Cybersecurity & Cryptography MCQ

Explanation

The CIA triad: Confidentiality (only authorized access), Integrity (data is accurate and unmodified), Availability (systems accessible when needed). All security controls map to one or more of these principles.

Explanation

Encryption protects data confidentiality. Symmetric encryption uses the same key for encrypt/decrypt. Asymmetric uses a public/private key pair. Decryption reverses the process with the correct key.

Explanation

Cryptographic hash functions (SHA-256, SHA-3) are one-way (no reversal), deterministic, and collision-resistant. Used for password storage, digital signatures, and data integrity checks.

Explanation

Symmetric (AES, ChaCha20): fast, same key both ways — key distribution is the challenge. Asymmetric (RSA, ECC): public key encrypts/verifies; private key decrypts/signs. TLS uses both: asymmetric for key exchange, symmetric for data.

Explanation

A digital signature: hash the message, encrypt with private key. Verifier decrypts with public key, compares hashes. Proves authenticity (from key owner) and integrity (message unchanged).

Explanation

X.509 certificates bind a public key to a domain/entity, signed by a trusted CA. Browsers trust the CA hierarchy. Used in TLS/HTTPS for server authentication.

Explanation

Phishing uses deceptive emails/sites mimicking legitimate ones. Spear phishing targets specific individuals/organizations. Protections: email authentication (SPF, DKIM, DMARC), user training, multi-factor authentication.

Explanation

2FA/MFA combines factors: knowledge (password), possession (TOTP app, hardware key), inherence (biometrics). Even if a password is stolen, attackers need the second factor.

Explanation

Firewalls enforce access control based on IP, port, protocol, and state. Packet filters, stateful inspection, and NGFWs (with DPI, application awareness) provide increasing sophistication.

Explanation

SQL injection: entering ' OR '1'='1 in a login form may yield SELECT * WHERE username='' OR '1'='1' — always true. Prevented by parameterized queries/prepared statements.

Explanation

XSS: stored (persisted in DB), reflected (in URL), or DOM-based. Attacker injects <script>document.cookie</script>. Prevented by output encoding, CSP headers, and input validation.

Explanation

VPNs encrypt traffic between client and VPN server, hiding content from ISPs and providing remote network access. Common protocols: OpenVPN, WireGuard, IKEv2/IPSec.

Explanation

Malware types: virus (attaches to programs), worm (self-replicates via networks), trojan (disguises as legitimate), ransomware (encrypts data for ransom), spyware (monitors activity), adware.

Explanation

Ransomware (WannaCry, Ryuk, Conti) encrypts data and demands cryptocurrency payment. Prevention: offline backups, patch management, EDR, network segmentation. Paying ransom is not guaranteed to restore data.

Explanation

Brute force is mitigated by: account lockouts, rate limiting, long random passwords, MFA, CAPTCHAs, and PBKDF2/bcrypt/Argon2 password hashing to slow offline attacks.

Explanation

DoS floods targets with traffic (SYN flood, HTTP flood, ICMP flood). DDoS uses many systems (botnets). Mitigations: rate limiting, anycast, scrubbing centers (Cloudflare, Akamai).

Explanation

Least privilege limits damage from compromised accounts. If an employee's account is hijacked, they can only access what that role requires. Apply to users, service accounts, and application permissions.

Explanation

Zero-day: vendor has had "zero days" to patch it. Exploits may be sold on dark web. Defense: defense-in-depth (assume breach), EDR/behavioral detection, network segmentation, microsegmentation.

Explanation

MITM: attacker intercepts traffic (ARP poisoning, rogue Wi-Fi, DNS spoofing) to eavesdrop or inject malicious content. TLS/HTTPS prevents MITM by authenticating the server via certificates.

Explanation

Port scanning (nmap) identifies open TCP/UDP ports and running services. Used by attackers for reconnaissance and by defenders for security audits. SYN scan (-sS) is stealthy; it sends SYN but no ACK.

Explanation

Authentication: "Are you who you claim to be?" (username/password, certificates, biometrics). Authorization: "Are you allowed to do this?" (RBAC, ACLs, policies). Both are required for access control.

Explanation

TLS certificates authenticate servers to clients. They contain: subject (domain), issuer (CA), public key, validity dates, and CA signature. Certificate chains link to trusted root CAs in the browser/OS trust store.

Explanation

Network segmentation limits blast radius: if one segment is compromised, attackers can't easily reach other segments. Zero trust goes further, requiring verification for every access request.

Explanation

Security audits review controls, configurations, access logs, policies, and compliance. Penetration tests actively simulate attacks. Vulnerability assessments scan for known weaknesses.

Explanation

HTTPS = HTTP over TLS. TLS provides: encryption (eavesdroppers can't read traffic), authentication (server cert validates identity), and integrity (MAC prevents tampering). Port 443 vs HTTP's 80.

Explanation

Without salt: identical passwords produce identical hashes (rainbow tables work). With salt: each password has a unique random salt prepended, making precomputed attacks infeasible. bcrypt/Argon2 handle salting automatically.

Explanation

Pen testing (ethical hacking) follows phases: recon, scanning, exploitation, post-exploitation, reporting. Black-box (no knowledge), white-box (full knowledge), gray-box (partial). Used for compliance and security validation.

Explanation

Certificate pinning prevents rogue CA attacks: even if an attacker has a CA-signed certificate, the app rejects it if it doesn't match the pinned hash. Challenges: certificate rotation requires app updates.

Explanation

Social engineering exploits human psychology: phishing, pretexting (fake identity), baiting (malicious USB drives), tailgating (physical access). Technical controls don't prevent human manipulation — training is key.

Explanation

Botnets (Mirai, Emotet) infect devices (PCs, IoT) with malware. The command-and-control (C2) server issues commands. Used for DDoS, spam, cryptomining, and data theft.

Explanation

Input validation: whitelist acceptable characters/formats, reject or sanitize others. Prevents SQL injection, XSS, command injection, and path traversal. Defense-in-depth: validate on both client and server.

Explanation

OWASP Top 10 (2021): Broken Access Control, Cryptographic Failures, Injection, Insecure Design, Security Misconfiguration, Vulnerable Components, Authentication Failures, SSRF, etc. Industry-standard reference.

Explanation

Vulnerability scanners (Nessus, OpenVAS, Qualys) check for known CVEs, misconfigurations, missing patches, and weak configurations. Not the same as penetration testing (which actively exploits).

Explanation

CVEs (mitre.org/cve) provide a standard way to reference vulnerabilities. CVE-2021-44228 is Log4Shell. CVSS scores rate severity (0-10). Vendors reference CVEs in security advisories.

Explanation

Encryption at rest (AES-256) protects data on disk if storage media is stolen. Full disk encryption (BitLocker, FileVault) or database-level encryption (TDE in SQL Server). Complement to encryption in transit (TLS).

Explanation

Encryption in transit (TLS) protects data moving between client and server from network eavesdroppers. Mandatory for all sensitive data. HSTS (HTTP Strict Transport Security) enforces HTTPS.

Explanation

Rootkits modify the OS to hide processes, files, and network connections from security tools. They operate at kernel level (kernel rootkit), hypervisor level (hyperjacking), or firmware level (hardest to remove).

Explanation

CSRF: victim's browser sends a forged request using their session cookies. Example: a hidden form on evil.com submits a bank transfer to bank.com using victim's session. CSRF tokens prevent this.

Explanation

Security through obscurity (hiding algorithms, source code) is not a standalone security measure. Kerckhoffs's principle: a system should be secure even if everything about it except the key is public.

Explanation

IDS detects and alerts; IPS (Intrusion Prevention System) also blocks. NIDS monitors network traffic; HIDS monitors host activity. Signature-based detection uses known attack patterns; anomaly-based detects deviations.

Explanation

AES (Rijndael, 2001 NIST standard) replaced DES. Block cipher with 128-bit blocks and 128/192/256-bit keys. Modes: CBC, CTR, GCM (AEAD). AES-NI hardware acceleration makes it fast on modern CPUs.

Explanation

TLS 1.3 removes MD5/SHA-1, RSA key exchange (no forward secrecy), CBC mode, and compression. Only ephemeral key exchanges (ECDHE/DHE) allowed. 1-RTT handshake (vs 2-RTT for 1.2) improves latency.

Explanation

PFS: each TLS session uses ephemeral DH/ECDH keys. If the server's private key is later compromised, past sessions cannot be decrypted. TLS 1.3 mandates PFS; TLS 1.2 made it optional.

Explanation

RSA (Rivest-Shamir-Adleman) relies on factoring n=p*q being hard. Used for key encapsulation and signatures. Disadvantages: slow (1000x slower than AES), key size (2048-4096 bits needed), vulnerable to quantum (Shor's algorithm).

Explanation

ECC provides the same security as RSA with far smaller keys: 256-bit ECC ≈ 3072-bit RSA. More efficient for TLS, mobile devices, and IoT. Used in ECDSA (signatures) and ECDH (key exchange).

Explanation

DH allows A and B to compute the same shared secret without transmitting it. An eavesdropper sees only public values. ECDH uses elliptic curves for efficiency. Used in TLS for session key establishment.

Explanation

Rainbow tables store hash:password chains. Fast lookup to crack unsalted hashes. Defeated by salting: each password has a unique random salt, making precomputed tables useless.

Explanation

HMAC(K, M) = H(K ⊕ opad || H(K ⊕ ipad || M)). It requires a shared secret key, providing both integrity and authentication. Used in JWT signatures (HS256), TLS, and API authentication.

Explanation

CAs (DigiCert, Let's Encrypt, Google Trust Services) sign certificates after verifying domain ownership (DV) or organization identity (OV/EV). Browsers/OSes include root CAs in trust stores.

Explanation

CRL (Certificate Revocation List): large, infrequently updated. OCSP (Online Certificate Status Protocol): real-time but adds latency. OCSP Stapling: server pre-fetches and caches OCSP response. Let's Encrypt 90-day certs make revocation less critical.

Explanation

OAuth 2.0 flows (Authorization Code, Client Credentials, Implicit, Device Code) issue access tokens. Applications use tokens to access APIs on behalf of users without knowing their password. PKCE prevents authorization code interception.

Explanation

OIDC adds authentication to OAuth 2.0. The ID token (JWT) contains claims about the user (sub, email, name). Used for SSO across applications (Google, Facebook login buttons use OIDC).

Explanation

JWT = base64url(header).base64url(payload).signature. Signed with HS256 (HMAC) or RS256 (RSA). Stateless: server verifies signature without session storage. Claims: iss, sub, exp, aud. Never store sensitive data in payload (it's not encrypted by default).

Explanation

SAML 2.0 enables enterprise SSO: the Identity Provider (IdP, e.g., Okta, Azure AD) authenticates users and sends signed XML assertions to Service Providers (SPs). Used in corporate environments alongside OIDC/OAuth 2.0.

Explanation

WAFs (Cloudflare WAF, AWS WAF, ModSecurity) inspect HTTP requests/responses for attack signatures and anomalies. They operate at Layer 7 and can block OWASP Top 10 attacks.

Explanation

Defense in depth: perimeter (firewall), network (IDS/segmentation), host (antivirus, hardening), application (WAF, SAST), data (encryption), and user (MFA, training). No single point of failure.

Explanation

Vulnerability (e.g., buffer overflow in sshd). Exploit: the code that triggers the overflow. Payload: what executes after exploitation (reverse shell, ransomware dropper). Metasploit separates exploit modules from payloads.

Explanation

Vertical privilege escalation: user→admin via sudo misconfiguration, SUID binaries, or kernel exploits. Horizontal: accessing other users' data. Least privilege minimizes escalation impact.

Explanation

SolarWinds, XZ Utils, npm malicious packages: attackers inject malicious code into legitimate software updates. Defenses: software bill of materials (SBOM), code signing, reproducible builds, third-party audits.

Explanation

SSRF: attacker controls a URL the server fetches (e.g., image URL). They set URL to http://169.254.169.254/metadata (AWS IMDSv1) to steal cloud credentials. Defense: validate URLs, block internal IP ranges, use IMDSv2.

Explanation

Path traversal (directory traversal): http://site.com/files?name=../../etc/passwd reads the password file. Prevented by canonicalizing paths and ensuring they stay within the web root.

Explanation

Cryptographic agility: abstracting crypto operations so algorithms can be replaced (SHA-1→SHA-2, RSA→ECC→CRYSTALS-Kyber for PQC). Systems without agility require major rewrites when algorithms are deprecated.

Explanation

WebAuthn (W3C) + CTAP2 = FIDO2. Uses device-bound private keys (no password server-side). Phishing-resistant: signatures are bound to the origin. Passkeys (synced credentials) extend this to multi-device use.

Explanation

Microsoft and Google report ~70% of critical CVEs are memory safety issues in C/C++. Memory-safe languages (Rust, Go, Swift) prevent these at compile time. NSA and CISA recommend memory-safe languages.

Explanation

Pentest: defined scope (web app, network), find and report vulns. Red team: adversary simulation — phishing, persistence, lateral movement, data exfiltration — testing people, processes, and technology holistically.

Explanation

SIEMs (Splunk, IBM QRadar, Elastic SIEM) collect logs from firewalls, IDS, endpoints, and cloud services. Correlation rules and machine learning detect anomalies and generate alerts for SOC analysts.

Explanation

A nonce (number used once) ensures that encrypting the same plaintext twice produces different ciphertext, and prevents attackers from replaying captured messages. Used in TLS handshakes, AES-GCM, and authentication protocols.

Explanation

Block ciphers (AES) process fixed-size blocks (e.g., 128 bits) and need a mode of operation (CBC, GCM, CTR). Stream ciphers (ChaCha20, RC4) generate a continuous keystream XORed with plaintext, suiting real-time data like video calls.

Explanation

MitB malware (e.g., banking trojans like Zeus) hooks browser APIs to alter form data or displayed content without the user noticing, even over a legitimate HTTPS connection, since the tampering happens after decryption on the endpoint.

Explanation

DNS cache poisoning corrupts a resolver's cache with fake records, redirecting users to attacker-controlled servers (often for phishing or malware delivery). DNSSEC mitigates this by cryptographically signing DNS responses.

Explanation

SRI uses an integrity attribute containing a base64-encoded hash (e.g., sha384-...). The browser computes the hash of the fetched file and refuses to execute it if it doesn't match, protecting against compromised CDNs.

Explanation

CSP lets servers declare an allowlist (e.g., script-src 'self' https://trusted.cdn.com). Browsers block any resource not matching the policy, significantly reducing the impact of injected scripts even if an XSS flaw exists.

Explanation

Credential stuffing leverages the fact that users often reuse passwords across services — attackers replay breached credential lists at scale using automation/bots. Defenses include MFA, breached-password checks, and rate limiting.

Explanation

KDFs apply many iterations (and, for Argon2, memory-hard computation) to slow down attackers performing offline guessing, especially with GPUs or ASICs. They are essential for securely storing passwords and deriving encryption keys from passphrases.

Explanation

Typosquatters register domains like "gooogle.com" or "paypa1.com" to capture mistyped traffic for phishing, ad fraud, or malware distribution. Brand owners often proactively register common misspellings to prevent abuse.

Explanation

NAT was designed for IP address conservation, but as a side effect it obscures internal network topology and prevents unsolicited inbound connections from reaching internal hosts directly — though it is not a substitute for a firewall.

Explanation

Code signing uses the publisher's private key to sign a hash of the executable; operating systems and package managers verify the signature with the publisher's certificate, blocking tampered or unsigned code (e.g., Windows SmartScreen, macOS Gatekeeper).

Explanation

A maturing SOC grows in two complementary directions: going deeper (vertical) by improving analytics, automation (SOAR), and threat-hunting on existing telemetry, and going wider (horizontal) by onboarding new data sources such as cloud, OT, or SaaS logs.

Explanation

An evil twin AP broadcasts the same name as a trusted network (e.g., "Airport_WiFi"). Victims who connect have their traffic routed through the attacker, enabling credential theft and MITM attacks. Mitigated by using VPNs and verifying network certificates.

Explanation

DNSSEC adds a chain of digital signatures (RRSIG records validated against DNSKEY/DS records up to the root) so resolvers can detect forged or altered responses, directly countering DNS cache-poisoning and spoofing attacks. Note it provides integrity and authenticity, not confidentiality — that is the role of DNS-over-HTTPS/TLS.

Explanation

Shor's algorithm breaks RSA/ECC. Grover's algorithm halves symmetric key security. NIST PQC standards (2024): CRYSTALS-Kyber (KEM), CRYSTALS-Dilithium, FALCON, SPHINCS+ (signatures) — based on lattices and hash trees.

Explanation

Meltdown: exploits out-of-order execution to read kernel memory from user space. Spectre: exploits branch prediction to leak data from other processes. Patches (KPTI, retpoline) have significant performance overhead.

Explanation

Timing attacks: comparing secret strings with == leaks length/value via timing differences. bcrypt uses constant-time comparison. RSA implementations must use constant-time modular exponentiation. TLS: padding oracle attacks exploit timing.

Explanation

DEP/NX marks pages non-executable. ROP reuses existing executable code. Attackers build "gadget chains" on the stack — small code sequences ending in RET. Combined with ASLR bypass (info leak), enables arbitrary code execution.

Explanation

KASLR randomizes kernel base at boot, making hardcoded addresses fail. But side-channel attacks (KASLR bypass via TLB timing, prefetch timing) can leak the kernel address, negating protection. SMEP/SMAP provide complementary defenses.

Explanation

Complete mediation (Saltzer-Schroeder): check every access, not just login. Cache invalidation attacks exploit cached authorization decisions. Reference monitors must be invoked for every access to enforced objects.

Explanation

TPM (ISO/IEC 11889) stores keys in hardware (can't be extracted by software). Used for: BitLocker (binds disk encryption to platform state), measured boot (PCR registers capture boot chain), remote attestation.

Explanation

Security by design (shift-left): threat modeling (STRIDE, PASTA), secure coding standards, secure defaults (deny by default, minimal permissions), review processes, and security requirements alongside functional requirements.

Explanation

CRYSTALS-Kyber/Dilithium are lattice-based. The Learning With Errors (LWE) problem is NP-hard under quantum computing models. No efficient quantum algorithm exists for LWE (unlike factoring/discrete log).

Explanation

HSMs (Thales Luna, AWS CloudHSM, YubiHSM) physically protect private keys. They perform signing and decryption inside the device. Even with root access to the server, keys cannot be extracted.

Explanation

ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) documents how adversaries operate: Initial Access (phishing), Execution, Persistence, Privilege Escalation, Lateral Movement, Exfiltration. Used by SOCs for detection coverage mapping.

Explanation

Even with encrypted memory, access patterns leak information (which blocks are accessed). ORAM shuffles and re-encrypts blocks on each access, hiding patterns. Used in secure enclaves (Intel SGX) and privacy-preserving computation.

Explanation

OCSP Stapling: server fetches its own OCSP response, signs it, and includes it in the TLS handshake. Client doesn't need to contact the CA (faster, private). Must-Staple extension enforces stapling to prevent soft-fail degradation.

Explanation

Confused deputy: the deputy has authority but uses it on behalf of an attacker without knowing. CSRF tricks the browser (which has the user's cookies) to send requests. SSRF makes the server (with internal access) fetch attacker-chosen URLs.

Explanation

MPC (Yao's garbled circuits, secret sharing, homomorphic encryption): parties compute f(x₁,x₂,...,xₙ) and learn only the output, not each other's inputs. Used in private set intersection, privacy-preserving ML, and threshold signatures.

Explanation

FHE (Fully Homomorphic Encryption — Gentry 2009) allows arbitrary computation on encrypted data. Cloud can process encrypted data without decryption. Still ~1 million times slower than plaintext computation. CKKS/BFV schemes in active deployment for privacy-preserving ML.

Explanation

CTI levels: strategic (executive risk), operational (campaign details), tactical (malware indicators). STIX/TAXII standards for sharing. CTI feeds enrich SIEM rules, firewall blocklists, and inform red team emulation (ATT&CK TTPs).

Explanation

Zero Trust (NIST SP 800-207): "never trust, always verify." Eliminates implicit trust based on network location. Requires: strong identity, device health checks, least-privilege access, micro-segmentation, and continuous monitoring.

Explanation

Differential privacy (Dwork 2006): f(D) and f(D') produce outputs within ε of each other where D and D' differ by one record. Apple (keyboard suggestions), Google (RAPPOR), and the US Census use DP to release statistics without revealing individuals.

Explanation

ZKPs satisfy completeness (a true statement convinces an honest verifier), soundness (a false statement cannot convince the verifier except with negligible probability), and zero-knowledge (the verifier learns nothing beyond validity). zk-SNARKs and zk-STARKs apply this to blockchains and private authentication.