Information and Cyber Security MCQs
BCA 6th Semester
Table of Contents
1. Introduction to Cyber Security
1. What is Cyber Security?
A) Protection of physical assets only
B) The practice of defending computers, servers, mobile devices, electronic systems, networks, and data from malicious attacks
C) A software program that identifies vulnerabilities
D) A type of computer virus
Correct Answer: B
2. Which of the following is NOT one of the three primary goals of information security?
A) Confidentiality
B) Integrity
C) Scalability
D) Availability
Correct Answer: C
3. What does the CIA triad in information security stand for?
A) Central Intelligence Agency
B) Confidentiality, Integrity, and Availability
C) Cyber Intelligence Association
D) Computer Information Architecture
Correct Answer: B
4. What is the primary goal of confidentiality in cybersecurity?
A) Ensure data is accurate and reliable
B) Make systems available to authorized users
C) Prevent unauthorized access to sensitive information
D) Track system activities
Correct Answer: C
5. Which of the following is NOT a cybersecurity defense mechanism?
A) Anti-virus software
B) SQL injection
C) Firewalls
D) Intrusion Detection Systems
Correct Answer: B
6. What is a security policy?
A) A software program that prevents cyber attacks
B) A document that outlines how an organization plans to protect its physical and information technology assets
C) A method of encryption
D) A type of antivirus software
Correct Answer: B
7. What is the purpose of a risk assessment in cybersecurity?
A) To identify, analyze and evaluate potential security risks
B) To determine the best antivirus software to use
C) To configure firewall settings
D) To establish user password policies
Correct Answer: A
8. Which of the following is an example of a defense-in-depth strategy?
A) Using only a firewall to protect a network
B) Relying solely on antivirus software
C) Implementing multiple layers of security controls throughout an information system
D) Changing passwords once per year
Correct Answer: C
9. What is a security vulnerability?
A) A software program designed to prevent unauthorized access
B) A weakness that can be exploited by a threat actor
C) A security protocol for preventing data breaches
D) A tool used by cybersecurity professionals to encrypt data
Correct Answer: B
10. What does data integrity refer to in cybersecurity?
A) Ensuring data is accessible to authorized users
B) Ensuring data is encrypted
C) Ensuring data remains accurate and unaltered
D) Ensuring data is backed up regularly
Correct Answer: C
2. Cyber Threats and Vulnerabilities
11. What is a zero-day vulnerability?
A) A vulnerability that has existed for zero days
B) A vulnerability that is known to the software vendor but hasn't been patched yet
C) A vulnerability that is unknown to the software vendor and has no available fix
D) A vulnerability that can be fixed in zero days
Correct Answer: C
12. What is phishing?
A) A type of malware that encrypts files and demands ransom
B) The practice of sending deceptive emails that appear to be from reputable sources to steal sensitive information
C) A method of securing email communications
D) A technique to prevent unauthorized access to a system
Correct Answer: B
13. What is a man-in-the-middle attack?
A) When an attacker physically positions themselves between two computers
B) When an attacker eavesdrops on communication between two parties without their knowledge
C) When an attacker uses social engineering to gain access to a building
D) When an attacker creates a fake website to steal credentials
Correct Answer: B
14. What is a DDoS attack?
A) An attempt to make a machine or network resource unavailable by flooding it with traffic from multiple sources
B) A method of encrypting data during transmission
C) A technique to gain unauthorized access to a system
D) A virus that duplicates itself and spreads to other computers
Correct Answer: A
15. What is social engineering in the context of cybersecurity?
A) Building social networks to improve security
B) Using technical methods to hack into systems
C) Manipulating people into divulging confidential information or performing actions that compromise security
D) Engineering social platforms to be more secure
Correct Answer: C
16. What is the difference between a threat and a vulnerability?
A) There is no difference; the terms are interchangeable
B) A threat is a potential danger while a vulnerability is a weakness that can be exploited
C) A threat is internal while a vulnerability is external
D) A vulnerability is a potential danger while a threat is a weakness that can be exploited
Correct Answer: B
17. What is SQL injection?
A) A method of injecting code that manipulates SQL databases
B) A way to optimize SQL database performance
C) A database management technique
D) A secure method for querying databases
Correct Answer: A
18. What is a brute force attack?
A) A sophisticated method of hacking that requires minimal computing power
B) An attack method that uses physical force to damage computer systems
C) A trial and error method used to decode encrypted data such as passwords by trying all possible combinations
D) A type of DDoS attack
Correct Answer: C
19. What is cross-site scripting (XSS)?
A) A security feature that allows websites to share information
B) A type of attack where malicious scripts are injected into trusted websites
C) A method for securing data transfer between websites
D) A programming technique for creating dynamic web pages
Correct Answer: B
20. What is a backdoor in cybersecurity?
A) An emergency exit in case of a physical security breach
B) A method of bypassing normal authentication in a system
C) A secure entry point for system administrators
D) A backup system for data recovery
Correct Answer: B
3. Cryptography Basics
21. What is cryptography?
A) The study of ancient writing systems
B) The practice of securing communication through the use of codes and ciphers
C) A method of creating digital currencies
D) The study of computer programming languages
Correct Answer: B
22. What is the difference between symmetric and asymmetric encryption?
A) Symmetric encryption uses one key for both encryption and decryption, while asymmetric uses different keys for each
B) Symmetric encryption is more secure than asymmetric encryption
C) Asymmetric encryption uses one key while symmetric uses multiple keys
D) There is no difference; the terms are interchangeable
Correct Answer: A
23. Which of the following is an example of a symmetric encryption algorithm?
A) RSA
B) AES
C) ECC
D) Diffie-Hellman
Correct Answer: B
24. Which of the following is an example of an asymmetric encryption algorithm?
A) AES
B) DES
C) RSA
D) Blowfish
Correct Answer: C
25. What is a hash function?
A) A function that encrypts data with a key
B) A function that converts data of arbitrary size to a fixed size without a key
C) A function that decrypts encrypted data
D) A function that compresses data for storage
Correct Answer: B
26. Which of the following is NOT a characteristic of a good cryptographic hash function?
A) It is deterministic (same input always produces the same output)
B) It is reversible (can recover original input from the hash)
C) It has high collision resistance
D) Small changes in input result in significantly different outputs
Correct Answer: B
27. What is the primary purpose of encryption in cybersecurity?
A) To speed up data processing
B) To compress data for efficient storage
C) To protect confidentiality of data
D) To detect viruses and malware
Correct Answer: C
28. What is a key in cryptography?
A) A piece of information that determines the output of a cryptographic algorithm
B) A device used to physically secure computer systems
C) A type of algorithm used to encrypt data
D) A password used to log into a system
Correct Answer: A
29. What is the primary advantage of asymmetric encryption over symmetric encryption?
A) It is faster and requires less computational power
B) It is easier to implement
C) It solves the key distribution problem
D) It provides stronger encryption that cannot be broken
Correct Answer: C
30. What is a digital certificate used for?
A) To certify that a user has completed cybersecurity training
B) To encrypt data during transmission
C) To verify the ownership of a public key
D) To track user activities on a network
Correct Answer: C
4. Network Security
31. What is a firewall in computer networks?
A) A physical barrier that prevents unauthorized access to server rooms
B) A network security device that monitors and filters incoming and outgoing network traffic
C) Software that detects malware
D) A backup system that activates when the main system fails
Correct Answer: B
32. What is the primary function of an Intrusion Detection System (IDS)?
A) To encrypt network traffic
B) To block unauthorized access to a network
C) To monitor network traffic for suspicious activities and alert administrators
D) To optimize network performance
Correct Answer: C
33. What is the difference between an IDS and an IPS?
A) IDS is for detection only, while IPS can also prevent/block attacks
B) IPS is for detection only, while IDS can also prevent/block attacks
C) IDS is for internal networks, while IPS is for external networks
D) There is no difference; the terms are interchangeable
Correct Answer: A
34. What is a VPN?
A) A type of firewall that provides extra security
B) A technology that creates a secure, encrypted connection over a less secure network
C) A special network protocol used only by government agencies
D) A virus protection network
Correct Answer: B
35. What is a DMZ (Demilitarized Zone) in network security?
A) A physical area where computers are not allowed
B) A subnet that contains an organization's exposed, outward-facing services
C) A zone where military-grade encryption is used
D) A network that has no security measures
Correct Answer: B
36. What is port scanning?
A) A technique to find open ports on a target system
B) A method of securing unused ports on a network
C) A process of copying data from one port to another
D) Monitoring shipping ports for security threats
Correct Answer: A
37. Which protocol is used to secure HTTP connections?
A) FTP
B) HTTPS
C) SMTP
D) TELNET
Correct Answer: B
38. What is ARP poisoning?
A) A technique to secure ARP tables
B) A method of encrypting ARP requests
C) An attack that involves sending fake ARP messages to associate the attacker's MAC address with a legitimate IP address
D) A virus that targets ARP protocols
Correct Answer: C
39. What is the purpose of network segmentation?
A) To improve network performance by reducing traffic
B) To establish a flat network architecture
C) To divide a network into multiple segments or subnets to improve security
D) To combine multiple networks into one large network
Correct Answer: C
40. What is a honeypot in network security?
A) A security mechanism designed to detect, deflect, or counteract attempts at unauthorized use of information systems
B) A trap set to detect or deflect unauthorized access attempts to a network
C) A technique for encrypting network traffic
D) A sweet treat given to ethical hackers
Correct Answer: B
5. Cyber Crimes and Cyber Laws
41. What is cybercrime?
A) Using computers for any illegal purpose
B) Criminal activity that involves a computer, network, or network-connected device
C) Breaking into government networks
D) Creating malware
Correct Answer: B
42. When was the Information Technology Act in India first enacted?
A) 1990
B) 2000
C) 2008
D) 2013
Correct Answer: B
43. Which section of the IT Act deals with penalties for data protection breaches?
A) Section 43A
B) Section 66
C) Section 72
D) Section 84
Correct Answer: A
44. Which of the following is NOT considered cybercrime under the IT Act?
A) Unauthorized access to computer systems
B) Computer-related fraud
C) Installing legitimate security software
D) Cyber terrorism
Correct Answer: C
45. What is identity theft?
A) The theft of computer hardware
B) The fraudulent acquisition and use of a person's private identifying information
C) Stealing network equipment
D) Creating a fake email address
Correct Answer: B
46. Which of the following is NOT a punishment under the IT Act 2000 for cybercrimes?
A) Imprisonment
B) Fine
C) Community service
D) Both imprisonment and fine
Correct Answer: C
47. What is the punishment for hacking under Section 66 of the IT Act 2000?
A) Imprisonment up to 6 months
B) Imprisonment up to 3 years or fine up to Rs. 5 lakh, or both
C) Only fine up to Rs. 2 lakh
D) Imprisonment up to 10 years
Correct Answer: B
48. What is cyber stalking?
A) Using the internet to stalk or harass an individual, group, or organization
B) Using a computer to break into secured systems
C) Creating fake social media profiles
D) Sending spam emails
Correct Answer: A
49. Which amendment to the IT Act 2000 introduced provisions related to child pornography?
A) The 2005 amendment
B) The 2008 amendment
C) The 2013 amendment
D) The 2017 amendment
Correct Answer: B
50. Under which section of the IT Act is publishing obscene material in electronic form punishable?
A) Section 66
B) Section 67
C) Section 72
D) Section 84
Correct Answer: B
6. Ethical Hacking Fundamentals
51. What is ethical hacking?
A) Hacking into systems without authorization
B) The practice of hacking into a system with the permission of its owner to identify security vulnerabilities
C) Creating and distributing viruses for research purposes
D) Stealing data for educational purposes
Correct Answer: B
52. What is the main difference between an ethical hacker and a malicious hacker?
A) The tools they use
B) Their technical knowledge
C) Authorization and intent
D) The time they spend hacking
Correct Answer: C
53. What is a penetration test?
A) A test of a network's physical security
B) A simulated cyberattack to check for exploitable vulnerabilities
C) A test of a firewall's effectiveness
D) A test to determine if a system has been compromised
Correct Answer: B
54. What is the first phase of ethical hacking?
A) Scanning
B) Reconnaissance/Footprinting
C) Gaining Access
D) Maintaining Access
Correct Answer: B
55. Which of the following is NOT a type of penetration testing?
A) Black box testing
B) White box testing
C) Gray box testing
D) Clear box testing
Correct Answer: D
56. What is social engineering in ethical hacking?
A) Building relationships with other ethical hackers
B) Manipulating people into divulging confidential information
C) Creating social media profiles for reconnaissance
D) Engineering social platforms to be more secure
Correct Answer: B
57. What is vulnerability assessment?
A) A process of identifying security holes in a system or network
B) Assessing the financial impact of a security breach
C) Determining if a system has been compromised
D) Evaluating the effectiveness of security personnel
Correct Answer: A
58. Which tool is commonly used for network scanning during ethical hacking?
A) Microsoft Word
B) Nmap
C) Adobe Photoshop
D) Calculator
Correct Answer: B
59. What is the purpose of a security audit?
A) To hack into a system to steal data
B) To systematically evaluate the security of a system or application
C) To install security software
D) To train security personnel
Correct Answer: B
60. What is the final phase of ethical hacking?
A) Scanning
B) Gaining Access
C) Maintaining Access
D) Reporting
Correct Answer: D
7. Malware
61. What is malware?
A) Software designed to help maintain computer systems
B) Software specifically designed to disrupt, damage, or gain unauthorized access to a computer system
C) Software used for ethical hacking
D) Software used to secure computer systems
Correct Answer: B
62. Which of the following is NOT a type of malware?
A) Virus
B) Trojan horse
C) Firewall
D) Ransomware
Correct Answer: C
63. What is a computer virus?
A) A type of malware that can self-replicate and attach itself to other programs
B) A program that provides security to a computer
C) A hardware component that can be infected
D) A type of network security protocol
Correct Answer: A
64. What is a Trojan horse?
A) A type of malware that appears legitimate but is designed to perform harmful actions
B) A virus that only affects Macintosh computers
C) A physical device used to breach security
D) A security tool used by ethical hackers
Correct Answer: A
65. What distinguishes a worm from a virus?
A) Worms are not malicious while viruses are
B) Worms can self-replicate and spread independently, while viruses need a host program
C) Viruses can self-replicate while worms cannot
D) Worms only affect networks, not individual computers
Correct Answer: B
66. What is ransomware?
A) Software that protects against malware
B) Malware that blocks access to data until a ransom is paid
C) A type of security tool
D) A type of encryption used to secure data
Correct Answer: B
67. What is spyware?
A) Software used by security agencies to monitor networks
B) Software that secretly monitors and collects information about a user's activities without their consent
C) A type of antivirus software
D) Software used to encrypt sensitive data
Correct Answer: B
68. What is a rootkit?
A) A collection of software tools that enable administrator-level access to a computer or network
B) A tool used to secure the root directory of a computer
C) A kit used to physically secure computer hardware
D) A tool used to recover deleted files
Correct Answer: A
69. What is the primary purpose of adware?
A) To provide security updates
B) To automatically display advertisements to users
C) To encrypt data
D) To enhance system performance
Correct Answer: B
70. What is a logic bomb?
A) A physical explosive device used to destroy computer hardware
B) A piece of code intentionally inserted into software to perform a malicious function when triggered by specific conditions
C) A tool used to test logical errors in programming
D) A security mechanism used to prevent unauthorized access
Correct Answer: B
8. Wireless Network Security
71. What is the most secure wireless encryption protocol among the following?
A) WEP
B) WPA
C) WPA2
D) WPA3
Correct Answer: D
72. Why is WEP considered insecure for wireless networks?
A) It uses too complex encryption algorithms
B) It has known vulnerabilities and can be easily cracked
C) It requires too much processing power
D) It is too expensive to implement
Correct Answer: B
73. What is a rogue access point?
A) An access point that has been authorized by network administrators
B) An unauthorized wireless access point installed on a secure network
C) A specially configured access point used for security testing
D) An access point with enhanced security features
Correct Answer: B
74. What is a wireless evil twin attack?
A) When two legitimate access points interfere with each other
B) When a legitimate access point is configured with two SSIDs
C) When an attacker creates a fake access point with the same SSID as a legitimate one
D) When two wireless networks use the same channel
Correct Answer: C
75. What is war driving?
A) A military tactic involving drones
B) The act of searching for Wi-Fi networks by a person in a moving vehicle using a portable computer
C) A type of denial-of-service attack
D) A method of securing wireless networks
Correct Answer: B
76. What is MAC filtering in wireless security?
A) Filtering out Macintosh computers from the network
B) A security technique that allows only devices with specific MAC addresses to access the network
C) A method of enhancing wireless signal strength
D) A technique to limit internet access based on content
Correct Answer: B
77. Why is MAC address filtering not considered a strong security measure?
A) It is too difficult to implement
B) It slows down the network significantly
C) MAC addresses can be easily spoofed
D) It is not supported by most wireless routers
Correct Answer: C
78. What is a wireless jamming attack?
A) When an attacker uses specially designed equipment to interfere with wireless signals
B) When an attacker steals wireless encryption keys
C) When an attacker changes the configuration of a wireless access point
D) When an attacker intercepts wireless traffic
Correct Answer: A
79. What is SSID hiding?
A) Physically hiding the wireless router
B) Configuring the wireless network not to broadcast its network name
C) Encrypting the SSID with a special algorithm
D) Changing the SSID frequently
Correct Answer: B
80. Why is SSID hiding not considered a strong security measure?
A) It makes the network hard to use
B) It reduces signal strength
C) The SSID can still be discovered by monitoring probe requests from connected devices
D) It increases network latency
Correct Answer: C
9. Digital Signatures and Certificates
81. What is a digital signature?
A) A scanned image of a handwritten signature
B) A mathematical scheme for verifying the authenticity of digital messages or documents
C) A password used to access digital documents
D) A digital watermark embedded in documents
Correct Answer: B
82. What is the primary purpose of a digital signature?
A) To encrypt the contents of a document
B) To verify the identity of the sender and ensure that the message has not been altered
C) To compress the document for faster transmission
D) To add a visual signature to electronic documents
Correct Answer: B
83. Which of the following is NOT a characteristic of a digital signature?
A) Authentication
B) Non-repudiation
C) Integrity
D) Confidentiality
Correct Answer: D
84. What is a digital certificate?
A) A certificate of completion for a cybersecurity course
B) An electronic document that proves the ownership of a public key
C) A password used to access secure websites
D) A digital backup of important documents
Correct Answer: B
85. Who issues digital certificates?
A) Internet Service Providers (ISPs)
B) Certificate Authorities (CAs)
C) Web hosting companies
D) Government agencies only
Correct Answer: B
86. What is the X.509 standard?
A) A standard for public key infrastructure (PKI) and digital certificates
B) A type of encryption algorithm
C) A standard for wireless network security
D) A protocol for secure file transfer
Correct Answer: A
87. What is a certificate revocation list (CRL)?
A) A list of websites with valid certificates
B) A list of digital certificates that are no longer valid
C) A list of approved certificate authorities
D) A list of encryption algorithms used in certificates
Correct Answer: B
88. What does PKI stand for in the context of digital certificates?
A) Personal Key Infrastructure
B) Private Key Integration
C) Public Key Infrastructure
D) Protected Key Installation
Correct Answer: C
89. Which of the following is NOT a component of PKI?
A) Certificate Authority
B) Registration Authority
C) Internet Authority
D) Certificate Repository
Correct Answer: C
90. What is the purpose of a timestamp in a digital signature?
A) To make the signature look more official
B) To prove when the signature was created
C) To encrypt the signature
D) To identify where the signature was created
Correct Answer: B
10. Cloud and IoT Security
91. What is cloud computing?
A) Computing that takes place in cold environments
B) The delivery of computing services over the internet
C) A type of weather forecasting technology
D) A special type of computer hardware
Correct Answer: B
92. What does IoT stand for?
A) Internet of Things
B) Integration of Technology
C) Internal Office Technology
D) International Online Transactions
Correct Answer: A
93. Which of the following is a security concern specific to cloud computing?
A) Physical damage to hardware
B) Data location and jurisdiction issues
C) Local power outages
D) Hardware obsolescence
Correct Answer: B
94. What is a key security challenge for IoT devices?
A) They are too expensive
B) They often have limited processing power for implementing strong security measures
C) They are not widely available
D) They consume too much electricity
Correct Answer: B
95. What is the shared responsibility model in cloud security?
A) All security is the responsibility of the cloud provider
B) All security is the responsibility of the cloud customer
C) Security responsibilities are shared between the cloud provider and the customer
D) Security is the responsibility of a third-party security firm
Correct Answer: C
96. What is a botnet in relation to IoT security?
A) A network of IoT devices that have been compromised and can be controlled remotely
B) A type of security software for IoT devices
C) A networking protocol specific to IoT
D) A type of IoT device
Correct Answer: A
97. What is data residency in cloud computing?
A) How long data is stored in the cloud
B) The physical location where data is stored
C) How data is transferred between cloud services
D) The format in which data is stored
Correct Answer: B
98. What is a key concern with default passwords in IoT devices?
A) They are too complex to remember
B) They are often the same across all devices of the same model, making them vulnerable
C) They expire too quickly
D) They require special characters
Correct Answer: B
99. What is the OWASP IoT Top 10?
A) The top 10 selling IoT devices
B) A list of the top 10 security vulnerabilities specific to IoT
C) The 10 most expensive IoT implementations
D) A list of 10 recommended IoT devices for home use
Correct Answer: B
100. Which of the following is a measure to enhance cloud security?
A) Using the same password for all cloud services
B) Implementing multi-factor authentication
C) Sharing access credentials with all team members
D) Disabling encryption to improve performance
Correct Answer: B
 6 semester){kind=link}
0 Comments