NSE 1 Practice Exam — Information Security Awareness

A. A virus requires a host file to spread; a worm can self-propagate across networks without one B. A worm requires a host file; a virus does not C. Viruses only spread by email; worms only spread by USB drive D. There is no meaningful difference between the two

Correct: A

Viruses attach to and depend on a host program to spread, whereas worms are standalone programs that replicate and spread across networks on their own.

A. Software that displays unwanted advertisements B. Malware that encrypts a victim's files and demands payment for the decryption key C. A tool used to test password strength D. A rule configured on a firewall

Correct: B

Ransomware encrypts a victim's data and extorts payment (usually in cryptocurrency) in exchange for the decryption key.

A. A known vulnerability with an available patch that was never applied B. A vulnerability being actively exploited before the vendor has released a fix C. An expired SSL certificate D. A weak password on a shared account

Correct: B

A zero-day is a flaw exploited by attackers before the vendor knows about it or has had "zero days" to produce a fix.

A. Steal login credentials B. Overwhelm a system or network with traffic so legitimate users can't access it C. Encrypt files for ransom D. Install a hidden backdoor for later access

Correct: B

DDoS attacks flood a target with traffic from many sources at once, exhausting its capacity and denying service to legitimate users.

A. A single powerful attack server B. A network of compromised devices controlled remotely to carry out coordinated attacks C. A type of antivirus signature database D. A legitimate cloud computing cluster

Correct: B

A botnet is a collection of malware-infected devices ("bots") an attacker can command remotely, often used for DDoS, spam, or credential-stuffing at scale.

A. They are short, opportunistic, fully automated attacks B. They are prolonged, targeted intrusions where attackers maintain stealthy long-term access C. They only target home users D. They are a category of antivirus software

Correct: B

APTs are characterized by patience and stealth — a well-resourced attacker establishes and maintains covert access over an extended period, usually against a specific target.

A. It disguises itself as legitimate software to trick users into installing it B. It only spreads by physically connecting a USB drive C. It is a defensive tool used by security teams D. It automatically patches vulnerabilities on the host

Correct: A

Named for the mythological horse, a Trojan hides malicious functionality inside something that appears legitimate or useful.

A. A nation-state hacking group B. An employee who intentionally or accidentally exposes sensitive data C. A DDoS botnet D. A zero-day exploit found in the wild

Correct: B

Insider threats come from people who already have legitimate access — the risk can be malicious or purely accidental (e.g. mishandling data).

A. Humans are usually the weakest, most easily manipulated link in the security chain B. Technical systems have no vulnerabilities C. It is illegal to target technical systems D. Humans have no access to sensitive data

Correct: A

Technical controls can be strong while people remain susceptible to manipulation — social engineering exploits trust, urgency, and habit rather than a software flaw.

A. A method of physically breaking into a building B. A fraudulent attempt to obtain sensitive information by posing as a trustworthy source, typically via email C. A type of encryption algorithm D. A network port-scanning technique

Correct: B

Phishing impersonates a trusted sender (a bank, a coworker, IT) to trick the target into revealing credentials or other sensitive data.

A. Spear phishing is a random, mass-sent attack B. Spear phishing is a highly targeted attack customized for a specific individual or organization C. Spear phishing only happens over the phone D. There is no real difference between the two

Correct: B

Spear phishing uses researched, personalized details (name, role, project) to make the lure far more convincing than a generic mass phishing email.

A. Phishing conducted over voice calls B. Phishing conducted only via video conferencing C. A virus that spreads through voicemail systems D. A legitimate identity-verification process

Correct: A

Vishing ("voice phishing") uses phone calls — often spoofed caller ID or a fabricated urgent scenario — to extract information or push the victim into an action.

A. Shoulder surfing B. Tailgating (piggybacking) C. Baiting D. Pretexting

Correct: B

Tailgating is gaining physical access by following an authorized person through a secured door, relying on politeness or inattention rather than a credential.

A. Sending unsolicited advertisements B. Creating a fabricated scenario or false identity to manipulate a victim into divulging information C. Scanning a network for open ports D. Installing a firewall rule

Correct: B

Pretexting builds a believable false context (e.g. "I'm from IT and need to verify your password") to earn enough trust that the victim volunteers information.

A. They make the email load faster B. They pressure the victim into acting quickly without stopping to verify legitimacy C. They are required by email protocol standards D. They improve email deliverability

Correct: B

Urgency short-circuits careful thinking ("your account will be locked in 1 hour") so the victim reacts on impulse instead of pausing to verify.

A. Leaving an infected USB drive somewhere to entice a victim into plugging it in B. Calling someone and pretending to be IT support C. Sending a fake invoice by email D. Physically forcing entry into a building

Correct: A

Baiting dangles something tempting — a "found" USB drive, a free download — that delivers malware once the victim takes it.

A. Click the link immediately to check if it's real B. Reply to the sender asking for confirmation C. Don't click the link; verify the sender through a separate, trusted channel and report it D. Forward it to all colleagues

Correct: C

Replying or engaging confirms the address is live; the safe path is to verify independently (a known number/portal, not links in the email) and report it to security/IT.

A. It's short and easy to remember B. It's long, unique, mixes character types, and isn't reused across accounts C. It's the same across all accounts for consistency D. It contains only your name and birth year

Correct: B

Length and uniqueness matter most — a long, unique passphrase resists both brute-force guessing and credential-stuffing from other breaches.

A. It replaces the need for a password entirely B. It adds an extra verification step so a stolen password alone isn't enough to gain access C. It slows down legitimate logins for no security benefit D. It's only useful for system administrators

Correct: B

MFA requires something beyond "what you know" (a password) — like a code from a device you have — so a leaked password by itself doesn't grant access.

A. Patches often fix known security vulnerabilities that attackers actively exploit B. Updates always add new attack surface C. Patching is optional and has no security relevance D. Only antivirus software needs updating

Correct: A

Unpatched software is one of the most common entry points attackers use, since the vulnerability and often a working exploit are publicly known.

A. Use it freely for banking since it's convenient B. Avoid sensitive transactions, or use a trusted VPN to encrypt the connection C. Public Wi-Fi is always encrypted end-to-end by default D. Turn off your device firewall to improve speed

Correct: B

Open/public networks can be sniffed or spoofed by others on the same network — a VPN tunnels and encrypts your traffic regardless of the local network's trustworthiness.

A. It's purely for organizing files alphabetically B. It ensures data is handled and protected according to its sensitivity level C. It removes the need for access controls D. It only applies to paper documents

Correct: B

Classification tiers let an organization apply proportionate controls — a public marketing PDF and a customer database don't need the same handling.

A. Use it since it's already logged in B. Ignore it — it's not your responsibility C. Lock it or report it, and remind the colleague to lock their screen when stepping away D. Log out and log back in under your own name

Correct: C

An unattended, unlocked session is an open door for anyone nearby — the responsible action is to secure it and reinforce the habit, not exploit or ignore it.

A. It's about office aesthetics only B. It reduces the risk of sensitive information — printed documents, sticky notes with passwords — being seen or taken by unauthorized people C. It has no real impact on data security D. It's only required for compliance paperwork, not real risk reduction

Correct: B

Physical information exposure (a password on a sticky note, a printed report left on a desk) is a real and common leak point, especially in shared or visited spaces.

A. Do nothing since the damage is already done B. Wait to see if anything bad happens before reacting C. Immediately change your password and report the incident to your security/IT team D. Only mention it if someone asks

Correct: C

Fast reporting lets the security team contain the exposure (revoke sessions, watch for misuse) — the sooner it's reported, the smaller the potential blast radius.