I85PREP
⌘ K
ICDL Cyber Security study materials
ICDL Cyber Security study resources

ICDL Cyber Security (ICDL) practice questions

One question at a time. Build your ICDL Cyber Security understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cyber Security Concepts

Which term describes the assurance that data has not been altered or destroyed in an unauthorized manner?

  1. Non-repudiation
  2. Confidentiality
  3. Availability
  4. Integrity Correct answer.

Explanation

Integrity means data remains accurate and complete and has not been changed without authorization. The other principles cover secrecy, uptime, and proof of origin.

Question 2Cyber Security Concepts

A company encrypts customer records so that only authorized staff can read them. Which security goal is this primarily supporting?

  1. Confidentiality Correct answer.
  2. Integrity
  3. Authentication
  4. Availability

Explanation

Encryption restricts readability to parties holding the correct key, which protects confidentiality. It does not by itself guarantee uptime, accuracy, or identity verification.

Question 3Cyber Security Concepts

What is the primary purpose of a firewall on a network perimeter?

  1. To scan email attachments for malware
  2. To back up data to an offsite location
  3. To encrypt files stored on user devices
  4. To filter traffic between networks based on rules Correct answer.

Explanation

A firewall inspects traffic crossing a boundary and allows or blocks it according to configured rules. Its role is traffic control, not backup, file encryption, or email scanning.

Question 4Cyber Security Concepts

Which type of malware typically spreads by itself across networks without requiring a user to open a file?

  1. Rootkit
  2. Trojan
  3. Adware
  4. Worm Correct answer.

Explanation

A worm self-replicates and propagates across systems without user action. Trojans rely on user execution, adware displays advertising, and rootkits hide activity rather than self-spread.

Question 5Cyber Security Concepts

A message claims to come from a bank and asks the recipient to click a link and confirm their password. Which attack does this describe?

  1. Phishing Correct answer.
  2. Denial of service
  3. Brute force
  4. Shoulder surfing

Explanation

Phishing uses deceptive messages that impersonate a trusted party to trick users into revealing credentials. It is social engineering, not a technical flooding or guessing attack.

Question 6Cyber Security Concepts

What does the principle of least privilege require?

  1. Users are granted only the access they need to do their job Correct answer.
  2. All users share a single administrator account for simplicity
  3. Passwords must be changed every thirty days
  4. All data must be encrypted at rest

Explanation

Least privilege limits each account to the minimum rights necessary for its tasks, reducing the impact of compromise or misuse. It does not prescribe password age or encryption rules.

Question 7Cyber Security Concepts

Which practice best protects a laptop against unauthorized access when it is left unattended in a public place?

  1. Disabling the screensaver
  2. Using a cable lock and locking the screen Correct answer.
  3. Storing passwords in a plain text file
  4. Sharing the login password with a colleague

Explanation

A physical lock deters theft and a locked screen prevents casual access to the session. Sharing passwords or storing them in plain text weakens, rather than strengthens, protection.

Question 8Cyber Security Concepts

What is the main purpose of applying software updates promptly?

  1. To free up disk space automatically
  2. To increase the screen resolution
  3. To reduce the license cost
  4. To remove known vulnerabilities that attackers can exploit Correct answer.

Explanation

Updates frequently contain patches for security flaws, so installing them closes avenues attackers could use. They are not primarily about cost, display, or storage.

Question 9Cyber Security Concepts

An attacker intercepts and reads traffic on a network segment. Which property of the communication is most directly compromised?

  1. Durability
  2. Integrity
  3. Confidentiality Correct answer.
  4. Availability

Explanation

Eavesdropping exposes the content of communications to an unauthorized party, which violates confidentiality. Integrity would involve modification, and availability would involve disruption.

Question 10Cyber Security Concepts

Which control is an example of multi-factor authentication?

  1. A password combined with a code from an authenticator app Correct answer.
  2. A security question combined with a PIN
  3. A username combined with a password
  4. A password combined with a second password

Explanation

Multi-factor authentication combines factors from different categories, such as something you know (a password) and something you have (an authenticator app). Two items from the same category count as a single factor.

Question 11Cyber Security Concepts

Why is symmetric encryption often paired with asymmetric encryption in secure communications?

  1. To avoid the need for any key management
  2. To use the speed of symmetric encryption while safely exchanging its key Correct answer.
  3. To eliminate the need for authentication
  4. To make the ciphertext larger and harder to guess

Explanation

Symmetric ciphers are fast but require a shared secret, so asymmetric methods are used to exchange or wrap the symmetric key securely. This hybrid approach balances performance and key distribution.

Question 12Cyber Security Concepts

A user receives a phone call from someone claiming to be IT support who asks for the user's password to fix an issue. What is the best response?

  1. Share only the first half of the password
  2. Refuse and report the call to the security team Correct answer.
  3. Provide the password since IT staff require it
  4. Ask the caller to email a request for the password

Explanation

Legitimate support staff do not need a user's password, so the request is a social-engineering red flag. Refusing and reporting it protects both the user and the organization.

Question 13Cyber Security Concepts

Which action best mitigates the risk of ransomware destroying critical business data?

  1. Renaming the administrator account
  2. Disabling the firewall for faster recovery
  3. Maintaining tested, offline backups Correct answer.
  4. Increasing the password length policy

Explanation

Ransomware encrypts files, so reliable backups that are isolated from the network and verified by testing allow recovery without paying. The other changes do not restore lost data.

Question 14Cyber Security Concepts

What distinguishes a vulnerability from a threat?

  1. A vulnerability is a weakness, while a threat is a potential cause of harm Correct answer.
  2. A vulnerability is always technical, while a threat is always human
  3. They are identical terms used interchangeably
  4. A vulnerability is an attacker, while a threat is a weakness

Explanation

A vulnerability is a weakness that could be exploited, whereas a threat is any potential source or agent that could cause harm. Risk arises when a threat can act on a vulnerability.

Question 15Cyber Security Concepts

An organization segments its network so that the finance department cannot reach engineering servers directly. Which goal does this segmentation primarily serve?

  1. Reducing the impact of a compromise by limiting lateral movement Correct answer.
  2. Simplifying the encryption of stored data
  3. Eliminating the need for user authentication
  4. Increasing the bandwidth available to each department

Explanation

Segmentation restricts which systems can talk to each other, so a compromised host cannot easily reach unrelated resources. It is a containment measure, not a bandwidth or encryption strategy.

Question 16Cyber Security Concepts

Which of these is the strongest indicator that an email may be a phishing attempt?

  1. The sender address domain is subtly misspelled Correct answer.
  2. The message arrives during working hours
  3. The message contains a signature block
  4. The message uses the company logo

Explanation

Look-alike domains that imitate a trusted organization are a classic phishing sign. Logos, timing, and signatures can all appear in legitimate mail and are weak indicators.

Question 17Cyber Security Concepts

What is the purpose of hashing a password before storing it?

  1. To encrypt network traffic during login
  2. To compress the password to save storage
  3. To allow the password to be reversed for support requests
  4. To make the stored value unusable if the database is stolen Correct answer.

Explanation

A cryptographic hash is one-way, so storing only the hash means a stolen database does not directly reveal passwords. Hashing is not reversible, nor is it compression or transport encryption.

Question 18Cyber Security Concepts

Which measure best reduces the risk from lost or stolen mobile devices containing company data?

  1. Storing data only in email attachments
  2. Using a longer Wi-Fi password
  3. Enabling remote wipe and device encryption Correct answer.
  4. Disabling automatic updates

Explanation

Encryption protects data at rest if the device is lost, and remote wipe lets the organization erase data after theft. The other options either weaken security or do not address device loss.

Question 19Cyber Security Concepts

A security team wants to verify that a downloaded file has not been tampered with. Which mechanism is appropriate?

  1. Checking the file's creation date
  2. Comparing a published cryptographic hash of the file Correct answer.
  3. Renaming the file extension
  4. Opening the file in a text editor

Explanation

A cryptographic hash acts as a fingerprint; if the computed hash matches the publisher's value, the file is unchanged. Dates, extensions, and visual inspection do not reliably detect tampering.

Question 20Cyber Security Concepts

Why should an organization avoid using the same password across multiple services?

  1. A breach of one service can expose accounts on other services Correct answer.
  2. It slows down login times
  3. It increases the cost of software licenses
  4. It prevents the use of multi-factor authentication

Explanation

Credential reuse lets attackers apply stolen username-password pairs to other systems, a practice known as credential stuffing. Unique passwords contain the damage to a single service.

Question 21Cyber Security Concepts

Which scenario best illustrates the concept of defense in depth?

  1. Relying on a single very strong firewall
  2. Disabling logging to reduce storage costs
  3. Combining firewalls, endpoint protection, access controls, and user training Correct answer.
  4. Giving all staff administrator rights to simplify support

Explanation

Defense in depth layers multiple independent controls so that failure of one does not expose the whole system. A single control, regardless of strength, is a single point of failure.

Question 22Cyber Security Concepts

An attacker floods a web server with excessive requests until legitimate users cannot connect. Which security objective is being attacked?

  1. Availability Correct answer.
  2. Confidentiality
  3. Non-repudiation
  4. Integrity

Explanation

A denial-of-service attack exhausts resources so that the service is no longer reachable, which targets availability. It does not primarily aim to read or alter data.

Question 23Cyber Security Concepts

A company stores customer data in the cloud. Under a shared responsibility model, what typically remains the customer's responsibility?

  1. Physical security of the data center
  2. Maintaining the underlying hypervisor
  3. Replacing failed server hardware
  4. Managing user accounts and access permissions Correct answer.

Explanation

Cloud providers usually secure the physical infrastructure and platform, while customers remain responsible for their own data, identities, and access configuration. Misconfigured permissions are therefore a customer-side risk.

Question 24Cyber Security Concepts

Which approach best limits the damage an attacker can cause after gaining an initial foothold on a workstation?

  1. Granting broad permissions so users can self-support
  2. Applying least privilege and network segmentation Correct answer.
  3. Using the same local administrator password on all hosts
  4. Disabling security logging to reduce noise

Explanation

Least privilege limits what the compromised account can do, and segmentation limits where it can reach, together constraining lateral movement. Broad rights and shared admin passwords amplify the impact.

Question 25Cyber Security Concepts

A security analyst finds that a public-facing service uses an outdated library with a known exploitable flaw. Which action should be prioritized?

  1. Add the library to the allowlist and continue
  2. Document the flaw and revisit it at the next annual review
  3. Restrict access to the flaw's public advisory
  4. Patch or replace the vulnerable library and verify the fix Correct answer.

Explanation

A known exploitable flaw on an internet-facing service represents immediate risk, so remediation by patching or replacing the component is the priority. Merely documenting or allowlisting it leaves the exposure in place.

Question 26Cyber Security Concepts

Which term describes the assurance that data has not been altered in an unauthorized way?

  1. Confidentiality
  2. Non-repudiation
  3. Availability
  4. Integrity Correct answer.

Explanation

Integrity concerns the accuracy and completeness of data and the assurance that it has not been changed improperly. The other properties address secrecy, uptime, and proof of origin.

Question 27Cyber Security Concepts

A user installs an app from an unofficial website and it secretly sends contact data to a remote server. Which category of malware does this best describe?

  1. Adware
  2. Rootkit
  3. Spyware Correct answer.
  4. Worm

Explanation

Spyware covertly gathers information about a user or device and transmits it to a third party. Adware mainly displays advertising, rootkits hide presence, and worms self-propagate.

Question 28Cyber Security Concepts

Which practice makes a social engineering attack that relies on impersonating a colleague by phone less likely to succeed?

  1. Recording the call without informing the caller
  2. Forwarding the call to voicemail and ignoring it
  3. Speaking more quietly so others cannot overhear
  4. Verifying the caller's identity through an independent channel Correct answer.

Explanation

Social engineering exploits trust, so confirming identity through a separate, known channel breaks the attacker's assumed authority. The other actions do not establish whether the caller is genuine.

Question 29Cyber Security Concepts

Which statement best describes the role of a firewall on a network?

  1. It filters traffic between networks according to defined rules Correct answer.
  2. It scans email attachments for malicious code
  3. It records every keystroke made on a server
  4. It encrypts files stored on user workstations

Explanation

A firewall controls network traffic by permitting or denying it based on configured rules. Encryption, content scanning, and keystroke logging are functions of other tools.

Question 30Cyber Security Concepts

What is the primary purpose of a privacy policy published by an online service?

  1. To give users legal ownership of the provider's servers
  2. To guarantee that the service cannot be breached
  3. To list the technical security controls used by the provider
  4. To explain how personal data is collected, used, and shared Correct answer.

Explanation

A privacy policy informs users about the handling of their personal data, including purposes and sharing. It is a transparency document, not a security guarantee or a transfer of assets.

Question 31Cyber Security Concepts

Which action best reduces the risk posed by a malicious USB drive found in a parking lot?

  1. Plugging it into an isolated computer to inspect the files
  2. Handing it to IT staff without plugging it in Correct answer.
  3. Formatting it on your own laptop before use
  4. Copying its files to a shared network drive for review

Explanation

Unknown removable media should be treated as potentially malicious and given to trained staff without being connected. Connecting it to any system, even briefly, can trigger malicious code.

Question 32Cyber Security Concepts

What does authentication establish about a user?

  1. That the user has permission to read a specific file
  2. That the user's device is free of malware
  3. That the user is who they claim to be Correct answer.
  4. That the user's activity has been logged

Explanation

Authentication verifies identity claims before access is considered. Authorization, logging, and endpoint health are separate concerns handled after or alongside authentication.

Question 33Cyber Security Concepts

Which behavior most clearly indicates that a website is using an encrypted connection?

  1. The site displays a company logo
  2. The site asks for a username and password
  3. The page loads quickly
  4. The address begins with https and a padlock is shown Correct answer.

Explanation

Transport encryption is signaled by HTTPS and a padlock indicator in the browser. Logos, speed, and login prompts say nothing about whether the connection is encrypted.

Question 34Cyber Security Concepts

An employee receives an unexpected message urging immediate payment to a new supplier bank account. Which characteristic most strongly suggests a business email compromise attempt?

  1. The message was sent during business hours
  2. The message was addressed to a distribution list
  3. Urgency combined with a change in payment details Correct answer.
  4. The message contains a formal signature block

Explanation

Business email compromise typically combines pressure to act quickly with a request to alter financial details. Timing, signatures, and distribution lists are common in legitimate mail as well.

Question 35Cyber Security Concepts

Why does salting a password hash improve protection against precomputed lookup attacks?

  1. It makes each stored hash unique even for identical passwords Correct answer.
  2. It encrypts the hash with a shared secret key
  3. It doubles the length of the original password
  4. It prevents users from choosing weak passwords

Explanation

A salt is unique random data added before hashing, so identical passwords produce different hashes and precomputed tables become ineffective. It does not lengthen passwords, encrypt hashes, or enforce policy.

Question 36Cyber Security Concepts

A company wants to ensure that a departed employee can no longer access systems. Which step is most directly effective?

  1. Reviewing the employee's past emails
  2. Reassigning the employee's desk to another worker
  3. Changing the office Wi-Fi password
  4. Disabling the account and revoking credentials on the day of departure Correct answer.

Explanation

Access removal depends on disabling accounts and revoking credentials promptly. Wi-Fi changes, mailbox review, and desk reassignment do not remove the individual's system access.

Question 37Cyber Security Concepts

Which control most directly addresses the risk of an attacker reading data from a stolen backup tape?

  1. Labeling the tape with a serial number
  2. Storing the tape in a locked cabinet
  3. Rotating tapes on a weekly schedule
  4. Encrypting the backup data at rest Correct answer.

Explanation

Encryption at rest keeps data unreadable even if the physical medium is stolen. Physical locks, labels, and rotation schedules help with handling but do not protect the data itself.

Question 38Cyber Security Concepts

Which activity is characteristic of a denial-of-service attack rather than an intrusion attempt?

  1. Installing a backdoor for later access
  2. Guessing passwords until one succeeds
  3. Copying a database to an external server
  4. Overwhelming a service so legitimate users cannot reach it Correct answer.

Explanation

Denial of service aims to make a resource unavailable rather than to gain access or steal data. Password guessing, backdoors, and exfiltration are intrusion-related behaviors.

Question 39Cyber Security Concepts

What is the main security benefit of keeping an offline, tested backup?

  1. It guarantees that no data will ever be lost
  2. Data can be restored even if malware encrypts the live systems Correct answer.
  3. It makes the network faster during an incident
  4. It removes the need for antivirus software

Explanation

An offline copy that has been tested can be used to recover without relying on systems that may be compromised. It does not replace endpoint protection or guarantee zero data loss.

Question 40Cyber Security Concepts

A user connects to a coffee shop Wi-Fi network that has no password. Which risk is most relevant?

  1. The device's battery will drain faster
  2. The device's operating system will update automatically
  3. The device's storage will fill with cached pages
  4. Traffic may be intercepted by others on the same network Correct answer.

Explanation

On an open wireless network, nearby parties may be able to capture unencrypted traffic. Battery, updates, and caching are unrelated to the security exposure.

Question 41Cyber Security Concepts

Which statement best explains why a digital signature provides non-repudiation?

  1. It compresses the message so it travels faster
  2. It binds the signer's private key to the message so only that key holder could have produced it Correct answer.
  3. It hides the message contents from everyone except the recipient
  4. It stores a copy of the message on a public server

Explanation

A signature is created with the signer's private key and verified with the public key, linking the message to the key holder. Confidentiality, compression, and public storage are different functions.

Question 42Cyber Security Concepts

An organization requires that administrators use a separate, privileged account for administrative tasks. What risk does this mainly reduce?

  1. The time needed to reboot servers
  2. Damage from malware running under an everyday user context Correct answer.
  3. The cost of software licensing
  4. The number of help desk tickets

Explanation

Separating privileged accounts limits what malware can do when a user browses or reads email in a lower-privilege context. Licensing, reboot time, and ticket volume are operational, not security, effects.

Question 43Cyber Security Concepts

Which factor makes a password alone a weak form of authentication?

  1. It can be reused, guessed, or captured and then used by someone else Correct answer.
  2. It is stored in the user's memory
  3. It is usually shorter than a web address
  4. It is entered using a keyboard

Explanation

A password is a shared secret that can be reused, guessed, phished, or captured, and possession is not tied to a person. Memory, keyboard entry, and length relative to a URL are not the core weakness.

Question 44Cyber Security Concepts

A company discovers that customer records were posted online after an attacker used valid employee credentials. Which control would most directly have limited this outcome?

  1. Restricting access to customer data to staff who need it Correct answer.
  2. Adding more printers to the office network
  3. Increasing the length of the Wi-Fi password
  4. Scheduling backups more frequently

Explanation

Limiting access to data on a need-to-know basis reduces what a compromised account can reach. Wi-Fi passwords, printers, and backup frequency do not constrain the account's data access.

Question 45Cyber Security Concepts

Which practice best supports the accuracy of security logs during an investigation?

  1. Storing logs only on the affected server
  2. Deleting old logs to save disk space
  3. Allowing all users to edit log files
  4. Synchronizing system clocks and protecting logs from modification Correct answer.

Explanation

Consistent timestamps and tamper protection make logs reliable evidence across systems. Deleting logs, local-only storage, and open editing undermine their value.

Question 46Cyber Security Concepts

Which situation best illustrates a supply chain risk?

  1. A server disk fails and must be replaced
  2. A visitor connects a phone to the guest Wi-Fi
  3. An employee forgets a password and locks an account
  4. A trusted software vendor's update mechanism is compromised to deliver malware Correct answer.

Explanation

Supply chain risk arises when a trusted third party or its distribution channel is compromised, allowing malicious content to reach customers. The other situations are ordinary operational events.

Question 47Cyber Security Concepts

A security team finds that a web application reflects user input back to the browser without encoding, allowing script to run in other users' sessions. Which weakness is present?

  1. Denial of service
  2. Cross-site scripting Correct answer.
  3. Buffer overflow
  4. SQL injection

Explanation

Cross-site scripting occurs when untrusted input reaches the browser without proper encoding, letting attacker script execute in a victim's session. SQL injection targets database queries, and the other options describe different failure modes.

Question 48Cyber Security Concepts

An organization wants to compare the likelihood and impact of identified risks so it can prioritize treatment. Which activity is this?

  1. Incident response
  2. Risk assessment Correct answer.
  3. Asset inventory
  4. Penetration testing

Explanation

Risk assessment evaluates likelihood and impact to rank risks for treatment decisions. Incident response handles events, penetration testing probes defenses, and asset inventory records what exists.

Question 49Cyber Security Concepts

Which design choice best limits the impact of a compromised encryption key used for stored archives?

  1. Using separate keys per archive with a managed rotation process Correct answer.
  2. Using one long-lived key for every archive
  3. Sharing the key with all staff for convenience
  4. Storing the key alongside each archive

Explanation

Key separation and rotation confine the blast radius of a compromised key to fewer objects and reduce its useful lifetime. A single long-lived key, co-located keys, and broad sharing all increase exposure.

Question 50Cyber Security Concepts

An analyst observes repeated failed logins from many source addresses against several accounts, followed by one success. Which interpretation is most reasonable?

  1. A harmless network scan by a monitoring tool
  2. A distributed password-guessing campaign that succeeded Correct answer.
  3. A routine backup job running late
  4. A scheduled password expiry process

Explanation

Many sources trying many accounts and then one success is consistent with a distributed guessing attack that found valid credentials. Backups, expiry, and monitoring scans do not produce that pattern.