CYBER SECURITY FUNDAMENTALS EXAM NEWEST
2026 ACTUAL EXAM TEST BANK| 2 VERSIONS
(VERSION A & B) WITH COMPLETE 350 REAL EXAM
QUESTIONS AND CORRECT VERIFIED ANSWERS/
ALREADY GRADED A+ (MOST RECENT!!)
1. Which of the following best defines the “CIA Triad” in
cybersecurity?
a) Confidentiality, Integrity, Authentication
b) Confidentiality, Integrity, Availability
c) Confidentiality, Inspection, Authorization
d) Centralized Intelligence Agency
Correct Answer: b) Confidentiality, Integrity, Availability
Rationale: The CIA Triad is the foundational model for information
security. Confidentiality ensures data is not disclosed to
unauthorized parties; Integrity ensures data is not altered
improperly; Availability ensures data is accessible when needed.
2. What type of attack occurs when an attacker intercepts and
possibly alters communication between two parties who
believe they are directly communicating with each other?
a) Denial of Service
b) Man-in-the-Middle (MITM)
1
,c) Phishing
d) Replay attack
Correct Answer: b) Man-in-the-Middle (MITM)
Rationale: In a MITM attack, the attacker secretly relays and
possibly alters the communication between two parties. Neither
party is aware of the interception.
3. Which layer of the OSI model does a firewall operate at
when filtering based on IP addresses and ports?
a) Application Layer
b) Session Layer
c) Network and Transport Layers
d) Physical Layer
Correct Answer: c) Network and Transport Layers
Rationale: Firewalls that filter based on IP addresses operate at the
Network layer (Layer 3), and filtering based on ports operates at
the Transport layer (Layer 4).
4. What is the primary purpose of hashing in cybersecurity?
a) Encrypt data so it can be decrypted later
b) Verify data integrity
c) Authenticate a user
d) Provide non-repudiation
2
,Correct Answer: b) Verify data integrity
Rationale: Hashing produces a fixed-size digest of data. If the
data changes, the hash changes. It is not reversible, so it’s not
encryption—it ensures integrity.
5. Which of the following is an example of symmetric
encryption?
a) RSA
b) ECC
c) AES
d) Diffie-Hellman
Correct Answer: c) AES
Rationale: AES (Advanced Encryption Standard) is a symmetric
encryption algorithm, meaning the same key is used for encryption
and decryption. RSA and ECC are asymmetric.
6. What is the main risk of using default credentials on a
network device?
a) Weak hashing algorithms
b) Ease of brute-force attacks
c) Unauthorized access by attackers
d) Loss of data integrity
3
, Correct Answer: c) Unauthorized access by attackers
Rationale: Default usernames/passwords are widely known and
published. Attackers can use them to gain immediate administrative
access to devices.
7. A security policy that states “all HTTP traffic must be
blocked except for the proxy server” is an example of what?
a) Default-deny principle
b) Principle of least privilege
c) Separation of duties
d) Defense in depth
Correct Answer: a) Default-deny principle
Rationale: Default-deny means all traffic is blocked unless explicitly
allowed. Here, only the proxy server is allowed HTTP, everything
else is denied.
8. Which attack involves sending unsolicited messages to a
large number of people hoping a few will click malicious
links?
a) Whaling
b) Spear phishing
c) Spam phishing
d) Vishing
4
2026 ACTUAL EXAM TEST BANK| 2 VERSIONS
(VERSION A & B) WITH COMPLETE 350 REAL EXAM
QUESTIONS AND CORRECT VERIFIED ANSWERS/
ALREADY GRADED A+ (MOST RECENT!!)
1. Which of the following best defines the “CIA Triad” in
cybersecurity?
a) Confidentiality, Integrity, Authentication
b) Confidentiality, Integrity, Availability
c) Confidentiality, Inspection, Authorization
d) Centralized Intelligence Agency
Correct Answer: b) Confidentiality, Integrity, Availability
Rationale: The CIA Triad is the foundational model for information
security. Confidentiality ensures data is not disclosed to
unauthorized parties; Integrity ensures data is not altered
improperly; Availability ensures data is accessible when needed.
2. What type of attack occurs when an attacker intercepts and
possibly alters communication between two parties who
believe they are directly communicating with each other?
a) Denial of Service
b) Man-in-the-Middle (MITM)
1
,c) Phishing
d) Replay attack
Correct Answer: b) Man-in-the-Middle (MITM)
Rationale: In a MITM attack, the attacker secretly relays and
possibly alters the communication between two parties. Neither
party is aware of the interception.
3. Which layer of the OSI model does a firewall operate at
when filtering based on IP addresses and ports?
a) Application Layer
b) Session Layer
c) Network and Transport Layers
d) Physical Layer
Correct Answer: c) Network and Transport Layers
Rationale: Firewalls that filter based on IP addresses operate at the
Network layer (Layer 3), and filtering based on ports operates at
the Transport layer (Layer 4).
4. What is the primary purpose of hashing in cybersecurity?
a) Encrypt data so it can be decrypted later
b) Verify data integrity
c) Authenticate a user
d) Provide non-repudiation
2
,Correct Answer: b) Verify data integrity
Rationale: Hashing produces a fixed-size digest of data. If the
data changes, the hash changes. It is not reversible, so it’s not
encryption—it ensures integrity.
5. Which of the following is an example of symmetric
encryption?
a) RSA
b) ECC
c) AES
d) Diffie-Hellman
Correct Answer: c) AES
Rationale: AES (Advanced Encryption Standard) is a symmetric
encryption algorithm, meaning the same key is used for encryption
and decryption. RSA and ECC are asymmetric.
6. What is the main risk of using default credentials on a
network device?
a) Weak hashing algorithms
b) Ease of brute-force attacks
c) Unauthorized access by attackers
d) Loss of data integrity
3
, Correct Answer: c) Unauthorized access by attackers
Rationale: Default usernames/passwords are widely known and
published. Attackers can use them to gain immediate administrative
access to devices.
7. A security policy that states “all HTTP traffic must be
blocked except for the proxy server” is an example of what?
a) Default-deny principle
b) Principle of least privilege
c) Separation of duties
d) Defense in depth
Correct Answer: a) Default-deny principle
Rationale: Default-deny means all traffic is blocked unless explicitly
allowed. Here, only the proxy server is allowed HTTP, everything
else is denied.
8. Which attack involves sending unsolicited messages to a
large number of people hoping a few will click malicious
links?
a) Whaling
b) Spear phishing
c) Spam phishing
d) Vishing
4
