Cybersecurity practice questions (Jahziah exam)

Area 01 · Cybersecurity foundations

A company's security team receives a report that an employee received an email appearing to be from the IT department, asking them to reset their password by clicking a link. The link leads to a fake login page. The employee did not click the link but reported it. Which type of social engineering attack is this, and what is the primary human factor that makes such attacks successful?

Pick an answer to check yourself.

1. APhishing; the human factor is authority and urgency.
2. BPhishing; the human factor is technical naivety and lack of training.
3. CPretexting; the human factor is trust in known contacts.
4. DTailgating; the human factor is politeness and courtesy.

Area 02 · Data security

An analyst is allowed to run COUNT queries on a personnel table but is denied any query returning individual rows. By combining counts over overlapping sets of employees (e.g., all staff with salary above 80k, then the same set excluding one named employee), the analyst deduces that employee's salary. Which database security problem is this?

Pick an answer to check yourself.

1. AAggregation, because combining separate authorised query results reveals a sensitive fact
2. BInference, because the analyst deduces restricted individual data from permitted aggregate results
3. CSQL injection, because the analyst manipulates the query to bypass row restrictions
4. DData corruption, because overlapping counts produce inconsistent results

Area 03 · Software security

A script processes a list of user-supplied filenames and deletes each file using the command `os.remove(filename)`. The filenames are validated to ensure they end with `.tmp`. Which of the following is the most significant security risk in this design?

Pick an answer to check yourself.

1. AThe script may delete files outside the intended directory if the filename contains path traversal sequences like `../`.
2. BThe script may be vulnerable to command injection if the filename contains shell metacharacters.
3. CThe script may fail to delete files if the filename contains spaces or special characters.
4. DThe script may allow an attacker to delete files with the `.tmp` extension that belong to other users.

Area 04 · Component security

A security audit reveals that a database server is configured to allow remote connections from any IP address without encryption, and the database software is the latest version. Which vulnerability does this configuration primarily introduce?

Pick an answer to check yourself.

1. AUnencrypted remote access leading to data interception
2. BOutdated software vulnerability
3. CWeak password policy vulnerability
4. DPhysical theft vulnerability

Area 05 · Network security

A web server sits behind a stateful firewall that permits inbound TCP only on port 443 and drops all other inbound SYNs. An attacker on the internet repeatedly sends SYNs to ports 80, 22, 3306 and 8080 of that server, then captures the firewall's replies to determine which ports are filtered. Which conclusion about this reconnaissance attempt and its mitigation is best supported?

Pick an answer to check yourself.

1. AThe scan reveals nothing useful because the firewall is stateful; the appropriate mitigation is to disable stateful inspection so replies become consistent.
2. BThe differing replies (RST for closed ports versus no reply for filtered ports) disclose the firewall's rule set; mitigation is to drop silently on filtered ports and rate-limit scan traffic.
3. CThe scan is a TCP SYN flood that will exhaust the firewall's connection table; mitigation is to disable TCP entirely and rely on UDP services.
4. DBecause only port 443 is permitted inbound, the scan proves the firewall is filtering and no further action is needed regardless of what the replies disclose.

Area 06 · System security

A designer is choosing the privilege architecture for a new operating system kernel. In candidate design P, every kernel subsystem — including device drivers, file systems and network protocol handlers — runs in a single privileged address space and can directly access every kernel data structure. In candidate design Q, the kernel is decomposed into a small privileged core plus user-space servers, and each server reaches other servers and the hardware only through message passing mediated by the core. A critical buffer-overflow defect exists in the network protocol handler, which will be exploited remotely in both designs. Which analysis of the two designs is correct?

Pick an answer to check yourself.

1. AIn design Q the exploited network server is itself a user-space process, so a successful exploit corrupts only that server's address space unless the attacker can further subvert the small core through the inter-server interface; in design P the same exploit runs with kernel privilege and can directly overwrite the scheduler, page tables and other subsystems' data.
2. BThe two designs are equivalent against this exploit because both implement a kernel/user privilege boundary that the remote attacker must cross before reaching any system data.
3. CDesign P is safer because all subsystems share one address space, which allows the kernel to detect a subsystem writing outside its own data and abort only the offending subsystem.
4. DDesign Q eliminates the risk entirely because moving the protocol handler out of the kernel means the handler can no longer be reached by unauthenticated network traffic.

Area 07 · Human security

A security analyst is reviewing a set of security events and wants to classify each as a likely indicator of a cyber attack or as a benign event. The events are: 1. A user account that normally logs in from the office at 9 AM logs in successfully from a foreign IP address at 2 AM. 2. An employee receives an email from a colleague's address asking for a password reset, but the colleague is on leave and the email was sent from a slightly misspelled domain. 3. A server performs a scheduled backup to an approved cloud storage service every night at 1 AM. 4. A user reports that their mouse cursor occasionally moves on its own during a remote support session initiated by IT. Which events are most appropriately classified as indicators of a potential cyber attack?

Pick an answer to check yourself.

1. AEvents 1 and 2 only
2. BEvents 1, 2, and 3 only
3. CEvents 2 and 4 only
4. DEvents 1, 2, 3, and 4

Area 08 · Organizational security

A security analyst at a bank is asked by a senior manager to check whether a colleague's account has been using an unapproved cloud storage service. The analyst's monitoring tool can access that colleague's private files only by bypassing the normal access-control process. The bank's code of ethics requires authorization before accessing any employee's data and requires that monitoring be limited to what is necessary. Which action best applies ethical cybersecurity practice?

Pick an answer to check yourself.

1. ABypass the access controls quietly, since the manager's request is an internal authorization and the investigation serves a legitimate security purpose.
2. BObtain documented authorization from the appropriate authority, then inspect only the account activity needed for the investigation.
3. CRefuse all monitoring tasks on principle, because accessing another employee's activity is always unethical for an individual analyst.
4. DProceed only after informing the colleague directly and getting their personal consent to the monitoring.