أسئلة تدريب الأمن السيبراني (اختبار جاهزية)

المجال 01 · أسس الأمن السيبراني

A company's security team receives a report that an employee received an email appearing to be from the IT department, asking them to reset their password by clicking a link. The link leads to a fake login page. The employee did not click the link but reported it. Which type of social engineering attack is this, and what is the primary human factor that makes such attacks successful?

اختر إجابة لتختبر نفسك.

1. APhishing; the human factor is authority and urgency.
2. BPhishing; the human factor is technical naivety and lack of training.
3. CPretexting; the human factor is trust in known contacts.
4. DTailgating; the human factor is politeness and courtesy.

المجال 02 · أمن البيانات

An analyst is allowed to run COUNT queries on a personnel table but is denied any query returning individual rows. By combining counts over overlapping sets of employees (e.g., all staff with salary above 80k, then the same set excluding one named employee), the analyst deduces that employee's salary. Which database security problem is this?

اختر إجابة لتختبر نفسك.

1. AAggregation, because combining separate authorised query results reveals a sensitive fact
2. BInference, because the analyst deduces restricted individual data from permitted aggregate results
3. CSQL injection, because the analyst manipulates the query to bypass row restrictions
4. DData corruption, because overlapping counts produce inconsistent results

المجال 03 · أمن البرمجيات

A script processes a list of user-supplied filenames and deletes each file using the command `os.remove(filename)`. The filenames are validated to ensure they end with `.tmp`. Which of the following is the most significant security risk in this design?

اختر إجابة لتختبر نفسك.

1. AThe script may delete files outside the intended directory if the filename contains path traversal sequences like `../`.
2. BThe script may be vulnerable to command injection if the filename contains shell metacharacters.
3. CThe script may fail to delete files if the filename contains spaces or special characters.
4. DThe script may allow an attacker to delete files with the `.tmp` extension that belong to other users.

المجال 04 · أمن المكونات

A security audit reveals that a database server is configured to allow remote connections from any IP address without encryption, and the database software is the latest version. Which vulnerability does this configuration primarily introduce?

اختر إجابة لتختبر نفسك.

1. AUnencrypted remote access leading to data interception
2. BOutdated software vulnerability
3. CWeak password policy vulnerability
4. DPhysical theft vulnerability

المجال 05 · أمن الشبكات

A web server sits behind a stateful firewall that permits inbound TCP only on port 443 and drops all other inbound SYNs. An attacker on the internet repeatedly sends SYNs to ports 80, 22, 3306 and 8080 of that server, then captures the firewall's replies to determine which ports are filtered. Which conclusion about this reconnaissance attempt and its mitigation is best supported?

اختر إجابة لتختبر نفسك.

1. AThe scan reveals nothing useful because the firewall is stateful; the appropriate mitigation is to disable stateful inspection so replies become consistent.
2. BThe differing replies (RST for closed ports versus no reply for filtered ports) disclose the firewall's rule set; mitigation is to drop silently on filtered ports and rate-limit scan traffic.
3. CThe scan is a TCP SYN flood that will exhaust the firewall's connection table; mitigation is to disable TCP entirely and rely on UDP services.
4. DBecause only port 443 is permitted inbound, the scan proves the firewall is filtering and no further action is needed regardless of what the replies disclose.

المجال 06 · أمن الأنظمة

A designer is choosing the privilege architecture for a new operating system kernel. In candidate design P, every kernel subsystem — including device drivers, file systems and network protocol handlers — runs in a single privileged address space and can directly access every kernel data structure. In candidate design Q, the kernel is decomposed into a small privileged core plus user-space servers, and each server reaches other servers and the hardware only through message passing mediated by the core. A critical buffer-overflow defect exists in the network protocol handler, which will be exploited remotely in both designs. Which analysis of the two designs is correct?

اختر إجابة لتختبر نفسك.

1. AIn design Q the exploited network server is itself a user-space process, so a successful exploit corrupts only that server's address space unless the attacker can further subvert the small core through the inter-server interface; in design P the same exploit runs with kernel privilege and can directly overwrite the scheduler, page tables and other subsystems' data.
2. BThe two designs are equivalent against this exploit because both implement a kernel/user privilege boundary that the remote attacker must cross before reaching any system data.
3. CDesign P is safer because all subsystems share one address space, which allows the kernel to detect a subsystem writing outside its own data and abort only the offending subsystem.
4. DDesign Q eliminates the risk entirely because moving the protocol handler out of the kernel means the handler can no longer be reached by unauthenticated network traffic.

المجال 07 · الأمن البشري

A security analyst is reviewing a set of security events and wants to classify each as a likely indicator of a cyber attack or as a benign event. The events are: 1. A user account that normally logs in from the office at 9 AM logs in successfully from a foreign IP address at 2 AM. 2. An employee receives an email from a colleague's address asking for a password reset, but the colleague is on leave and the email was sent from a slightly misspelled domain. 3. A server performs a scheduled backup to an approved cloud storage service every night at 1 AM. 4. A user reports that their mouse cursor occasionally moves on its own during a remote support session initiated by IT. Which events are most appropriately classified as indicators of a potential cyber attack?

اختر إجابة لتختبر نفسك.

1. AEvents 1 and 2 only
2. BEvents 1, 2, and 3 only
3. CEvents 2 and 4 only
4. DEvents 1, 2, 3, and 4

المجال 08 · الأمن المؤسسي

A security analyst at a bank is asked by a senior manager to check whether a colleague's account has been using an unapproved cloud storage service. The analyst's monitoring tool can access that colleague's private files only by bypassing the normal access-control process. The bank's code of ethics requires authorization before accessing any employee's data and requires that monitoring be limited to what is necessary. Which action best applies ethical cybersecurity practice?

اختر إجابة لتختبر نفسك.

1. ABypass the access controls quietly, since the manager's request is an internal authorization and the investigation serves a legitimate security purpose.
2. BObtain documented authorization from the appropriate authority, then inspect only the account activity needed for the investigation.
3. CRefuse all monitoring tasks on principle, because accessing another employee's activity is always unethical for an individual analyst.
4. DProceed only after informing the colleague directly and getting their personal consent to the monitoring.