Creating a comprehensive quiz with 100 multiple-choice questions (MCQs) that are oriented towards

CEH Certification (Certified Ethical Hacker) and CompTIA Security+ can be quite extensive. Here's a
detailed quiz covering various topics from these certifications:

### Cyber Security Quiz

#### General Questions

1. What is the main goal of a vulnerability assessment?

- A) To identify security holes in a system.

- B) To repair detected vulnerabilities.

- C) To test the effectiveness of security policies.

- D) To monitor network traffic.

2. Which type of malware is designed to provide unauthorized, remote access to a system?

- A) Virus

- B) Worm

- C) Trojan

- D) Spyware

3. What is the purpose of encryption in information security?

- A) To hide the existence of data.

- B) To ensure data integrity.

- C) To prevent unauthorized access.

- D) To detect changes in data.

4. Which protocol is used for secure communication over a computer network?

- A) HTTP

- B) FTP
 - C) HTTPS

- D) SMTP

5. What does CIA triad stand for in cybersecurity?

- A) Confidentiality, Integrity, Availability

- B) Confidentiality, Integrity, Authentication

- C) Confidentiality, Identity, Availability

- D) Communication, Integrity, Availability

#### CEH Certification-Oriented Questions

6. Which technique is used in a man-in-the-middle attack?

- A) Phishing

- B) IP Spoofing

- C) SQL Injection

- D) Denial of Service

7. What is the main purpose of a honeypot in network security?

- A) To secure a network by attracting and detecting attackers.

- B) To trap malware.

- C) To monitor legitimate user activities.

- D) To enhance the performance of a network.

8. Which tool is commonly used for password cracking?

- A) Wireshark

- B) Nmap

- C) John the Ripper

- D) Nessus
9. In penetration testing, what is a "zero-day exploit"?

- A) An exploit for which no patch is available.

- B) An exploit used on the first day of an attack.

- C) An exploit that targets network infrastructure.

- D) An exploit that is easily detectable.

10. Which type of scan is used to determine open ports and services on a target system?

- A) Vulnerability Scan

- B) Port Scan

- C) Network Scan

- D) Service Scan

#### CompTIA Security+ Oriented Questions

11. What is the primary function of a firewall?

- A) To detect intrusions.

- B) To prevent malware infections.

- C) To block unauthorized access.

- D) To perform data encryption.

12. Which of the following is a characteristic of a phishing attack?

- A) Exploits a zero-day vulnerability.

- B) Uses social engineering tactics.

- C) Installs a rootkit on the victim's machine.

- D) Disrupts network services.

13. What is the main purpose of a digital signature?

- A) To encrypt data.

- B) To authenticate the sender.

 - C) To ensure data availability.

- D) To improve network speed.

14. Which of the following is an example of a physical security measure?

- A) Encryption

- B) Firewalls

- C) CCTV Cameras

- D) Antivirus Software

15. What is the purpose of a DMZ in network security?

- A) To act as a buffer zone between a private network and the internet.

- B) To prevent internal attacks.

- C) To encrypt network traffic.

- D) To manage network devices.

#### Advanced Questions

16. What is a common method used in SQL Injection attacks?

- A) Inserting malicious code into a SQL query.

- B) Encrypting SQL database entries.

- C) Bypassing authentication through SQL commands.

- D) Creating a SQL-based firewall.

17. Which type of malware can replicate itself and spread to other systems without any user
intervention?

- A) Virus

- B) Worm

- C) Trojan

- D) Ransomware
18. What does the principle of least privilege refer to?

- A) Granting users the minimum levels of access necessary to perform their job functions.

- B) Limiting access to the network perimeter.

- C) Using the least amount of resources for security operations.

- D) Reducing the number of privileged users.

19. Which tool is used for network packet analysis?

- A) Metasploit

- B) Wireshark

- C) Hydra

- D) Burp Suite

20. What is a security baseline?

- A) A set of minimum security standards for a system.

- B) A strategy for mitigating risks.

- C) A report of security incidents.

- D) A measurement of network performance.

#### Further Questions

21. What type of attack involves an attacker intercepting and altering communications between two
parties without their knowledge?

- A) Phishing

- B) Man-in-the-middle attack

- C) Denial of Service

- D) SQL Injection

22. Which security model uses labels to determine access levels for users?
 - A) Discretionary Access Control (DAC)

- B) Mandatory Access Control (MAC)

- C) Role-Based Access Control (RBAC)

- D) Attribute-Based Access Control (ABAC)

23. What is the purpose of an Intrusion Detection System (IDS)?

- A) To block unauthorized access.

- B) To detect and alert on suspicious activities.

- C) To perform data encryption.

- D) To scan for vulnerabilities.

24. Which of the following is a technique used to verify the identity of a user or device?

- A) Authorization

- B) Encryption

- C) Authentication

- D) Auditing

25. What does the term "sandboxing" refer to in cybersecurity?

- A) Isolating suspicious files or programs in a controlled environment.

- B) Monitoring network traffic.

- C) Encrypting data at rest.

- D) Creating backups of critical data.

#### More Advanced Questions

26. Which type of attack aims to make a system or network resource unavailable to users?

- A) Phishing

- B) Man-in-the-middle attack

- C) Denial of Service
 - D) SQL Injection

27. What is the purpose of a Security Information and Event Management (SIEM) system?

- A) To monitor and analyze security events in real-time.

- B) To encrypt data transmissions.

- C) To perform vulnerability assessments.

- D) To manage network devices.

28. What does "DNS spoofing" refer to?

- A) Redirecting a domain name to a different IP address.

- B) Blocking DNS queries.

- C) Encrypting DNS traffic.

- D) Disabling DNS servers.

29. Which cryptographic method uses the same key for both encryption and decryption?

- A) Asymmetric encryption

- B) Symmetric encryption

- C) Hashing

- D) Digital Signatures

30. What is the primary goal of a penetration test?

- A) To improve network speed.

- B) To find and fix vulnerabilities.

- C) To encrypt sensitive data.

- D) To create backups of critical data.

#### Continuing the Questions

31. What is the function of a proxy server?

 - A) To block malware.

- B) To act as an intermediary for requests from clients seeking resources from other servers.

- C) To encrypt network traffic.

- D) To monitor user activity.

32. Which of the following best describes a botnet?

- A) A network of bots used for legitimate automation.

- B) A network of infected computers controlled by an attacker.

- C) A tool for network analysis.

- D) A type of malware that encrypts data.

33. What is a security policy?

- A) A document that outlines an organization's security goals and strategies.

- B) A tool used to detect intrusions.

- C) A program that encrypts data.

- D) A firewall rule set.

34. Which type of malware is often used to launch DDoS attacks?

- A) Adware

- B) Rootkit

- C) Botnet

- D) Spyware

35. What is the purpose of network segmentation?

- A) To increase network speed.

- B) To limit the spread of malware and improve security.

- C) To reduce the number of users on a network.

- D) To monitor network traffic.

#### Going Deeper

36. Which protocol is used to secure remote login sessions?

- A) Telnet

- B) SSH

- C) FTP

- D) HTTP

37. What is a primary function of antivirus software?

- A) To block network traffic.

- B) To scan and remove malicious software.

- C) To encrypt data.

- D) To monitor user activity.

38. Which type of attack involves sending unsolicited bulk messages?

- A) Phishing

- B) Spam

- C) Man-in-the-middle attack

- D) SQL Injection

39. What is the purpose of a VPN (Virtual Private Network)?

- A) To provide secure remote access to a network.

- B) To scan for malware.

- C) To monitor network traffic.

- D) To block unauthorized access.

40. Which of the following is a characteristic of a brute force attack?

 - A) Using a dictionary of known passwords.

- B) Attempting all possible password combinations.

- C) Exploiting software vulnerabilities.

- D) Sending phishing emails.

#### Advanced Topics

41. What is the function of a network intrusion prevention system (IPS)?

- A) To block malicious traffic.

- B) To detect and alert on suspicious activities.

- C) To encrypt network traffic.

- D) To perform vulnerability scans.

42. Which of the following is a technique used to strengthen passwords?

- A) Encryption

- B) Hashing

- C) Salting

- D) Scripting

43. What does "pharming" refer to in cybersecurity?

- A) Redirecting traffic from a legitimate site to a fraudulent one.

- B) Harvesting email addresses for spam.

- C) Installing malware on a system.

- D) Phishing via SMS.

44. Which of the following describes a logic bomb?

- A) Malware that replicates itself.

- B) Code that triggers a malicious action when certain conditions are met.

- C) Software used for password cracking.

 - D) A method of social engineering.

45. What is the purpose of data masking?

- A) To encrypt data.

- B) To protect sensitive data by obscuring it.

- C) To back up data.

- D) To monitor data access.

#### Continuing with Security+ Focus

46. What does "BYOD" stand for?

- A) Bring Your Own Device

- B) Bring Your Own Data

- C) Backup Your Own Data

- D) Backup Your Own Device

47. What is the main goal of social engineering attacks?

- A) To exploit software vulnerabilities.

- B) To manipulate individuals into divulging confidential information.

- C) To disrupt network services.

- D) To steal physical devices.

48. Which of the following is a characteristic of ransomware?

- A) Encrypts the victim's data and demands payment for decryption.

- B) Steals personal information.

- C) Redirects web traffic to malicious sites.

- D) Monitors user activity.

49. What is the purpose of a security token?

 - A) To encrypt data.

- B) To provide a form of two-factor authentication.

- C) To block unauthorized access.

- D) To monitor network traffic.

50. Which type of attack involves overwhelming a system with a flood of traffic?

- A) Phishing

- B) Man-in-the-middle attack

- C) Denial of Service

- D) SQL Injection

#### Detailed Questions

51. What is the purpose of a digital certificate?

- A) To provide encryption keys.

- B) To authenticate the identity of a user or device.

- C) To monitor network traffic.

- D) To perform vulnerability assessments.

52. Which of the following is an example of multi-factor authentication?

- A) Password and PIN

- B) Password and fingerprint

- C) Username and password

- D) Password and security question

53. What does "WPA2" stand for?

- A) Wireless Protected Access 2

- B) Wired Protected Access 2

- C) Wireless Private Access 2

 - D) Wired Private Access 2

54. What is a characteristic of a spear-phishing attack?

- A) Targets a large number of users indiscriminately.

- B) Targets specific individuals or organizations.

- C) Involves social media platforms.

- D) Uses malicious software to exploit vulnerabilities.

55. What is the primary function of a network access control (NAC) system?

- A) To encrypt network traffic.

- B) To control access to network resources.

- C) To monitor user activity.

- D) To perform data backups.

#### Advanced Security+ Topics

56. What is an example of a symmetric encryption algorithm?

- A) RSA

- B) AES

- C) DSA

- D) ECC

57. What is the primary goal of risk management?

- A) To eliminate all risks.

- B) To identify, assess, and mitigate risks.

- C) To monitor network traffic.

- D) To perform vulnerability scans.

58. Which of the following describes "data at rest"?

 - A) Data being transmitted over a network.

- B) Data stored on a hard drive or other storage medium.

- C) Data being processed by a computer.

- D) Data being backed up.

59. What does "MAC" stand for in network security?

- A) Media Access Control

- B) Mandatory Access Control

- C) Message Authentication Code

- D) Multiple Access Control

60. What is the function of an SSL/TLS certificate?

- A) To encrypt email messages.

- B) To provide secure communication over a computer network.

- C) To authenticate users.

- D) To perform vulnerability assessments.

#### Continuing the Deep Dive

61. What is the purpose of a public key in asymmetric encryption?

- A) To decrypt data encrypted with the private key.

- B) To encrypt data that can be decrypted with the private key.

- C) To perform hashing.

- D) To create digital signatures.

62. Which of the following is a feature of a stateful firewall?

- A) Filters packets based solely on source and destination IP addresses.

- B) Tracks the state of active connections and makes decisions based on the context of the
traffic.
 - C) Blocks all incoming traffic by default.

- D) Only filters outgoing traffic.

63. What is a characteristic of a denial-of-service (DoS) attack?

- A) It encrypts the victim's data and demands payment.

- B) It exploits a vulnerability in a web application.

- C) It aims to make a network or system unavailable to users.

- D) It involves stealing sensitive information.

64. What is the purpose of a security audit?

- A) To encrypt sensitive data.

- B) To assess the effectiveness of security controls.

- C) To perform real-time monitoring.

- D) To create backups of critical data.

65. Which protocol is used to securely transfer files over a network?

- A) HTTP

- B) FTP

- C) SFTP

- D) Telnet

#### More Questions

66. What is an example of a physical access control measure?

- A) Password policy

- B) Firewall

- C) Security badge

- D) Antivirus software
67. What is the primary function of a web application firewall (WAF)?

- A) To monitor network traffic.

- B) To filter and monitor HTTP requests to and from a web application.

- C) To encrypt web traffic.

- D) To perform data backups.

68. What does the term "phishing" refer to?

- A) Sending emails that appear to be from a legitimate source to trick recipients into divulging
personal information.

- B) Intercepting communications between two parties.

- C) Launching denial-of-service attacks.

- D) Encrypting data and demanding payment for decryption.

69. Which type of encryption is commonly used to protect data stored on a mobile device?

- A) Symmetric encryption

- B) Asymmetric encryption

- C) Hashing

- D) Steganography

70. What is the primary purpose of a disaster recovery plan (DRP)?

- A) To prevent data breaches.

- B) To ensure the availability and recovery of critical systems and data after a disaster.

- C) To monitor network traffic.

- D) To perform vulnerability assessments.

#### Continuing with In-depth Topics

71. Which of the following best describes a security incident?

- A) An unplanned event that disrupts normal operations.

 - B) A planned security audit.

- C) A regular network scan.

- D) A system update.

72. What is the main function of two-factor authentication (2FA)?

- A) To encrypt data.

- B) To provide an additional layer of security by requiring two forms of verification.

- C) To monitor network traffic.

- D) To perform data backups.

73. Which type of attack involves the attacker disguising themselves as a trusted entity in
communication?

- A) Phishing

- B) Man-in-the-middle

attack

- C) Denial of Service

- D) SQL Injection

74. What does the term "zero-day vulnerability" refer to?

- A) A vulnerability that is known and has a patch available.

- B) A vulnerability that is exploited on the day it is discovered.

- C) A vulnerability that has not been discovered yet.

- D) A vulnerability that affects zero systems.

75. What is the purpose of a hash function in cybersecurity?

- A) To encrypt data.

- B) To generate a unique fixed-size string from input data, often used for data integrity verification.

- C) To perform user authentication.

 - D) To control access to network resources.

#### Final Set of Questions

76. Which protocol is often used for secure email communication?

- A) HTTP

- B) FTP

- C) IMAP

- D) S/MIME

77. What is the function of a demilitarized zone (DMZ) in network security?

- A) To secure sensitive data.

- B) To act as a buffer zone between a private network and the internet.

- C) To monitor network traffic.

- D) To encrypt network communications.

78. What does "SSL" stand for?

- A) Secure Socket Layer

- B) Secure System Layer

- C) Secure Session Layer

- D) Secure Security Layer

79. Which of the following best describes an advanced persistent threat (APT)?

- A) A short-term, high-intensity attack.

- B) A long-term, targeted attack aimed at stealing data.

- C) A random attack on multiple targets.

- D) An attack that disrupts services temporarily.

80. What is the purpose of a network sniffer?

 - A) To encrypt data.

- B) To intercept and analyze network traffic.

- C) To block unauthorized access.

- D) To perform vulnerability scans.

#### Last Set of Questions

81. Which of the following is a characteristic of a rootkit?

- A) It replicates itself.

- B) It hides the existence of malicious software.

- C) It encrypts data and demands payment.

- D) It sends unsolicited bulk messages.

82. What is the primary goal of an incident response plan?

- A) To prevent incidents.

- B) To manage and mitigate the impact of security incidents.

- C) To perform regular security audits.

- D) To encrypt sensitive data.

83. What is an example of an administrative control in cybersecurity?

- A) Firewall

- B) Security policy

- C) Antivirus software

- D) Encryption

84. What does "APT" stand for in cybersecurity?

- A) Advanced Persistent Threat

- B) Advanced Protected Technology

- C) Advanced Penetration Test

 - D) Advanced Policy Threat

85. Which type of attack uses multiple compromised systems to launch an attack on a single
target?

- A) Phishing

- B) Man-in-the-middle attack

- C) Denial of Service (DoS)

- D) Distributed Denial of Service (DDoS)

#### Final Questions

86. What is a vulnerability scan?

- A) A scan to detect vulnerabilities in a network or system.

- B) A scan to monitor user activity.

- C) A scan to encrypt data.

- D) A scan to back up data.

87. What is the main purpose of a digital certificate in PKI?

- A) To provide a method for secure key exchange.

- B) To perform data encryption.

- C) To monitor network traffic.

- D) To control access to resources.

88. Which of the following describes a buffer overflow attack?

- A) Sending too much data to a buffer, causing it to overflow and overwrite adjacent memory.

- B) Blocking legitimate traffic.

- C) Redirecting network traffic.

- D) Encrypting data without authorization.

89. What is the role of an SIEM system in cybersecurity?

- A) To encrypt sensitive data.

- B) To collect, analyze, and report on security-related events and incidents.

- C) To block unauthorized access.

- D) To back up critical data.

90. Which protocol is commonly used to secure web traffic?

- A) HTTP

- B) FTP

- C) SMTP

- D) HTTPS

#### Final In-depth Questions

91. What does the principle of "defense in depth" refer to?

- A) Using multiple layers of security controls to protect against threats.

- B) Relying on a single security control for protection.

- C) Outsourcing security to third-party vendors.

- D) Using encryption for all data.

92. Which of the following is a characteristic of malware?

- A) It is always visible to the user.

- B) It can disrupt, damage, or gain unauthorized access to systems.

- C) It improves system performance.

- D) It only affects mobile devices.

93. What is a security awareness program?

- A) A set of policies for incident response.

- B) A training program to educate users about security threats and best practices.
 - C) A tool for monitoring network traffic.

- D) A software for encrypting data.

94. Which type of attack attempts to guess passwords by trying many possibilities?

- A) Phishing

- B) Man-in-the-middle attack

- C) Brute force attack

- D) SQL Injection

95. What does "VPN" stand for?

- A) Virtual Private Network

- B) Virtual Protected Network

- C) Virtual Public Network

- D) Virtual Packet Network

#### Last Five Questions

96. What is the purpose of a security operations center (SOC)?

- A) To perform data backups.

- B) To monitor and respond to security incidents.

- C) To encrypt network traffic.

- D) To create security policies.

97. Which of the following best describes "steganography"?

- A) Encrypting data.

- B) Hiding data within other files or messages.

- C) Scanning for vulnerabilities.

- D) Performing penetration testing.

98. What is the role of a penetration tester?

- A) To monitor network traffic.

- B) To find and exploit vulnerabilities in systems.

- C) To encrypt sensitive data.

- D) To perform regular security audits.

99. Which of the following is a primary characteristic of spyware?

- A) It encrypts data and demands payment.

- B) It monitors user activity and sends the information to an attacker.

- C) It blocks legitimate traffic.

- D) It replicates itself across networks.

100. What is the primary function of a cryptographic hash function?

- A) To encrypt data.

- B) To generate a unique fixed-size output from input data, used for data integrity verification.

- C) To control access to resources.

- D) To perform user authentication.

### Answer Key

1. A

2. C

3. C

4. C

5. A

6. B

7. A

8. C

9. A
10. B

11. C

12. B

13. B

14. C

15. A

16. A

17. B

18. A

19. B

20. A

21. B

22. B

23. B

24. C

25. A

26. C

27. A

28. A

29. B

30. B

31. B

32. B

33. A

34. C

35. B

36. B

37. B

38. B
39. A

40. B

41. A

42. C

43. A

44. B

45. B

46. A

47. B

48. A

49. B

50. C

51. B

52. B

53. A

54. B

55. B

56. B

57. B

58. B

59. A

60. B

61. B

62. B

63. C

64. B

65. C

66. C

67. B
68. A

69. A

70. B

71. A

72. B

73. B

74. B

75. B

76. D

77. B

78. A

79. B

80. B

81. B

82. B

83. B

84. A

85. D

86. A

87. A

88. A

89. B

90. D

91. A

92. B

93. B

94. C

95. A

96. B
97. B

98. B

99. B

100. B

This quiz covers a wide range of topics relevant to CEH Certification and CompTIA Security+,
providing a comprehensive review for anyone studying for these exams.