Michigan Cybersecurity Advanced Exam
Practice Questions And Correct Answers
(Verified Answers) Plus Rationale 2026
Q&A| Instant Download Pdf
1. Which of the following best describes a zero-day vulnerability?
A. A vulnerability that has been publicly disclosed and patched
B. A vulnerability that exists but is not exploitable
C. A vulnerability that is unknown to the vendor and exploitable
D. A vulnerability that only affects outdated operating systems
A zero-day vulnerability is a flaw in software that is unknown to the
vendor and for which no patch exists, making it exploitable by
attackers.
2. In a SIEM (Security Information and Event Management) system, what
is the primary function of correlation rules?
A. To encrypt log files
B. To monitor network bandwidth
C. To identify patterns of events that may indicate security incidents
D. To back up data to cloud storage
Correlation rules in SIEM analyze and link disparate events from
multiple sources to detect potential security threats that single
events alone might not reveal.
3. Which protocol provides secure communication over an untrusted
network by encrypting both authentication and data?
A. FTP
B. Telnet
C. HTTP
D. SSH
SSH (Secure Shell) encrypts both the login credentials and data
, transmitted between a client and server, ensuring confidentiality
over untrusted networks.
4. What is the main purpose of a honeypot in network security?
A. To speed up network traffic
B. To replace firewalls
C. To attract and analyze attackers without risking critical systems
D. To store encrypted backups
Honeypots are decoy systems designed to lure attackers, allowing
security teams to study attack methods while isolating real assets
from harm.
5. Which of the following attacks involves intercepting and potentially
altering communication between two parties without their
knowledge?
A. Phishing
B. Man-in-the-middle (MITM)
C. Denial-of-service (DoS)
D. SQL injection
A MITM attack occurs when an attacker secretly intercepts
communication between two parties and may manipulate the
messages to compromise data integrity or confidentiality.
6. In cryptography, what is the key difference between symmetric and
asymmetric encryption?
A. Symmetric uses longer keys than asymmetric
B. Asymmetric is faster than symmetric
C. Symmetric uses the same key for encryption and decryption,
whereas asymmetric uses a public/private key pair
D. Asymmetric cannot be used for digital signatures
Symmetric encryption relies on a shared secret key for both
encryption and decryption, while asymmetric encryption uses a
paired public key and private key system.
7. Which type of malware specifically encrypts user files and demands
payment for decryption?
A. Worm
B. Trojan
C. Spyware
, D. Ransomware
Ransomware encrypts a victim’s data and typically demands a
ransom payment to restore access, making it a major cybersecurity
threat.
8. What is the primary goal of penetration testing?
A. To install antivirus software
B. To simulate attacks in order to identify vulnerabilities
C. To monitor network bandwidth
D. To create firewall rules
Penetration testing involves ethical hackers attempting to exploit
vulnerabilities in a controlled environment to identify weaknesses
before malicious actors can exploit them.
9. Which authentication factor is based on something a user is?
A. Password
B. Security token
C. PIN
D. Biometric characteristics
Biometric factors, such as fingerprints, retina scans, or facial
recognition, authenticate users based on inherent physical or
behavioral traits.
10. What is the primary risk of using outdated software in an
enterprise environment?
A. Reduced battery life
B. Slower user interfaces
C. Exposure to known vulnerabilities and exploits
D. Higher licensing fees
Outdated software often lacks critical security patches, leaving
systems susceptible to known exploits and increasing the risk of
compromise.
11. Which framework provides guidelines for organizations to
manage and reduce cybersecurity risk using a five-step approach of
Identify, Protect, Detect, Respond, and Recover?
A. ISO 27001
B. COBIT
C. PCI DSS
Practice Questions And Correct Answers
(Verified Answers) Plus Rationale 2026
Q&A| Instant Download Pdf
1. Which of the following best describes a zero-day vulnerability?
A. A vulnerability that has been publicly disclosed and patched
B. A vulnerability that exists but is not exploitable
C. A vulnerability that is unknown to the vendor and exploitable
D. A vulnerability that only affects outdated operating systems
A zero-day vulnerability is a flaw in software that is unknown to the
vendor and for which no patch exists, making it exploitable by
attackers.
2. In a SIEM (Security Information and Event Management) system, what
is the primary function of correlation rules?
A. To encrypt log files
B. To monitor network bandwidth
C. To identify patterns of events that may indicate security incidents
D. To back up data to cloud storage
Correlation rules in SIEM analyze and link disparate events from
multiple sources to detect potential security threats that single
events alone might not reveal.
3. Which protocol provides secure communication over an untrusted
network by encrypting both authentication and data?
A. FTP
B. Telnet
C. HTTP
D. SSH
SSH (Secure Shell) encrypts both the login credentials and data
, transmitted between a client and server, ensuring confidentiality
over untrusted networks.
4. What is the main purpose of a honeypot in network security?
A. To speed up network traffic
B. To replace firewalls
C. To attract and analyze attackers without risking critical systems
D. To store encrypted backups
Honeypots are decoy systems designed to lure attackers, allowing
security teams to study attack methods while isolating real assets
from harm.
5. Which of the following attacks involves intercepting and potentially
altering communication between two parties without their
knowledge?
A. Phishing
B. Man-in-the-middle (MITM)
C. Denial-of-service (DoS)
D. SQL injection
A MITM attack occurs when an attacker secretly intercepts
communication between two parties and may manipulate the
messages to compromise data integrity or confidentiality.
6. In cryptography, what is the key difference between symmetric and
asymmetric encryption?
A. Symmetric uses longer keys than asymmetric
B. Asymmetric is faster than symmetric
C. Symmetric uses the same key for encryption and decryption,
whereas asymmetric uses a public/private key pair
D. Asymmetric cannot be used for digital signatures
Symmetric encryption relies on a shared secret key for both
encryption and decryption, while asymmetric encryption uses a
paired public key and private key system.
7. Which type of malware specifically encrypts user files and demands
payment for decryption?
A. Worm
B. Trojan
C. Spyware
, D. Ransomware
Ransomware encrypts a victim’s data and typically demands a
ransom payment to restore access, making it a major cybersecurity
threat.
8. What is the primary goal of penetration testing?
A. To install antivirus software
B. To simulate attacks in order to identify vulnerabilities
C. To monitor network bandwidth
D. To create firewall rules
Penetration testing involves ethical hackers attempting to exploit
vulnerabilities in a controlled environment to identify weaknesses
before malicious actors can exploit them.
9. Which authentication factor is based on something a user is?
A. Password
B. Security token
C. PIN
D. Biometric characteristics
Biometric factors, such as fingerprints, retina scans, or facial
recognition, authenticate users based on inherent physical or
behavioral traits.
10. What is the primary risk of using outdated software in an
enterprise environment?
A. Reduced battery life
B. Slower user interfaces
C. Exposure to known vulnerabilities and exploits
D. Higher licensing fees
Outdated software often lacks critical security patches, leaving
systems susceptible to known exploits and increasing the risk of
compromise.
11. Which framework provides guidelines for organizations to
manage and reduce cybersecurity risk using a five-step approach of
Identify, Protect, Detect, Respond, and Recover?
A. ISO 27001
B. COBIT
C. PCI DSS
