I85PREP
⌘ K
ICDL IT Security study materials
ICDL IT Security study resources

ICDL IT Security practice questions

One question at a time. Build your ICDL IT Security understanding.

First 50 of 199 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security concepts

Which term describes the principle that a user should be given only the access needed to perform their job and no more?

  1. Separation of duties
  2. Least privilege Correct answer.
  3. Zero trust
  4. Defence in depth

Explanation

Least privilege limits each account to the minimum rights required for its tasks, reducing the damage a compromised or misused account can cause. Separation of duties splits tasks between people, while defence in depth layers controls and zero trust removes implicit trust based on location.

Question 2Security concepts

What is the main purpose of encrypting data at rest on a laptop's disk?

  1. To compress the stored files
  2. To speed up file access
  3. To prevent malware installation
  4. To protect data if the device is lost or stolen Correct answer.

Explanation

Encryption at rest renders stored data unreadable without the key, so a thief who obtains the physical disk cannot easily read its contents. It does not stop malware from running or make files faster or smaller.

Question 3Security concepts

A message is altered in transit so that the amount on an invoice changes from 100 to 900. Which security objective has been violated?

  1. Integrity Correct answer.
  2. Confidentiality
  3. Availability
  4. Non-repudiation

Explanation

Integrity means data remains accurate and unaltered unless changed by an authorised party, so silent modification of an invoice breaks it. Confidentiality concerns who can read data, availability concerns timely access, and non-repudiation concerns proving who did something.

Question 4Security concepts

Which of these is an example of social engineering?

  1. Guessing a weak Wi-Fi password
  2. Sending a phishing email that impersonates a bank Correct answer.
  3. Flooding a network with traffic
  4. Exploiting an unpatched web server

Explanation

Social engineering manipulates people into revealing information or taking actions, and a phishing email impersonating a trusted bank is a classic example. The other options are technical attacks against systems or networks.

Question 5Security concepts

What distinguishes a virus from a worm?

  1. A worm cannot replicate itself
  2. A virus only affects mobile phones
  3. A virus needs a host file or user action to spread, while a worm spreads on its own Correct answer.
  4. A virus is always harmless

Explanation

A virus attaches to files or relies on a user running an infected program, whereas a worm self-replicates across networks without a host or user action. Both are malicious and can cause harm.

Question 6Security concepts

Which practice best protects an account against unauthorised access even if the password is leaked?

  1. Enabling multi-factor authentication Correct answer.
  2. Using a short numeric PIN
  3. Writing the password on a sticky note
  4. Reusing the same password on many sites

Explanation

Multi-factor authentication requires a second factor such as a code or token, so a leaked password alone is insufficient to log in. Reuse, poor storage, and short PINs all weaken protection.

Question 7Security concepts

What is the role of a firewall on a network?

  1. To filter traffic according to defined rules Correct answer.
  2. To back up files automatically
  3. To scan email attachments for malware
  4. To assign domain names to websites

Explanation

A firewall inspects network traffic and permits or blocks it based on configured rules. Email scanning, backups, and name resolution are handled by other tools.

Question 8Security concepts

Which of the following is the strongest form of authentication factor?

  1. Something you are, such as a fingerprint Correct answer.
  2. Something you have, such as a hardware token
  3. Something you know, such as a password
  4. Something you type, such as a username

Explanation

Biometric factors such as fingerprints are tied to the person and are difficult to share or guess, making them generally stronger than knowledge-based or possession-based factors alone. Usernames are identifiers, not authentication factors.

Question 9Security concepts

An employee receives a phone call from someone claiming to be from IT support who asks for the employee's password to fix an issue. What is the best response?

  1. Refuse and verify the caller through official channels Correct answer.
  2. Email the password to the caller instead
  3. Share only the first half of the password
  4. Provide the password since IT needs it

Explanation

Legitimate IT staff do not need a user's password, so the request is a likely pretexting attempt. The safe action is to refuse and confirm the request through a known official contact route.

Question 10Security concepts

A company stores customer records and must ensure only authorised staff can read them. Which control most directly addresses this requirement?

  1. Daily disk defragmentation
  2. Faster network switches
  3. Access control lists on the records Correct answer.
  4. Load balancing across servers

Explanation

Access control lists define which identities may read or modify a resource, directly enforcing authorised access. Defragmentation, load balancing, and faster switches affect performance, not who can read data.

Question 11Security concepts

What does a digital signature primarily provide to the recipient of a message?

  1. Encryption of the entire message body
  2. Compression of the message for storage
  3. Guaranteed delivery within a time limit
  4. Confirmation of the signer's identity and that the message is unaltered Correct answer.

Explanation

A digital signature lets the recipient verify who signed the message and that its contents have not changed since signing. It does not by itself encrypt the message or guarantee delivery timing.

Question 12Security concepts

An organisation wants to reduce the impact of a successful phishing attack. Which measure helps most directly?

  1. Regular security awareness training with simulated phishing Correct answer.
  2. Increasing monitor resolution
  3. Shortening network cable runs
  4. Adding more printers to the network

Explanation

Awareness training that includes simulated phishing teaches staff to recognise and report deceptive messages, reducing the chance they act on them. The other options have no security effect on phishing.

Question 13Security concepts

Which statement best describes ransomware?

  1. It spreads through USB drives without harming data
  2. It encrypts files and demands payment for the decryption key Correct answer.
  3. It silently logs keystrokes and sends them to an attacker
  4. It displays unwanted advertisements in a browser

Explanation

Ransomware denies access to data, typically by encryption, and demands payment to restore it. Keyloggers, adware, and some USB worms are different malware categories with different behaviours.

Question 14Security concepts

Why should an organisation apply security patches promptly?

  1. To increase the size of log files
  2. To change the colour scheme of applications
  3. To reduce the number of user accounts
  4. To close known vulnerabilities before attackers exploit them Correct answer.

Explanation

Patches fix known flaws, and delaying them leaves systems exposed to exploits that are often publicly available. Log size, account counts, and appearance are unrelated to patching.

Question 15Security concepts

A user connects to a public café Wi-Fi network to check online banking. Which precaution most reduces the risk of interception?

  1. Disabling the device's screen lock
  2. Sharing the connection with nearby devices
  3. Using a trusted VPN or the bank's mobile app over encrypted connections Correct answer.
  4. Turning up the screen brightness

Explanation

A VPN or a properly secured app encrypts traffic so that others on the untrusted network cannot read it. Screen settings and connection sharing do not protect data in transit.

Question 16Security concepts

Which of the following best describes a brute-force attack?

  1. Tricking a user into revealing a password
  2. Physically stealing a server
  3. Systematically trying many possible passwords until one works Correct answer.
  4. Intercepting traffic on a network segment

Explanation

A brute-force attack repeatedly attempts candidate passwords or keys until the correct one is found. Deception, interception, and theft are different attack classes.

Question 17Security concepts

What is the purpose of backing up data to a separate location?

  1. To prevent users from deleting files
  2. To increase disk capacity
  3. To make files open faster
  4. To recover data after loss, corruption, or a ransomware attack Correct answer.

Explanation

A separate backup allows restoration when primary data is lost, corrupted, or encrypted by malware. Backups do not speed up access, block deletion, or add storage capacity.

Question 18Security concepts

An attacker sends an email with a link to a fake login page that closely mimics a real service. Which control best helps a user avoid entering credentials there?

  1. Checking the URL and using bookmarks or typed addresses Correct answer.
  2. Disabling the browser's address bar
  3. Increasing the email font size
  4. Forwarding the email to colleagues

Explanation

Verifying the address and navigating via trusted bookmarks or typed URLs helps users avoid look-alike phishing sites. The other options either do nothing or worsen the situation.

Question 19Security concepts

Which principle explains why an organisation should not rely on a single control, such as a firewall alone, for protection?

  1. Least privilege
  2. Single sign-on
  3. Data minimisation
  4. Defence in depth Correct answer.

Explanation

Defence in depth layers multiple independent controls so that if one fails, others still provide protection. Least privilege limits access, single sign-on simplifies login, and data minimisation limits collected data.

Question 20Security concepts

A staff member finds a USB drive in the car park and plugs it into a work computer to identify the owner. What is the main risk?

  1. The drive may contain malware that infects the computer Correct answer.
  2. The drive may be full and unusable
  3. The drive may be slower than the network
  4. The drive may be the wrong colour

Explanation

Unknown removable media can carry malware, including autorun exploits, so plugging it in can compromise the host. Capacity, colour, and speed are not the security concern.

Question 21Security concepts

Which of the following best illustrates the concept of non-repudiation?

  1. A user is locked out after three failed logins
  2. A user receives an email receipt
  3. A user cannot later deny having signed a transaction because a digital signature verifies their identity Correct answer.
  4. A user's files are encrypted on the disk

Explanation

Non-repudiation ensures a party cannot credibly deny an action, which a digital signature tied to their key supports. Lockouts, disk encryption, and receipts do not by themselves prove who performed an action.

Question 22Security concepts

A company wants to let contractors access only the project files they need while blocking everything else. Which approach best meets this requirement?

  1. Share the administrator password with contractors
  2. Disable logging for contractor accounts
  3. Give contractors the same rights as permanent staff
  4. Apply role-based access limited to the project resources Correct answer.

Explanation

Role-based access scoped to the project grants exactly the resources needed, consistent with least privilege. Broad rights, shared admin credentials, and disabled logging all increase risk.

Question 23Security concepts

An organisation discovers that encrypted customer data was copied, but the encryption keys were stored on the same server and were also taken. What is the most accurate assessment?

  1. Availability is unaffected, so there is no security impact
  2. Confidentiality is likely breached because the keys were exposed with the data Correct answer.
  3. Integrity is the only concern since the data was copied
  4. Confidentiality is preserved because the data was encrypted

Explanation

Encryption only protects data when keys remain separate from the ciphertext; if both are stolen, the attacker can decrypt and read the data. The exposure therefore threatens confidentiality, not just integrity or availability.

Question 24Security concepts

A user reports that their account was accessed from another country, but they still have their password and never shared it. Which explanation is most plausible?

  1. The user's keyboard layout changed
  2. The company's printer ran out of toner
  3. The user's monitor was too dim
  4. The account password was reused on a breached site and the credentials were replayed Correct answer.

Explanation

Credential stuffing replays usernames and passwords leaked from other breaches, which explains access without the user sharing the password. The other events have no bearing on remote account access.

Question 25Security concepts

A security team finds that a web application accepts input that later appears in database queries. Which control most directly prevents this from being exploited?

  1. Longer session timeouts
  2. Input validation and parameterised queries Correct answer.
  3. Larger server memory
  4. More frequent password changes

Explanation

Validating input and using parameterised queries separates data from code, preventing injection attacks such as SQL injection. Session timeouts, memory, and password policy do not address injection.

Question 26Security concepts

Which security goal is concerned with keeping data accurate and unaltered during storage and transmission?

  1. Confidentiality
  2. Integrity Correct answer.
  3. Availability
  4. Anonymity

Explanation

Integrity means data is complete, accurate and protected from unauthorised modification. Confidentiality concerns who may read data, and availability concerns timely access to it.

Question 27Security concepts

A company classifies documents so that only staff with a genuine work need may view sensitive records. Which concept does this reflect?

  1. Least privilege Correct answer.
  2. Defence in depth
  3. Fail-safe defaults
  4. Separation of duties

Explanation

Least privilege grants users only the access required for their tasks and nothing more. It limits the damage that a compromised or careless account can cause.

Question 28Security concepts

Which description best matches a Trojan horse?

  1. A program that displays unwanted advertisements only
  2. Malicious code hidden inside software that appears legitimate Correct answer.
  3. A technique for testing password strength
  4. A network device that forwards traffic between subnets

Explanation

A Trojan disguises malicious functionality within apparently useful or genuine-looking software. Users install it willingly because the harmful payload is concealed.

Question 29Security concepts

An attacker intercepts traffic between a user and a website and relays messages while reading them. Which type of attack is this?

  1. Man-in-the-middle Correct answer.
  2. SQL injection
  3. Denial of service
  4. Privilege escalation

Explanation

A man-in-the-middle attack places the attacker between two parties so communications pass through them. This lets the attacker observe or alter the traffic without the parties realising.

Question 30Security concepts

What is the main purpose of encrypting data at rest on a laptop?

  1. To allow multiple users to share the same files
  2. To prevent the laptop from overheating
  3. To speed up disk read and write operations
  4. To keep the contents unreadable if the device is lost or stolen Correct answer.

Explanation

Encryption at rest converts stored data into ciphertext so that anyone without the key cannot read it. This protects confidentiality when physical control of the device is lost.

Question 31Security concepts

Which statement best describes the role of a hash function in verifying a downloaded file?

  1. It encrypts the file so only the publisher can open it
  2. It compresses the file so it downloads faster
  3. It records who downloaded the file and when
  4. It produces a fixed-length value that changes if the file content changes Correct answer.

Explanation

A hash function maps data of any size to a fixed-length digest, and even a tiny change to the input produces a different digest. Comparing the published digest with one computed locally reveals tampering or corruption.

Question 32Security concepts

Which of these is a symmetric encryption algorithm?

  1. ECDSA
  2. RSA
  3. Diffie-Hellman
  4. AES Correct answer.

Explanation

AES is a symmetric block cipher that uses the same key to encrypt and decrypt. RSA and ECDSA are asymmetric algorithms, and Diffie-Hellman is a key agreement method.

Question 33Security concepts

What does a certificate authority do in a public key infrastructure?

  1. It assigns IP addresses to network devices
  2. It vouches for the link between a public key and the identity it belongs to Correct answer.
  3. It stores every user's private key on a central server
  4. It encrypts all traffic on the internet

Explanation

A certificate authority issues signed certificates that bind a public key to a verified identity. Relying parties trust the CA's signature when validating that binding.

Question 34Security concepts

Which practice best reduces the risk of an organisation losing data through accidental deletion by a user?

  1. Requiring users to sign an acceptable use policy
  2. Maintaining tested, versioned backups stored separately from the live system Correct answer.
  3. Increasing the screen resolution on workstations
  4. Disabling antivirus scanning during business hours

Explanation

Tested backups kept separately allow recovery from accidental or malicious deletion. The restore process must be verified so that the copies are usable when needed.

Question 35Security concepts

A user receives an unexpected email with an attachment from an unknown sender. Which action best follows security awareness guidance?

  1. Forward the attachment to colleagues to ask their opinion
  2. Open the attachment to see whether it looks suspicious
  3. Reply to the sender requesting more details before opening it
  4. Do not open the attachment and report the message to the IT or security team Correct answer.

Explanation

Unexpected attachments are a common malware delivery route, so they should not be opened. Reporting the message lets the security team investigate and warn others if needed.

Question 36Security concepts

Why is it risky to reuse the same password across several online services?

  1. A breach at one service can let attackers access the user's accounts elsewhere Correct answer.
  2. It slows down the user's internet connection
  3. It prevents the use of multi-factor authentication
  4. It makes each individual password harder to remember

Explanation

When one service is breached, stolen credentials are often tried against other sites in credential-stuffing attacks. Unique passwords confine the damage to a single account.

Question 37Security concepts

An organisation separates its public web servers from its internal file servers so that a compromise of the web tier does not directly expose internal data. Which concept does this illustrate?

  1. Network segmentation Correct answer.
  2. Data deduplication
  3. Load balancing
  4. Single sign-on

Explanation

Network segmentation divides infrastructure into zones with controlled traffic between them. A breach in one zone is contained rather than spreading freely to the others.

Question 38Security concepts

A security analyst reviews logs and finds repeated failed logins followed by one success at an unusual hour from a new location. Which interpretation is most reasonable?

  1. The account is being backed up normally
  2. The account may have been compromised and should be investigated and locked Correct answer.
  3. The logging system is malfunctioning
  4. The user has probably forgotten their password

Explanation

A burst of failures ending in success from an unfamiliar location fits a password-guessing or credential-stuffing attempt. Treating it as a possible compromise and investigating quickly limits harm.

Question 39Security concepts

Which control is designed to detect intrusions rather than prevent them?

  1. An intrusion detection system that alerts on suspicious traffic patterns Correct answer.
  2. A firewall rule that blocks a port
  3. File permissions restricting access to a folder
  4. Full disk encryption on a laptop

Explanation

An intrusion detection system monitors activity and raises alerts about suspicious behaviour. Prevention is the role of controls that actively block or restrict actions.

Question 40Security concepts

Which statement best describes the principle of least privilege?

  1. Users are granted full administrative rights so that they can resolve their own problems quickly.
  2. Users are granted access to all systems once their identity has been verified at login.
  3. Users are granted only the access rights required to perform their assigned tasks. Correct answer.
  4. Users are granted access based on how long they have worked for the organisation.

Explanation

Least privilege limits each account to the minimum permissions needed for its legitimate duties, reducing the damage an account compromise or mistake can cause. Access is granted per task requirement and reviewed as roles change, rather than being broad or permanent.

Question 41Malware and threats

Which type of malware self-replicates across networks without needing a host file or user action?

  1. A logic bomb
  2. A trojan
  3. A worm Correct answer.
  4. A rootkit

Explanation

A worm is standalone malware that spreads by exploiting network services and copying itself to other machines automatically. Trojans, logic bombs and rootkits do not self-propagate in this way.

Question 42Malware and threats

A user receives an email attachment that appears to be an invoice but installs a backdoor when opened. Which term best describes this malware?

  1. A boot sector virus
  2. A trojan Correct answer.
  3. A keylogger
  4. A worm

Explanation

Malware disguised as a legitimate file that relies on the user opening it to deliver a payload is a trojan. Its defining trait is deception rather than self-replication.

Question 43Malware and threats

What is the key characteristic of ransomware?

  1. It silently records every keystroke for later retrieval
  2. It floods a network with traffic to deny service
  3. It encrypts or locks data and demands payment for restoration Correct answer.
  4. It displays unwanted advertisements in a browser

Explanation

Ransomware denies the victim access to their data, usually through encryption, and demands payment to restore it. Other malware families have different primary goals.

Question 44Malware and threats

Which malware type is designed to secretly gather information about a user's activity and send it to an attacker?

  1. A logic bomb
  2. Adware
  3. Spyware Correct answer.
  4. A file infector virus

Explanation

Spyware covertly collects information such as browsing habits, credentials or messages and transmits it to a third party. Its defining purpose is surveillance rather than disruption.

Question 45Malware and threats

What distinguishes a virus from other malware in terms of how it operates?

  1. It attaches to a host file or program and needs that host to be executed Correct answer.
  2. It only affects servers, never workstations
  3. It spreads only through physical USB drives
  4. It always encrypts the victim's files

Explanation

A virus inserts its code into a legitimate host file or program and runs when the host is executed. This dependency on a host is its defining property.

Question 46Malware and threats

A program lies dormant and only activates its malicious payload when a specific date is reached. What is this called?

  1. A logic bomb Correct answer.
  2. A trojan
  3. A worm
  4. A rootkit

Explanation

A logic bomb is malicious code that stays inactive until a trigger condition, such as a date or event, is met. The trigger is what defines it.

Question 47Malware and threats

Which term describes a collection of compromised computers controlled remotely by an attacker?

  1. A botnet Correct answer.
  2. A honeypot
  3. A subnet
  4. A sandbox

Explanation

A botnet is a network of infected machines, often called bots or zombies, that an attacker commands remotely. Honeypots, subnets and sandboxes are legitimate network or security concepts.

Question 48Malware and threats

What is the defining behaviour of a rootkit?

  1. It spreads through removable media only
  2. It sends bulk advertising emails
  3. It conceals malicious activity and maintains privileged access on a system Correct answer.
  4. It encrypts files and demands a ransom

Explanation

A rootkit is designed to hide an intruder's presence and preserve high-level access, often by subverting the operating system. Concealment and persistence are its core traits.

Question 49Malware and threats

An attacker sends emails that impersonate a bank and ask recipients to confirm their passwords on a linked page. Which attack is this?

  1. A denial-of-service attack
  2. Shoulder surfing
  3. Phishing Correct answer.
  4. A man-in-the-middle attack

Explanation

Phishing uses fraudulent messages that impersonate a trusted entity to trick recipients into revealing credentials or other data. The deception through a message and fake page is characteristic.

Question 50Malware and threats

A targeted phishing message that is carefully personalised to a specific senior executive is best described as which type of attack?

  1. Spear phishing Correct answer.
  2. Smishing
  3. Vishing
  4. Pharming

Explanation

Spear phishing is a targeted form of phishing aimed at a specific individual or small group, often using researched personal details. The tailoring to one person is the distinguishing feature.