HomeSubjectsUniversityBlogAbout

Security Fundamentals

Topic in Cyber Security

210 total MCQsShowing 30 with explanations10 Easy10 Medium10 Hard
Start Timed Quiz on Security FundamentalsBack to Cyber Security

About This Topic

Security fundamentals are the core principles, led by the CIA triad of confidentiality, integrity and availability, that guide how information is protected. Beyond the triad, questions cover authenticity and non-repudiation, defence in depth, least privilege, separation of duties and fail-safe defaults. Formal models get specific attention: Bell-LaPadula for confidentiality, Biba for integrity, and Clark-Wilson with its well-formed transactions and certified procedures. You should compare discretionary, mandatory and role-based access control, explain data classification levels, and know the basic difference between symmetric and asymmetric encryption. Organizational topics such as security policies, security tokens and the role of a SOC appear too.

Below are 30 practice questions from a pool of 210 Security Fundamentals MCQs, one of 16 topics in Cyber Security. Each shows the correct answer with an explanation; when you are ready, take a timed quiz to test recall under exam conditions.

Practice Questions

Each question below shows the correct answer with a full explanation. Use these to build conceptual understanding before attempting a timed quiz.

Security FundamentalsEasy

Q1. What does confidentiality mean in information security?

  1. A.Data is regularly backed up to remote locations
  2. B.Data is continuously available to all authorized users
  3. C.Data is only accessible to authorized individuals✓ Correct
  4. D.Data remains unmodified and accurately preserved

Explanation

Confidentiality ensures that information is accessible only to those authorized to have access.

Report an error in this question

Security FundamentalsEasy

Q2. What does integrity mean in information security?

  1. A.Data remains accurate and unaltered during storage and transmission✓ Correct
  2. B.Data is available 24/7 within enterprise security environments
  3. C.Data is deleted after use within enterprise security environments
  4. D.Data is always encrypted regardless of the specific situation or context

Explanation

Integrity ensures that data remains accurate, complete, and unmodified except by authorized users.

Report an error in this question

Security FundamentalsEasy

Q3. What does availability mean in the CIA triad?

  1. A.Data can be accessed by anyone in security contexts
  2. B.Data is encrypted within enterprise security environments
  3. C.Data is stored in the cloud within enterprise security environments
  4. D.Authorized users can access data and resources when needed✓ Correct

Explanation

Availability ensures that information and resources are accessible to authorized users when needed.

Report an error in this question

Security FundamentalsEasy

Q4. Which of the following is a strong password practice?

  1. A.Using password123 within enterprise security environments
  2. B.Using your name as password within enterprise security environments
  3. C.Using a mix of uppercase, lowercase, numbers, and special characters✓ Correct
  4. D.Using the same password for all accounts

Explanation

A strong password uses a combination of uppercase and lowercase letters, numbers, and special characters.

Report an error in this question

Security FundamentalsEasy

Q5. What is encryption?

  1. A.Deleting files permanently within enterprise security environments
  2. B.Converting data into a coded format to prevent unauthorized access✓ Correct
  3. C.Compressing files to save space within enterprise security environments
  4. D.Backing up data to cloud within enterprise security environments

Explanation

Encryption is the process of converting plaintext data into ciphertext using an algorithm and key to prevent unauthorized access.

Report an error in this question

Security FundamentalsEasy

Q6. What is the purpose of a backup?

  1. A.To encrypt files using established cryptographic standards
  2. B.To speed up computer processing performance speed
  3. C.To delete unnecessary files within the data management framework
  4. D.To create a copy of data for recovery in case of data loss✓ Correct

Explanation

A backup is a copy of data stored separately so it can be restored in case of data loss, corruption, or disaster.

Report an error in this question

Security FundamentalsEasy

Q7. Which of the following is a type of security control?

  1. A.Gaming control
  2. B.Preventive control✓ Correct
  3. C.Marketing control
  4. D.Advertising control

Explanation

Preventive controls are security measures designed to prevent security incidents from occurring, such as firewalls and access controls.

Report an error in this question

Security FundamentalsEasy

Q8. What is authentication?

  1. A.Verifying the identity of a user or system✓ Correct
  2. B.Applying cryptographic ciphers to protect data
  3. C.Compressing files to reduce disk storage consumption
  4. D.Architecting and building responsive web applications

Explanation

Authentication is the process of verifying the identity of a user, device, or system before granting access.

Report an error in this question

Security FundamentalsEasy

Q9. What does a password manager do?

  1. A.Attempts to crack and compromise stored passwords
  2. B.Broadcasts and shares passwords on public platforms
  3. C.Permanently removes and erases stored passwords
  4. D.Securely stores and manages passwords for various accounts✓ Correct

Explanation

A password manager securely stores, generates, and manages passwords for multiple accounts.

Report an error in this question

Security FundamentalsEasy

Q10. Which is an example of 'something you know' in authentication?

  1. A.Smart card
  2. B.Retina scan
  3. C.Password✓ Correct
  4. D.Fingerprint

Explanation

A password is an example of a knowledge factor (something you know) in authentication.

Report an error in this question

Security FundamentalsMedium

Q11. What is the difference between symmetric and asymmetric encryption?

  1. A.Symmetric uses two keys, asymmetric uses one across computing environments
  2. B.There is no difference in any deployment scenario or context
  3. C.Symmetric is always stronger regardless of the specific situation or context
  4. D.Symmetric uses one key for both encryption and decryption, asymmetric uses a key pair✓ Correct

Explanation

Symmetric encryption uses a single shared key, while asymmetric encryption uses a public-private key pair.

Report an error in this question

Security FundamentalsMedium

Q12. What is a hash function used for in security?

  1. A.Applying symmetric ciphers for secure data transfer
  2. B.Generating a fixed-size output from input data for integrity verification✓ Correct
  3. C.Generating redundant backup copies of system data
  4. D.Compressing files to reduce disk storage consumption

Explanation

A hash function produces a fixed-size digest from input data, used to verify data integrity.

Report an error in this question

Security FundamentalsMedium

Q13. Which is an example of a detective security control?

  1. A.Intrusion Detection System (IDS)✓ Correct
  2. B.Firewall within enterprise security environments
  3. C.Data-at-rest symmetric encryption
  4. D.Access control list in security contexts

Explanation

An IDS is a detective control that monitors network traffic for suspicious activity and alerts administrators.

Report an error in this question

Security FundamentalsMedium

Q14. What is the purpose of an access control list (ACL)?

  1. A.To define which users or systems are granted access to specific resources✓ Correct
  2. B.To encrypt data using symmetric cipher algorithms
  3. C.To compress files for reducing disk storage consumption
  4. D.To generate comprehensive network topology diagrams

Explanation

An ACL specifies which users or system processes are granted access to objects and what operations are allowed.

Report an error in this question

Security FundamentalsMedium

Q15. What is the difference between identification and authentication?

  1. A.Neither is used in security within enterprise security environments
  2. B.They are fundamentally the same thing in security
  3. C.Identification claims an identity, authentication proves it✓ Correct
  4. D.Authentication comes before identification

Explanation

Identification is claiming an identity (e.g., entering a username), while authentication is proving that identity (e.g., entering the correct password).

Report an error in this question

Security FundamentalsMedium

Q16. What is a security token in authentication?

  1. A.A backup device for managing enterprise data resources
  2. B.A physical or digital device that generates one-time passwords for authentication✓ Correct
  3. C.A network firewall rule for filtering inbound traffic
  4. D.A software application used for enterprise computing operations

Explanation

A security token generates time-based or event-based one-time passwords as a second factor of authentication.

Report an error in this question

Security FundamentalsMedium

Q17. What is the purpose of security auditing?

  1. A.To deploy and install application software across enterprise computing systems
  2. B.To architect and design new information systems and management
  3. C.To increase available bandwidth for improved download speeds
  4. D.To systematically evaluate the security of a system by testing against established criteria✓ Correct

Explanation

Security auditing involves systematically evaluating an organization's security posture against policies, standards, and best practices.

Report an error in this question

Security FundamentalsMedium

Q18. Which security principle involves dividing critical tasks among multiple people?

  1. A.Need to know
  2. B.Least privilege
  3. C.Defense in depth
  4. D.Separation of duties✓ Correct

Explanation

Separation of duties divides critical tasks among multiple people to prevent fraud and errors.

Report an error in this question

Security FundamentalsMedium

Q19. What is a security baseline?

  1. A.A next-generation firewall security appliance
  2. B.A backup schedule for creating regular recovery snapshots
  3. C.The fastest network speed within enterprise security environments
  4. D.A minimum set of security controls required for a system✓ Correct

Explanation

A security baseline is a set of minimum security standards that must be applied to systems to ensure consistent protection.

Report an error in this question

Security FundamentalsMedium

Q20. What type of attack targets the availability component of the CIA triad?

  1. A.Network eavesdropping attack
  2. B.Denial of Service (DoS)✓ Correct
  3. C.Spear phishing email attack
  4. D.Credential data theft attack

Explanation

A DoS attack targets availability by overwhelming a system with traffic, making it unavailable to legitimate users.

Report an error in this question

Security FundamentalsHard

Q21. What is the Bell-LaPadula security model primarily designed to protect?

  1. A.Confidentiality✓ Correct
  2. B.Non-repudiation
  3. C.Integrity
  4. D.Availability

Explanation

The Bell-LaPadula model enforces confidentiality through 'no read up, no write down' rules for access control.

Report an error in this question

Security FundamentalsHard

Q22. Which security model uses 'no read down, no write up' to protect integrity?

  1. A.Brewer-Nash
  2. B.Clark-Wilson
  3. C.Biba Model✓ Correct
  4. D.Bell-LaPadula

Explanation

The Biba model protects data integrity using the rules: no read down (simple integrity) and no write up (star integrity property).

Report an error in this question

Security FundamentalsHard

Q23. What is the Clark-Wilson integrity model based on?

  1. A.Discretionary access control in security contexts
  2. B.Mandatory access control within enterprise security environments
  3. C.Well-formed transactions and separation of duties✓ Correct
  4. D.Role-based access control in security contexts

Explanation

The Clark-Wilson model enforces integrity through well-formed transactions and separation of duties.

Report an error in this question

Security FundamentalsHard

Q24. In security, what is a 'rainbow table'?

  1. A.A precomputed table for reversing cryptographic hash functions✓ Correct
  2. B.A type of firewall configuration for security management
  3. C.A network topology map used in enterprise network infrastructure
  4. D.A colorful network diagram used in enterprise network infrastructure

Explanation

A rainbow table is a precomputed table of hash values used to reverse cryptographic hash functions, typically for cracking password hashes.

Report an error in this question

Security FundamentalsHard

Q25. What is the purpose of 'salting' in password hashing?

  1. A.Making passwords taste better within enterprise security environments
  2. B.Compressing the password within enterprise security environments
  3. C.Adding random data to the password before hashing to prevent rainbow table attacks✓ Correct
  4. D.Encrypting the password twice within enterprise security environments

Explanation

Salting adds random data to a password before hashing, ensuring identical passwords produce different hashes.

Report an error in this question

Security FundamentalsHard

Q26. What is the Kerckhoffs principle in cryptography?

  1. A.Encryption is unnecessary within enterprise security environments
  2. B.A system should be secure even if everything except the key is public knowledge✓ Correct
  3. C.Keys should be shared publicly within enterprise security environments
  4. D.All algorithms should be secret regardless of the specific situation or context

Explanation

Kerckhoffs' principle states that a cryptographic system should be secure even if everything about the system is public knowledge, except the key.

Report an error in this question

Security FundamentalsHard

Q27. What is the difference between DAC and MAC access control models?

  1. A.MAC allows users to share freely within enterprise security environments
  2. B.DAC allows owners to set permissions, MAC enforces system-wide policies based on classification labels✓ Correct
  3. C.They are fundamentally identical concepts with no meaningful differences
  4. D.DAC is more restrictive than MAC within enterprise security environments

Explanation

DAC lets resource owners determine access, while MAC uses system-enforced policies based on security labels, making MAC more restrictive.

Report an error in this question

Security FundamentalsHard

Q28. Which describes 'security through obscurity'?

  1. A.Relying on secrecy of implementation rather than sound design for security✓ Correct
  2. B.Implementing zero trust within enterprise security environments
  3. C.Using strong encryption within enterprise security environments
  4. D.Using multiple firewalls within enterprise security environments

Explanation

Security through obscurity relies on keeping implementation secret rather than using fundamentally sound security practices. It is generally considered weak.

Report an error in this question

Security FundamentalsHard

Q29. What is a Common Vulnerability Scoring System (CVSS)?

  1. A.A cryptographic algorithm used for protecting sensitive data
  2. B.A standard network communication protocol for data transfer
  3. C.A type of malware scanner designed for compromising system integrity
  4. D.A standardized framework for rating the severity of security vulnerabilities✓ Correct

Explanation

CVSS is an open framework for communicating the severity of software vulnerabilities using a numerical score from 0.0 to 10.0.

Report an error in this question

Security FundamentalsHard

Q30. What does TCB (Trusted Computing Base) refer to?

  1. A.An automated backup solution designed for enterprise-level data recovery and restoration
  2. B.A physical network cable used for connecting devices within the network infrastructure
  3. C.The totality of protection mechanisms within a computer system responsible for enforcing security policy✓ Correct
  4. D.A cloud computing platform used for hosting and managing distributed enterprise workloads

Explanation

The TCB encompasses all hardware, firmware, and software components critical to security, responsible for enforcing the system's security policy.

Report an error in this question

More Cyber Security Topics

Introduction to Cyber Security

Practice MCQs with explanations

Cryptography

Practice MCQs with explanations

Network Security

Practice MCQs with explanations

OS Security

Practice MCQs with explanations

Web Security

Practice MCQs with explanations

Malware & Attacks

Practice MCQs with explanations

Ready to test yourself on Security Fundamentals?

Take a timed quiz drawn from 210+ questions on this topic. No signup required — your progress saves in your browser.

Start Security Fundamentals Quiz