Question 1

What is the CIA triad and why is it important in cyber security?

Accepted Answer

The CIA triad stands for Confidentiality, Integrity, and Availability. Confidentiality ensures that data is accessible only to authorised users, often through encryption and access controls. Integrity guarantees that data remains accurate and unaltered, using hashing and checksums. Availability ensures that systems and data are accessible when needed, through redundancy and disaster recovery. This triad is the foundation of all security policies and helps organisations prioritise their security efforts.

Question 2

How do firewalls work and what types are there?

Accepted Answer

Firewalls monitor and control incoming and outgoing network traffic based on predetermined security rules. They act as a barrier between a trusted internal network and untrusted external networks like the internet. Types include packet-filtering firewalls (which inspect packets at the network layer), stateful inspection firewalls (which track the state of active connections), and next-generation firewalls (which combine traditional filtering with application-level inspection and intrusion prevention).

Question 3

What is the difference between symmetric and asymmetric encryption?

Accepted Answer

Symmetric encryption uses the same key for both encryption and decryption, making it fast but requiring secure key exchange. Examples include AES and DES. Asymmetric encryption uses a pair of keys: a public key for encryption and a private key for decryption. It solves the key exchange problem but is slower. Examples include RSA and ECC. In practice, hybrid systems use asymmetric encryption to exchange a symmetric key, then use symmetric encryption for bulk data.

Question 4

What is a vulnerability assessment and how is it different from a penetration test?

Accepted Answer

A vulnerability assessment is an automated scan that identifies potential weaknesses in systems, such as missing patches or misconfigurations. It provides a list of vulnerabilities but does not exploit them. A penetration test (pen test) is a manual, simulated attack that attempts to exploit vulnerabilities to determine if they can be used to gain unauthorised access or cause damage. Pen tests are more thorough and provide a realistic assessment of security posture.

Question 5

What are the key steps in an incident response plan?

Accepted Answer

An incident response plan typically follows six phases: Preparation (establishing policies and tools), Identification (detecting anomalies and confirming an incident), Containment (isolating affected systems to prevent spread), Eradication (removing the threat, e.g., malware), Recovery (restoring systems to normal operation), and Lessons Learned (analysing the incident to improve future response). Each phase is documented to ensure repeatability and compliance.

Question 6

How does social engineering work and what are common examples?

Accepted Answer

Social engineering manipulates people into divulging confidential information or performing actions that compromise security. Common examples include phishing (fraudulent emails that appear legitimate), pretexting (creating a fabricated scenario to obtain information), baiting (offering something enticing like a free USB drive containing malware), and tailgating (following an authorised person into a restricted area). Awareness training and strict verification procedures are key defences.

Server-Side Scripting

Assessment criteria