A hospital installs high-powered machines to manage patient records, imaging, and authentication for thousands of users. These machines provide services to all connected devices. What type of computer are they using?
An architect uses a machine for 3D modeling, design work, and email. It is designed for one person to use at a time. What type of computer is this?
A delivery driver relies on a smartphone app to track packages and communicate with the central office. What type of computer is the smartphone?
A factory machine automatically fills bottles with liquid. The controller in the machine runs only the specialized program needed to control the filling process. What type of computer is this?
An employee downloads an attachment that looks like a report, but when they open it, their system becomes infected. What type of malware is this?
A malicious program spreads automatically across a network without any user clicking or opening a file. What type of malware is this?
A user installs a free game, not realizing it contains hidden code that lets an adversary remotely access their computer. What type of malware is this?
A business finds its files encrypted and a message demanding payment for a decryption key. What type of malware is this?
An adversary secretly installs software that records every keystroke a user makes, including passwords. What type of malware is this?
A malicious program is hidden in system processes and is almost impossible to detect because it operates at the operating system level. What type of malware is this?
An organization discovers malware that never writes files to disk but instead lives only in system memory. What type of malware is this?
A company fails to install a security update. An attacker uses the unpatched software flaw to take over the system and steal files. Which vulnerability was exploited?
An attacker guesses an employee’s weak password and gains access to company resources. Which vulnerability was exploited?
An adversary boots a stolen laptop into recovery mode and bypasses user logins because no BIOS password was set. Which vulnerability was exploited?
An employee plugs in a USB drive that automatically launches malware without clicking anything. Which vulnerability was exploited?
An attacker connects to an unsecured network service on a computer that was not protected. Which vulnerability was exploited?
A device’s firewall is disabled, allowing malicious packets to flood in and disrupt the system. Which vulnerability was exploited?
A computer without anti-malware software becomes infected when a malicious email attachment is opened. Which vulnerability was exploited?
A hospital’s patient database is encrypted by ransomware, preventing staff from accessing medical records. What level of risk does this represent?
An email server has not been updated with the latest patch, leaving it vulnerable to a critical exploit. What level of risk does this represent?
A water treatment facility uses systems with username/password access but does not require multifactor authentication. What level of risk does this represent?
An employee’s personal laptop has Telnet port 23 open. If exploited, the impact would be minimal. What level of risk does this represent?
A bank requires employees to log in using both a password and a fingerprint scan. What type of authentication is this?
A user logs in to their email by entering a PIN they created. What type of authentication factor is this?
An employee swipes an access card to enter a secure server room. What type of authentication factor is this?
A company uses facial recognition software to allow access to workstations. What type of authentication factor is this?
A financial service blocks logins from outside the United States unless the user has prior approval. What type of authentication factor is this?
A hash function takes an input of any length and outputs a fixed-length string. What is this output called?
Two different files are processed by the same hash function and produce the same output. What is this called?
An important property of cryptographic hash functions is that given a hash, it is infeasible to figure out the input. What is this called?
MD5 and SHA1 are no longer considered secure because adversaries can force collisions. What has happened to these algorithms?
Why should organizations store password hashes instead of plaintext passwords?
Why do systems add a random salt when hashing passwords?
A hacker steals a user’s password. Since the organization has not enabled multifactor authentication, the hacker can log in with the same rights as the user. What attack is this exploiting?
An attacker tries many password guesses directly against a company’s login portal. What type of attack is this?
An attacker obtains a stolen database of usernames and hashed passwords, then tests them on their own computer. What type of attack is this?
A hacker uses stolen usernames and passwords from a breach at another company to try logging into employees’ accounts. What is this attack called?
An adversary attempts one very common password (like “Password123”) across hundreds of accounts in the same organization. What attack is this?
An IoT device is left with the default admin username and password. An attacker tries these credentials to gain access. What attack is this?
An adversary uses a program to try every possible combination of letters, numbers, and symbols until the password is found. What attack is this?
An attacker uses a file of common passwords to test against a captured hash. What attack is this?
An attacker uses a precomputed list of passwords and their hashes to quickly match against a captured password hash. What attack is this?
An organization creates rules that prohibit employees from visiting gaming or social media sites while on company devices. What type of control is this?
A company requires employees to create passwords of at least 12 characters and to change them every 90 days. What type of control is this?
A company restricts who can log in to servers remotely and requires all services not being used to be disabled. What type of control is this?
An organization prohibits employees from installing their own applications and requires them to request software through IT. What type of control is this?
A security tool isolates malicious files and removes them after detecting suspicious activity. What type of software is this?
Anti-malware programs compare files against a database of known malicious patterns. What are these patterns called?
A company releases an update to fix a security hole in its operating system. What is this update called?
Why is keeping operating systems and applications up to date important for security?
A company requires employees to include uppercase, lowercase, numbers, and special characters in their passwords. What setting is this?
A company requires all user passwords to be at least 14 characters long. What setting is this?
An organization requires users to change their password every 120 days. What setting is this?
A system prevents users from reusing any of their last 10 passwords. What setting is this?
A company locks a user account for 15 minutes after five failed login attempts. What setting is this?
A user enables a program on their laptop that filters which network connections are allowed in or out of the device. What is this?
A firewall rule on a laptop blocks all outbound FTP traffic. What type of firewall is this?
A host-based firewall is configured to allow traffic only from specific IP addresses. What is this firewall using?
A system administrator reviews logs showing multiple failed login attempts late at night. What is this an example of?
A suspicious process is found running on a server that was not authorized by the administrator. What is this an example of?
A file on a laptop is discovered to have a hash that matches a known malware sample. What is this an example of?
An administrator notices many failed login attempts from the same IP address. What is this an example of?
A system log shows one user attempting dozens of incorrect passwords in rapid succession. What type of attack does this indicate?
A log reveals a legitimate employee account logging in from a foreign country at 3 a.m. What does this suggest?
Logs show dozens of different employees failing to log in within seconds, all from the same IP address. What type of attack is this?
A system shows repeated login attempts using default admin credentials like “admin:password.” What type of attack is this?
Why can’t offline password attacks be detected through system logs?