Cybersecurity Analyst question bank
100 questions. Filter by level and skill, track what you've solved, and see how many people get each one right.
- Which part of the CIA triad does a DDoS hit?
- Threat, vulnerability or risk?
- What does SHA-256 do?
- Default port for Remote Desktop
- Where to see SPF, DKIM and DMARC results
- Symmetric or asymmetric?
- IDS vs IPS
- What is Windows Event ID 4625?
- Applying least privilege
- Which login is really two-factor?
- What is spear phishing?
- Which port does DNS use?
- Which key encrypts a secret message?
- How a digital signature is created
- Why passwords are salted
- What is Windows Event ID 4624?
- IOC vs IOA
- False positive or false negative?
- Which malware spreads by itself?
- Backups that survive ransomware
- What HTTPS protects
- Spot the defence in depth
- What is a zero-day?
- CVE, CVSS and CWE
- What is Sysmon Event ID 1?
- What makes a firewall stateful?
- What does SPF check?
- Brute force or password spraying?
- Which IP address is private?
- Safe use of VirusTotal
- A hash that no longer matches
- Why chain of custody matters
- What a Tier 1 SOC analyst does
- Spot the social engineering
- Tactic vs technique in MITRE ATT&CK
- Which vulnerability do you patch first?
- Failed logons followed by success
- NIST incident response lifecycle
- Why does a browser trust a certificate?
- Suspicious process tree in EDR
- Spot the attack in a web log
- Unusual DNS traffic
- Reading the logon type
- Splunk query for failed logons
- KQL for failed Entra sign-ins
- What DMARC p=none does
- Triage an impossible travel alert
- Stopping MFA fatigue attacks
- Read a Suricata rule
- Spotting C2 beaconing
- Wireshark filter for HTTP POSTs
- Security log cleared on a server
- A suspicious scheduled task
- CloudTrail logging was stopped
- When you cannot patch yet
- Spot the lookalike sender domain
- Why analysts defang URLs
- Containing a hijacked Microsoft 365 account
- Why write detections in Sigma?
- What this YARA rule matches
- The Pyramid of Pain
- Sharing threat intel at scale
- What EDR host isolation does
- What evidence to collect first
- Decoding -EncodedCommand
- Credentialed vs unauthenticated scans
- Odd queries in Zeek dns.log
- File integrity alert on a web server
- Detecting Kerberoasting
- What zero trust really means
- SSRF and cloud instance metadata
- Reading static analysis results
- A good threat hunting hypothesis
- Why a 99% accurate rule floods the SOC
- Artefacts of PsExec lateral movement
- First move on an encrypting host
- Evicting a Golden Ticket attacker
- Detecting DCSync
- Password reset did not stop the attacker
- Phishing that bypasses MFA
- Why the JNDI rule missed attacks
- DNS logs went quiet
- Why JA4 replaced JA3
- An impossible timeline
- A living-off-the-land download
- Trusting a green ATT&CK heatmap
- Exfiltration before encryption
- Reading an EPSS score
- Is this S3 bucket public?
- Hidden escalation with PassRole
- Successful sign-in with no MFA
- Detecting AS-REP roasting
- Hardening against NTLM relay
- Suspicious access to LSASS
- When a trusted update is malicious
- Why honeytokens are high fidelity
- Web server spawning a shell
- Detecting timestomping
- GDPR breach notification deadline
- rundll32 with no arguments