1
FOUNDATIONS & CIA TRIAD (Q1–15)
1. Which principle of the CIA triad ensures data has not been altered?
A. Confidentiality
B. Integrity
C. Availability
D. Non-repudiation
Answer: B — Integrity ensures data is not modified unauthorized.
2. A ransomware attack that encrypts files primarily impacts:
A. Confidentiality
B. Integrity
C. Availability
D. Authentication
Answer: C — Encrypted files are unavailable to legitimate users.
3. Which is an example of a confidentiality control?
A. Encryption
B. Checksum
C. Load balancing
D. Backup
Answer: A — Encryption protects data from unauthorized disclosure.
4. Non-repudiation is best achieved through:
A. Symmetric encryption
B. Digital signatures
C. Hashing
D. Firewalls
Answer: B — Digital signatures prove origin and prevent denial.
5. Which best describes "defense in depth"?
A. A single strong firewall
B. Multiple layered security controls
C. Antivirus only
D. Password complexity
Answer: B — Layered controls reduce single points of failure.
6. Which is a technical control?
A. Security policy
B. Firewall
C. Security awareness training
D. Background checks
Answer: B — Firewalls are technical (logical) controls.
, 2
7. Which is an administrative control?
A. Intrusion detection system
B. Security policy
C. Biometric lock
D. Encryption
Answer: B — Policies are administrative controls.
8. Which is a physical control?
A. Access control list
B. Locked server room
C. Encryption
D. Password policy
Answer: B — Physical controls protect facilities.
9. The primary goal of information assurance is to:
A. Eliminate all risk
B. Protect and defend information systems
C. Increase network speed
D. Reduce costs
Answer: B — IA protects information and systems.
10. Which is NOT part of the CIA triad?
A. Confidentiality
B. Integrity
C. Availability
D. Anonymity
Answer: D — Anonymity is not a CIA pillar.
11. A DDoS attack primarily targets:
A. Confidentiality
B. Integrity
C. Availability
D. Authentication
Answer: C — DDoS makes services unavailable.
12. Which is an example of a deterrent control?
A. Warning banner
B. Encryption
C. Backup
D. Firewall
Answer: A — Deterrent controls discourage attacks.
13. Which is a detective control?
A. Firewall
, 3
B. IDS
C. Encryption
D. Lock
Answer: B — IDS detects intrusions.
14. Which is a corrective control?
A. Backup restoration
B. Security policy
C. Warning sign
D. Firewall
Answer: A — Corrective controls restore systems after an incident.
15. Which is a compensating control?
A. A control that replaces a primary control when it can't be implemented
B. A control that prevents all attacks
C. A control that detects attacks
D. A control that encrypts data
Answer: A — Compensating controls provide alternative protection.
RISK MANAGEMENT (Q16–30)
16. Risk is best defined as:
A. Threat × Vulnerability × Impact
B. Threat + Vulnerability
C. Impact only
D. Probability only
Answer: A — Risk combines threat, vulnerability, and impact.
17. Which risk response involves transferring risk?
A. Installing a firewall
B. Purchasing cyber insurance
C. Accepting the risk
D. Avoiding the activity
Answer: B — Insurance transfers financial risk.
18. Which risk response involves avoiding risk?
A. Buying insurance
B. Not engaging in the risky activity
C. Installing antivirus
D. Accepting the risk
Answer: B — Avoidance eliminates the activity causing risk.
FOUNDATIONS & CIA TRIAD (Q1–15)
1. Which principle of the CIA triad ensures data has not been altered?
A. Confidentiality
B. Integrity
C. Availability
D. Non-repudiation
Answer: B — Integrity ensures data is not modified unauthorized.
2. A ransomware attack that encrypts files primarily impacts:
A. Confidentiality
B. Integrity
C. Availability
D. Authentication
Answer: C — Encrypted files are unavailable to legitimate users.
3. Which is an example of a confidentiality control?
A. Encryption
B. Checksum
C. Load balancing
D. Backup
Answer: A — Encryption protects data from unauthorized disclosure.
4. Non-repudiation is best achieved through:
A. Symmetric encryption
B. Digital signatures
C. Hashing
D. Firewalls
Answer: B — Digital signatures prove origin and prevent denial.
5. Which best describes "defense in depth"?
A. A single strong firewall
B. Multiple layered security controls
C. Antivirus only
D. Password complexity
Answer: B — Layered controls reduce single points of failure.
6. Which is a technical control?
A. Security policy
B. Firewall
C. Security awareness training
D. Background checks
Answer: B — Firewalls are technical (logical) controls.
, 2
7. Which is an administrative control?
A. Intrusion detection system
B. Security policy
C. Biometric lock
D. Encryption
Answer: B — Policies are administrative controls.
8. Which is a physical control?
A. Access control list
B. Locked server room
C. Encryption
D. Password policy
Answer: B — Physical controls protect facilities.
9. The primary goal of information assurance is to:
A. Eliminate all risk
B. Protect and defend information systems
C. Increase network speed
D. Reduce costs
Answer: B — IA protects information and systems.
10. Which is NOT part of the CIA triad?
A. Confidentiality
B. Integrity
C. Availability
D. Anonymity
Answer: D — Anonymity is not a CIA pillar.
11. A DDoS attack primarily targets:
A. Confidentiality
B. Integrity
C. Availability
D. Authentication
Answer: C — DDoS makes services unavailable.
12. Which is an example of a deterrent control?
A. Warning banner
B. Encryption
C. Backup
D. Firewall
Answer: A — Deterrent controls discourage attacks.
13. Which is a detective control?
A. Firewall
, 3
B. IDS
C. Encryption
D. Lock
Answer: B — IDS detects intrusions.
14. Which is a corrective control?
A. Backup restoration
B. Security policy
C. Warning sign
D. Firewall
Answer: A — Corrective controls restore systems after an incident.
15. Which is a compensating control?
A. A control that replaces a primary control when it can't be implemented
B. A control that prevents all attacks
C. A control that detects attacks
D. A control that encrypts data
Answer: A — Compensating controls provide alternative protection.
RISK MANAGEMENT (Q16–30)
16. Risk is best defined as:
A. Threat × Vulnerability × Impact
B. Threat + Vulnerability
C. Impact only
D. Probability only
Answer: A — Risk combines threat, vulnerability, and impact.
17. Which risk response involves transferring risk?
A. Installing a firewall
B. Purchasing cyber insurance
C. Accepting the risk
D. Avoiding the activity
Answer: B — Insurance transfers financial risk.
18. Which risk response involves avoiding risk?
A. Buying insurance
B. Not engaging in the risky activity
C. Installing antivirus
D. Accepting the risk
Answer: B — Avoidance eliminates the activity causing risk.
