Cyber Security has become a critical domain in computer science, information technology, and competitive examinations. Candidates preparing for PPSC Lecturer Computer Science, FPSC, NTS, and various IT recruitment tests frequently encounter questions related to information security, encryption algorithms, malware types, network protocols, and ethical hacking. This curated collection features 50 high-yield Cyber Security MCQs with verified answers and detailed explanations to help you master fundamental security concepts.
Section 1: Information Security Fundamentals & CIA Triad
Q1. What does the “CIA Triad” stand for in information security?
A) Confidentiality, Integrity, Availability
B) Control, Inspection, Authorization
C) Confidentiality, Identification, Authentication
D) Computing, Intelligence, Automation
Correct Answer: A) Confidentiality, Integrity, Availability
Explanation: The CIA triad is a foundational model designed to guide policies for information security within an organization: Confidentiality (privacy), Integrity (accuracy/trustworthiness), and Availability (accessibility).
Q2. Which principle of the CIA triad ensures that data is accessible only to authorized individuals?
A) Integrity
B) Availability
C) Confidentiality
D) Non-repudiation
Correct Answer: C) Confidentiality
Explanation: Confidentiality prevents sensitive data from being exposed to unauthorized people, entities, or processes.
Q3. Ensuring that data has not been altered, modified, or tampered with by unauthorized parties refers to which security principle?
A) Confidentiality
B) Integrity
C) Availability
D) Authentication
Correct Answer: B) Integrity
Explanation: Data integrity guarantees that information remains accurate and reliable, free from malicious or accidental modification.
Q4. What security property ensures that computer systems and data are accessible to authorized users whenever needed?
A) Confidentiality
B) Integrity
C) Availability
D) Scalability
Correct Answer: C) Availability
Explanation: Availability ensures that infrastructure, network services, and applications function properly and remain reachable for legitimate users.
Q5. What security service confirms the identity of a user, device, or system before granting access?
A) Authorization
B) Authentication
C) Encryption
D) Auditing
Correct Answer: B) Authentication
Explanation: Authentication validates who a user or system is (e.g., via passwords, biometrics, or tokens), whereas authorization determines what they are allowed to do.
Q6. What process determines what resources a successfully authenticated user is permitted to access?
A) Encryption
B) Authentication
C) Authorization
D) Hashing
Correct Answer: C) Authorization
Explanation: Authorization grants or restricts specific access rights and privileges to authenticated entities based on security policies.
Q7. Which security concept prevents a sender from denying they sent a message or transaction?
A) Confidentiality
B) Non-repudiation
C) Redundancy
D) Obfuscation
Correct Answer: B) Non-repudiation
Explanation: Non-repudiation provides undeniable proof of data transmission or receipt, commonly achieved using digital signatures.
Q8. What term describes a weakness or flaw in a system’s design, implementation, or configuration?
A) Threat
B) Vulnerability
C) Exploit
D) Malware
Correct Answer: B) Vulnerability
Explanation: A vulnerability is a security loophole or weakness that attackers can potentially exploit to compromise a system.
Q9. Any circumstance or event with the potential to adversely impact a system or organization is called a:
A) Vulnerability
B) Threat
C) Countermeasure
D) Patch
Correct Answer: B) Threat
Explanation: A threat represents a potential danger that could exploit a vulnerability and cause harm to information assets.
Q10. What security mechanism is designed to neutralize or mitigate a potential threat or vulnerability?
A) Exploit
B) Countermeasure (Control)
C) Malware
D) Payload
Correct Answer: B) Countermeasure (Control)
Explanation: Countermeasures (or security controls) protect systems by reducing vulnerabilities or blocking threats.
Section 2: Malware, Viruses & Attacks
Q11. What malicious software disguises itself as a legitimate or useful program to trick users into installing it?
A) Virus
B) Worm
C) Trojan Horse
D) Ransomware
Correct Answer: C) Trojan Horse
Explanation: A Trojan appears benign or helpful, but conceals malicious code designed to compromise system security once executed.
Q12. What type of malware replicates itself across computer networks without requiring human user interaction?
A) Trojan Horse
B) Computer Worm
C) Logic Bomb
D) Spyware
Correct Answer: B) Computer Worm
Explanation: Unlike viruses that require a host file or user action, worms independently propagate across network connections.
Q13. What malware encrypts a victim’s files or locks system access until a monetary demand is paid?
A) Adware
B) Ransomware
C) Rootkit
D) Spyware
Correct Answer: B) Ransomware
Explanation: Ransomware holds data hostage through cryptographic encryption, demanding ransom payments for decryption keys.
Q14. What deceptive social engineering technique involves sending fraudulent emails disguised as trusted entities to steal credentials?
A) Phishing
B) Spoofing
C) Sniffing
D) Pharming
Correct Answer: A) Phishing
Explanation: Phishing uses deceptive communications to trick victims into revealing sensitive personal or corporate data.
Q15. What targeted phishing attack specifically focuses on high-profile executives or individuals with high-level access?
A) Vishing
B) Whaling
C) Smishing
D) Spimming
Correct Answer: B) Whaling
Explanation: Whaling targets senior executives (“big fish”) to steal valuable corporate credentials or authorize fraudulent fund transfers.
Q16. What attack floods a target website or server with massive bogus traffic to exhaust resources and cause service disruption?
A) Man-in-the-Middle Attack
B) Denial of Service (DoS / DDoS)
C) SQL Injection
D) Cross-Site Scripting
Correct Answer: B) Denial of Service (DoS / DDoS)
Explanation: DDoS attacks overload servers with simultaneous requests originating from multiple distributed compromised systems.
Q17. In which attack type does an unauthorized third party secretly intercept and relay communications between two parties?
A) Buffer Overflow
B) Man-in-the-Middle (MitM) Attack
C) Zero-Day Attack
D) Brute Force Attack
Correct Answer: B) Man-in-the-Middle (MitM) Attack
Explanation: MitM attackers position themselves secretly in a communication channel to eavesdrop or alter data exchanged between users.
Q18. What vulnerability injection attack allows malicious database commands to be executed via web application input fields?
A) Cross-Site Scripting (XSS)
B) SQL Injection (SQLi)
C) Buffer Overflow
D) DNS Poisoning
Correct Answer: B) SQL Injection (SQLi)
Explanation: SQL injection exploits poorly validated input fields to execute unauthorized database queries and extract sensitive tables.
Q19. What security flaw occurs when a program writes more data to a memory buffer than it can hold, overwriting adjacent memory?
A) SQL Injection
B) Buffer Overflow
C) Phishing
D) Session Hijacking
Correct Answer: B) Buffer Overflow
Explanation: Buffer overflows occur when applications lack boundary checks, allowing attackers to inject and execute arbitrary machine code.
Q20. What security exploit targets previously unknown software vulnerabilities before developers can issue a patch?
A) Brute-force Attack
B) Zero-Day Exploit
C) Dictionary Attack
D) Rainbow Table Attack
Correct Answer: B) Zero-Day Exploit
Explanation: Zero-day exploits take advantage of software flaws on the very day they are discovered, before a fix is released.
Section 3: Cryptography & Security Protocols
Q21. What branch of mathematics and computing is dedicated to securing communication through scrambling and unscrambling data?
A) Steganography
B) Cryptography
C) Biometrics
D) Hashing
Correct Answer: B) Cryptography
Explanation: Cryptography transforms readable plaintext into unreadable ciphertext and back, ensuring data privacy and integrity.
Q22. What cryptographic technique uses the exact same key for both encryption and decryption?
A) Asymmetric Encryption
B) Symmetric Encryption
C) Public Key Cryptography
D) Hashing
Correct Answer: B) Symmetric Encryption
Explanation: Symmetric algorithms (e.g., AES, DES) rely on a shared secret key utilized by both sender and receiver.
Q23. Which cryptographic system uses a key pair consisting of a Public Key and a Private Key?
A) Symmetric Encryption
B) Asymmetric Encryption
C) Caesar Cipher
D) Substitution Cipher
Correct Answer: B) Asymmetric Encryption
Explanation: Asymmetric algorithms (e.g., RSA, ECC) encrypt data with a public key and decrypt it using a corresponding private key.
Q24. Which of the following is a widely used symmetric block cipher standard?
A) RSA
B) AES (Advanced Encryption Standard)
C) Diffie-Hellman
D) DSA
Correct Answer: B) AES (Advanced Encryption Standard)
Explanation: AES is a robust, globally recognized symmetric encryption standard supporting key lengths of 128, 192, and 256 bits.
Q25. What cryptographic process converts arbitrary input data into a fixed-length string of characters (digest) that cannot be reversed?
A) Encryption
B) Decryption
C) Hashing
D) Steganography
Correct Answer: C) Hashing
Explanation: Hashing is a one-way mathematical function (e.g., SHA-256, MD5) used to verify data integrity.
Q26. Which of the following is a cryptographic hash algorithm?
A) AES
B) DES
C) SHA-256
D) RSA
Correct Answer: C) SHA-256
Explanation: Secure Hash Algorithm 256 (SHA-256) generates a unique 256-bit hash fingerprint to check for data tampering.
Q27. What secure protocol is used to encrypt web traffic between a browser and a web server over port 443?
A) HTTP
B) FTP
C) HTTPS (SSL/TLS)
D) Telnet
Correct Answer: C) HTTPS (SSL/TLS)
Explanation: HTTPS secures web communications using SSL/TLS cryptographic protocols.
Q28. What protocol provides secure encrypted command-line remote login services over port 22?
A) Telnet
B) SSH (Secure Shell)
C) RDP
D) SNMP
Correct Answer: B) SSH (Secure Shell)
Explanation: SSH replaces unencrypted remote administration tools like Telnet with secure cryptographic channels.
Q29. What security protocol secures wireless local area networks (WLANs) using advanced encryption?
A) WEP
B) WPA2 / WPA3
C) HTTP
D) ARP
Correct Answer: B) WPA2 / WPA3
Explanation: WPA2 and WPA3 provide robust Wi-Fi security frameworks replacing older, easily cracked protocols like WEP.
Q30. What digital file securely binds a public key to the identity of its owner, issued by a Certificate Authority (CA)?
A) Password File
B) Digital Certificate
C) Cookie
D) Log File
Correct Answer: B) Digital Certificate
Explanation: Digital certificates validate the identity of websites and servers in Public Key Infrastructure (PKI) environments.
Section 4: Network Security & Defense Mechanisms
Q31. What network security system monitors incoming and outgoing traffic and filters packets based on security rules?
A) Switch
B) Firewall
C) Hub
D) Repeater
Correct Answer: B) Firewall
Explanation: Firewalls act as a security barrier between trusted internal networks and untrusted external networks.
Q32. What advanced security device monitors network traffic for suspicious activity and generates alerts or blocks threats in real-time?
A) IDS / IPS
B) Network Bridge
C) Modem
D) Hub
Correct Answer: A) IDS / IPS
Explanation: Intrusion Detection Systems (IDS) monitor and alert, while Intrusion Prevention Systems (IPS) actively block detected threats.
Q33. What isolated, controlled network layer hosts public-facing services while protecting the internal corporate network?
A) VLAN
B) DMZ (Demilitarized Zone)
C) VPN Tunnel
D) Subnet
Correct Answer: B) DMZ (Demilitarized Zone)
Explanation: A DMZ acts as a buffer zone between the public internet and a private internal network.
Q34. What technology creates a private, encrypted communication tunnel across a public network like the internet?
A) NAT
B) VPN (Virtual Private Network)
C) DHCP
D) DNS
Correct Answer: B) VPN (Virtual Private Network)
Explanation: VPNs protect data privacy and integrity for remote users connecting to internal organizational infrastructure.
Q35. What security practice involves creating duplicate copies of critical data to protect against hardware failure or ransomware?
A) Redundancy
B) Data Backup
C) Hashing
D) Partitioning
Correct Answer: B) Data Backup
Explanation: Routine data backups ensure recovery capabilities following data loss, hardware failures, or cyber extortion.
Q36. What security principle restricts user account privileges to the absolute minimum necessary to perform job duties?
A) Defense in Depth
B) Principle of Least Privilege (PoLP)
C) Separation of Duties
D) Open Design
Correct Answer: B) Principle of Least Privilege (PoLP)
Explanation: PoLP limits exposure by ensuring users and programs only possess permissions required for their specific tasks.
Q37. What multi-layered security strategy deploys multiple independent defensive controls so that if one fails, others protect the system?
A) Single Point of Failure
B) Defense in Depth (Layered Security)
C) Perimeter Security
D) Flat Network Architecture
Correct Answer: B) Defense in Depth (Layered Security)
Explanation: Defense in depth relies on multiple defensive layers (firewalls, MFA, encryption, endpoint security) to safeguard assets.
Q38. What authentication method requires a user to provide two or more verification factors to gain access?
A) Single Sign-On (SSO)
B) Multi-Factor Authentication (MFA)
C) Password Hashing
D) Biometric Encryption
Correct Answer: B) Multi-Factor Authentication (MFA)
Explanation: MFA strengthens security by combining distinct authentication categories: something you know, something you have, and something you are.
Q39. What type of ethical hacker is legally hired by organizations to test and probe systems for security vulnerabilities?
A) Black-Hat Hacker
B) White-Hat Hacker
C) Script Kiddie
D) Cyber Terrorist
Correct Answer: B) White-Hat Hacker
Explanation: White-hat hackers perform penetration testing with explicit permission to identify and fix security flaws before malicious actors find them.
Q40. What term describes malicious hackers who break into systems for illegal personal gain, malice, or disruption?
A) White-Hat Hacker
B) Black-Hat Hacker
C) Auditor
D) Security Analyst
Correct Answer: B) Black-Hat Hacker
Explanation: Black-hat hackers exploit vulnerabilities maliciously for financial theft, espionage, or sabotage.
Section 5: Operating System & Application Security (41-50)
Q41. What software update is released by developers to fix discovered security vulnerabilities or software bugs?
A) Malware
B) Patch / Security Update
C) Driver
D) Freeware
Correct Answer: B) Patch / Security Update
Explanation: Regular patching is essential to close security loopholes before attackers can exploit them.
Q42. What security concept ensures that critical tasks require two or more people to cooperate, preventing fraud?
A) Least Privilege
B) Separation of Duties
C) Multi-Factor Authentication
D) Data Obfuscation
Correct Answer: B) Separation of Duties
Explanation: Separation of duties divides sensitive responsibilities across multiple personnel to minimize risk of internal fraud or error.
Q43. What malicious software grants hidden, privileged administrative access to a computer while evading detection?
A) Spyware
B) Rootkit
C) Adware
D) Worm
Correct Answer: B) Rootkit
Explanation: Rootkits modify operating system kernels or core files to maintain persistent backdoor access without detection.
Q44. What type of software covertly tracks user activity, keystrokes, and browsing habits without consent?
A) Spyware
B) Firewall
C) Antivirus
D) Compiler
Correct Answer: A) Spyware
Explanation: Spyware gathers private user information and transmits it to unauthorized third parties.
Q45. What technique conceals secret messages or data inside ordinary non-secret files (like images or audio)?
A) Cryptography
B) Steganography
C) Hashing
D) Tokenization
Correct Answer: B) Steganography
Explanation: Steganography hides the very existence of a communication within carrier files rather than encrypting the text.
Q46. What attack targets user sessions by stealing session cookies or tokens after successful login?
A) Brute-Force Attack
B) Session Hijacking
C) SQL Injection
D) DNS Spoofing
Correct Answer: B) Session Hijacking
Explanation: Session hijacking allows attackers to impersonate authenticated users by stealing active session tokens.
Q47. What security mechanism replaces sensitive data values with unique randomized identification tokens for privacy?
A) Encryption
B) Tokenization
C) Hashing
D) Compression
Correct Answer: B) Tokenization
Explanation: Tokenization substitutes sensitive data (like credit card numbers) with random tokens, protecting data at rest.
Q48. What security assessment technique involves simulating real-world cyber attacks against a system to test defenses?
A) Vulnerability Scanning
B) Penetration Testing (Pen Test)
C) Code Compilation
D) Packet Sniffing
Correct Answer: B) Penetration Testing (Pen Test)
Explanation: Penetration tests actively probe applications and networks to evaluate the strength of existing security controls.
Q49. What automated security tool checks systems for known vulnerabilities, misconfigurations, and outdated software?
A) Antivirus Scanner
B) Vulnerability Scanner
C) Firewall
D) Packet Analyzer
Correct Answer: B) Vulnerability Scanner
Explanation: Vulnerability scanners systematically review network assets against databases of known security flaws.
Q50. What foundational cybersecurity practice involves teaching staff and employees how to recognize phishing and social engineering?
A) Patch Management
B) Security Awareness Training
C) Network Subnetting
D) Data Hashing
Correct Answer: B) Security Awareness Training
Explanation: Human error is a primary security risk; awareness training equips employees to spot and report social engineering attempts.
Conclusion
Mastering these 50 Cyber Security MCQs establishes a robust understanding of information security principles, threats, cryptographic systems, and defensive architectures. Regular practice of these high-frequency exam questions will significantly boost your confidence for PPSC, FPSC, NTS, and professional IT interviews.