Cybersecurity Analyst
Security fundamentals and cryptography questions
103 questions on Security fundamentals and cryptography for cybersecurity analysts, easiest first.
Easy 38
- Which part of the CIA triad does a DDoS hit?easy
- Threat, vulnerability or risk?easy
- What does SHA-256 do?easy
- Symmetric or asymmetric?easy
- Applying least privilegeeasy
- Which key encrypts a secret message?easy
- How a digital signature is createdeasy
- Why passwords are saltedeasy
- What HTTPS protectseasy
- Spot the defence in deptheasy
- What is a zero-day?easy
- CVE, CVSS and CWEeasy
- A hash that no longer matcheseasy
- Invoice amount changed in transiteasy
- Salary sheet shared by mistakeeasy
- Logging in versus being allowedeasy
- Proving who approved iteasy
- Password stored in Base64easy
- Is this multi-factor?easy
- Creating and approving a vendoreasy
- Buying cyber insuranceeasy
- Best way to store passwordseasy
- What kind of algorithm AES iseasy
- Hashing or encryption?easy
- Why label dataeasy
- Which control type is a policy?easy
- What CCTV mainly doeseasy
- What ISO/IEC 27001 iseasy
- What goes into a CSReasy
- Browser warns on a self-signed certeasy
- The 3-2-1 backup ruleeasy
- Ransomware deleted the backups tooeasy
- Turning off unused serviceseasy
- What should happen on failureeasy
- Moving SSH to port 2222easy
- What India's DPDP Act coverseasy
- Patching without testingeasy
- First step in vulnerability managementeasy
Medium 39
- Which vulnerability do you patch first?medium
- NIST incident response lifecyclemedium
- Why does a browser trust a certificate?medium
- When you cannot patch yetmedium
- Credentialed vs unauthenticated scansmedium
- Encrypted image still shows the logomedium
- What AES-GCM addsmedium
- What Diffie-Hellman is formedium
- Old traffic after a key leakmedium
- Encrypting a 2 GB file to a public keymedium
- Signing a webhook with a hashmedium
- The function added in NIST CSF 2.0medium
- Forcing a password change every 60 daysmedium
- RTO and RPOmedium
- Checking if a certificate was revokedmedium
- Wildcard certificate warningmedium
- Works in Chrome, fails in curlmedium
- A CVE in the KEV catalogmedium
- Scan or penetration test?medium
- Scanner flags a patched OpenSSLmedium
- Storing card numbers for repeat billingmedium
- Access based on attributesmedium
- What a pepper addsmedium
- Severity of a CVSS 7.5medium
- Keeping the algorithm secretmedium
- Reading a CVSS vectormedium
- Adjusting CVSS for your networkmedium
- Accepting an unpatched riskmedium
- When is the fix due?medium
- How Let's Encrypt checks you own a domainmedium
- What mutual TLS addsmedium
- Signed app after the certificate expiresmedium
- Why the root CA stays offlinemedium
- Which apps use the bad library?medium
- What made Log4Shell so seriousmedium
- HMAC as proof in a disputemedium
- Private key posted on GitHubmedium
- API key in an old commitmedium
- How Wazuh finds vulnerable softwaremedium
Hard 26
- What zero trust really meanshard
- Reading an EPSS scorehard
- RSA private key with small numbershard
- Working out ALEhard
- Which random password is strongerhard
- Collisions in a 64-bit hashhard
- Same nonce used twice in AES-GCMhard
- Which order: MAC or encrypt?hard
- What a quantum computer breakshard
- What ML-KEM is used forhard
- What to migrate to post-quantum firsthard
- Rotating keys on 50 TB of datahard
- Secret user writing to an unclassified filehard
- Maximum TLS certificate lifetimehard
- JWT signed with the public keyhard
- Same IV for every recordhard
- Why Certificate Transparency existshard
- Working out MTTRhard
- Strength of a 5-word passphrasehard
- Changing a cookie without the keyhard
- Risk of TLS 1.3 0-RTT datahard
- Salts leaked with the hasheshard
- What an HSM protects againsthard
- App breaks after a certificate changehard
- Two ECDSA signatures with the same khard
- Why SHA-1 certificates were droppedhard