Web Application Security (1-10)
What is the primary purpose of input validation in web apps?
a) Improve UI
b) Prevent injection attacks
c) Speed up loading
d) Encrypt data
Answer: b
Which vulnerability allows attackers to inject malicious scripts into web pages?
a) SQL Injection
b) Cross-Site Scripting (XSS)
c) CSRF
d) Clickjacking
Answer: b
What does HTTPS stand for?
a) HyperText Transfer Protocol Secure
b) HyperText Transfer Protocol Service
c) Hyper Transfer Text Secure
d) Hyper Transfer Protocol Security
Answer: a
Which HTTP header helps protect against clickjacking?
a) X-Frame-Options
b) Content-Type
c) Authorization
d) Cache-Control
Answer: a
What attack exploits vulnerabilities in web sessions to impersonate a user?
a) CSRF
b) Session Hijacking
c) Phishing
d) Brute Force
Answer: b
What security mechanism prevents unauthorized commands from being executed in a web
session?
a) CAPTCHA
b) CSRF Tokens
c) VPN
d) Firewall
Answer: b
What is SQL Injection?
a) Inserting SQL commands to manipulate databases
b) Sending spam emails
c) Stealing cookies
d) Password guessing
Answer: a
What does Content Security Policy (CSP) help prevent?
a) Data encryption
b) XSS attacks
c) Data loss
d) Network sniffing
Answer: b
Which protocol is commonly used for secure login authentication?
a) FTP
b) LDAP
c) OAuth
d) SMTP
Answer: c
What does Cross-Site Request Forgery (CSRF) exploit?
a) User trust in the site
b) Server misconfiguration
c) Weak encryption
d) Network vulnerabilities
Answer: a
Mobile Application Security (11-20)
Which is a common mobile app security risk?
a) Unsecured Wi-Fi
b) Malware apps
c) Weak app permissions
d) All of the above
Answer: d
What is the principle of least privilege?
a) Granting apps minimal necessary permissions
b) Allowing full access to apps
c) Disabling app updates
d) Encrypting data only on servers
Answer: a
Which technique protects data stored on mobile devices?
a) Data encryption
b) Port scanning
c) SQL injection
d) IP spoofing
Answer: a
Which platform feature can restrict app permissions?
a) Sandboxing
b) Firewall
c) Proxy
d) VPN
Answer: a
What does Mobile Device Management (MDM) primarily do?
a) Manage mobile apps and security policies
b) Monitor network traffic
c) Encrypt emails
d) Perform backups
Answer: a
What can happen if an app requests excessive permissions?
a) Increased risk of data leakage
b) Faster app performance
c) Reduced battery use
d) Better UI experience
Answer: a
Which method is used to authenticate mobile apps?
a) Biometric verification
b) Password only
c) IP address filtering
d) VPN tunneling
Answer: a
What is “jailbreaking” in mobile security?
a) Removing OS restrictions to install unauthorized apps
b) Encrypting data
c) Upgrading OS securely
d) Factory resetting device
Answer: a
What is a common attack targeting mobile apps?
a) Man-in-the-middle
b) Port scanning
c) Brute force
d) ARP spoofing
Answer: a
What is two-factor authentication (2FA)?
a) Two passwords
b) Password plus additional verification method
c) Single password
d) Biometric only
Answer: b
Network Security (21-30)
What is the purpose of a firewall?
a) Filter network traffic
b) Encrypt files
c) Backup data
d) Scan for malware
Answer: a
What does VPN stand for?
a) Virtual Private Network
b) Variable Protocol Network
c) Virtual Public Network
d) Verified Private Network
Answer: a
Which protocol encrypts email communication?
a) SMTP
b) IMAP
c) PGP
d) FTP
Answer: c
What is a common network attack where data is intercepted?
a) Phishing
b) Man-in-the-middle
c) DDoS
d) Ransomware
Answer: b
What does IDS stand for?
a) Intrusion Detection System
b) Internal Data Server
c) Internet Defense Service
d) Intrusion Deployment Software
Answer: a
Which port is commonly used for HTTPS?
a) 21
b) 443
c) 80
d) 22
Answer: b
What is ARP spoofing?
a) Fake IP address mapping to intercept traffic
b) Malware injection
c) DNS poisoning
d) Email phishing
Answer: a
Which device connects multiple network segments?
a) Router
b) Switch
c) Hub
d) Firewall
Answer: b
What does DDoS stand for?
a) Distributed Denial of Service
b) Dynamic Data of Service
c) Digital Denial on Server
d) Distributed Data of System
Answer: a
Which is an effective way to secure wireless networks?
a) Use WEP encryption
b) Use WPA3 encryption
c) Disable passwords
d) Use open Wi-Fi
Answer: b
DevOps Security (31-40)
What does "shift-left" security mean?
a) Integrate security early in development
b) Test after deployment
c) Outsource security
d) Focus on network security only
Answer: a
What tool automates builds and testing in DevOps?
a) Jenkins
b) Wireshark
c) Nmap
d) Metasploit
Answer: a
What is Infrastructure as Code (IaC)?
a) Managing infrastructure using code
b) Writing application code only
c) Manual server setup
d) Hardware coding
Answer: a
Which security practice involves scanning code for vulnerabilities?
a) Static Application Security Testing (SAST)
b) Penetration testing
c) Firewall configuration
d) Code formatting
Answer: a
What does CI/CD stand for?
a) Continuous Integration / Continuous Deployment
b) Code Integration / Code Deployment
c) Continuous Internet / Continuous Data
d) Code Inspection / Code Development
Answer: a
What is a container in DevOps?
a) Lightweight, portable executable package
b) Physical server
c) Network device
d) Programming language
Answer: a
Which platform is widely used for container orchestration?
a) Kubernetes
b) Docker
c) Jenkins
d) GitHub
Answer: a
What is a secret in DevOps?
a) Sensitive data like API keys or passwords
b) Hidden code
c) Malware
d) Encrypted file
Answer: a
What is a common security risk with CI/CD pipelines?
a) Storing secrets in code repositories
b) Slow builds
c) High bandwidth use
d) Low test coverage
Answer: a
Which practice improves security by automatically testing apps during development?
a) Automated security testing
b) Manual penetration testing
c) Firewall installation
d) Data encryption
Answer: a
Cloud Security (41-50)
What is the Shared Responsibility Model?
a) Division of security duties between cloud provider and customer
b) Outsourcing all security to cloud provider
c) Customer is solely responsible for security
d) Cloud provider handles backups only
Answer: a
Which is a common cloud security risk?
a) Data breaches due to misconfiguration
b) Hardware failure
c) Slow network speeds
d) Application bugs
Answer: a
What does CASB stand for?
a) Cloud Access Security Broker
b) Cloud Automated Security Backup
c) Cloud Access Security Base
d) Cloud Application Security Bot
Answer: a
What is multi-factor authentication (MFA)?
a) More than one method to verify user identity
b) Single password login
c) Biometric only
d) Password and username only
Answer: a
What is encryption at rest?
a) Encrypting stored data
b) Encrypting data in transit
c) Encrypting live video
d) Encrypting backups only
Answer: a
What does SaaS stand for?
a) Software as a Service
b) Security as a Service
c) Storage as a Service
d) Software and Security
Answer: a
Which cloud deployment model is owned by a single organization?
a) Public cloud
b) Private cloud
c) Hybrid cloud
d) Community cloud
Answer: b
What does DLP stand for in cloud security?
a) Data Loss Prevention
b) Data Logging Process
c) Digital Layer Protection
d) Data Leak Protocol
Answer: a
What is a benefit of cloud security monitoring?
a) Detect threats in real-time
b) Backup files automatically
c) Reduce cloud costs
d) Increase internet speed
Answer: a
What is the main function of Identity and Access Management (IAM) in cloud?
a) Control user access and permissions
b) Monitor network traffic
c) Encrypt data
d) Backup user data
Answer: a
Let me know if you want the answers in a separate file or want me to create explanations for
these!
