I85PREP
⌘ K
ICDL Cyber Security study materials
ICDL Cyber Security study resources

ICDL Cyber Security (ICDL) practice questions

One question at a time. Build your ICDL Cyber Security understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security concepts

What does the term 'confidentiality' mean in the CIA triad of information security?

  1. Data is complete and unaltered
  2. Data is stored in encrypted backups
  3. Data is only accessible to authorized parties Correct answer.
  4. Data is always available when needed

Explanation

Confidentiality ensures that information is disclosed only to those with a legitimate right to access it, typically enforced through access controls and encryption. Availability and integrity describe different properties of the triad.

Question 2Security concepts

Which security property is violated when an attacker secretly alters a bank transaction record?

  1. Non-repudiation
  2. Confidentiality
  3. Integrity Correct answer.
  4. Availability

Explanation

Integrity means data remains accurate and has not been modified without authorization. Unauthorized alteration of a record directly breaks integrity.

Question 3Security concepts

What is the primary purpose of a firewall on a network?

  1. To encrypt data stored on disk
  2. To filter incoming and outgoing traffic based on rules Correct answer.
  3. To scan files for known malware signatures
  4. To create backups of system configurations

Explanation

A firewall inspects network traffic and permits or blocks it according to a configured rule set, forming a boundary between network segments. Malware scanning, disk encryption, and backups are handled by other tools.

Question 4Security concepts

Which type of malware typically disguises itself as legitimate software to trick users into installing it?

  1. Rootkit
  2. Worm
  3. Trojan horse Correct answer.
  4. Adware

Explanation

A Trojan horse presents itself as useful or legitimate software so the user installs it voluntarily, after which hidden malicious functions run. The defining trait is deception about its true purpose.

Question 5Security concepts

What distinguishes a worm from a virus?

  1. A worm cannot cause any damage to data
  2. A worm only affects mobile phones
  3. A worm requires a user to open an email attachment
  4. A worm spreads across networks on its own without a host file Correct answer.

Explanation

A worm is self-replicating and propagates across networks without needing to attach to a host program or be triggered by a user. A virus typically requires a host file and some user action to spread.

Question 6Security concepts

What is the defining characteristic of a phishing attack?

  1. Intercepting traffic on an unsecured wireless network
  2. Guessing passwords using a large dictionary list
  3. Flooding a server with traffic to exhaust its resources
  4. Deceiving users into revealing information via fraudulent messages Correct answer.

Explanation

Phishing uses fraudulent communications that impersonate a trusted party to trick recipients into disclosing credentials or other sensitive data. The deception of the human target is central to the technique.

Question 7Security concepts

An employee receives a call from someone claiming to be from IT support who asks for the employee's password to 'fix a server issue'. Which attack does this represent?

  1. Social engineering Correct answer.
  2. Denial of service
  3. SQL injection
  4. Man-in-the-middle

Explanation

The caller manipulates the employee's trust and authority expectations to obtain a credential. This exploitation of human behavior rather than technical flaws is social engineering.

Question 8Security concepts

What is the main goal of ransomware?

  1. Secretly recording keystrokes to capture passwords
  2. Displaying unwanted advertisements on the screen
  3. Redirecting web searches to sponsored sites
  4. Encrypting files and demanding payment for the decryption key Correct answer.

Explanation

Ransomware blocks access to data, usually by encryption, and demands payment in exchange for restoring access. The extortion model is its defining feature.

Question 9Security concepts

What is the primary function of antivirus software?

  1. Encrypting all outgoing email
  2. Filtering network packets by port number
  3. Detecting and removing known malicious programs Correct answer.
  4. Managing user account permissions

Explanation

Antivirus software scans files and running processes for malicious code, typically using signatures and heuristics, and then blocks or removes it. The other listed functions belong to different security technologies.

Question 10Security concepts

Which practice best reduces the risk of an attacker reusing a stolen password on other accounts?

  1. Writing all passwords in a shared document
  2. Changing the password only once a year
  3. Using a different strong password for each account Correct answer.
  4. Reusing one complex password everywhere

Explanation

Unique passwords per account prevent a breach at one service from granting access to others. Password reuse is the factor that lets a single stolen credential compromise many accounts.

Question 11Security concepts

What does multi-factor authentication require?

  1. Two or more different types of evidence to verify identity Correct answer.
  2. A single hardware token used alone
  3. A password longer than sixteen characters
  4. A password changed every thirty days

Explanation

Multi-factor authentication combines factors from different categories, such as something you know, something you have, and something you are. Combining distinct factor types substantially raises the effort needed to impersonate a user.

Question 12Security concepts

Which of the following is an example of a biometric authentication factor?

  1. A one-time code from an authenticator app
  2. A memorized passphrase
  3. A fingerprint scan Correct answer.
  4. A smart card inserted into a reader

Explanation

Biometrics verify identity using physical characteristics such as fingerprints, iris patterns, or facial features. Knowledge-based and possession-based items belong to other factor categories.

Question 13Security concepts

What is the role of encryption in protecting data?

  1. It permanently deletes data after a set period
  2. It records who accessed a file and when
  3. It verifies that a file has not been altered
  4. It makes data unreadable to anyone without the correct key Correct answer.

Explanation

Encryption transforms plaintext into ciphertext so that only holders of the correct key can recover the original content. This protects confidentiality even if the data is intercepted or stolen.

Question 14Security concepts

A company wants data on a stolen laptop's disk to remain unreadable to the thief. Which control directly addresses this?

  1. A firewall rule set
  2. Full-disk encryption Correct answer.
  3. A screen lock timeout
  4. An intrusion detection system

Explanation

Full-disk encryption renders stored data unreadable without the decryption key, so physical theft of the device does not expose the contents. Other controls address different threat channels.

Question 15Security concepts

What is the purpose of hashing a password before storing it?

  1. To compress the password to save disk space
  2. To encrypt network traffic between client and server
  3. To allow administrators to read users' passwords
  4. To make it computationally infeasible to recover the original password Correct answer.

Explanation

A cryptographic hash is a one-way function, so storing only the hash means the original password cannot be derived from the stored value. This limits the damage if the password database is stolen.

Question 16Security concepts

Which statement best describes a zero-day vulnerability?

  1. A flaw that is exploited before a fix is available Correct answer.
  2. A flaw that can only be triggered by an administrator
  3. A flaw that has been publicly known for over a year
  4. A flaw that only affects systems with no antivirus

Explanation

A zero-day is a previously unknown vulnerability for which no patch yet exists at the time of exploitation, leaving defenders with no vendor fix to apply. The defining element is the absence of an available remedy when the attack occurs.

Question 17Security concepts

What is a patch in the context of software security?

  1. An update that fixes a known vulnerability or defect Correct answer.
  2. A backup copy of a database
  3. A policy that defines password length
  4. A tool that encrypts a hard drive

Explanation

A patch is a vendor-supplied update that corrects defects, including security vulnerabilities, in installed software. Applying patches promptly closes known avenues of attack.

Question 18Security concepts

Why is prompt patching important for reducing organizational risk?

  1. It closes known vulnerabilities before attackers can exploit them Correct answer.
  2. It eliminates the need for network firewalls
  3. It removes the need for user awareness training
  4. It guarantees that no new vulnerabilities will appear

Explanation

Once a vulnerability is publicly disclosed, attackers can quickly weaponize it, so installing the vendor fix shrinks the window of exposure. Patching addresses known flaws but does not replace other layered controls.

Question 19Security concepts

What is the main objective of a denial-of-service attack?

  1. To steal confidential customer records
  2. To impersonate a user after stealing credentials
  3. To make a service unavailable to legitimate users Correct answer.
  4. To encrypt files and demand a ransom

Explanation

A denial-of-service attack overwhelms a system or network so that it cannot serve legitimate requests, harming availability. The other options describe confidentiality- or integrity-focused attacks.

Question 20Security concepts

Which scenario best illustrates a man-in-the-middle attack?

  1. An attacker secretly relays traffic between two parties who believe they are communicating directly Correct answer.
  2. A server is flooded with requests until it crashes
  3. A malicious program encrypts files on a workstation
  4. A user receives a fraudulent invoice email asking for payment

Explanation

In a man-in-the-middle attack the adversary positions itself between two communicating parties, intercepting or altering traffic while each side believes it is talking directly to the other. This is distinct from deception by message or by resource exhaustion.

Question 21Security concepts

Which of the following is a strong indicator of a phishing email?

  1. The message is addressed to you by your correct full name
  2. The email contains your organization's logo
  3. The sender's domain is subtly misspelled and the message urges immediate action Correct answer.
  4. The message arrives during normal business hours

Explanation

Lookalike sender domains combined with urgency are classic phishing signals that push recipients to act before verifying. Correct personalization, logos, and timing can be imitated or coincidental and are not reliable indicators.

Question 22Security concepts

What does the principle of least privilege require?

  1. Every user must change roles each quarter
  2. All users share a single administrator account
  3. Users receive only the access rights needed for their tasks Correct answer.
  4. Access rights are granted to everyone by default

Explanation

Least privilege limits each account to the minimum permissions required to perform its function, which reduces the impact of a compromised account. Broad or shared access increases the blast radius of any incident.

Question 23Security concepts

An employee in the sales department can open the payroll database and edit salary records. Which security principle is being violated?

  1. Availability
  2. Data integrity
  3. Non-repudiation
  4. Least privilege Correct answer.

Explanation

The sales employee holds access far beyond what the job requires, which is a direct breach of least privilege. Restricting permissions to job-relevant resources limits both accidental and malicious misuse.

Question 24Security concepts

What is the purpose of security awareness training for employees?

  1. To help staff recognize and respond to threats such as phishing Correct answer.
  2. To configure firewall rules automatically
  3. To replace the need for antivirus software
  4. To encrypt data at rest on servers

Explanation

Awareness training builds the human layer of defense by teaching staff to spot suspicious messages and follow reporting procedures. It complements rather than replaces technical controls.

Question 25Security concepts

Why is it risky to reuse the same password across multiple websites?

  1. It prevents the use of multi-factor authentication
  2. It makes each individual password harder to remember
  3. It slows down the login process on each site
  4. A breach at one site can expose credentials valid on other sites Correct answer.

Explanation

When one service is breached, attackers replay the stolen credentials against other services in credential-stuffing attacks. Unique passwords contain the damage to a single account.

Question 26Security concepts

Which type of malware is designed to spread itself automatically across networks without needing a user to open a file or click a link?

  1. A trojan
  2. Spyware
  3. A rootkit
  4. A worm Correct answer.

Explanation

A worm is self-replicating malware that propagates across networks on its own, exploiting reachable services rather than relying on user action. The other categories depend on user execution, concealment, or data collection rather than autonomous spread.

Question 27Security concepts

Which security control is a physical measure rather than a logical or administrative one?

  1. A file permission list
  2. A firewall rule set
  3. A locked server-room door Correct answer.
  4. A password policy

Explanation

Physical controls act on the tangible environment, such as barriers and locks that restrict access to equipment. Firewalls, password policies, and file permissions are logical or administrative controls that operate on systems and behaviour.

Question 28Security concepts

What is the main purpose of a firewall on a network boundary?

  1. To filter traffic against defined rules Correct answer.
  2. To encrypt files stored on servers
  3. To scan email attachments for malware
  4. To record keystrokes for auditing

Explanation

A firewall inspects traffic crossing a boundary and permits or blocks it according to configured rules. Its core function is traffic control, while malware scanning, encryption, and keystroke logging are performed by other tools.

Question 29Security concepts

A user receives an email that appears to come from their bank but the link actually leads to a look-alike site that captures login details. Which security concept does this best illustrate?

  1. Social engineering Correct answer.
  2. SQL injection
  3. Brute-force attack
  4. Privilege escalation

Explanation

Social engineering manipulates people into disclosing information or taking unsafe actions, and deceptive messages with fraudulent links are a classic form. The other options are technical attacks against systems rather than manipulation of a person.

Question 30Security concepts

An organization stores backup tapes in an off-site warehouse. Which threat is most directly reduced by keeping backups off-site?

  1. Theft of credentials through keylogging
  2. Loss of data when a disaster destroys the primary site Correct answer.
  3. Infection of workstations by ransomware
  4. Interception of traffic on the local network

Explanation

Off-site storage ensures a copy of data survives an event that destroys the primary location, such as fire or flood. The other threats concern credentials, endpoint infection, or network traffic and are not addressed by relocating backup media.

Question 31Security concepts

What distinguishes a vulnerability from a threat in risk assessment?

  1. A vulnerability is a control; a threat is the policy that enforces it
  2. A vulnerability is a weakness that can be exploited; a threat is anything that could exploit it Correct answer.
  3. A vulnerability is a legal requirement; a threat is the penalty for breach
  4. A vulnerability is an attacker; a threat is the damage they cause

Explanation

A vulnerability is an internal weakness in a system or process, while a threat is an external or internal actor or event with the potential to exploit that weakness. Risk arises when a threat can act on a vulnerability.

Question 32Security concepts

A company classifies customer records as confidential. Which action best applies that classification in practice?

  1. Publishing the records on the intranet for transparency
  2. Emailing the records to all staff as an attachment
  3. Restricting access to staff who need the records for their role Correct answer.
  4. Storing the records in a shared folder open to the whole company

Explanation

Classification is only meaningful when it drives handling rules, and confidential data should be limited to those with a genuine need. Broad distribution or open storage contradicts the label and expands the exposure of sensitive information.

Question 33Security concepts

An attacker combines information from a social media profile with a leaked database to guess an employee's answers to account recovery questions. Which weakness does this exploit?

  1. Reliance on knowledge-based recovery secrets Correct answer.
  2. Use of encrypted connections to the service
  3. Enforcement of account lockout thresholds
  4. Use of long randomly generated passwords

Explanation

Knowledge-based recovery questions depend on facts that may be publicly discoverable or already leaked, letting an attacker satisfy the recovery process without the password. Encryption, lockouts, and strong passwords protect other parts of authentication and do not fix guessable recovery secrets.

Question 34Security concepts

A security team must choose between two controls for the same risk: one costs little but stops only some attacks, the other costs far more and stops nearly all. Which approach reflects sound risk management?

  1. Defer the decision until an incident occurs
  2. Always select the least expensive control available
  3. Always select the control that stops the most attacks
  4. Compare each control's cost against the reduction in expected loss Correct answer.

Explanation

Risk management weighs the cost of a control against the loss it is expected to prevent, so a cheaper partial control can be justified when the residual risk is acceptable. Choosing purely on effectiveness or purely on price ignores the trade-off, and waiting for an incident leaves the risk untreated.

Question 35Malware

Which type of malware is designed to replicate itself and spread to other computers without needing to attach to a host file?

  1. A worm Correct answer.
  2. A trojan
  3. A rootkit
  4. A logic bomb

Explanation

A worm is self-replicating and spreads across networks on its own, without needing to infect a host file or rely on user action. Trojans, rootkits and logic bombs do not spread by self-replication in this way.

Question 36Malware

A program claims to be a free antivirus scanner but secretly installs adware and steals browser data. What kind of malware is this?

  1. A logic bomb
  2. A boot sector virus
  3. A worm
  4. A trojan Correct answer.

Explanation

A trojan presents itself as useful or legitimate software to trick the user into running it, then performs hidden malicious actions. It does not replicate itself, which distinguishes it from a worm.

Question 37Malware

What is the defining characteristic of a virus compared with other malware?

  1. It always encrypts files for ransom
  2. It spreads only through email attachments
  3. It attaches to a host file or program to spread Correct answer.
  4. It hides inside the operating system kernel

Explanation

A virus inserts its code into a host file or program and relies on that host being executed to spread. Encryption for ransom, kernel hiding and email-only spread describe other behaviors or specific delivery methods.

Question 38Malware

Malware that encrypts a user's files and demands payment to restore access is called:

  1. Ransomware Correct answer.
  2. A rootkit
  3. Spyware
  4. A keylogger

Explanation

Ransomware encrypts data and demands payment for the decryption key. Spyware, keyloggers and rootkits focus on surveillance or concealment rather than holding data for ransom.

Question 39Malware

Which type of malware is specifically designed to record every keystroke a user types?

  1. A worm
  2. A keylogger Correct answer.
  3. A boot sector virus
  4. A logic bomb

Explanation

A keylogger captures keyboard input, often to steal passwords and other sensitive data. The other options describe replication, trigger-based or startup-area behaviors.

Question 40Malware

What is the primary purpose of a rootkit?

  1. To hide malicious files and processes from the user and security tools Correct answer.
  2. To encrypt the user's documents for ransom
  3. To display unwanted advertisements
  4. To flood a network with traffic

Explanation

A rootkit is built to conceal the presence of malware and attacker activity by hiding files, processes and registry entries. Ransom, traffic flooding and ad display are goals of other malware families.

Question 41Malware

Malware that displays unwanted advertisements and redirects browser searches is best classified as:

  1. A trojan
  2. Ransomware
  3. Adware Correct answer.
  4. A worm

Explanation

Adware is software that automatically displays or downloads advertising material, often redirecting browsing. It is distinct from trojans, worms and ransomware in purpose.

Question 42Malware

A piece of code lies dormant in a payroll system and wipes records on a specific date. What is this called?

  1. Adware
  2. A keylogger
  3. A worm
  4. A logic bomb Correct answer.

Explanation

A logic bomb stays inactive until a specified condition or date triggers its payload. Self-replication, keystroke capture and advertising describe other categories.

Question 43Malware

Which feature most reliably distinguishes a worm from a virus?

  1. The worm only affects mobile devices
  2. The worm never causes any harm to systems
  3. The worm is always delivered as an email attachment
  4. The worm can spread across networks without user action or a host file Correct answer.

Explanation

A worm propagates on its own across networks without needing a host file or user interaction, whereas a virus requires a host and typically user action to spread. Delivery method, target platform and harm level are not defining differences.

Question 44Malware

A user receives an email with a macro-enabled document. On opening it, a script downloads additional malware. Which term best describes this document?

  1. A dropper Correct answer.
  2. A logic bomb
  3. A rootkit
  4. A keylogger

Explanation

A dropper is code or a file that installs and executes additional malware on the victim system. A rootkit conceals activity, a keylogger captures input, and a logic bomb triggers on a condition.

Question 45Malware

Why is a fileless malware attack difficult for traditional antivirus software to detect?

  1. It always uses a known signature
  2. It disables the keyboard
  3. It only targets offline computers
  4. It runs in memory using legitimate system tools rather than a malicious file on disk Correct answer.

Explanation

Fileless malware operates in memory and abuses legitimate tools such as scripting engines, leaving little or no malicious file on disk for signature-based scanning. It does not depend on being offline, using known signatures or disabling input.

Question 46Malware

A company's shared network drive becomes unusually slow, and a self-spreading program is found consuming bandwidth by copying itself to every connected PC. Which malware type is involved?

  1. Adware
  2. A logic bomb
  3. A worm Correct answer.
  4. A trojan

Explanation

Self-replication across connected machines with heavy bandwidth use is characteristic of a worm. Logic bombs, trojans and adware do not spread by autonomous replication.

Question 47Malware

Which malware category is most associated with secretly collecting browsing habits and login details and sending them to a remote server?

  1. A logic bomb
  2. Ransomware
  3. A boot sector virus
  4. Spyware Correct answer.

Explanation

Spyware covertly gathers information about a user's activity and transmits it to an attacker. Ransomware, boot sector viruses and logic bombs have different primary behaviors.

Question 48Malware

An attacker wants malware to survive a reboot and load before the operating system. Which infection approach best achieves this?

  1. Recording keystrokes
  2. Displaying a pop-up advertisement
  3. Sending a phishing email
  4. Infecting the boot sector Correct answer.

Explanation

Infecting the boot sector lets malicious code execute during startup, before the operating system and many defenses load. Phishing is a delivery method, while pop-ups and keylogging are behaviors, not persistence at boot.

Question 49Malware

What best describes a polymorphic virus?

  1. It hides inside the operating system kernel
  2. It changes its own code each time it replicates to evade signature detection Correct answer.
  3. It spreads only over Bluetooth
  4. It encrypts user files and demands payment

Explanation

A polymorphic virus mutates its code as it replicates so that signature-based scanners struggle to recognize it. Encryption for ransom, kernel hiding and Bluetooth-only spread are unrelated.

Question 50Malware

A user's browser homepage keeps changing and extra toolbars appear after installing a free program. Which malware behavior is most likely?

  1. A logic bomb triggering on a date
  2. Ransomware encrypting files
  3. A rootkit hiding processes
  4. Adware bundled with the installer Correct answer.

Explanation

Bundled adware commonly alters browser settings and adds toolbars to generate advertising revenue. File encryption, process hiding and date-triggered payloads do not match these symptoms.