That data is not altered or tampered with without authorization

That systems remain accessible during an outage

That data is only readable by authorized users

It self-replicates and spreads across networks without needing a host file or user action

It only activates after a specific trigger date

It disguises itself as legitimate software to trick users

A mass email scam sent to random unrelated addresses

A phishing attack tailored to target a specific person or organization

An attack that intercepts traffic between two parties

To encrypt a victim's files and demand payment

To remotely control a network of compromised devices to carry out coordinated attacks

Flooding a server with traffic until it becomes unavailable

Compromising a website frequently visited by a target group to infect their devices

Guessing a password using automated trial and error

Which ports are open and what services are running on them

The contents of encrypted files on the system

It encrypts all outbound traffic automatically

It hides internal device IP addresses from external networks

It authenticates users before granting network access

A number used only once to help prevent replay attacks

The secret key shared between two parties

Guessing a password by trying every possible character combination

Using username and password pairs stolen from one breach to try logging into other accounts

Tricking a user into revealing their password through a fake login page

Systematically trying many password combinations until the correct one is found

Sending forged requests using a victim's active session

Injecting malicious code into a database query

Users being able to act outside their intended permissions

A flaw where user input is executed as a database command

Writing more data to a memory buffer than it is allocated to hold, corrupting adjacent memory

A session hijacking technique using stolen cookies

The risk that one tenant's data could be improperly exposed to another tenant

The requirement to manage physical servers on-site

Enabling multi-factor authentication for all cloud accounts

Leaving a storage bucket publicly accessible when it should be restricted

Rotating encryption keys on a regular schedule

To determine the effect of disruptions on business operations and prioritize recovery efforts

To scan applications for known vulnerabilities

To verify a user's identity before granting access

Eliminating a risk entirely by removing the affected asset

Shifting the financial impact of a risk to another party, such as through insurance

Accepting a risk without taking any further action

To limit the spread and impact of an incident before it causes further damage

To restore all systems to normal operation

A discussion-based simulation of a security incident used to test response plans

A live penetration test performed on production systems

An automated tool that patches vulnerabilities in real time

Cyber Security Quiz