Unlock hundreds more features
Save your Quiz to the Dashboard
View and Export Results
Use AI to Create Quizzes and Analyse Results

OR
Sign inSign in with Facebook
Sign inSign in with Google
Quizzes > Computers & IT

Cyber Security Test: Fundamentals of 2FA, Phishing, and More

Quick, free security fundamentals practice test with instant results.

Editorial: Review CompletedCreated By: Carson CoeUpdated Aug 25, 2025
Difficulty: Moderate
2-5mins
Learning OutcomesCheat Sheet
Paper art shield padlock documents symbolize confidentiality integrity availability cybersecurity quiz on teal background

This cybersecurity fundamentals quiz helps you check your understanding of confidentiality, integrity, and availability, plus 2FA and phishing. Get instant results, see which topics need work, and build safer habits. Next, try our cybersecurity basics quiz, take a cyber security awareness quiz, or drill with a cybersecurity certification practice quiz.

Which of the following best describes the principle of confidentiality in information security?
Maintaining data accuracy and consistency
Ensuring data is accessible only to authorized users
Ensuring systems are available when needed
Tracking user activity across networks
Confidentiality ensures that sensitive information is only accessible to authorized individuals and is protected from unauthorized disclosure. It is one of the three pillars of the CIA triad, alongside integrity and availability. Techniques such as access controls and encryption are commonly employed to preserve confidentiality. For more details, see .
In the context of the CIA triad, what does availability ensure?
That systems and data are accessible when needed
That data is encrypted at rest
That data accuracy is maintained over its lifecycle
That users are properly authenticated
Availability ensures that authorized users can access systems and data when required, preventing downtime or interruptions. High availability architectures, redundancy, and regular backups are common methods to achieve this. Without availability, critical services can be disrupted, affecting business operations. Learn more at .
Which of the following best defines integrity in information security?
Restricting data access to authorized users
Encrypting data during transmission
Ensuring data is accurate and has not been tampered with
Keeping systems running continuously
Integrity refers to the protection of information from unauthorized modification or deletion, ensuring that data remains accurate and reliable. Mechanisms like checksums, digital signatures, and hashing help detect and prevent tampering. Maintaining integrity is crucial for trust in systems and data. See for more information.
What does two-factor authentication (2FA) require from a user?
Password and username entered twice
Two distinct forms of verification from different categories
Two users to authenticate each session
Two separate passwords for the same account
Two-factor authentication requires a user to provide two distinct types of credentials, typically something they know (e.g., password) and something they have (e.g., a token or mobile device). This adds an extra layer of security beyond single-factor methods. Implementing 2FA significantly reduces the risk of unauthorized access. More details at .
Which device monitors and filters network traffic based on predefined security rules?
Load balancer
Switch
Firewall
Bridge
A firewall inspects incoming and outgoing network traffic and permits or blocks it based on specified security policies. It acts as a barrier between trusted internal networks and untrusted external networks. Firewalls can be implemented as hardware, software, or a combination of both. Learn more at .
What term describes malicious software designed to harm, exploit, or disrupt systems?
Middleware
Malware
Protocol
Firmware
Malware is any software intentionally created to perform malicious actions, such as stealing data, disrupting services, or spying on users. Common types include viruses, worms, trojans, ransomware, and spyware. Protecting systems with antivirus and anti-malware solutions helps mitigate these threats. For further details, see .
Which security principle limits user or process permissions to the bare minimum needed to perform a task?
Principle of least privilege
Separation of duties
Principle of complete mediation
Need-to-know principle
The principle of least privilege ensures that users and processes are granted only the access necessary to complete their tasks, reducing the potential attack surface. This minimizes unintended or malicious actions by limiting permissions. It is a foundational element of secure system design. Additional information at .
What is the primary purpose of encryption in cybersecurity?
To protect the confidentiality of data
To generate system backups
To authenticate user identities
To optimize network performance
Encryption transforms data into an unreadable format for unauthorized parties, ensuring confidentiality during storage or transmission. Only those with the correct decryption key can restore the original content. While encryption can support other security functions, its primary goal is to maintain data secrecy. Learn more at .
What characterizes a brute-force attack?
Exploiting a vulnerability to run arbitrary code
Intercepting and redirecting network traffic
Systematically trying every possible combination of credentials
Injecting malicious scripts into web pages
In a brute-force attack, an attacker attempts every possible combination of keys or passwords until the correct one is found. This method is computationally intensive but can be effective against weak or short passwords. Countermeasures include strong password policies and account lockout mechanisms. More details at .
What is the primary purpose of adding a 'salt' to a password hash?
To replace the need for a secure password
To defend against precomputed rainbow table attacks
To accelerate the hashing process
To allow hash values to be publicly shared
A salt is random data added to a password before hashing to ensure that identical passwords result in different hashes. This technique prevents attackers from using precomputed rainbow tables to reverse hashes into passwords. Each user's salt must be unique and stored securely alongside the hash. See .
Which statement best describes the difference between symmetric and asymmetric encryption?
Symmetric is always slower than asymmetric
Symmetric uses a single shared key, while asymmetric uses a public/private key pair
Symmetric requires certificates, asymmetric does not
Asymmetric uses the same key for encryption and decryption
Symmetric encryption uses one secret key for both encryption and decryption, making it computationally efficient but requiring secure key distribution. Asymmetric encryption uses a pair of keys - a public key for encryption and a private key for decryption - eliminating the need to share the private key. Both types serve different purposes in a secure communication framework. For more, visit .
What is DNS cache poisoning?
Injecting malicious scripts via DNS queries
Encrypting DNS traffic to prevent eavesdropping
Hijacking domain registrar accounts
Manipulating DNS resolver cache to redirect users to malicious sites
DNS cache poisoning involves corrupting the DNS resolver's cache so that it returns incorrect IP addresses, redirecting users to fraudulent or malicious websites. Attackers exploit this to intercept sensitive data or distribute malware. Techniques like DNSSEC help protect against such attacks by providing data origin authentication and integrity. Learn more at .
In network security, what does DMZ stand for and what is its purpose?
Dynamic Management Zone, for real-time traffic analysis
Direct Messaging Zone, to enable secure chat
Data Mirroring Zone, for backup synchronization
Demilitarized Zone, to isolate external-facing services from the internal network
A Demilitarized Zone (DMZ) is a network segment that hosts external-facing services, such as web or email servers, separated from the internal network by firewalls. It minimizes the risk to internal systems by isolating services that are exposed to the internet. Proper configuration ensures attackers cannot easily move from the DMZ to internal resources. See .
What security features does SSL/TLS provide for web communications?
Confidentiality, integrity, and authentication of data in transit
File integrity monitoring
User role management and permissions
Network segmentation and VLAN isolation
SSL/TLS protocols establish encrypted links between a client and server, ensuring confidentiality by encrypting data, integrity by using message authentication codes, and authentication typically via digital certificates. This secures sensitive information like credentials and financial data during transmission. SSL is the predecessor to TLS, which is the modern standard. More details at .
What is an SQL injection attack?
Injecting scripts into web pages to execute on clients
Inserting malicious SQL statements into input fields to manipulate a database
Manipulating DNS records via SQL commands
Using SQL to encrypt database backups
SQL injection occurs when an attacker inserts or manipulates SQL queries in an application's input fields, allowing unauthorized access to or manipulation of the database. This can lead to data theft, corruption, or privilege escalation. Preventive measures include parameterized queries and input validation. See .
What is the principle of separation of duties in cybersecurity?
Segmenting network traffic by application type
Using multiple authentication methods for the same user
Ensuring no single individual has control over all phases of a critical process
Storing backups in different physical locations
Separation of duties is a security principle that divides critical tasks among multiple people to reduce the risk of fraud or error. By requiring two or more individuals to complete a process, organizations can prevent unauthorized actions or concealment of malicious activity. This is commonly applied in financial systems and access controls. More information at .
What is a Public Key Infrastructure (PKI)?
A protocol for secure file transfer
A framework for creating, distributing, and managing digital certificates and public keys
A hardware firewall configuration standard
A system for real-time network intrusion detection
Public Key Infrastructure provides the policies, roles, and procedures needed to create, manage, distribute, and revoke digital certificates. It enables secure exchange of information over networks by binding public keys to entities. Components include Certificate Authorities (CAs), Registration Authorities (RAs), and digital certificates. For further reading, see .
How does a man-in-the-middle attack operate?
The attacker exploits SQL vulnerabilities to access a database
The attacker sends phishing emails to gather credentials
The attacker floods a network with excessive traffic to disrupt services
The attacker intercepts and possibly alters communication between two parties without their knowledge
In a man-in-the-middle attack, the adversary positions themselves between two communicating parties to eavesdrop or manipulate data in transit. This can compromise confidentiality and integrity of the exchanged information. Encryption and mutual authentication help mitigate such threats. More details at .
What does perfect forward secrecy provide in secure communications?
Compromise of long-term keys does not compromise past session keys
Automatic renewal of digital certificates before expiration
Unconditional protection against quantum attacks
Guaranteed delivery of messages in order
Perfect forward secrecy ensures that each session uses a unique session key that is not derived from long-term private keys. Even if an attacker later obtains the server's private key, they cannot decrypt past communications. Protocols like TLS can be configured to support forward secrecy using ephemeral key exchanges. See .
What security threat is mitigated by using rainbow table salts in password hashing?
Precomputed hash attacks that reverse password hashes
Session hijacking over insecure networks
Denial of service by flooding login requests
Injections attacks on web forms
Salting passwords adds unique random data to each password before hashing, preventing attackers from using precomputed rainbow tables to reverse hashes into plaintext passwords. Without salts, identical passwords share the same hash value, making mass cracking easier. Salting combined with strong hash functions greatly increases attack complexity. More at .
What describes a cross-site scripting (XSS) attack?
Sending unauthorized cross-domain API requests
Tampering with cross-site cookies via network sniffing
Injecting malicious scripts into webpages viewed by other users
Redirecting users to external domains without consent
Cross-site scripting (XSS) attacks involve injecting client-side scripts into webpages that execute in other users' browsers. This can lead to session hijacking, defacement, or redirection to malicious sites. Proper input validation and context-aware escaping are effective defenses. See .
What is the core principle of a zero trust security model?
Trust all devices on the internal network
Use a single perimeter defense to protect resources
Authenticate users only once per session
Never trust any user or device by default; always verify
Zero trust security is a model that assumes no implicit trust for any user or device, regardless of location, and requires continuous verification of identities and device health. Access to resources is granted based on dynamic policies, context, and least privilege. This approach helps mitigate lateral movement within networks. Learn more at .
Which vulnerability affects the basic Diffie-Hellman key exchange if not combined with authentication?
It is susceptible to man-in-the-middle attacks
It leaks private keys through timing channels
It cannot generate forward secrecy
It requires quantum-resistant algorithms
Without proper authentication mechanisms, Diffie-Hellman key exchange is vulnerable to man-in-the-middle attacks, where an attacker intercepts and relays key exchange messages. Both parties believe they share keys directly, while the attacker can decrypt and re-encrypt messages. Combining Diffie-Hellman with certificates or digital signatures mitigates this risk. For details, see .
What is a principal advantage of elliptic curve cryptography (ECC) compared to RSA?
Provides equivalent security with smaller key sizes
Automatically generates digital certificates
Is immune to side-channel attacks
Does not require complex mathematical operations
Elliptic curve cryptography achieves strong security with significantly smaller key sizes compared to RSA, which results in faster computations and reduced storage requirements. This makes ECC ideal for resource-constrained environments like mobile devices. However, ECC still relies on complex mathematics and must be implemented correctly to avoid vulnerabilities. More information at .
What defines a side-channel attack against cryptographic implementations?
Intercepting keys during key exchange over a network
Manipulating cipher algorithms through software vulnerabilities
Exploiting physical information leakages like timing or power consumption
Brute-forcing encryption keys via exhaustive search
Side-channel attacks exploit unintentional physical leakages - such as timing information, power consumption, or electromagnetic emissions - from cryptographic operations to derive secret keys. These attacks do not target the mathematical strength of the algorithm but its implementation. Countermeasures include constant-time algorithms and hardware shielding. See .
0
{"name":"Which of the following best describes the principle of confidentiality in information security?", "url":"https://www.quiz-maker.com/QPREVIEW","txt":"Which of the following best describes the principle of confidentiality in information security?, In the context of the CIA triad, what does availability ensure?, Which of the following best defines integrity in information security?","img":"https://www.quiz-maker.com/3012/images/ogquiz.png"}

Study Outcomes

  1. Understand the CIA Triad -

    Grasp the core principles of confidentiality, integrity, and availability to build a solid foundation in cybersecurity fundamentals.

  2. Identify Common Threats -

    Recognize typical security risks and vulnerabilities tested in cyber security fundamentals test answers army scenarios to improve defensive strategies.

  3. Apply Security Best Practices -

    Implement key measures for protecting data and systems by applying insights gained from our cybersecurity fundamentals quiz and practice test questions.

  4. Analyze Incident Responses -

    Assess and select appropriate actions for simulated security incidents to sharpen your analytical skills and readiness for real-world scenarios.

  5. Evaluate Personal Strengths -

    Receive instant feedback on your answers to pinpoint areas of mastery and those needing improvement across Sections 1, 5, and 6.

Cheat Sheet

  1. The CIA Triad -

    Understand confidentiality, integrity, and availability as the core of any cyber security fundamentals quiz; use the "CIA" mnemonic to lock in these pillars. Confidentiality means restricting data access, integrity ensures information stays unaltered, and availability guarantees systems are online when needed (NIST SP 800-12). Mastering this triad is key to tackling cyber security fundamentals test answers army and related cybersecurity basics test questions.

  2. Encryption Methods -

    Differentiate symmetric (AES) from asymmetric (RSA) encryption: symmetric uses one shared key, while asymmetric relies on public/private key pairs (IEEE Transactions on Information Forensics). A handy trick is remembering "same key" for symmetric and "split key" for asymmetric. Solid grasp of these methods boosts your performance on any cyber security fundamentals practice test.

  3. Authentication vs. Authorization -

    Authentication verifies identity (username/password, biometrics), whereas authorization grants permission (role-based access control). Think "AuthENticates you, AuthORizes you" to keep them straight (OWASP Top 10). Clear differentiation helps you ace cybersecurity fundamentals questions on access control scenarios.

  4. Common Threat Types -

    Review malware (viruses, ransomware) and social engineering (phishing, spear phishing) as prevalent attack vectors; remember the SANS "Know Your Enemy" framework for detailed classifications. For example, ransomware encrypts your files until payment, while phishing tricks users via deceptive emails. Recognizing these threats is crucial for your cyber security fundamentals practice test readiness.

  5. Risk Management & Assessment -

    Calculate risk using the formula Risk = Likelihood × Impact and prioritize vulnerabilities accordingly (ISO/IEC 27005). Conduct regular vulnerability scans and use a risk matrix to visualize high-risk areas. Mastering risk management principles is a must for both the cybersecurity basics test and cyber security fundamentals quiz.

Make a Quiz (FREE) Copy & Edit This Quiz Create a Quiz with AI

Computers & IT Quizzes

Powered by: Quiz Maker