100 Cyber Security Quiz Questions & Answers 2026

Cyber Threats & Attacks — 25 Questions

1. What is malware? (Software designed to harm, exploit, or disable computer systems)
2. What is a virus? (Malicious code that attaches to legitimate programs and spreads)
3. What is ransomware? (Malware that encrypts files and demands payment for decryption)
4. What is phishing? (Fraudulent attempt to obtain sensitive info by pretending to be trustworthy)
5. What is spear phishing? (Targeted phishing aimed at specific individuals or organizations)
6. What is a DDoS attack? (Distributed Denial of Service — overwhelming a system with traffic)
7. What is a Man-in-the-Middle attack? (Attacker intercepts communication between two parties)
8. What is SQL injection? (Inserting malicious SQL code into a query to manipulate databases)
9. What is cross-site scripting (XSS)? (Injecting malicious scripts into trusted web pages)
10. What is a zero-day vulnerability? (Unknown vulnerability with no patch — attacker exploits it before fix)
11. What is a botnet? (Network of compromised computers controlled by an attacker)
12. What is social engineering? (Manipulating people to reveal confidential information)
13. What is a Trojan horse? (Malware disguised as legitimate software)
14. What is a rootkit? (Software hiding malicious activity — provides persistent privileged access)
15. What is a keylogger? (Malware recording keystrokes to capture passwords)
16. What is a brute force attack? (Trying all possible combinations to crack a password)
17. What is a dictionary attack? (Using common words/phrases to crack passwords)
18. What is credential stuffing? (Using leaked usernames/passwords from one breach on other sites)
19. What is an APT? (Advanced Persistent Threat — long-term targeted attack by skilled adversaries)
20. What is a watering hole attack? (Infecting websites frequented by targets)
21. What is a logic bomb? (Malicious code triggered by a specific condition or date)
22. What is spyware? (Software that secretly monitors and collects user information)
23. What is adware? (Software that automatically displays or downloads unwanted advertisements)
24. What is a worm in cybersecurity? (Self-replicating malware that spreads without needing a host program)
25. What is whaling, as a type of phishing? (A phishing attack targeting high-profile individuals like executives)

Security Concepts & Cryptography — 25 Questions

1. What is encryption? (Converting readable data into unreadable ciphertext)
2. What is decryption? (Converting ciphertext back to readable plaintext)
3. What is a cipher? (Algorithm for performing encryption/decryption)
4. What is symmetric encryption? (Same key for encryption and decryption — AES, DES)
5. What is asymmetric encryption? (Public/private key pair — RSA, ECDSA)
6. What is a hash function? (One-way function producing fixed-size output from any input)
7. What is SHA-256? (Secure Hash Algorithm — widely used cryptographic hash)
8. What is TLS? (Transport Layer Security — encrypts internet communications)
9. What is a digital certificate? (Electronic document proving ownership of a public key)
10. What is a PKI? (Public Key Infrastructure — framework for managing digital certificates)
11. What is 2FA/MFA? (Two/Multi-Factor Authentication — requires two forms of verification)
12. What is HTTPS? (HTTP + TLS — secure web communication)
13. What is a VPN? (Virtual Private Network — encrypts internet traffic and masks IP)
14. What is a firewall? (Network security device monitoring/filtering traffic)
15. What is the CIA triad? (Confidentiality, Integrity, Availability — core security principles)
16. What is a security audit? (Systematic evaluation of security policies and controls)
17. What is penetration testing? (Authorized simulated attack to find vulnerabilities)
18. What is SIEM? (Security Information and Event Management — centralized monitoring)
19. What is least privilege? (Users have minimum permissions needed — reduces attack surface)
20. What is defense in depth? (Multiple security layers — if one fails, others protect)
21. What is end-to-end encryption? (Encryption where only the sender and recipient can read the message)
22. What is a salt in password hashing? (Random data added to a password before hashing to prevent attacks)
23. What is a digital signature used for? (Verifying the authenticity and integrity of a message or document)
24. What is a sandbox in cybersecurity? (An isolated environment for safely testing or running suspicious code)
25. What is zero trust architecture? (A security model that never automatically trusts any user or device, verifying continuously)

Cybersecurity Defenses & Best Practices — 25 Questions

1. What is a strong password generally characterized by? (Length, complexity, and uniqueness across accounts)
2. What is a password manager used for? (Securely storing and generating unique passwords for different accounts)
3. What is patch management? (Regularly updating software to fix known vulnerabilities)
4. What is data backup used for in security? (Protecting against data loss from attacks like ransomware)
5. What is network segmentation? (Dividing a network into smaller parts to limit the spread of attacks)
6. What is an intrusion detection system (IDS)? (A system that monitors network traffic for suspicious activity)
7. What is an intrusion prevention system (IPS)? (A system that actively blocks detected threats, beyond just alerting)
8. What is endpoint security? (Protecting individual devices like laptops and phones from threats)
9. What is a security awareness training program for? (Educating employees to recognize and avoid security threats)
10. What is incident response? (The process of handling and mitigating a security breach after it occurs)
11. What is a disaster recovery plan? (A documented strategy for restoring systems after a major disruption)
12. What is data loss prevention (DLP)? (Tools and policies preventing sensitive data from leaving an organization)
13. What is multi-factor authentication's main benefit? (Adding extra verification steps beyond just a password)
14. What is the principle of "need to know" in security? (Limiting information access to only those who require it for their role)
15. What is a honeypot in cybersecurity? (A decoy system designed to attract and detect attackers)
16. What is a security baseline? (A minimum set of security configurations required for systems)
17. What is application whitelisting? (Allowing only approved software to run on a system)
18. What is the purpose of regular vulnerability scanning? (Proactively identifying weaknesses before attackers exploit them)
19. What is a secure software development lifecycle (SDLC)? (Integrating security practices throughout the software development process)
20. What is data encryption at rest? (Encrypting stored data, as opposed to data in transit)
21. What is the purpose of a security operations center (SOC)? (Continuously monitoring and responding to security incidents)
22. What is biometric authentication? (Using physical traits like fingerprints or facial recognition to verify identity)
23. What is the importance of regular employee offboarding in security? (Revoking access promptly when employees leave to prevent unauthorized access)
24. What is air-gapping a system? (Physically isolating a computer from unsecured networks for security)
25. What is the purpose of compliance standards like GDPR or HIPAA in cybersecurity? (Setting legal requirements for protecting personal and sensitive data)

Cybersecurity History & Careers — 25 Questions

1. What was the first computer virus, created as a proof of concept? (Creeper, in 1971)
2. What was the Morris Worm, released in 1988? (One of the first worms to spread widely across the early internet)
3. What was notable about the WannaCry ransomware attack of 2017? (It spread globally, exploiting a Windows vulnerability and affecting hospitals and businesses)
4. What was the Stuxnet worm, discovered in 2010? (A sophisticated cyberweapon believed to target Iranian nuclear facilities)
5. What organization is responsible for assigning CVE identifiers? (MITRE Corporation)
6. What is a "white hat" hacker's role generally? (Using hacking skills ethically and legally to improve security)
7. What is a Chief Information Security Officer (CISO) responsible for? (Overseeing an organization's overall information security strategy)
8. What certification is considered a gold standard for practical penetration testing skills? (OSCP — Offensive Security Certified Professional)
9. What does CompTIA Security+ certify? (Foundational cybersecurity knowledge and skills)
10. What does CISSP stand for? (Certified Information Systems Security Professional)
11. What organization maintains the OWASP Top 10 list of web vulnerabilities? (The Open Worldwide Application Security Project)
12. What government agency in the US focuses on cybersecurity and infrastructure protection? (CISA — Cybersecurity and Infrastructure Security Agency)
13. What was notable about the Equifax data breach of 2017? (It exposed personal data of roughly 147 million people)
14. What is a "bug bounty" program? (A program rewarding individuals for responsibly disclosing security vulnerabilities)
15. What is the role of a security analyst in an organization? (Monitoring systems and investigating potential security incidents)
16. What was the SolarWinds hack of 2020 notable for? (A sophisticated supply-chain attack affecting numerous government and corporate networks)
17. What is "Capture the Flag" (CTF) in the cybersecurity community? (A competition where participants solve security challenges to find hidden "flags")
18. What major event in 2013 revealed widespread government surveillance practices? (Disclosures by Edward Snowden)
19. What is a "red team" in cybersecurity testing? (A group simulating attacks to test an organization's defenses)
20. What is a "blue team" in cybersecurity? (The defensive team responsible for protecting against simulated or real attacks)
21. What career path focuses specifically on analyzing malware? (Malware analyst or reverse engineer)
22. What is digital forensics in cybersecurity careers? (Investigating and analyzing digital evidence after a security incident)
23. What is a Security Operations Center (SOC) analyst's typical responsibility? (Monitoring alerts and responding to potential threats in real time)
24. What is the purpose of cybersecurity insurance for organizations? (Providing financial protection against losses from cyber incidents)
25. What notable ransomware attack affected the Colonial Pipeline in 2021? (An attack that disrupted fuel supply across parts of the US)