 0: TABLE OF CONTENTS
Section Cognitive Tier Focus Area
PART I: THE PREVIEW Axiomatic Framework Strategic Imperatives, Core
Laws, and Threat Models
PART II: THE ELITE TEST
BANK
Tier 1 (Questions 1–10) Foundational Syntax & Cryptographic Primitives,
Application Framework Syntax, Protocol
Mechanics
Tier 2 (Questions 11–20) Complex Application & Architecture Governance,
Simulation Compliance, and Applied
Threat Modeling
Tier 3 (Questions 21–30) Grandmaster Synthesis Multi-variable High-Stakes
Crisis Simulation
PART I: THE PREVIEW
Mastering this test bank translates directly into elite operational competence, stripping away
academic theory to forge decision-making frameworks that withstand board-level scrutiny and
real-world cyber warfare. You will evaluate competing variables, discard legacy misconceptions,
and architect solutions grounded in the definitive global standards of modern cryptography,
application security, and data governance.
The "Critical Axioms" Cheat Sheet
● The Post-Quantum Cryptography (PQC) Mandate: FIPS 203 (ML-KEM) replaces
RSA/ECC by relying on the Module Learning With Errors (LWE) problem over lattices,
neutralizing Shor's algorithm. Algorithm execution strictly requires a FIPS 140-3 validated
cryptographic module.
● The AI Governance Duality: The NIST AI RMF is a voluntary, risk-based methodology
(Govern, Map, Measure, Manage). ISO/IEC 42001 is an auditable, certifiable
organizational Artificial Intelligence Management System (AIMS) structured around a
, Plan-Do-Check-Act cycle.
● The OWASP 2025 Architectural Shift: A03: Software Supply Chain Failures and A10:
Mishandling of Exceptional Conditions dictate modern threat modeling. A01: Broken
Access Control now explicitly consumes Server-Side Request Forgery (SSRF).
● The Application Security (AppSec) Continuum: SAST identifies logic flaws statically at
rest; DAST tests perimeter exploitability dynamically at runtime; SCA maps third-party
dependency vulnerabilities; IAST instruments the application from within to track runtime
execution flaws natively.
● The ISO 27001:2022 Transformation: Annex A has collapsed from 114 to 93 controls,
pivoting to four distinct themes: Organizational, People, Physical, and Technological.
● Kenyan Cyber-Regulatory Lethality: The Data Protection Act (DPA) 2019 penalizes
privacy failures (currently up to KES 5M or 1% turnover, shifting to "whichever is higher"
under the 2025 amendment), while the Computer Misuse and Cybercrimes Act (CMCA)
penalizes active hacking and cyber harassment (Section 27) with up to KES 20M fines
and imprisonment.
Core Threat & Application Matrices
STRIDE Category Target Security Property Modern Defense / Mitigation
Spoofing Authentication Cryptographic tokens, MFA,
signed session IDs
Tampering Integrity Server-side validation, TLS
everywhere, digital signatures
Repudiation Non-repudiation Tamper-evident, append-only
centralized audit logging
Information Disclosure Confidentiality Parameterized queries, generic
error masking, encryption at
rest
Denial of Service Availability Resource rate limiting, WAF,
load distribution
Elevation of Privilege Authorization Server-derived RBAC/ABAC,
least privilege architecture
Lateral Movement Containment Zero Trust Network Access
(STRIDE-LM) (ZTNA), micro-segmentation
PART II: THE ELITE TEST BANK
Tier 1: Foundational Syntax & Application
Q1: A federal agency is executing a mandate to migrate classified communication channels to
quantum-resistant standards. Based on the principles of the NIST FIPS 203 standard, which
underlying mathematical foundation is the MOST ACCURATE basis for the ML-KEM algorithm?
A) Integer factorization and discrete logarithms mathematically scaled for quantum resistance.
B) The Learning With Errors (LWE) problem applied over module lattices. C) Stateless
hash-based cryptographic structures utilizing the SPHINCS+ framework. D) Elliptic Curve
Diffie-Hellman (ECDH) executing within a hybrid key exchange handshake.
● The Answer: B (The Learning With Errors (LWE) problem applied over module lattices.)
, ● Distractor Analysis:
○ A is incorrect: Integer factorization (RSA) and discrete logarithms (ECC) are the
exact legacy mathematical problems that Shor's algorithm running on a quantum
computer will solve efficiently, rendering them obsolete.
○ C is incorrect: SPHINCS+ and stateless hash functions form the basis of FIPS 205
(SLH-DSA), which is a digital signature algorithm, not the ML-KEM key
encapsulation mechanism.
○ D is incorrect: ECDH is a classical algorithm. While it is paired with ML-KEM in a
hybrid configuration during migration, it is not the foundation of ML-KEM itself.
The Mentor's Analysis: Post-quantum cryptography fundamentally shifts the mathematical
battleground. FIPS 203 utilizes ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism)
because the computational difficulty of finding short vectors in high-dimensional geometric
lattices (Module LWE) has no known efficient quantum attack. Professional/Academic
Intuition: Never confuse key establishment algorithms (ML-KEM/FIPS 203) with digital
signature algorithms (ML-DSA/FIPS 204); they secure entirely different phases of the
cryptographic lifecycle.
Q2: A multinational software vendor is comparing frameworks to formalize its internal Artificial
Intelligence governance before entering European markets. Based on international AI
governance standards, which distinction between ISO/IEC 42001 and the NIST AI RMF is the
MOST ACCURATE? A) ISO 42001 is a voluntary, non-certifiable risk methodology, whereas the
NIST AI RMF is an auditable management system mandating third-party certification. B) The
NIST AI RMF provides specific, legally binding controls that automatically ensure compliance
with the EU AI Act. C) ISO 42001 relies on 10 management clauses and 38 specific Annex A
controls within a Plan-Do-Check-Act cycle, while the NIST AI RMF operates as a voluntary,
four-function methodology (Govern, Map, Measure, Manage). D) Both frameworks are identical
in structure, but ISO 42001 applies exclusively to generative AI, whereas NIST applies to
deterministic machine learning.
● The Answer: C (ISO 42001 relies on 10 management clauses and 38 specific Annex A
controls within a Plan-Do-Check-Act cycle, while the NIST AI RMF operates as a
voluntary, four-function methodology (Govern, Map, Measure, Manage).)
● Distractor Analysis:
○ A is incorrect: This reverses the reality. ISO 42001 is the certifiable, formal Artificial
Intelligence Management System (AIMS), while the NIST AI RMF is the voluntary
framework.
○ B is incorrect: The NIST AI RMF is a voluntary U.S. guideline and does not carry
the force of law, nor does it automatically satisfy the EU AI Act.
○ D is incorrect: Both frameworks apply to all forms of AI; they differ entirely in their
structural execution (AIMS vs. Risk Framework).
The Mentor's Analysis: Understanding framework taxonomy is non-negotiable. The NIST AI
RMF is an operational methodology used to assess the specific risks of an individual AI system.
ISO/IEC 42001 is an organizational management standard that provides the auditable,
certifiable governance chassis required to prove to external stakeholders that the organization
manages AI responsibly. Professional/Academic Intuition: Operationalize AI risk
assessment internally with NIST; monetize B2B trust globally with ISO 42001 certification.
Q3: A digital marketing firm based in the United Kingdom launches a web application that
collects email addresses, geolocation, and purchasing habits from users exclusively residing in
Kenya. The firm has no servers or employees in Africa. Based on the Kenya Data Protection Act
(DPA) 2019, which conclusion is the MOST ACCURATE? A) The firm must register with the
