CPA Quiz: Identify Common Cybersecurity Threats And Vulnerabilities
20 questions · exam conditions
0:00
Identify Common Cybersecurity Threats And VulnerabilitiesQuestion 1 of 20

Which of the following best describes a 'watering hole' attack?

An attacker sends targeted phishing emails to specific individuals in an organization.
An attacker compromises a legitimate website frequently visited by the target group, infecting visitors with malware when they visit the site.
An attacker floods a website with traffic to make it unavailable.
An attacker injects malicious code into a trusted software update.
← Back to quizzes

CPA Quiz

CPA Quiz: Identify Common Cybersecurity Threats And Vulnerabilities

Practice Identify Common Cybersecurity Threats And Vulnerabilities in CPA with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Identify Common Cybersecurity Threats And Vulnerabilities, giving you a quick way to practice the rules, question types, and explanations that matter most for CPA.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

Which of the following best describes a 'watering hole' attack?

  1. An attacker sends targeted phishing emails to specific individuals in an organization.
  2. An attacker compromises a legitimate website frequently visited by the target group, infecting visitors with malware when they visit the site. (correct answer)
  3. An attacker floods a website with traffic to make it unavailable.
  4. An attacker injects malicious code into a trusted software update.
Explanation: A watering hole attack compromises websites that the target group is known to visit, turning a trusted resource into a malware delivery mechanism. Answer B is correct. Targeted emails (A) describe spear phishing. Traffic flooding (C) describes DDoS. Software update injection (D) describes supply chain attacks.

Question 2

An attacker sends an email that appears to come from a bank asking users to click a link and 'verify their account.' The link leads to a fake website that captures credentials. This attack is best described as:

  1. Vishing - voice phishing using phone calls.
  2. Smishing - SMS-based phishing.
  3. Phishing - fraudulent email impersonating a trusted entity to steal credentials. (correct answer)
  4. Pharming - redirecting DNS queries to fraudulent websites.
Explanation: Phishing uses fraudulent emails impersonating trusted organizations to trick users into clicking malicious links or providing credentials. Answer C is correct. Vishing (A) uses phone calls. Smishing (B) uses text messages. Pharming (D) manipulates DNS rather than using deceptive emails.

Question 3

A threat actor gains access to an organization's network through a phishing email, moves laterally through the network to reach the financial systems, and exfiltrates customer financial data. Which cybersecurity framework function does the organization's failure to detect the lateral movement primarily relate to?

  1. Identify - the organization failed to identify its assets.
  2. Detect - the organization failed to detect anomalous activity indicating the attacker's lateral movement. (correct answer)
  3. Protect - the organization failed to implement sufficient access controls.
  4. Recover - the organization failed to restore systems after the breach.
Explanation: Failure to detect lateral movement within the network after initial compromise corresponds to the NIST CSF 'Detect' function - anomaly detection, network monitoring, and behavioral analytics should have identified unusual activity. Answer B is correct. Asset identification (A) is Identify. Access controls (C) are Protect. Recovery (D) follows a detected incident.

Question 4

Which of the following is the primary security control that mitigates the risk of credential stuffing attacks?

  1. Requiring passwords to be changed every 90 days.
  2. Implementing a web application firewall.
  3. Multi-factor authentication - which renders stolen username/password combinations from previous breaches unusable without the second factor. (correct answer)
  4. Encrypting all passwords stored in the database.
Explanation: Credential stuffing uses previously breached username/password pairs from other sites. MFA prevents these from being used even if credentials are valid, since the attacker cannot provide the second factor. Answer C is correct. Password rotation (A) doesn't prevent use of stolen credentials. WAF (B) may detect patterns but doesn't stop valid credentials. Password encryption (D) protects the database, not against credential stuffing.

Question 5

An organization discovers that an attacker had persistent access to its network for eight months before being detected. This type of attack is known as:

  1. A ransomware attack that encrypts data over time.
  2. A DDoS attack that gradually degrades system performance.
  3. A phishing attack that persists across multiple email campaigns.
  4. An advanced persistent threat (APT) - a sophisticated, long-duration attack where the attacker maintains stealthy presence to achieve strategic objectives such as data exfiltration. (correct answer)
Explanation: APTs are characterized by persistence, sophistication, and stealth - attackers maintain long-term access to pursue specific objectives without triggering detection. Answer D is correct. Ransomware (A) manifests visibly. DDoS (B) is immediately disruptive. Phishing (C) is a delivery mechanism, not a long-term presence.

Question 6

Which of the following best describes a 'zero-day vulnerability'?

  1. A vulnerability that was discovered and patched more than a year ago.
  2. A vulnerability that only affects systems that have not been updated in the past year.
  3. A vulnerability in systems that have been in service for zero years (brand new systems).
  4. A previously unknown vulnerability that has no available patch, giving defenders zero days to protect themselves before it can be exploited. (correct answer)
Explanation: Zero-day vulnerabilities are unknown to the vendor and have no patch available - attackers can exploit them before any defense can be deployed. Answer D is correct. Patched old vulnerabilities (A), outdated systems (B), and new systems (C) are not the definition of zero-day.

Question 7

An organization's security team receives an alert that a large volume of data is being transferred from an internal server to an external IP address at 2 AM. This behavior is most consistent with which threat?

  1. A DDoS attack originating from the internal server.
  2. A ransomware attack encrypting data on the internal server.
  3. A phishing attack targeting employees via email.
  4. Data exfiltration - an attacker or insider moving sensitive data to an external location, potentially as part of a breach or theft. (correct answer)
Explanation: Large overnight data transfers to external locations are a classic data exfiltration pattern - an attacker or insider copying sensitive data out of the organization. Answer D is correct. DDoS originates from external attacks (A). Ransomware encrypts but doesn't typically transfer data outbound (B). Phishing is an email-based delivery mechanism (C).

Question 8

A company's employees receive emails appearing to be from the CEO asking them to urgently wire transfer funds to an external account. This attack is best described as:

  1. A ransomware attack encrypting company data for payment.
  2. A spear phishing / business email compromise (BEC) attack using impersonation to fraudulently induce financial transfers. (correct answer)
  3. A distributed denial-of-service (DDoS) attack overwhelming the email server.
  4. A man-in-the-middle attack intercepting CEO communications.
Explanation: BEC/spear phishing attacks impersonate executives to trick employees into authorizing fraudulent financial transactions - a major source of financial fraud. Answer B is correct. Ransomware (A) encrypts data. DDoS (C) disrupts availability. MITM (D) intercepts active communications rather than impersonating via email.

Question 9

Ransomware is best described as:

  1. Malware that encrypts a victim's files or systems, rendering them inaccessible, and demands payment (usually cryptocurrency) in exchange for the decryption key. (correct answer)
  2. Software that secretly monitors and transmits user activity to a remote attacker.
  3. A network attack that floods a target with traffic to make it unavailable.
  4. A type of social engineering that tricks users into revealing passwords.
Explanation: Ransomware encrypts data and extorts payment for decryption - one of the most financially damaging cyberthreats to organizations. Answer A is correct. Silent monitoring and data exfiltration (B) describes spyware/RATs. Traffic flooding (C) describes DDoS. Password extraction through deception (D) describes phishing.

Question 10

An attacker intercepts communications between a user and their bank's website, reading and potentially modifying the traffic without either party's knowledge. This is best described as:

  1. A phishing attack.
  2. A man-in-the-middle (MITM) attack. (correct answer)
  3. A denial-of-service attack.
  4. A SQL injection attack.
Explanation: A MITM attack positions the attacker between two communicating parties, enabling interception and potential modification of the traffic without detection. Answer B is correct. Phishing (A) deceives users into revealing credentials. DoS (C) disrupts availability. SQL injection (D) targets databases through application input.

Question 11

Social engineering attacks are most dangerous because they:

  1. Exploit unpatched software vulnerabilities in operating systems.
  2. Are conducted by highly skilled nation-state hackers.
  3. Bypass technical controls by exploiting human psychology - manipulating people rather than systems. (correct answer)
  4. Always result in complete system compromise and data exfiltration.
Explanation: Social engineering targets the human element - the weakest link in security - using deception, urgency, or authority to convince people to take actions that compromise security. Technical controls cannot fully prevent socially engineered attacks. Answer C is correct. Software vulnerabilities (A) and nation-state actors (B) describe technical attacks. Outcomes vary (D).

Question 12

A distributed denial-of-service (DDoS) attack primarily threatens which element of the CIA triad?

  1. Availability - by overwhelming systems with traffic to make them inaccessible to legitimate users. (correct answer)
  2. Confidentiality - by exposing sensitive data to unauthorized parties.
  3. Integrity - by modifying data in transit between systems.
  4. Authentication - by bypassing login controls to gain unauthorized access.
Explanation: DDoS attacks overwhelm systems with traffic, making them unavailable - directly attacking the availability principle. Answer A is correct. DDoS does not typically expose data (B), modify data (C), or bypass authentication (D).

Question 13

An employee unknowingly installs software that appears to be a legitimate productivity tool but secretly creates a backdoor for attackers to access the corporate network. This malware type is called:

  1. A worm - self-replicating malware that spreads across networks.
  2. Ransomware - malware that encrypts files for extortion.
  3. Adware - software that displays unwanted advertisements.
  4. A Trojan horse - malware disguised as legitimate software that creates unauthorized access. (correct answer)
Explanation: A Trojan horse disguises itself as legitimate software to trick users into installing it, then executes malicious functionality like creating backdoors. Answer D is correct. Worms (A) spread without user action. Ransomware (B) encrypts data. Adware (C) displays ads.

Question 14

Which of the following best describes an 'insider threat' in cybersecurity?

  1. Attacks launched from inside the organization's firewall by external hackers who have breached the perimeter.
  2. Security risks posed by current or former employees, contractors, or partners who misuse their authorized access - whether maliciously or inadvertently. (correct answer)
  3. Threats that originate from internal vulnerability scanning activities.
  4. Threats from employees who are unaware of the organization's security policies.
Explanation: Insider threats come from individuals with authorized access - including malicious insiders (data theft, sabotage), negligent insiders (accidental data disclosure), and compromised insiders (whose credentials are stolen). Answer B is correct. Perimeter-breaching attackers (A) are external threats. Vulnerability scanning (C) is a security activity. Policy unawareness (D) is a training gap, not an insider threat category.

Question 15

Pretexting is a form of social engineering in which an attacker:

  1. Creates a fake website that closely mimics a legitimate one to steal credentials.
  2. Sends mass emails impersonating a trusted organization to harvest login credentials.
  3. Creates a fabricated scenario (pretext) to manipulate a victim into revealing information or taking an action they otherwise wouldn't. (correct answer)
  4. Uses malware to intercept keystrokes and capture passwords.
Explanation: Pretexting involves fabricating a believable story - posing as IT support, an auditor, or a vendor - to manipulate the victim. Answer C is correct. Fake websites (A) describe pharming/website spoofing. Mass credential harvesting emails (B) describe phishing. Keystroke capture (D) describes a keylogger.

Question 16

Which of the following vulnerabilities does cross-site scripting (XSS) exploit?

  1. Unpatched operating system vulnerabilities in web servers.
  2. Weak password policies that allow brute-force attacks on web application accounts.
  3. Misconfigured database permissions allowing unauthorized SQL queries.
  4. Insufficient input validation that allows attackers to inject malicious scripts into web pages viewed by other users. (correct answer)
Explanation: XSS exploits insufficient sanitization of user-supplied input to inject client-side scripts into web pages - scripts that execute in other users' browsers, potentially stealing session tokens or performing actions on their behalf. Answer D is correct. OS vulnerabilities (A), brute-force (B), and SQL permissions (C) are different vulnerability types.

Question 17

Which of the following best describes a 'supply chain attack' in cybersecurity?

  1. An attack that compromises a trusted vendor or software update to deliver malware to the vendor's customers - targeting organizations indirectly through their trusted supply chain. (correct answer)
  2. An attack that disrupts an organization's physical supply chain operations.
  3. An attack targeting an organization's procurement system to manipulate purchase orders.
  4. Social engineering of supply chain employees to gain physical access to warehouses.
Explanation: Supply chain attacks compromise trusted software, hardware, or service providers to reach a broader set of targets - exemplified by the SolarWinds attack where malware was distributed through a software update. Answer A is correct. Physical supply chain disruption (B), procurement system attacks (C), and physical access attacks (D) are different threat scenarios.

Question 18

Which of the following technical controls most effectively reduces the risk of SQL injection attacks?

  1. Encrypting all data stored in the database.
  2. Implementing multi-factor authentication for database users.
  3. Using parameterized queries or prepared statements that separate SQL code from user-supplied input data. (correct answer)
  4. Restricting database access to read-only for web application accounts.
Explanation: Parameterized queries prevent SQL injection by treating user input as data rather than executable code - the most effective prevention technique. Answer C is correct. Encryption (A) protects stored data but doesn't prevent injection. MFA (B) controls access but not injection. Read-only access (D) reduces damage but doesn't prevent all injection attacks.

Question 19

A company implements a vulnerability management program that includes regular scanning, prioritization by severity, and patch deployment within defined SLAs. The primary purpose of this program is to:

  1. Detect and respond to active cyberattacks in real time.
  2. Systematically identify and remediate known security weaknesses before they can be exploited by attackers. (correct answer)
  3. Train employees to recognize and report phishing attempts.
  4. Monitor network traffic for anomalous patterns indicating a breach.
Explanation: Vulnerability management proactively identifies and fixes security weaknesses - reducing the attack surface before adversaries can exploit known vulnerabilities. Answer B is correct. Real-time attack detection (A) is security monitoring. Phishing training (C) is security awareness. Traffic monitoring (D) is detection/SOC function.

Question 20

Which of the following vulnerabilities is most commonly exploited in ransomware attacks?

  1. Unpatched software vulnerabilities, weak remote access controls (RDP), and phishing emails delivering malicious attachments. (correct answer)
  2. Misconfigured database permissions allowing unauthorized SQL queries.
  3. Weak data classification policies leaving sensitive data unprotected.
  4. Insufficient logging making it difficult to detect unauthorized access.
Explanation: Ransomware commonly enters through phishing emails, unpatched vulnerabilities, and exposed remote desktop protocol (RDP) ports - making patch management, email security, and remote access controls the primary defenses. Answer A is correct. Database permissions (B), data classification (C), and logging gaps (D) are not primary ransomware entry vectors.