NOCTI Cybersecurity Standard Certification Practice Exam

These questions are part of the practice quiz. Start practicing

• Which term best describes a weakness in a system that could be exploited by an attacker?
• What access control model assigns permissions based on an employee's role within the organization?
• Which type of malware spreads automatically over networks without user action?
• Which access control model restricts access to objects based on the identity of the subject and is considered the least restrictive?
• What term describes the files downloaded by security software to identify a computer virus?
• What security risks are associated with BYOD, and how can they be mitigated?
• Phishing attack targeting specific individuals is called what?
• What term describes the act of shutting down or misusing websites or computer networks?
• Which broad category uses measurements of a biological feature for authentication?
• What is the numerical label assigned to each device connected to a computer network or the internet called?
• Which framework is commonly used for threat modeling?
• Which cipher is used only one time and then discarded?
• How does asymmetric encryption differ from symmetric encryption?
• What is used to restrict a user's or group's ability to read, write, and execute files in an operating system?
• Which of the following is a principal PKI component?
• Why is baseline configuration important in cybersecurity?
• Which setting should be checked to diagnose why a hyperlink redirects to a malicious site?
• What best describes the difference between hashing and encryption?
• To prevent a hacker from gaining access to all of a user's accounts, you should:
• Outline the general steps in patch management.
• In backup planning, what describes a balanced backup approach?
• Which option describes keystroke dynamics as a biometric method?
• In a transposition cipher, what operation is performed on the letters of a message?
• What is the primary goal of patch management?
• Which statement best distinguishes an intrusion detection system (IDS) from an intrusion prevention system (IPS)?
• Which concept is used to describe the classification level of information that is not publicly exposed?
• Which technology category focuses on physical traits such as fingerprints and retinal scans?
• What governs ethical hacking and its practice?
• What term describes creating a bit-for-bit copy of data to ensure it is not changed during evidence collection?
• What is the difference between encryption at rest and encryption in transit?
• Which term describes a program that looks legitimate but is actually malicious and tricks users into running it?
• In incident response, what is the overall goal?
• Which biometric approach analyzes patterns in user behavior such as keystrokes, signatures, and voice?
• What is the purpose of a business continuity plan (BCP)?
• What is described as the best physical security option for critical systems?
• Define the CIA triad.
• Which cipher exchanges letters for symbols contained within grid fragments?
• The enforcement of laws and procedures is difficult due to emerging technologies; what term describes this reality?
• What action helps prevent a threat from spreading across a network when one machine is compromised?
• After an intrusion has occurred and the intruder has been removed, what is the next step?
• Which term describes data or systems being accessible to authorized users when needed without disruption?
• Which security feature is used to physically secure servers in data centers?
• What activity represents regular preventive maintenance for security software?
• In backup planning, including both full and incremental backups provides what benefit?
• Which security approach restricts access to a system to only approved items?
• Which Windows component stores the ports that are being used by the system?
• Which security issue involves a user clicking a hyperlink that leads to malware?
• What is the role of TLS in data security?
• What is an acceptable use policy (AUP) and its purpose?
• Which cipher technique rearranges the order of letters in a message?
• Which scenario involves having access to both ciphertext and its corresponding plaintext?
• Which measures are recommended to mitigate BYOD risks?
• Which term describes transforming readable data into an unreadable form that requires a key to restore?
• In cryptography, an attack occurs when the attacker has ciphertext and knows the plaintext. This is best described as which type of attack?
• Which term refers to the set of permissions that determine access to files?
• Which statement best describes data in transit security?
• Which security measure uses two or more authentication methods?
• Which technique hides data by making small invisible changes to characters or fonts?
• Which technology enables remote access with an encrypted tunnel to a corporate network and can obscure a user's location?
• Which of the following best defines RPO in a business continuity context?
• Which type of update typically corrects operating system problems and security vulnerabilities?
• What term means a violation of a company security policy?
• Phishing that targets a high-profile employee to obtain information is known as what?
• Which practice supports evidence gathering by recording incident handling information?
• Which statement about backups is most accurate for restoring data quickly?
• Which term describes an attack that floods a site with traffic to overwhelm it?
• The event of unauthorized access to data by exploiting a vulnerability is called a
• What is typically performed as one of the first steps after installing a new operating system?
• When a biometric device wrongly rejects a legitimate user, what is this error called?
• What is Public Key Infrastructure (PKI) and its main components?
• What is an access control list (ACL) and how is it used?
• Which broad category includes malware such as viruses, trojans, worms, and ransomware?
• Which technique hides information by embedding it in fonts or other media?
• What is the term for the number of positions to move when encrypting a message?
• Which statement best describes the zero-trust security model?
• Which technology allows remote users to access corporate applications and resources through a secure encrypted connection?
• Which practice involves identifying risks and ranking them with the most critical risks listed first?
• Which term describes restricting access to resources after authentication by applying policies?
• Which encryption category uses two keys, with one publicly shared and the other kept private?
• What term describes an attack where an attacker intercepts data transmitted between a client and a wireless access point?
• What is the difference between full backups and incremental backups?
• Which activity involves applying software updates and patches to reduce vulnerabilities and exposure to risk?
• Which action is an example of risk mitigation in an organization's cybersecurity strategy?
• Which term best describes a package of updates that includes multiple fixes and improvements for an OS?
• A violation of a company security policy is described as a
• Which risk management concept is primarily about taking no immediate action but acknowledging risk as a possibility and choosing to live with it?
• Which cryptographic method uses two keys, a public key and a private key?
• Which method describes shifting characters by a fixed amount?
• What best describes phishing and what controls help prevent it?
• What is the primary characteristic of the secure evidence container?
• Which security control allows access to a website for an individual or user group?
• Which of the following are best practices for symmetric key management?
• What is input validation and why is it critical in secure coding?
• Which Windows component stores information for which hardware exists on the system, used in ongoing operation?
• Which principle states that users should be granted only the minimal set of rights necessary to perform their job?
• Which copying method is emphasized to ensure the data is not changed during evidence gathering?
• Which protocol is commonly used to provide encryption in transit for remote access, aside from TLS?
• What is the purpose of a digital certificate in public key cryptography?
• Which access-control device physically traps a trespasser between two locked doors?
• Which category of MFA is represented by biometrics such as fingerprints?
• Name a widely adopted symmetric encryption algorithm.
• In digital forensics, what is the first step in preserving the data on the computer's hard drive?
• What are the core phases of incident response?
• Which term describes a backdoor created by a malicious program that deceives users?
• Which term describes making the decision to accept the risk and not take further action to mitigate it?
• If a hash digest changes after transmission, what does this indicate?
• Which Windows component contains profiles for each user, installed applications, and the types of documents each can create?
• Which are common MFA factor categories and examples?
• What is the process of verifying the identity of a user called?
• Which term refers to the records that show when, where, and by whom evidence was collected?
• What term describes an investigator with the training and experience to properly analyze sensitive evidence?
• Which protocol is commonly used to provide encryption in transit for remote access?
• Which term describes deciding not to take actions to mitigate a risk, effectively delaying remedy?
• What is the purpose of a certificate revocation list (CRL) in PKI?
• The authentication method based on physiological measurement is called what?
• Which type of software detects, blocks, and removes viruses, spam and spyware to protect the computer from risks associated with unwanted emails and other attacks?
• Which security property ensures data remains accurate and complete and is not altered improperly?
• Which phase comes after Detection and Analysis and before Eradication and Recovery?
• Which term describes unauthorized viewing of a display to gain information?
• Which term describes enforcing access rights after authentication?
• Which set of activities includes procedure development, evidence assessment, evidence acquisition, evidence examination, documenting, and reporting?
• AAA stands for in identity and access management?
• Which defense is described as preventing an ICMP flood DDoS attack by blocking ping requests?
• Which CIA triad property ensures data integrity by preventing modification without authorization?
• Which device enforces security rules between networks?
• Which type of encryption uses the same key for both encryption and decryption?
• What process involves reviewing computer-generated event logs to proactively identify bugs, security threats, or other risks?
• Which cipher is regarded as the oldest and simplest form of substitution?
• Which set of measures reduces risk in Wi-Fi networks?
• Which term describes the fraudulent practice of sending email claiming to be from reputable companies in order to induce people to reveal personal information?
• Which Windows component also lists what hardware exists on the system?
• What term refers to the place where evidence collected by investigators is stored and kept confidential?
• What term describes an exploit that is discovered or used before the software maker knows about it and before a patch is available?
• What is a VPN and what security benefit does it provide?
• Which attack method shuts down a website by flooding it with traffic from multiple sources?
• Which security control restricts access to a website for a specific user group?
• What does the CIA triad stand for?
• What is the process of enforcing policies after the user has been authenticated?
• Which sequence correctly represents the general steps in patch management?
• What best describes a digital signature and how it verifies authenticity?
• Which system is described as creating log files that can be used to detect breaches?
• Which term best describes the broad category that encompasses malicious software designed to harm or exploit computer systems?
• Badges and smart cards are commonly used for which function?
• What is produced when plaintext is transformed by encryption using a key?
• In a cloud environment, which portion is typically handled by the customer in the shared responsibility model?
• How do RBAC and ABAC differ in granting access?
• Which action should be prioritized after installing a new OS to improve security?
• Which term describes the general concept of intercepting communication between two parties to monitor or alter data?
• Which file extension is associated with executable programs and increases risk of exploitation?
• Which phishing activity targets a high-profile executive to obtain information?
• Who is described as responsible for documenting any activity on the computer or components to prevent alteration of digital evidence, and who should take photographs?
• Which term means integrating all three concepts of confidentiality, integrity, and availability into security planning?
• Which authentication approach enables access to multiple network resources with one login?
• What does data classification involve?
• Which technique compares passwords against a list of words and their hash values?
• What term describes a mathematical function that creates a value from data to verify its integrity?
• What is the purpose of testing patches on one computer before updating the entire network?
• Which phishing technique is directed at a specific individual?
• Which recognition method specifically uses iris and retinal patterns?
• In ABAC, which elements are used to determine access?
• What term describes passwords that use uppercase and lowercase letters, numbers, and symbols?
• Which term describes a highly skilled attacker using multiple vectors to achieve objectives?
• Which statement best reflects the principle of least privilege?
• Which identification technology is most closely linked to iris patterns and retinal recognition?
• What is the term for the database of known malware patterns used by antivirus software?
• In the context of incident response preparation, which statement is true?
• Which practice involves communicating incident handling and the response process and is also an important part of evidence gathering?
• Which attack involves the attacker generating a chosen plaintext and obtaining the corresponding ciphertext under the same key?
• What is the purpose of an incident response playbook?
• What is the act of closely following an authorized person into a secure area called?
• Which security label is commonly used by government agencies to designate the sensitivity of information?
• What is Data Loss Prevention (DLP) and its goal?
• What can firmware updates cause to reset in a device such as a router?
• What is the primary objective of cybersecurity in terms of the CIA triad?
• Which term refers to maintaining data availability by replicating data across multiple storage locations, including cloud storage?
• How should host systems and servers be treated according to policy?
• If access decisions are made based on the user's specific identity, rather than their role, which model is in use?
• In cryptography, which cipher type maps each letter to a fixed different letter?
• Which action helps mitigate exploits by limiting running services on a computer?
• Define malware and give two examples.
• Why is multi-factor authentication (MFA) more secure than passwords alone?
• Which term describes the malware that blocks access to data until a ransom is paid?
• Which concept describes having multiple copies of data across different storage solutions, including cloud storage, to improve data availability?
• Which term describes data that has not been altered in an unauthorized way and remains trustworthy?
• Which statement is true about threats?
• The term used to describe a flaw in software or hardware that could be exploited to breach security is:
• Which type of malware is designed to block access to a computer system until a sum of money is paid?
• Which action is described as the important first step in digital forensics to ensure that data is not changed?
• What is incident escalation and why is it necessary?
• If a computer appears to be infected, which step should you take first?
• Which option best describes the device that physically enforces a barrier with two locked doors to block unauthorized access?
• Which statement best distinguishes threat, vulnerability, and risk?
• Which security property ensures information and systems are accessible to authorized users when needed?
• In digital signatures, which key is used to verify the signature's authenticity?
• What term describes a form of cyber attack that steals classified, sensitive data or intellectual property to gain an advantage?
• Which action addresses a specific vulnerability or bug in a software program?
• What elements should be included in a strong password policy?
• Which term describes a long-term, targeted cyber threat?
• What is a disaster recovery plan (DRP) and its main goal?
• Which action best enforces containment by isolating a malware-infected host to prevent spread?
• Define SQL injection and how to defend against it.
• What is the primary function of a firewall in network security?
• What is the practice of creating secure messages?
• Which technique is used to create an exact copy of the entire storage media for forensic analysis?
• Which encryption method is noted for protecting credit card numbers in transit?
• Which statement best defines RTO?
• In the context of log analysis, which element helps describe the impact of an attack?
• What is the term for ordinary readable text before it is encrypted?
• A security flaw, glitch or weakness found in an application or operating system is called a:
• What is the general term for converting plain text into coded symbols to prevent unauthorized access?
• Which type of malware executes destructive actions when the user opens or accesses it?
• What is the purpose of a secure Software Development Lifecycle (SDLC) model?
• What is network segmentation and why is it used?
• Which term describes attacker movement within a network after initial access?
• Which term describes the process of analyzing log data to determine when a security incident began, who initiated it, the sequence of actions, and the resulting business impact?
• In cloud security, what does the shared responsibility model describe?
• Which term refers to the one-way function used to substantiate digital evidence?
• What is a patch in software maintenance?
• Define cross-site scripting (XSS) and a common mitigation.
• What term describes when a hacker successfully exploits a vulnerability to gain access to files on a computer or network?
• Why is patch management a critical security control?
• Which cipher uses a grid-based system to substitute letters with symbol fragments?
• What is SIEM and what are its core functions?