This set reviews Units 4 to 6: threats and vulnerabilities, incident response and forensics, and ethical hacking. Work through it under light time pressure.

How to use this set

  • Answer without notes first, then check.
  • Track your score by unit to find weak areas.
  • For each miss, write one sentence explaining why the right answer is right.

Strategy reminders

  • For incident questions, ask “which phase are we in?” (preparation, detection, containment, eradication, recovery, lessons learned).
  • For ethics questions, the answer almost always involves authorization, scope and responsible reporting.
  • For forensics, think preserve, document, verify with hashes.

Review reminders

  • Malware types, social engineering red flags.
  • CVE, CVSS, vulnerability management cycle.
  • SQL injection, XSS and CSRF prevention.
  • Incident lifecycle, SIEM, order of volatility, chain of custody.
  • Pen test phases, scope, disclosure, reporting.

Check your understanding

1. Malware that encrypts files and demands payment is:

  • Spyware
  • Ransomware
  • Adware
  • A worm

Answer: Ransomware. It locks data until a ransom is paid.

2. The best defense against ransomware damage is:

  • Offline, tested backups
  • A louder alarm
  • Turning off updates
  • Using shorter passwords

Answer: Offline, tested backups. They allow restoration without paying.

3. Parameterized queries mainly prevent:

  • XSS
  • SQL injection
  • CSRF
  • DoS

Answer: SQL injection. Input stays separate from the query structure.

4. Isolating an infected laptop from the network is:

  • Containment
  • Preparation
  • Eradication
  • Lessons learned

Answer: Containment. It stops the spread.

5. Which should be collected first in a live investigation?

  • Backups
  • Memory contents
  • Printed logs
  • Archived email

Answer: Memory contents. RAM is the most volatile.

6. A SIEM is used to:

  • Correlate logs from many sources and raise alerts
  • Create certificates
  • Encrypt disks
  • Assign IP addresses

Answer: Correlate logs from many sources and raise alerts. It reveals patterns across systems.

7. What proves a forensic image matches the original drive?

  • Same file name
  • Matching hash values
  • Same color
  • Same size label

Answer: Matching hash values. Any difference would change the hash.

8. Before an authorized penetration test, the tester must obtain:

  • Written permission defining scope
  • A public blog post
  • Admin passwords from strangers
  • Nothing

Answer: Written permission defining scope. This is what makes testing legal and ethical.

9. Passive reconnaissance involves:

  • Scanning every port directly
  • Collecting public information without touching the target
  • Exploiting a server
  • Resetting passwords

Answer: Collecting public information without touching the target. Examples include WHOIS and public DNS.

10. After finding a flaw in a company’s website with no permission-to-test, the ethical step is:

  • Sell it
  • Publish it immediately
  • Stop and report it privately to the owner
  • Exploit more to be sure

Answer: Stop and report it privately to the owner. This is responsible disclosure.

PreviousNext