I85PREP
⌘ K
CyberOps Associate study materials
CyberOps Associate study resources

CyberOps Associate practice questions

One question at a time. Build your CyberOps Associate understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Concepts

Which security property ensures that data has not been altered by an unauthorized party?

  1. Confidentiality
  2. Availability
  3. Non-repudiation
  4. Integrity Correct answer.

Explanation

Integrity means data remains accurate and complete and has not been modified without authorization. Confidentiality restricts reading, availability ensures timely access, and non-repudiation prevents denial of an action.

Question 2Security Concepts

Which AAA component verifies a user's claimed identity before access is granted?

  1. Accounting
  2. Authorization
  3. Authentication Correct answer.
  4. Auditing

Explanation

Authentication checks credentials to confirm that a user is who they claim to be. Authorization then determines what the authenticated identity may do, and accounting records activity.

Question 3Security Concepts

An unpatched web server has a known software flaw that an attacker could use to gain access. Which term best describes the flaw itself?

  1. A threat
  2. An exploit
  3. A vulnerability Correct answer.
  4. A risk

Explanation

A vulnerability is a weakness that can be exploited, such as unpatched software. A threat is a potential cause of harm, risk combines likelihood and impact, and an exploit is the technique or code that takes advantage of the weakness.

Question 4Security Concepts

What does defense in depth primarily rely on to protect an organization?

  1. Shared administrator accounts
  2. Flat internal network design
  3. A single hardened gateway
  4. Multiple overlapping security controls Correct answer.

Explanation

Defense in depth uses layered controls so that a failure in one control does not expose the whole environment. The layers can include network, endpoint, application, and administrative safeguards.

Question 5Security Concepts

A user needs to review files in a shared folder for a one-day audit task. Which action best follows least privilege?

  1. Grant permanent full control
  2. Disable folder auditing
  3. Grant temporary read-only access Correct answer.
  4. Share a privileged account

Explanation

Least privilege means giving only the access needed, for only as long as needed. Temporary read-only access matches the audit task without granting unnecessary change or deletion rights.

Question 6Security Concepts

Which principle is central to a zero trust architecture?

  1. Trust traffic from the internal network by default
  2. Verify every access request explicitly Correct answer.
  3. Use shared credentials for internal users
  4. Rely only on a perimeter firewall

Explanation

Zero trust treats every access request as untrusted until it is explicitly verified, regardless of network location. It combines identity checks, device posture, and least privilege rather than assuming the internal network is safe.

Question 7Security Concepts

What is the primary purpose of classifying data, such as labeling it public, internal, or confidential?

  1. To apply controls that match its sensitivity Correct answer.
  2. To replace user authentication
  3. To eliminate the need for backups
  4. To increase storage capacity

Explanation

Data classification helps an organization determine the handling, access, retention, and protection requirements for each category. Higher-sensitivity data generally receives stricter controls.

Question 8Security Concepts

In the incident response process, which phase immediately follows containment?

  1. Recovery
  2. Eradication Correct answer.
  3. Preparation
  4. Lessons learned

Explanation

After an incident is contained, eradication removes the cause, such as malware or an attacker's access. Recovery then restores normal operations, and lessons learned comes later.

Question 9Security Concepts

Why is a chain of custody important when handling digital evidence?

  1. It speeds up malware reverse engineering
  2. It identifies the attacker's motive
  3. It encrypts evidence while stored
  4. It documents who handled the evidence and when Correct answer.

Explanation

A chain of custody records each person who handled evidence and each transfer or action taken. This supports integrity and admissibility by showing the evidence was not altered or mishandled.

Question 10Security Concepts

A badge reader records every entry attempt but does not stop anyone at the door. What type of security control is this?

  1. Compensating
  2. Corrective
  3. Detective Correct answer.
  4. Preventive

Explanation

A detective control identifies and records events after or while they occur, such as logging entry attempts. Preventive controls stop actions, corrective controls restore after an event, and compensating controls substitute for another control.

Question 11Security Concepts

Which risk assessment approach expresses likelihood and impact using monetary values?

  1. Quantitative risk analysis Correct answer.
  2. Qualitative risk analysis
  3. Threat modeling
  4. Vulnerability scanning

Explanation

Quantitative risk analysis assigns numeric values, often monetary, to assets, likelihood, and impact. Qualitative analysis uses descriptive ratings such as high, medium, and low.

Question 12Security Concepts

Which threat actor is typically well-funded, highly skilled, and persistent over long periods?

  1. An APT group Correct answer.
  2. A malicious internal insider
  3. An ideologically driven hacktivist
  4. A low-skilled script kiddie

Explanation

An advanced persistent threat group is usually well-resourced and conducts prolonged, targeted campaigns. Script kiddies use existing tools, hacktivists are ideologically driven, and insiders abuse authorized access.

Question 13Security Concepts

Which malware type can spread across networks by itself without user interaction?

  1. Spyware
  2. Trojan
  3. Worm Correct answer.
  4. Ransomware

Explanation

A worm self-propagates by exploiting vulnerabilities or using network services, often without any user action. Trojans rely on disguise, ransomware blocks access for payment, and spyware secretly collects information.

Question 14Security Concepts

An email is crafted for a specific employee and references that person's role and current project. Which social engineering technique is this?

  1. Spear phishing Correct answer.
  2. Vishing
  3. Smishing
  4. Phishing

Explanation

Spear phishing is a targeted phishing attempt tailored to a specific person or group. Generic phishing is broad, vishing uses voice calls, and smishing uses text messages.

Question 15Security Concepts

An attack uses many compromised devices to overwhelm a web service with traffic. What is this attack called?

  1. A distributed denial of service Correct answer.
  2. A single-source denial of service
  3. A database SQL injection
  4. A credential brute-force attack

Explanation

A distributed denial-of-service attack uses many compromised hosts, often a botnet, to flood a target. A single-source DoS uses one origin, brute force guesses credentials, and SQL injection manipulates database queries.

Question 16Security Concepts

An attacker on the same local network poisons ARP entries to intercept traffic between two hosts. Which attack is this?

  1. Cross-site scripting
  2. Man-in-the-middle Correct answer.
  3. Privilege escalation
  4. Ransomware

Explanation

ARP poisoning can place an attacker between two communicating hosts, enabling a man-in-the-middle attack. The attacker can then observe or modify traffic.

Question 17Security Concepts

Which cryptographic method uses a public key and a private key as a pair?

  1. Asymmetric encryption Correct answer.
  2. Symmetric encryption
  3. Hashing
  4. Steganography

Explanation

Asymmetric encryption uses a key pair: the public key can be shared, while the private key is kept secret. Symmetric encryption uses one shared secret key, hashing produces a digest, and steganography hides data within other data.

Question 18Security Concepts

Which mechanism is commonly used to verify that a downloaded file has not changed?

  1. Cryptographic hash Correct answer.
  2. Symmetric cipher
  3. Key exchange
  4. Compression

Explanation

A cryptographic hash produces a fixed-length digest; comparing the expected and computed digest reveals whether the file changed. Encryption hides content, key exchange establishes keys, and compression reduces size.

Question 19Security Concepts

In a public key infrastructure, what does a digital certificate primarily bind together?

  1. An identity to a public key Correct answer.
  2. A private key to a cipher suite
  3. A password to a username
  4. A session to a MAC address

Explanation

A digital certificate associates a subject identity with a public key and is signed by a trusted certificate authority. This lets parties trust that a public key belongs to the named entity.

Question 20Security Concepts

Which firewall type maintains a state table to track active connections?

  1. Stateless firewall
  2. Proxy firewall
  3. Stateful firewall Correct answer.
  4. Packet filter

Explanation

A stateful firewall tracks connections in a state table and can allow return traffic for an established session. Stateless packet filters evaluate each packet independently.

Question 21Security Concepts

Which security device can block malicious traffic inline before it reaches a protected host?

  1. Syslog server
  2. Honeypot
  3. Intrusion prevention system Correct answer.
  4. Intrusion detection system

Explanation

An intrusion prevention system sits inline and can drop or block traffic that matches malicious patterns. An intrusion detection system only alerts, a honeypot lures attackers, and a syslog server collects logs.

Question 22Security Concepts

What is the primary purpose of a VPN when users connect over the Internet?

  1. To create an encrypted tunnel to a trusted network Correct answer.
  2. To replace user authentication
  3. To block all malware on the endpoint
  4. To increase available bandwidth

Explanation

A VPN protects confidentiality by encapsulating traffic in an encrypted tunnel between the client and a trusted endpoint. It does not inherently increase bandwidth, authenticate users by itself, or block endpoint malware.

Question 23Security Concepts

Which access control model grants permissions based on a user's assigned job function?

  1. Role-based access control Correct answer.
  2. Mandatory access control
  3. Attribute-based access control
  4. Discretionary access control

Explanation

Role-based access control assigns permissions to roles, and users receive access through their role assignments. Discretionary control lets owners decide, mandatory control uses labels and clearances, and attribute-based control evaluates multiple attributes.

Question 24Security Concepts

What is the main security benefit of regular security awareness training?

  1. It guarantees that no breach can occur
  2. It replaces the need for technical controls
  3. It lowers phishing and human-error risk Correct answer.
  4. It encourages password reuse across sites

Explanation

Awareness training helps users recognize phishing, handle data safely, and follow procedures, reducing human-error risk. It supports technical controls rather than replacing them and cannot guarantee zero breaches.

Question 25Security Concepts

Which standard applies specifically to organizations that store, process, or transmit payment card data?

  1. PCI DSS Correct answer.
  2. HIPAA
  3. ISO 27001
  4. GDPR

Explanation

PCI DSS is the Payment Card Industry Data Security Standard for protecting cardholder data. HIPAA covers health information, GDPR protects personal data in the EU, and ISO 27001 is a general information security management standard.

Question 26Security Concepts

An attacker modifies several records in a customer database without authorization. Which element of the CIA triad is directly compromised?

  1. Availability
  2. Nonrepudiation
  3. Integrity Correct answer.
  4. Confidentiality

Explanation

Integrity is the property that data remains accurate, complete, and unaltered except through authorized change. Unauthorized modification of records is the classic integrity violation. Availability and confidentiality address access and disclosure rather than correctness of the data.

Question 27Security Concepts

Which term expresses the likelihood and impact of a threat taking advantage of a weakness?

  1. Risk Correct answer.
  2. Vulnerability
  3. Exploit
  4. Threat

Explanation

Risk combines the probability that a threat will act on a weakness with the resulting business impact. A threat is a potential source of harm and a vulnerability is the weakness itself, so neither alone expresses exposure. Risk is what organizations assess and treat with controls.

Question 28Security Concepts

A user signs in with a password and then enters a one-time code displayed on a hardware token. Which authentication factor category does the token represent?

  1. Somewhere you are
  2. Something you have Correct answer.
  3. Something you know
  4. A biometric property

Explanation

Authentication factors are grouped by what the user knows, has, or is. A physical token is a possession, so it is the something-you-have factor. Combining it with a password satisfies multifactor authentication because two different categories are used.

Question 29Security Concepts

Which phrase best describes the defense-in-depth principle?

  1. Security depends mainly on antivirus software on each host
  2. Overlapping layers of independent controls Correct answer.
  3. Every user is trusted once authenticated to the internal network
  4. A single hardened perimeter device protects the whole network

Explanation

Defense in depth places multiple, partly independent controls at different layers so that a single failure or bypass does not expose everything. It assumes any one control can fail and designs for that eventuality. Flat trust inside the network and reliance on one product both contradict the principle.

Question 30Security Concepts

After a workstation is infected, the team wipes it and restores the image from a known-good backup. Which control category does this action represent?

  1. Corrective Correct answer.
  2. Deterrent
  3. Preventive
  4. Detective

Explanation

Corrective controls act after an event to restore systems and data to a known-good state. Reimaging from a clean backup reduces the impact of the incident rather than stopping or recording it. Preventive and detective controls operate before or during the event.

Question 31Security Concepts

An organization deploys a new e-mail gateway and accepts that some phishing messages will still reach users. What does the remaining exposure represent?

  1. Residual risk Correct answer.
  2. Risk acceptance level
  3. Inherent risk
  4. Risk transfer

Explanation

Residual risk is what remains after safeguards have been applied and management has decided to live with it. Inherent risk is measured before any controls exist. The leftover exposure after the gateway is therefore residual risk.

Question 32Security Concepts

A developer who writes code cannot push it directly to production; a release manager must approve and deploy it. Which principle does this configuration enforce?

  1. Defense in depth
  2. Separation of duties Correct answer.
  3. Mandatory access control
  4. Least privilege

Explanation

Separation of duties splits a sensitive process so that no single person can complete it alone, which reduces the potential for fraud and error. Here the writing and releasing functions sit with different roles. The control is about dividing the workflow, not about the size of any one account's permissions.

Question 33Security Concepts

After a user authenticates successfully, the system checks which files and applications that user may open. Which function of AAA is being performed?

  1. Authorization Correct answer.
  2. Authentication
  3. Auditing
  4. Accounting

Explanation

Authorization determines what an authenticated identity is permitted to do. Authentication has already established who the user is, so the next step is deciding which resources are allowed. Accounting and auditing record activity for later review.

Question 34Security Concepts

A US-based retailer markets to customers in France and stores their personal data. Which regulation most directly governs how that data must be handled?

  1. PCI DSS
  2. HIPAA
  3. GDPR Correct answer.
  4. SOX

Explanation

The General Data Protection Regulation applies to the processing of personal data of individuals located in the European Union, regardless of where the company is based. It sets requirements for lawful basis, consent, breach notification, and data subject rights.

Question 35Security Concepts

What is the primary purpose of a honeypot?

  1. To back up critical servers in real time
  2. To attract and observe attacker activity Correct answer.
  3. To encrypt data before it leaves the host
  4. To block malware at the network boundary

Explanation

A honeypot is a decoy system with no legitimate production role, so any interaction with it is suspicious. Defenders use it to collect details about attacker tools, techniques, and intent while keeping them away from real assets. Detection of unauthorized activity is the goal, not blocking or protecting data directly.

Question 36Security Concepts

A help desk technician is granted full domain administrator rights 'just in case they are needed.' Which principle does this violate?

  1. Separation of duties
  2. Job rotation
  3. Defense in depth
  4. Least privilege Correct answer.

Explanation

Least privilege means each identity receives only the access required to perform its defined tasks, for only as long as required. Standing domain administrator rights for routine help desk work exceed that need and enlarge the impact of a compromised account. The problem is the breadth of permissions, not the division of a workflow.

Question 37Security Concepts

Which practice prevents an attacker who steals a password database from using precomputed tables to crack the stored passwords?

  1. Perfect forward secrecy
  2. Field tokenization
  3. Password salting Correct answer.
  4. Key escrow

Explanation

A salt is a unique random value added to each password before hashing, so identical passwords produce different hashes. This defeats precomputed lookup tables and forces the attacker to attack each entry separately. Salting is applied alongside a slow hashing algorithm for stored credentials.

Question 38Security Concepts

A hash value stored alongside a file cannot prove who produced the file. What does adding a digital signature provide beyond integrity?

  1. Faster hash computation
  2. Confidentiality of the file
  3. Automatic key rotation
  4. Nonrepudiation of origin Correct answer.

Explanation

A digital signature is created with the sender's private key and verified with the corresponding public key, binding the file to a specific identity. That binding gives origin authentication and nonrepudiation, which a bare hash cannot. The file content remains readable because signing does not encrypt.

Question 39Security Concepts

A hospital's continuity plan states that the patient portal must be restored within four hours of an outage. What does the four-hour figure describe?

  1. Recovery time objective Correct answer.
  2. Documented service level credit
  3. Mean time between failures
  4. Recovery point objective for backups

Explanation

The recovery time objective is the maximum acceptable duration of downtime before a service must be operational again. It is expressed in elapsed time from the outage. A recovery point objective instead describes how much data loss is tolerable and is measured against the last good backup.

Question 40Security Concepts

A vulnerability scanner reports the same critical finding on 500 hosts, but the affected service is reachable only from an isolated lab that holds no sensitive data. What is the most appropriate next step?

  1. Validate exposure, then prioritize by risk Correct answer.
  2. Suppress the finding permanently and close the ticket
  3. Escalate to the software vendor and wait for a patch
  4. Patch all 500 hosts within the same maintenance window

Explanation

Scanner severity reflects the vulnerability in isolation, while remediation priority should reflect the organization's actual exposure and asset value. Confirming reachability and data sensitivity first lets the team rank the finding against others and act where risk is highest. The decision and its rationale should still be documented.

Question 41Security Monitoring

What is the primary role of a SIEM in a security operations center?

  1. Packet blocking and prevention
  2. Data encryption at rest
  3. Log correlation and analysis Correct answer.
  4. IP address assignment

Explanation

A SIEM collects logs from many sources, normalizes the events, and correlates them to surface meaningful security alerts. It is not an inline enforcement device and does not provide encryption or IP address management.

Question 42Security Monitoring

What distinguishes an IPS from an IDS?

  1. It blocks detected traffic inline Correct answer.
  2. It assigns VLANs to switches
  3. It only stores packet captures
  4. It only analyzes endpoint files

Explanation

An IDS detects and alerts on suspicious activity, while an IPS is placed inline and can actively drop or block malicious traffic. Packet capture, endpoint file analysis, and VLAN assignment are separate functions.

Question 43Security Monitoring

In syslog, which severity level represents an emergency?

  1. 7
  2. 4
  3. 0 Correct answer.
  4. 6

Explanation

Syslog severity levels range from 0 for emergency to 7 for debug. Level 0 indicates the system is unusable and requires immediate attention.

Question 44Security Monitoring

What type of information does NetFlow primarily provide?

  1. Antivirus signature updates
  2. Full packet payloads
  3. DNS zone contents
  4. Flow metadata Correct answer.

Explanation

NetFlow records metadata about network conversations, such as source and destination addresses, ports, protocol, and byte counts. It does not normally include full packet payloads, antivirus updates, or DNS zone data.

Question 45Security Monitoring

Which Windows event ID records a successful user logon?

  1. 4624 Correct answer.
  2. 4625
  3. 4688
  4. 7045

Explanation

Windows Event ID 4624 is generated for a successful logon. Event ID 4625 records a failed logon, 4688 records process creation, and 7045 records a new service installation.

Question 46Security Monitoring

On many Debian-based Linux systems, which log file records authentication events such as SSH logins?

  1. /var/log/boot.log
  2. /var/log/auth.log Correct answer.
  3. /var/log/kern.log
  4. /var/log/dpkg.log

Explanation

The auth.log file commonly records authentication-related events on Debian-based systems, including SSH logon attempts. Kernel messages, package operations, and boot messages are recorded in separate log files.

Question 47Security Monitoring

Which IDS detection method compares activity against known attack patterns?

  1. Protocol state analysis
  2. Anomaly detection
  3. Signature matching Correct answer.
  4. Statistical baselining

Explanation

Signature-based detection compares traffic or events against known patterns associated with attacks. Anomaly detection and baselining instead look for deviations from normal behavior.

Question 48Security Monitoring

Which log source records web requests made by users through an intermediary server?

  1. NetFlow record
  2. Firewall log
  3. Proxy log Correct answer.
  4. DNS server log

Explanation

A proxy log records user web requests that pass through the proxy, often including requested URLs and user identities. Firewall and NetFlow records focus more on connection metadata, while DNS logs show name resolution queries.

Question 49Security Monitoring

Why is consistent NTP time synchronization important for security monitoring?

  1. It aligns timestamps across log sources Correct answer.
  2. It reduces the volume of stored logs
  3. It increases packet capture throughput
  4. It encrypts log traffic between sensors

Explanation

Accurate, synchronized clocks allow analysts to place events from different devices on a common timeline. NTP does not reduce log volume, encrypt log traffic, or increase capture performance.

Question 50Security Monitoring

Which investigative question can full packet capture answer that NetFlow records cannot?

  1. How many bytes were exchanged?
  2. Which destination port was used?
  3. What payload was transferred? Correct answer.
  4. Which source IP initiated a connection?

Explanation

Full packet capture includes the actual payload of a session, allowing analysts to inspect transferred content. NetFlow records include metadata such as source IP, destination port, and byte counts but not the payload itself.