I85PREP
⌘ K
SCYM study materials
SCYM study resources

SCYM practice questions

One question at a time. Build your SCYM understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Unverified blueprint area 1 (placeholder - awaiting official source)

Which property of the CIA triad is concerned with ensuring that data has not been modified without authorization?

  1. Non-repudiation
  2. Confidentiality
  3. Availability
  4. Integrity Correct answer.

Explanation

Integrity means data is accurate, complete, and protected from unauthorized changes. Confidentiality limits who can read data, and availability ensures systems are accessible when needed.

Question 2Unverified blueprint area 1 (placeholder - awaiting official source)

An employee receives an email that appears to come from the payroll team and is urged to click a link to confirm direct deposit at a lookalike domain. Which term best describes this attack?

  1. SQL injection
  2. Brute force
  3. DDoS
  4. Phishing Correct answer.

Explanation

Phishing uses deceptive messages that impersonate a trusted party to trick recipients into revealing information or clicking malicious links. The lookalike domain and urgency are classic phishing indicators.

Question 3Unverified blueprint area 1 (placeholder - awaiting official source)

A one-time code generated by a hardware token is an example of which authentication factor category?

  1. Something you are
  2. Somewhere you are
  3. Something you know
  4. Something you have Correct answer.

Explanation

A hardware token is a physical object the user possesses, so it represents the something-you-have factor. Combining it with a password creates multi-factor authentication.

Question 4Unverified blueprint area 1 (placeholder - awaiting official source)

Which practice best reflects the principle of least privilege?

  1. Granting only the access required for a job role Correct answer.
  2. Blocking all outbound traffic by default
  3. Requiring password changes every thirty days
  4. Granting every employee full administrator rights

Explanation

Least privilege limits each account to the minimum access needed to perform its assigned tasks. This reduces the blast radius if an account is compromised or misused.

Question 5Unverified blueprint area 1 (placeholder - awaiting official source)

Which operation is designed to be one-way and is commonly used to verify data integrity?

  1. Base64 encoding
  2. Asymmetric encryption
  3. Symmetric encryption
  4. Hashing Correct answer.

Explanation

A cryptographic hash produces a fixed-length digest that cannot feasibly be reversed, so any change to the input changes the digest. Comparing digests is a standard integrity check.

Question 6Unverified blueprint area 1 (placeholder - awaiting official source)

Which device filters network traffic between segments according to a defined rule set?

  1. Repeater
  2. Switch
  3. Hub
  4. Firewall Correct answer.

Explanation

A firewall inspects traffic and permits or denies it based on configured rules. It is placed between network zones to enforce a security boundary.

Question 7Unverified blueprint area 1 (placeholder - awaiting official source)

What is the defining behavior of ransomware?

  1. It secretly records keystrokes for later retrieval
  2. It spreads by infecting removable media only
  3. It encrypts files and demands payment for release Correct answer.
  4. It floods a target with excessive traffic

Explanation

Ransomware denies access to data, typically by encrypting it, and then demands payment for the decryption key. The extortion demand distinguishes it from other malware families.

Question 8Unverified blueprint area 1 (placeholder - awaiting official source)

What is the primary goal of patch management?

  1. Documenting user passwords
  2. Remediating known software vulnerabilities Correct answer.
  3. Rotating encryption keys
  4. Increasing network bandwidth

Explanation

Patch management identifies, tests, and deploys vendor updates that fix known vulnerabilities and defects. Timely patching shrinks the window in which known flaws can be exploited.

Question 9Unverified blueprint area 1 (placeholder - awaiting official source)

Which statement correctly describes symmetric encryption?

  1. It uses a public key to encrypt and a private key to decrypt
  2. It uses one shared key for both encryption and decryption Correct answer.
  3. It cannot provide confidentiality for data at rest
  4. It is always slower than asymmetric encryption

Explanation

Symmetric encryption uses the same secret key for both operations, so both parties must share and protect that key. It is generally fast and well suited to bulk data protection.

Question 10Unverified blueprint area 1 (placeholder - awaiting official source)

Alice wants to send a confidential message to Bob using public-key cryptography. Which key should Alice use to encrypt the message?

  1. Bob's public key Correct answer.
  2. Alice's public key
  3. Bob's private key
  4. Alice's private key

Explanation

Encrypting with Bob's public key ensures that only Bob's matching private key can decrypt the message. Alice's own keys are not used to restrict reading to Bob.

Question 11Unverified blueprint area 1 (placeholder - awaiting official source)

A digital signature created with a sender's private key primarily provides which assurance?

  1. That the message came from the signer unaltered Correct answer.
  2. That the message will be delivered within a set time
  3. That the network path is free of congestion
  4. That the message content is hidden from intermediaries

Explanation

A signature binds the message to the signer's private key and detects any change to the signed content. Verification with the corresponding public key confirms origin and integrity.

Question 12Unverified blueprint area 1 (placeholder - awaiting official source)

Which control is most effective at preventing SQL injection?

  1. Logging all database queries
  2. Escaping HTML entities in output
  3. Using parameterized queries Correct answer.
  4. Enforcing a 12-character password policy

Explanation

Parameterized queries separate SQL code from user-supplied values, so input cannot change the query structure. This addresses the root cause rather than detecting attacks afterward.

Question 13Unverified blueprint area 1 (placeholder - awaiting official source)

Reflected cross-site scripting (XSS) occurs when:

  1. An attacker alters records directly in the database
  2. A server certificate has passed its expiry date
  3. A session token is reused by the server after logout
  4. Untrusted input is returned in a response without proper encoding Correct answer.

Explanation

Reflected XSS happens when a request parameter is echoed back into the response and the browser executes it as script. Output encoding and input validation break this path.

Question 14Unverified blueprint area 1 (placeholder - awaiting official source)

What is the main purpose of including a CSRF token in a web form?

  1. To compress the response before delivery
  2. To encrypt the form data in transit
  3. To cache the form for repeat submissions
  4. To reject forged requests that reuse a victim's session Correct answer.

Explanation

A CSRF token is a per-session or per-request value the server verifies before accepting a state-changing request. An attacker who cannot read the token cannot forge a valid request from another site.

Question 15Unverified blueprint area 1 (placeholder - awaiting official source)

Why is a unique salt stored with each password hash?

  1. To shorten the time needed to compute the hash
  2. To prevent reuse of precomputed rainbow tables Correct answer.
  3. To allow the password to be recovered by an administrator
  4. To encrypt the password before hashing

Explanation

A unique salt makes identical passwords produce different hashes and defeats precomputed lookup tables. It forces an attacker to attack each hash separately.

Question 16Unverified blueprint area 1 (placeholder - awaiting official source)

How does an intrusion prevention system (IPS) differ from an intrusion detection system (IDS)?

  1. An IPS only analyzes logs after an incident
  2. An IPS can block malicious traffic inline Correct answer.
  3. An IPS encrypts traffic between network segments
  4. An IPS stores packets for forensic review

Explanation

An IPS sits inline and can drop or reset traffic when it matches a malicious pattern. An IDS is typically passive and only alerts on suspicious activity.

Question 17Unverified blueprint area 1 (placeholder - awaiting official source)

In the incident response lifecycle, which phase immediately follows identification?

  1. Lessons learned
  2. Preparation
  3. Recovery
  4. Containment Correct answer.

Explanation

After an incident is identified and confirmed, the team works to contain it before eradicating the cause and recovering systems. Preparation precedes identification, and lessons learned comes at the end.

Question 18Unverified blueprint area 1 (placeholder - awaiting official source)

What does a recovery time objective (RTO) specify?

  1. The cost ceiling for disaster recovery equipment
  2. The number of staff required for recovery
  3. The maximum age of backups that must be retained
  4. The target time to restore a service after disruption Correct answer.

Explanation

RTO defines how quickly a service must be restored after a disruption to meet business requirements. It is commonly paired with RPO, which addresses tolerable data loss.

Question 19Unverified blueprint area 1 (placeholder - awaiting official source)

In risk assessment, risk is best expressed as:

  1. The combination of likelihood and impact Correct answer.
  2. The count of security controls deployed
  3. The number of users with administrator rights
  4. The age of the oldest unpatched system

Explanation

Risk reflects the probability that a threat exploits a vulnerability and the resulting harm. It is commonly modeled as likelihood multiplied by impact.

Question 20Unverified blueprint area 1 (placeholder - awaiting official source)

Role-based access control (RBAC) assigns permissions primarily according to:

  1. The reputation score of the device
  2. The user's job function or role Correct answer.
  3. The sensitivity label of each document
  4. The time of day a user logs in

Explanation

RBAC groups permissions into roles and assigns users to roles based on their responsibilities. Access changes when the user's role changes, simplifying administration.

Question 21Unverified blueprint area 1 (placeholder - awaiting official source)

Which protection does TLS provide for data in transit?

  1. Protection of data at rest on the server disk
  2. Confidentiality and integrity with server authentication Correct answer.
  3. Guaranteed availability during a denial-of-service attack
  4. Non-repudiation of message delivery to the recipient

Explanation

TLS encrypts the channel, detects tampering, and validates the server's certificate during the handshake. It does not protect stored data or guarantee uptime.

Question 22Unverified blueprint area 1 (placeholder - awaiting official source)

A zero-day vulnerability is best described as:

  1. A flaw discovered by an internal audit team
  2. A flaw that has been patched for more than a year
  3. A flaw that only affects offline systems
  4. A flaw for which no vendor fix is yet available Correct answer.

Explanation

Zero-day refers to the absence of a vendor patch at the time of exploitation, leaving defenders without an official fix. The term describes fix availability, not who discovered the flaw.

Question 23Unverified blueprint area 1 (placeholder - awaiting official source)

A volumetric distributed denial-of-service (DDoS) attack primarily aims to:

  1. Modify records in a backend database
  2. Steal credentials from an authentication server
  3. Saturate network bandwidth with junk traffic Correct answer.
  4. Encrypt files on employee workstations

Explanation

Volumetric attacks overwhelm the target's link capacity with high-volume traffic from many sources. The goal is to exhaust bandwidth so legitimate requests cannot get through.

Question 24Unverified blueprint area 1 (placeholder - awaiting official source)

How does a penetration test differ from a vulnerability scan?

  1. A penetration test checks only source code
  2. A penetration test only lists missing patches
  3. A penetration test runs without any authorization
  4. A penetration test simulates an attacker chaining weaknesses Correct answer.

Explanation

A penetration test is an authorized, goal-driven simulation that can combine weaknesses to demonstrate real impact. A scan is typically automated and reports potential issues without exploiting them.

Question 25Unverified blueprint area 1 (placeholder - awaiting official source)

Attribute-based access control (ABAC) makes authorization decisions using:

  1. Attributes of the subject, resource, action, and environment Correct answer.
  2. A static list of users stored in a text file
  3. The order in which requests arrive at the server
  4. A single global password shared by a team

Explanation

ABAC evaluates policies against attributes such as user department, resource classification, requested action, and context like time or location. This supports fine-grained, dynamic decisions.

Question 26Unverified blueprint area 1 (placeholder - awaiting official source)

Which property of a cryptographic hash allows a recipient to detect that a downloaded file has been modified?

  1. The digest is stored inside the file it was computed from
  2. The digest length grows in proportion to the file size
  3. The digest can be decrypted to recover the original input
  4. A small change in the input produces a completely different digest Correct answer.

Explanation

Hash functions are one-way and exhibit the avalanche effect: any change to the input yields an unrelated digest, so comparing the expected and computed digests reveals tampering. Hashing does not encrypt the data, and digest length is fixed regardless of input size.

Question 27Unverified blueprint area 1 (placeholder - awaiting official source)

A fingerprint reader used for logon is an example of which authentication factor category?

  1. Something you know
  2. Something you are Correct answer.
  3. Something you have
  4. Somewhere you are

Explanation

Authentication factors fall into categories such as knowledge, possession, inherence, and location. A fingerprint is a biometric trait, which belongs to the inherence category, commonly phrased as "something you are."

Question 28Unverified blueprint area 1 (placeholder - awaiting official source)

The principle of least privilege requires that a user account be granted:

  1. Only the access required for assigned tasks Correct answer.
  2. Access equal to that of the user's manager
  3. Full administrative rights by default
  4. Access granted for a fixed one-year term

Explanation

Least privilege limits each account to the permissions needed for its current duties, which shrinks the damage a compromised or misused account can cause. Broader rights are added only when a documented need exists, and they are removed when no longer required.

Question 29Unverified blueprint area 1 (placeholder - awaiting official source)

Which malware type spreads across a network by itself, exploiting vulnerabilities without user interaction?

  1. Spyware
  2. Logic bomb
  3. Worm Correct answer.
  4. Trojan

Explanation

A worm is self-propagating: it scans for and exploits reachable hosts without needing a user to open a file or click a link. Other malware families generally require user action, a trigger condition, or an attacker's command to spread.

Question 30Unverified blueprint area 1 (placeholder - awaiting official source)

A screened subnet (DMZ) is used primarily to:

  1. Host internet-facing services apart from the internal network Correct answer.
  2. Store offline backups of critical servers
  3. Encrypt traffic between branch offices
  4. Provide guest wireless access to visitors

Explanation

A screened subnet places externally reachable services in a buffer zone so that a compromise there does not directly expose the internal network. Traffic between the DMZ and the internal network is restricted by policy.

Question 31Unverified blueprint area 1 (placeholder - awaiting official source)

What is the primary function of a security information and event management (SIEM) platform?

  1. Blocking malicious packets at the perimeter
  2. Encrypting data at rest on servers
  3. Correlating log data from many sources Correct answer.
  4. Scanning hosts for missing patches

Explanation

A SIEM collects logs and events from diverse systems, normalizes them, and correlates them to surface patterns that individual sources would not reveal. It supports detection and investigation rather than acting as an inline blocking device.

Question 32Unverified blueprint area 1 (placeholder - awaiting official source)

In the 3-2-1 backup rule, the "1" refers to:

  1. One administrator accountable
  2. One copy stored offsite Correct answer.
  3. One backup taken per week
  4. One restore test per year

Explanation

The 3-2-1 rule calls for three copies of data, on two different media types, with one copy held offsite. The offsite copy protects against site-wide events such as fire, flood, or ransomware that reaches the primary network.

Question 33Unverified blueprint area 1 (placeholder - awaiting official source)

An attacker walks through a badge-controlled door immediately behind a legitimate employee without presenting credentials. This attack is called:

  1. Shoulder surfing
  2. Tailgating Correct answer.
  3. Dumpster diving
  4. Whaling

Explanation

Tailgating is unauthorized physical entry achieved by following an authorized person through a controlled door. Awareness training and physical controls such as turnstiles or mantraps reduce the risk.

Question 34Unverified blueprint area 1 (placeholder - awaiting official source)

Which mechanism returns the revocation status of an individual certificate in real time?

  1. OCSP Correct answer.
  2. CSR
  3. PKCS#12
  4. CRL

Explanation

The Online Certificate Status Protocol lets a client query a responder about one specific certificate and receive a current good, revoked, or unknown answer. A CRL instead distributes a signed list of revoked serial numbers that clients download periodically.

Question 35Unverified blueprint area 1 (placeholder - awaiting official source)

SAML is most commonly used to:

  1. Enable single sign-on across separate web domains Correct answer.
  2. Encrypt files stored on a file server
  3. Sign email messages between organizations
  4. Hash passwords before they are stored

Explanation

SAML exchanges signed assertions about a user's identity so that a service provider can accept an authentication performed by a separate identity provider. This is the basis of browser-based single sign-on across organizational boundaries.

Question 36Unverified blueprint area 1 (placeholder - awaiting official source)

Which characteristic best identifies a rootkit?

  1. It encrypts user files and demands payment
  2. It emails copies of itself to the user's contacts
  3. It hides its presence while keeping privileged access Correct answer.
  4. It records keystrokes and forwards them to an attacker

Explanation

A rootkit is designed to conceal itself and its artifacts, often by modifying the operating system kernel or boot process, so that it can retain privileged access undetected. Detection therefore frequently requires offline or boot-level inspection.

Question 37Unverified blueprint area 1 (placeholder - awaiting official source)

Why do organizations assign labels such as Public, Internal, and Confidential to data?

  1. To reduce the number of accounts that must be audited
  2. To define how each data set must be handled and protected Correct answer.
  3. To decide which staff need security training
  4. To determine which firewall rules should be deployed at the edge

Explanation

Classification ties a data set to a defined set of handling requirements, such as encryption, access approval, retention, and sharing restrictions. The label gives users and systems a consistent rule for protecting the data wherever it moves.

Question 38Unverified blueprint area 1 (placeholder - awaiting official source)

A honeypot is deployed to:

  1. Attract and observe attacker activity Correct answer.
  2. Provide a second authentication factor
  3. Cache content closer to end users
  4. Balance traffic across a pool of web servers

Explanation

A honeypot is a decoy system with no production role, so any interaction with it is suspicious by definition. It provides early warning and intelligence about attacker tools and techniques while drawing attention away from real assets.

Question 39Unverified blueprint area 1 (placeholder - awaiting official source)

A vulnerability has a CVSS base score of 9.8. What does this score indicate?

  1. It is known to be exploited in the wild
  2. It is rated critical severity Correct answer.
  3. It can be exploited without credentials
  4. It affects nine or more hosts

Explanation

CVSS base scores range from 0 to 10 and map to qualitative severity bands, with 9.0 and above rated critical. The base score reflects intrinsic characteristics of the flaw, not whether it is currently being exploited in the wild.

Question 40Unverified blueprint area 1 (placeholder - awaiting official source)

The main purpose of a tabletop exercise is to:

  1. Rehearse the response plan without live systems Correct answer.
  2. Verify that backups can be read by the restore team
  3. Measure how long a full restore actually takes
  4. Test failover of production systems to a hot site

Explanation

A tabletop exercise is a discussion-based walkthrough in which participants talk through a scenario against the incident response plan. It exposes gaps in roles, communications, and decision-making without the cost or risk of activating real systems.

Question 41Unverified blueprint area 1 (placeholder - awaiting official source)

A logic bomb is code that:

  1. Copies itself to removable media
  2. Reports keystrokes to a remote host
  3. Fires when a set condition is met Correct answer.
  4. Encrypts files and demands payment

Explanation

A logic bomb stays dormant until a predetermined trigger, such as a date, a missing record, or the removal of an employee account, and then executes its payload. It is often planted by an insider and is not self-replicating.

Question 42Unverified blueprint area 1 (placeholder - awaiting official source)

Network access control (NAC) ensures that:

  1. Traffic between branch offices is encrypted
  2. Every DNS query is logged for review
  3. Device health is checked before network access Correct answer.
  4. Users are mapped to roles for file shares

Explanation

NAC evaluates an endpoint against policy, such as patch level, antivirus status, and device ownership, before or upon connection. Noncompliant devices can be quarantined or given limited remediation access.

Question 43Unverified blueprint area 1 (placeholder - awaiting official source)

Which element of a change request describes how to restore the previous state if the change fails?

  1. Implementation window
  2. Risk rating
  3. Backout plan Correct answer.
  4. Scope statement

Explanation

The backout, or rollback, plan documents the verified steps and decision criteria for reverting a change that causes problems. It is the mechanism that limits the duration and impact of an unsuccessful change.

Question 44Unverified blueprint area 1 (placeholder - awaiting official source)

Full-disk encryption on a laptop primarily protects against:

  1. Phishing messages sent to the device owner
  2. An attacker capturing packets on the local network
  3. Malware infecting the operating system
  4. Disclosure of data if the device is stolen Correct answer.

Explanation

Full-disk encryption renders the stored contents unreadable without the correct key, which addresses the risk of a lost or stolen device. It does not defend against malware running on an unlocked system or against network interception.

Question 45Unverified blueprint area 1 (placeholder - awaiting official source)

Which feature distinguishes spear phishing from generic phishing?

  1. It is sent in bulk to thousands of recipients
  2. It targets only company executives
  3. It relies on phone calls instead of email
  4. It is tailored to a specific person or team Correct answer.

Explanation

Spear phishing uses researched details about a narrow target, such as a team's projects or a supplier relationship, to make the lure convincing. Generic phishing, by contrast, uses a broad, untargeted message sent to many recipients.

Question 46Unverified blueprint area 1 (placeholder - awaiting official source)

A system has a maximum tolerable downtime (MTD) of 8 hours. Which recovery time objective (RTO) is consistent with that MTD?

  1. 10 hours
  2. 6 hours Correct answer.
  3. 24 hours
  4. 12 hours

Explanation

The RTO is the target time to restore service and must be at or below the MTD, which is the point at which the outage becomes unacceptable. A 6-hour RTO leaves margin inside the 8-hour limit.

Question 47Unverified blueprint area 1 (placeholder - awaiting official source)

Why does a RAID 1 mirror not satisfy the need for backups?

  1. It cannot be used on production servers
  2. It slows down restore operations significantly
  3. It stores data on only one disk at a time
  4. It copies deletions and corruption to both disks Correct answer.

Explanation

A mirror writes identical data to every disk, so accidental deletion, logical corruption, or ransomware encryption propagates immediately to all members. A backup preserves an independent earlier point-in-time copy that is isolated from the live array.

Question 48Unverified blueprint area 1 (placeholder - awaiting official source)

What does an HMAC add beyond a plain cryptographic hash?

  1. It produces a shorter digest than a hash
  2. It makes the hash reversible by the receiver
  3. It encrypts the message before hashing it
  4. It uses a secret key to also prove authenticity Correct answer.

Explanation

An HMAC combines a hash function with a shared secret key, so only a party holding the key can produce a valid value. This supplies authenticity and integrity, whereas an unkeyed hash proves integrity alone.

Question 49Unverified blueprint area 1 (placeholder - awaiting official source)

In STRIDE threat modeling, which category covers an attacker modifying data in transit?

  1. Tampering Correct answer.
  2. Information disclosure
  3. Repudiation
  4. Spoofing

Explanation

STRIDE categorizes threats as spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. Tampering covers unauthorized modification of data, whether at rest or in transit.

Question 50Unverified blueprint area 1 (placeholder - awaiting official source)

A browser warns that a certificate is untrusted because it is self-signed. Why does the browser reject it?

  1. No trusted third party has vouched for its identity Correct answer.
  2. Its public key is longer than the browser allows
  3. The certificate has been added to the browser's trust store
  4. The key pair was generated on the wrong operating system

Explanation

Browsers rely on a chain of trust that terminates in a trusted root certificate authority. A self-signed certificate is its own issuer and provides no independent attestation of the server's identity.