CPA Isc Quiz: Identify Common Cybersecurity Threats And Vulnerabilities

What this quiz covers

This quiz focuses on Identify Common Cybersecurity Threats And Vulnerabilities, giving you a quick way to practice the rules, question types, and explanations that matter most for CPA Isc.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

Question 1

1. A ransomware attack encrypting company data for payment.
2. A spear phishing / business email compromise (BEC) attack using impersonation to fraudulently induce financial transfers. (correct answer)
3. A distributed denial-of-service (DDoS) attack overwhelming the email server.
4. A man-in-the-middle attack intercepting CEO communications.

Explanation: BEC/spear phishing attacks impersonate executives to trick employees into authorizing fraudulent financial transactions - a major source of financial fraud. Answer B is correct. Ransomware (A) encrypts data. DDoS (C) disrupts availability. MITM (D) intercepts active communications rather than impersonating via email.

Question 2

1. Malware that encrypts a victim's files or systems, rendering them inaccessible, and demands payment (usually cryptocurrency) in exchange for the decryption key. (correct answer)
2. Software that secretly monitors and transmits user activity to a remote attacker.
3. A network attack that floods a target with traffic to make it unavailable.
4. A type of social engineering that tricks users into revealing passwords.

Explanation: Ransomware encrypts data and extorts payment for decryption - one of the most financially damaging cyberthreats to organizations. Answer A is correct. Silent monitoring and data exfiltration (B) describes spyware/RATs. Traffic flooding (C) describes DDoS. Password extraction through deception (D) describes phishing.

Question 3

1. A phishing attack.
2. A man-in-the-middle (MITM) attack. (correct answer)
3. A denial-of-service attack.
4. A SQL injection attack.

Explanation: A MITM attack positions the attacker between two communicating parties, enabling interception and potential modification of the traffic without detection. Answer B is correct. Phishing (A) deceives users into revealing credentials. DoS (C) disrupts availability. SQL injection (D) targets databases through application input.

Question 4

1. Exploit unpatched software vulnerabilities in operating systems.
2. Are conducted by highly skilled nation-state hackers.
3. Bypass technical controls by exploiting human psychology - manipulating people rather than systems. (correct answer)
4. Always result in complete system compromise and data exfiltration.

Explanation: Social engineering targets the human element - the weakest link in security - using deception, urgency, or authority to convince people to take actions that compromise security. Technical controls cannot fully prevent socially engineered attacks. Answer C is correct. Software vulnerabilities (A) and nation-state actors (B) describe technical attacks. Outcomes vary (D).

Question 5

1. Availability - by overwhelming systems with traffic to make them inaccessible to legitimate users. (correct answer)
2. Confidentiality - by exposing sensitive data to unauthorized parties.
3. Integrity - by modifying data in transit between systems.
4. Authentication - by bypassing login controls to gain unauthorized access.

Explanation: DDoS attacks overwhelm systems with traffic, making them unavailable - directly attacking the availability principle. Answer A is correct. DDoS does not typically expose data (B), modify data (C), or bypass authentication (D).

Question 6

1. A worm - self-replicating malware that spreads across networks.
2. Ransomware - malware that encrypts files for extortion.
3. Adware - software that displays unwanted advertisements.
4. A Trojan horse - malware disguised as legitimate software that creates unauthorized access. (correct answer)

Explanation: A Trojan horse disguises itself as legitimate software to trick users into installing it, then executes malicious functionality like creating backdoors. Answer D is correct. Worms (A) spread without user action. Ransomware (B) encrypts data. Adware (C) displays ads.

Question 7

1. Attacks launched from inside the organization's firewall by external hackers who have breached the perimeter.
2. Security risks posed by current or former employees, contractors, or partners who misuse their authorized access - whether maliciously or inadvertently. (correct answer)
3. Threats that originate from internal vulnerability scanning activities.
4. Threats from employees who are unaware of the organization's security policies.

Explanation: Insider threats come from individuals with authorized access - including malicious insiders (data theft, sabotage), negligent insiders (accidental data disclosure), and compromised insiders (whose credentials are stolen). Answer B is correct. Perimeter-breaching attackers (A) are external threats. Vulnerability scanning (C) is a security activity. Policy unawareness (D) is a training gap, not an insider threat category.

Question 8

1. Creates a fake website that closely mimics a legitimate one to steal credentials.
2. Sends mass emails impersonating a trusted organization to harvest login credentials.
3. Creates a fabricated scenario (pretext) to manipulate a victim into revealing information or taking an action they otherwise wouldn't. (correct answer)
4. Uses malware to intercept keystrokes and capture passwords.

Explanation: Pretexting involves fabricating a believable story - posing as IT support, an auditor, or a vendor - to manipulate the victim. Answer C is correct. Fake websites (A) describe pharming/website spoofing. Mass credential harvesting emails (B) describe phishing. Keystroke capture (D) describes a keylogger.

Question 9

1. Unpatched operating system vulnerabilities in web servers.
2. Weak password policies that allow brute-force attacks on web application accounts.
3. Misconfigured database permissions allowing unauthorized SQL queries.
4. Insufficient input validation that allows attackers to inject malicious scripts into web pages viewed by other users. (correct answer)

Explanation: XSS exploits insufficient sanitization of user-supplied input to inject client-side scripts into web pages - scripts that execute in other users' browsers, potentially stealing session tokens or performing actions on their behalf. Answer D is correct. OS vulnerabilities (A), brute-force (B), and SQL permissions (C) are different vulnerability types.

Question 10

1. An attack that compromises a trusted vendor or software update to deliver malware to the vendor's customers - targeting organizations indirectly through their trusted supply chain. (correct answer)
2. An attack that disrupts an organization's physical supply chain operations.
3. An attack targeting an organization's procurement system to manipulate purchase orders.
4. Social engineering of supply chain employees to gain physical access to warehouses.

Explanation: Supply chain attacks compromise trusted software, hardware, or service providers to reach a broader set of targets - exemplified by the SolarWinds attack where malware was distributed through a software update. Answer A is correct. Physical supply chain disruption (B), procurement system attacks (C), and physical access attacks (D) are different threat scenarios.

Question 11

1. An attacker sends targeted phishing emails to specific individuals in an organization.
2. An attacker compromises a legitimate website frequently visited by the target group, infecting visitors with malware when they visit the site. (correct answer)
3. An attacker floods a website with traffic to make it unavailable.
4. An attacker injects malicious code into a trusted software update.

Explanation: A watering hole attack compromises websites that the target group is known to visit, turning a trusted resource into a malware delivery mechanism. Answer B is correct. Targeted emails (A) describe spear phishing. Traffic flooding (C) describes DDoS. Software update injection (D) describes supply chain attacks.

Question 12

1. Vishing - voice phishing using phone calls.
2. Smishing - SMS-based phishing.
3. Phishing - fraudulent email impersonating a trusted entity to steal credentials. (correct answer)
4. Pharming - redirecting DNS queries to fraudulent websites.

Explanation: Phishing uses fraudulent emails impersonating trusted organizations to trick users into clicking malicious links or providing credentials. Answer C is correct. Vishing (A) uses phone calls. Smishing (B) uses text messages. Pharming (D) manipulates DNS rather than using deceptive emails.

Question 13

1. Identify - the organization failed to identify its assets.
2. Detect - the organization failed to detect anomalous activity indicating the attacker's lateral movement. (correct answer)
3. Protect - the organization failed to implement sufficient access controls.
4. Recover - the organization failed to restore systems after the breach.

Explanation: Failure to detect lateral movement within the network after initial compromise corresponds to the NIST CSF 'Detect' function - anomaly detection, network monitoring, and behavioral analytics should have identified unusual activity. Answer B is correct. Asset identification (A) is Identify. Access controls (C) are Protect. Recovery (D) follows a detected incident.

Question 14

1. Encrypting all data stored in the database.
2. Implementing multi-factor authentication for database users.
3. Using parameterized queries or prepared statements that separate SQL code from user-supplied input data. (correct answer)
4. Restricting database access to read-only for web application accounts.

Explanation: Parameterized queries prevent SQL injection by treating user input as data rather than executable code - the most effective prevention technique. Answer C is correct. Encryption (A) protects stored data but doesn't prevent injection. MFA (B) controls access but not injection. Read-only access (D) reduces damage but doesn't prevent all injection attacks.

Question 15

1. Detect and respond to active cyberattacks in real time.
2. Systematically identify and remediate known security weaknesses before they can be exploited by attackers. (correct answer)
3. Train employees to recognize and report phishing attempts.
4. Monitor network traffic for anomalous patterns indicating a breach.

Explanation: Vulnerability management proactively identifies and fixes security weaknesses - reducing the attack surface before adversaries can exploit known vulnerabilities. Answer B is correct. Real-time attack detection (A) is security monitoring. Phishing training (C) is security awareness. Traffic monitoring (D) is detection/SOC function.

Question 16

1. Unpatched software vulnerabilities, weak remote access controls (RDP), and phishing emails delivering malicious attachments. (correct answer)
2. Misconfigured database permissions allowing unauthorized SQL queries.
3. Weak data classification policies leaving sensitive data unprotected.
4. Insufficient logging making it difficult to detect unauthorized access.

Explanation: Ransomware commonly enters through phishing emails, unpatched vulnerabilities, and exposed remote desktop protocol (RDP) ports - making patch management, email security, and remote access controls the primary defenses. Answer A is correct. Database permissions (B), data classification (C), and logging gaps (D) are not primary ransomware entry vectors.

Question 17

1. Requiring passwords to be changed every 90 days.
2. Implementing a web application firewall.
3. Multi-factor authentication - which renders stolen username/password combinations from previous breaches unusable without the second factor. (correct answer)
4. Encrypting all passwords stored in the database.

Explanation: Credential stuffing uses previously breached username/password pairs from other sites. MFA prevents these from being used even if credentials are valid, since the attacker cannot provide the second factor. Answer C is correct. Password rotation (A) doesn't prevent use of stolen credentials. WAF (B) may detect patterns but doesn't stop valid credentials. Password encryption (D) protects the database, not against credential stuffing.

Question 18

1. A ransomware attack that encrypts data over time.
2. A DDoS attack that gradually degrades system performance.
3. A phishing attack that persists across multiple email campaigns.
4. An advanced persistent threat (APT) - a sophisticated, long-duration attack where the attacker maintains stealthy presence to achieve strategic objectives such as data exfiltration. (correct answer)

Explanation: APTs are characterized by persistence, sophistication, and stealth - attackers maintain long-term access to pursue specific objectives without triggering detection. Answer D is correct. Ransomware (A) manifests visibly. DDoS (B) is immediately disruptive. Phishing (C) is a delivery mechanism, not a long-term presence.

Question 19

1. A vulnerability that was discovered and patched more than a year ago.
2. A vulnerability that only affects systems that have not been updated in the past year.
3. A vulnerability in systems that have been in service for zero years (brand new systems).
4. A previously unknown vulnerability that has no available patch, giving defenders zero days to protect themselves before it can be exploited. (correct answer)

Explanation: Zero-day vulnerabilities are unknown to the vendor and have no patch available - attackers can exploit them before any defense can be deployed. Answer D is correct. Patched old vulnerabilities (A), outdated systems (B), and new systems (C) are not the definition of zero-day.

Question 20

1. A vulnerability assessment identifies and reports weaknesses without actively exploiting them; a penetration test actively attempts to exploit vulnerabilities to demonstrate impact. (correct answer)
2. A vulnerability assessment is performed by external parties; a penetration test is performed internally.
3. A vulnerability assessment covers only network vulnerabilities; a penetration test covers all attack surfaces.
4. Vulnerability assessments are automated; penetration tests are entirely manual.

Explanation: Vulnerability assessments scan and report on weaknesses. Penetration tests go further by attempting to exploit those weaknesses, demonstrating real-world attack scenarios and impact. Answer A is correct. Both can be internal or external (B). Both can cover various attack surfaces (C). Both use automation and manual techniques (D).