I85PREP
⌘ K
Google Cybersecurity study materials
Google Cybersecurity study resources

Google Cybersecurity practice questions

One question at a time. Build your Google Cybersecurity understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Foundations of Cybersecurity

An unauthorized user gains access to a payroll system and changes the amount listed on a financial record. Which element of the CIA triad has been violated?

  1. Confidentiality
  2. Availability
  3. Authentication
  4. Integrity Correct answer.

Explanation

Integrity means data is accurate, complete, and unaltered by unauthorized parties. Modifying a stored value corrupts the trustworthiness of the data, which is an integrity failure even if the attacker also saw the record.

Question 2Foundations of Cybersecurity

Which practice best protects the confidentiality of data on a laptop that might be lost or stolen?

  1. Configuring automatic operating system updates
  2. Encrypting the drive with full-disk encryption Correct answer.
  3. Requiring a monthly password change
  4. Storing nightly backups on a network share

Explanation

Encryption renders stored data unreadable without the key, so a thief who obtains the physical device cannot read its contents. This directly addresses disclosure risk, which is the concern of confidentiality.

Question 3Foundations of Cybersecurity

Which statement describes the principle of least privilege?

  1. Access is reviewed only after a security incident occurs
  2. Access is granted whenever a manager informally requests it
  3. Every employee receives administrative access to simplify support requests
  4. Users receive only the access required to perform their job tasks Correct answer.

Explanation

Least privilege limits each account to the minimum rights needed for its work, which shrinks the damage an attacker or careless user can cause. Access is typically tied to job role and reviewed regularly rather than granted broadly.

Question 4Foundations of Cybersecurity

Which data element is classified as sensitive personally identifiable information (SPII)?

  1. Office building location
  2. Job title
  3. Public social media handle
  4. Medical record number Correct answer.

Explanation

SPII is a subset of PII that requires stricter handling because its exposure can cause serious harm, such as identity theft or discrimination. Health and medical identifiers fall into that category, while generic workplace details do not.

Question 5Foundations of Cybersecurity

A group defaces a company's public website to protest the company's environmental policies. Which threat actor type best describes this group?

  1. Organized crime group
  2. Insider threat
  3. Nation-state actor
  4. Hacktivist Correct answer.

Explanation

Hacktivists are motivated by ideological or political goals and often seek publicity for a cause. Defacement carried out as a protest matches that motivation rather than financial gain or espionage.

Question 6Foundations of Cybersecurity

In the NIST Cybersecurity Framework, which core function covers actions taken to limit the impact of a potential security event, such as access control and awareness training?

  1. Protect Correct answer.
  2. Detect
  3. Recover
  4. Identify

Explanation

The Protect function covers safeguards that reduce the likelihood and impact of incidents, including access control, training, and protective technology. Identify concerns asset and risk understanding, Detect concerns discovering events, and Recover concerns restoration.

Question 7Foundations of Cybersecurity

Which phase of the incident response lifecycle involves establishing tools, policies, and training before a security event occurs?

  1. Eradication
  2. Preparation Correct answer.
  3. Post-incident activity
  4. Containment

Explanation

Preparation is the phase in which an organization builds the plans, tooling, communication paths, and skills it will rely on during an incident. The later phases assume that this groundwork already exists.

Question 8Foundations of Cybersecurity

Which of the following is a technical security control?

  1. A firewall rule that blocks inbound traffic Correct answer.
  2. A posted acceptable-use policy
  3. A security awareness training program
  4. A pre-employment background check

Explanation

Technical controls are implemented through technology such as firewalls, encryption, and access management systems. Policies, training, and background checks are administrative controls managed through people and process.

Question 9Foundations of Cybersecurity

Which statement correctly distinguishes a regulation from a security framework?

  1. A regulation lists technical configurations, whereas a framework lists legal penalties
  2. A regulation is published by an industry consortium, whereas a framework is enforced by governments
  3. A regulation applies only to small businesses, whereas a framework applies only to large enterprises
  4. A regulation is an enforceable law, whereas a framework is voluntary guidance Correct answer.

Explanation

Regulations such as GDPR carry legal force, and non-compliance can bring penalties. Frameworks such as NIST publications or ISO standards are guidance that organizations adopt voluntarily or because another party requires it.

Question 10Foundations of Cybersecurity

Which task is most typical of an entry-level security operations center analyst?

  1. Running external penetration tests against production systems
  2. Writing the organization's incident response policy
  3. Approving the organization's annual security budget
  4. Monitoring alerts and escalating suspected incidents Correct answer.

Explanation

Tier-one SOC analysts triage alerts from monitoring tools and escalate anything that looks suspicious to more senior staff. Budget, policy authorship, and offensive testing are handled by other roles.

Question 11Foundations of Cybersecurity

What is the primary purpose of a security information and event management (SIEM) system?

  1. To collect and correlate logs to detect threats Correct answer.
  2. To automatically patch vulnerable operating systems
  3. To encrypt data at rest across the network
  4. To replace perimeter firewalls

Explanation

A SIEM ingests log and event data from many sources, normalizes it, and applies correlation rules to surface suspicious patterns for analysts. It supports detection and investigation rather than prevention or remediation.

Question 12Foundations of Cybersecurity

What does the concept of defense in depth describe?

  1. Layering independent controls so no single failure exposes everything Correct answer.
  2. Encrypting all data and treating encryption as the only safeguard
  3. Relying on one well-configured perimeter firewall to block all attacks
  4. Removing overlapping controls so that each layer is unique

Explanation

Defense in depth assumes any one control can fail, so multiple independent layers are combined across people, process, and technology. An attacker must then defeat several different safeguards to succeed.

Question 13Foundations of Cybersecurity

An employee receives an email that appears to come from the IT help desk and asks them to click a link to reset their password. Which attack does this describe?

  1. Ransomware
  2. SQL injection
  3. Phishing Correct answer.
  4. Denial of service

Explanation

Phishing uses fraudulent messages that impersonate a trusted party to trick a recipient into revealing credentials or clicking a malicious link. The impersonation of internal IT staff is a classic phishing pattern.

Question 14Foundations of Cybersecurity

Which statement best describes ransomware?

  1. Software that secretly records keystrokes and sends them to an attacker
  2. Malware that encrypts files and demands payment for the decryption key Correct answer.
  3. Software that displays unwanted advertisements on a user's screen
  4. Traffic flooding that makes a service unavailable

Explanation

Ransomware denies access to data, usually by encryption, and then demands payment in exchange for restoring it. The extortion demand is what distinguishes it from other malware families.

Question 15Foundations of Cybersecurity

A tool repeatedly submits thousands of password guesses to a login form until one is accepted. Which attack is this?

  1. Cross-site scripting
  2. Brute force Correct answer.
  3. Phishing
  4. Tailgating

Explanation

Brute force attacks rely on systematic trial-and-error guessing of credentials or keys until a correct value is found. Account lockout, rate limiting, and strong password requirements are common mitigations.

Question 16Foundations of Cybersecurity

A server runs a web application that has not been patched, and attackers are actively scanning the internet for that flaw. Which term describes the unpatched application itself?

  1. Threat
  2. Vulnerability Correct answer.
  3. Impact
  4. Risk

Explanation

A vulnerability is a weakness in a system that could be exploited. The threat is the actor or event that could exploit it, and risk expresses the likelihood and impact of that happening.

Question 17Foundations of Cybersecurity

During a security assessment, which team typically plays the role of the attacker?

  1. Purple team
  2. Blue team
  3. Compliance team
  4. Red team Correct answer.

Explanation

Red teams simulate adversarial activity to test detection and response capabilities. Blue teams defend and monitor, while purple teams focus on improving collaboration between the two.

Question 18Foundations of Cybersecurity

A security analyst finds a coworker's username and password in a shared document. What is the ethical action?

  1. Use the credentials to check whether the coworker's account is exposed
  2. Ignore it because the account does not belong to the analyst
  3. Post the finding publicly to warn other employees
  4. Report the exposure through the proper internal channel without using the credentials Correct answer.

Explanation

Security professionals are expected to act only within granted authorization and to protect the organization and its users. Reporting the exposure privately lets the issue be fixed without unauthorized access or public disclosure.

Question 19Foundations of Cybersecurity

What does adopting an 'assume breach' mindset mean for defenders?

  1. Designing and monitoring as though an attacker is already inside the network Correct answer.
  2. Assuming attackers cannot reach internal systems once the perimeter is secured
  3. Treating every alert as a false positive to avoid alert fatigue
  4. Assuming users will always follow the security policy

Explanation

Assume breach accepts that perimeter defenses may fail and pushes teams to segment networks, monitor internal activity, and limit lateral movement. It shifts attention from prevention alone to detection and containment.

Question 20Foundations of Cybersecurity

Which item is an example of an administrative control?

  1. Disk encryption on employee laptops
  2. A badge reader on the data center door
  3. An intrusion detection system
  4. A mandatory vacation policy for staff who handle payments Correct answer.

Explanation

Administrative controls are policies, procedures, and personnel practices that direct how work is done. Forced time away from sensitive duties is a classic administrative safeguard against concealed fraud.

Question 21Foundations of Cybersecurity

Which principle is central to a zero trust architecture?

  1. Every access request is verified regardless of network location Correct answer.
  2. Internal network traffic is trusted by default
  3. A single strong perimeter firewall is sufficient
  4. Users are authenticated once per year

Explanation

Zero trust removes implicit trust based on being inside the network and requires continuous verification of identity, device, and context for each request. This limits lateral movement after a compromise.

Question 22Foundations of Cybersecurity

Which item is best described as an attack vector?

  1. A written security policy
  2. A removable USB drive Correct answer.
  3. A nightly backup schedule
  4. A firewall rule set

Explanation

An attack vector is a pathway or means by which an attacker can gain access to a system. Removable media is a known pathway for delivering malware or exfiltrating data.

Question 23Foundations of Cybersecurity

Which statement about cryptographic hashing is accurate?

  1. A hash can be reversed with the correct key
  2. A hash is a fixed-length value that changes if the input changes Correct answer.
  3. Hashing and symmetric encryption perform the same operation
  4. Hashing conceals data so the owner can recover it later

Explanation

A hash function maps input of any size to a fixed-length digest, and even a tiny change to the input produces a different digest. Hashes are one-way, so they verify integrity rather than provide reversible protection.

Question 24Foundations of Cybersecurity

Why do security teams retain and review system logs?

  1. Logs replace the need for user authentication
  2. Logs provide a record of activity that supports detection and investigation Correct answer.
  3. Logs automatically remove malware from infected hosts
  4. Logs encrypt network traffic while it is in transit

Explanation

Logs capture who did what and when across systems, which supports alerting, timeline reconstruction, and root-cause analysis. They are evidence and context, not a preventive or corrective mechanism on their own.

Question 25Foundations of Cybersecurity

Why is a scripting language such as Python commonly used by security analysts?

  1. It encrypts every file on a server by default
  2. It removes the need for security policies
  3. It can automate repetitive tasks such as parsing log files Correct answer.
  4. It guarantees that systems cannot be compromised

Explanation

Scripting lets analysts automate repetitive analysis, such as extracting indicators from large log files or updating access lists. Automation improves speed and consistency but does not replace controls or governance.

Question 26Play It Safe: Manage Security Risks

Which of the eight CISSP security domains focuses on defining security goals and objectives, risk mitigation, compliance, business continuity, and the legal and regulatory environment?

  1. Security and risk management Correct answer.
  2. Identity and access management
  3. Asset security
  4. Security assessment and testing

Explanation

The security and risk management domain covers setting security goals, mitigating risk, meeting compliance obligations, planning for business continuity, and understanding laws and regulations. The remaining domains address data protection, control testing, and access to systems.

Question 27Play It Safe: Manage Security Risks

Which core function of the NIST Cybersecurity Framework involves developing safeguards to secure critical infrastructure and assets?

  1. Identify
  2. Protect Correct answer.
  3. Detect
  4. Recover

Explanation

The Protect function covers the safeguards that limit or contain the impact of a security event, such as access control, awareness training, and data security. Identify is about understanding assets and risk, Detect is about finding events, and Recover is about restoring normal operations.

Question 28Play It Safe: Manage Security Risks

Which element of the CIA triad ensures that data and systems are accessible to authorized users whenever they are needed?

  1. Non-repudiation
  2. Availability Correct answer.
  3. Confidentiality
  4. Integrity

Explanation

Availability means that systems and data are reachable by authorized users when required, which is why backups and redundancy support it. Confidentiality keeps data hidden from those without permission, and integrity keeps it accurate and unaltered.

Question 29Play It Safe: Manage Security Risks

An attacker telephones an employee, claims to be from the IT help desk, and asks the employee to read out a password. Which term describes this attack?

  1. Smishing
  2. Vishing Correct answer.
  3. Phishing
  4. Whaling

Explanation

Vishing is voice phishing: the attacker uses a phone call to pressure a target into revealing information or taking an action. Smishing relies on text messages, while whaling describes the seniority of the target rather than the channel used.

Question 30Play It Safe: Manage Security Risks

Which type of malware spreads by itself across networks without requiring a user to open a file or click a link?

  1. Trojan horse
  2. Virus
  3. Ransomware
  4. Worm Correct answer.

Explanation

A worm self-replicates and moves between systems on its own, exploiting network services rather than relying on human interaction. Viruses need a user to execute an infected file, and trojans disguise themselves as legitimate software.

Question 31Play It Safe: Manage Security Risks

In security terms, which statement best defines risk?

  1. A gap between an organization's controls and a standard
  2. The likelihood of a threat exploiting a vulnerability Correct answer.
  3. Any circumstance that can negatively affect an asset
  4. A weakness in a system that a threat could exploit

Explanation

Risk combines the probability that a threat will act on a vulnerability with the resulting impact on the organization. The weakness itself is a vulnerability, while the actor or event that could exploit it is a threat.

Question 32Play It Safe: Manage Security Risks

Which threat actor is most likely to be motivated by a desire to publicize a political or social cause?

  1. A hacktivist Correct answer.
  2. An insider threat
  3. An organized crime group
  4. A state-sponsored actor

Explanation

Hacktivists pursue ideological agendas and often want visibility for a cause through website defacement or data leaks. State-sponsored actors usually serve government intelligence or disruption goals, and organized crime groups are driven mainly by profit.

Question 33Play It Safe: Manage Security Risks

Which type of control is designed to restore systems to normal operation after an incident has occurred?

  1. Deterrent
  2. Preventive
  3. Detective
  4. Corrective Correct answer.

Explanation

Corrective controls reduce the harm of an event and help return systems to normal, for example restoring data from backups or applying emergency patches. Preventive controls stop events, detective controls identify them, and deterrent controls discourage attackers.

Question 34Play It Safe: Manage Security Risks

Writing an organization-wide acceptable use policy that defines how employees may use company systems is an example of which control category?

  1. Physical
  2. Technical
  3. Managerial Correct answer.
  4. Operational

Explanation

Managerial controls are the policies, procedures, and administrative decisions that direct how security is governed and run. Operational controls are the day-to-day human actions that carry out those policies.

Question 35Play It Safe: Manage Security Risks

Which option best describes protected health information (PHI)?

  1. Health data created or received by a covered healthcare provider Correct answer.
  2. Data a company collects about employee job performance
  3. Any data that can be used to identify a specific individual
  4. Financial records that a bank keeps about its customers

Explanation

PHI is health-related data, including a person's condition, treatment, or payment for care, created or received by a healthcare provider, plan, or clearinghouse. Identifying data in general is personal data, which is broader than PHI.

Question 36Play It Safe: Manage Security Risks

An organization wants an independent review confirming its controls meet required standards and surfacing gaps before a regulator inspects it. Which activity best fits this need?

  1. A penetration test of internet-facing applications
  2. A tabletop exercise with the incident response team
  3. An internal security audit run by the organization's own team
  4. An external security audit performed by an outside firm Correct answer.

Explanation

An external audit is performed by an independent third party, which gives an objective view of compliance with standards and regulations; internal audits are run by the organization's own staff. Penetration tests and tabletop exercises probe specific technical or procedural weaknesses rather than overall compliance.

Question 37Play It Safe: Manage Security Risks

What is the main function of a security information and event management (SIEM) tool?

  1. It collects and correlates log data from many sources and raises alerts Correct answer.
  2. It automatically blocks malicious network traffic before it reaches any internal server
  3. It replaces the need for an incident response plan
  4. It encrypts sensitive data stored on endpoints and servers

Explanation

A SIEM ingests logs and event data from across the environment, correlates it, and surfaces alerts and dashboards so analysts can spot potential incidents. Automated blocking and encryption are separate controls, and a SIEM supports rather than replaces incident response planning.

Question 38Play It Safe: Manage Security Risks

Which capability best distinguishes a SOAR platform from a SIEM?

  1. Automated execution of predefined response actions Correct answer.
  2. Centralized storage of log data from many sources
  3. Detection of anomalies through correlation rules
  4. Dashboards that visualize security trends over time

Explanation

SOAR platforms take alerts and data gathered by tools such as a SIEM and run documented playbooks to respond automatically or with limited human involvement. Log storage, dashboards, and correlation rules are core SIEM capabilities.

Question 39Play It Safe: Manage Security Risks

What is an incident response playbook?

  1. Documented steps for responding to a specific type of incident Correct answer.
  2. A list of employees who are authorized to access the SIEM console
  3. A summary of the organization's legal and regulatory obligations
  4. A log that records every security incident from the past year

Explanation

A playbook documents who does what, and in what order, when a particular kind of incident occurs, such as which alerts to check and when to isolate a host. It is a procedure rather than a record, an access list, or a legal summary.

Question 40Play It Safe: Manage Security Risks

A legacy server runs an application with a known flaw, and exploit code for that flaw is publicly available. Which statement is accurate?

  1. The risk is unchanged because the server is not internet-facing
  2. The server has no risk until an attacker actually succeeds
  3. The flaw is a vulnerability and the exploit raises the risk Correct answer.
  4. The flaw is a threat and the exploit code is a vulnerability

Explanation

The weakness is the vulnerability, while anything that can act on it, such as an attacker using public exploit code, is the threat; widely available exploit code raises the likelihood of exploitation and therefore the risk. Risk exists as soon as a credible threat could act, whether or not an attack has succeeded.

Question 41Play It Safe: Manage Security Risks

A company cannot enforce multi-factor authentication on a legacy application, so instead it isolates the application on a segmented network and closely monitors all traffic to it. Which term best describes this approach?

  1. A preventive control that removes the vulnerability
  2. A compensating control that reduces risk another way Correct answer.
  3. A physical control that restricts access to the server room
  4. A detective control that replaces authentication

Explanation

A compensating control is an alternative safeguard used when the preferred control cannot be implemented, bringing risk down to an acceptable level without fixing the underlying weakness. Segmentation and monitoring reduce exposure but do not remove the missing authentication.

Question 42Play It Safe: Manage Security Risks

What is the primary purpose of the OWASP Top 10?

  1. It sets legally binding requirements for payment card processing
  2. It certifies developers in secure coding practices
  3. It ranks organizations by the strength of their security programs
  4. It raises awareness of critical web application security risks Correct answer.

Explanation

The OWASP Top 10 is an awareness document listing the most critical risks to web applications, such as broken access control and injection, so teams can prioritize remediation. It is not a certification, a company ranking, or a legal mandate.

Question 43Play It Safe: Manage Security Risks

Which regulation primarily governs the protection of patient health records in the United States?

  1. GDPR
  2. PCI DSS
  3. HIPAA Correct answer.
  4. ISO 27001

Explanation

HIPAA sets the requirements for safeguarding protected health information in the United States. GDPR governs personal data of individuals in the EU, PCI DSS covers cardholder data, and ISO 27001 is a voluntary management system standard.

Question 44Play It Safe: Manage Security Risks

Which action most directly reduces an organization's attack surface?

  1. Leaving default accounts and services enabled for convenience
  2. Allowing all employees to hold administrator rights
  3. Decommissioning unused services and closing unused ports Correct answer.
  4. Disabling logging on internal systems

Explanation

The attack surface is the total set of points where an attacker could attempt entry, so removing unnecessary services and closing unused ports shrinks it. Extra privileges, default accounts, and missing logs all enlarge the surface instead.

Question 45Play It Safe: Manage Security Risks

An organization labels all of its data as public, internal-only, confidential, or restricted. What is the main security benefit of this practice?

  1. It makes every piece of data equally available to all employees
  2. It guarantees that confidential data can never be breached by an attacker
  3. It removes the need for access controls on stored data
  4. It sets how much protection and which access rules each asset needs Correct answer.

Explanation

Classification shows how sensitive each asset is so the organization can apply proportionate controls, such as limiting confidential data to a need-to-know group. Labeling data does not by itself prevent breaches or remove the need for access controls.

Question 46Play It Safe: Manage Security Risks

Which characteristic best describes ransomware?

  1. It records keystrokes and sends them to an attacker
  2. It self-replicates across networks without any user action
  3. It encrypts data and demands payment for a decryption key Correct answer.
  4. It hides inside a legitimate program and gives attackers remote access

Explanation

Ransomware denies access to data, usually through encryption, and demands payment in exchange for restoring it. Remote access, self-replication, and keystroke capture describe backdoors, worms, and spyware respectively.

Question 47Play It Safe: Manage Security Risks

Which of the following is a technical control?

  1. A visitor sign-in log at reception
  2. A firewall rule that blocks unauthorized traffic Correct answer.
  3. A clean desk policy for staff
  4. A security awareness training program

Explanation

Technical controls are implemented through technology such as firewalls, encryption, and antivirus software. Policies, training, and visitor logs are managerial or operational controls.

Question 48Play It Safe: Manage Security Risks

An attacker impersonates a company executive in an email and asks the finance team to wire funds urgently. Which term best describes this attack?

  1. Business email compromise Correct answer.
  2. Watering hole attack
  3. Shoulder surfing
  4. Credential stuffing

Explanation

Business email compromise uses a spoofed or hijacked email account to impersonate a trusted figure and trick employees into transferring money or data. It relies on social engineering rather than technical exploitation of a network.

Question 49Play It Safe: Manage Security Risks

Which threat actor poses the greatest risk of misusing legitimate access credentials?

  1. A hacktivist
  2. An insider threat Correct answer.
  3. A script kiddie
  4. A nation-state actor

Explanation

Insiders already hold authorized access to systems and data, so they can misuse those credentials without needing to break in. External actors must first obtain access, often through phishing or exploitation.

Question 50Play It Safe: Manage Security Risks

What is the purpose of a bug bounty program?

  1. To pay customers who report slow website performance
  2. To hire security engineers from outside the company
  3. To insure the company against the cost of a breach
  4. To reward researchers for reporting vulnerabilities responsibly Correct answer.

Explanation

A bug bounty program pays external researchers for finding and disclosing vulnerabilities under agreed rules so that flaws are fixed before attackers exploit them. It is a vulnerability disclosure mechanism, not insurance, recruiting, or a performance program.