Revision loop
Recall beats rereading
Use short cycles that expose weak spots before the exam.
Attempt
Answer without notes
Check
Compare against the key idea
Correct
Rewrite only what was missing
Repeat
Return after a spaced interval
Cyber security exam questions and answers: a printable revision sheet
Whether you are sitting a college viva, a Security+ practice test, or an internal assessment, the same core questions keep appearing. This sheet collects them with short answers you can actually memorise. Bookmark it, print it, and revise it in the last week before your exam.
unavailable | Reviewed original Verizon DBIR and cybersecurity role skills. The breach dataset does not establish salaries, certification returns, remote-work rates, interview success or readiness timelines for this article. Prior unattributed statistic cards removed; no replacement numerical claim invented.01Attempt
Answer without notes | learn
02Check
Compare your reasoning with the core concept | search
03Correct
Rewrite what was missing; explain the mechanism | laptop
04Repeat
Revisit after a spaced interval | process
Section 1: Core concepts
What is the CIA triad? Confidentiality, Integrity, Availability — the three goals of security. Every control maps back to one of them.
What is the difference between authentication and authorization? Authentication proves who you are; authorization decides what you may do. Login is authentication; file permissions are authorization.
What is a vulnerability, a threat and a risk? A vulnerability is a weakness, a threat is what could exploit it, and risk is the likelihood multiplied by the impact.
What is defense in depth? Layered controls — network, host, application, data — so no single failure is total.
What is the principle of least privilege? Every user and process gets only the access it needs, nothing more. It limits both mistakes and breaches.
Section 2: Attacks and malware
What is phishing? Fraudulent messages that trick people into revealing credentials or installing malware. The most common starting point of real breaches.
Virus vs worm vs trojan? A virus needs a host file and user action; a worm self-propagates across networks; a trojan disguises itself as legitimate software.
What is ransomware? Malware that encrypts victim data and demands payment. Defence: offline backups, segmentation, email filtering, tested recovery.
What is SQL injection? Inserting malicious SQL through input fields to read or modify a database. Prevented with parameterised queries and input validation.
What is XSS? Injecting scripts into pages other users view, to steal sessions or act as them. Prevented with output encoding and content security policy.
What is a DDoS attack? Overwhelming a service with traffic from many sources. Mitigated with scrubbing services, rate limiting and CDN absorption.
Section 3: Network security
What is a firewall? A system that filters traffic by rules. Stateful firewalls track connections; next-generation firewalls add application awareness and IPS.
What is a DMZ? A buffer network between the internet and the internal network, hosting public-facing servers so a compromise there does not reach inside.
What is a VPN? An encrypted tunnel over a public network. Site-to-site links offices; remote-access connects individual users.
TCP vs UDP? TCP is connection-oriented and reliable (web, email); UDP is connectionless and fast (DNS, streaming, VoIP).
What is IDS vs IPS? IDS detects and alerts; IPS sits inline and blocks. Same detection logic, different position.
Section 4: Cryptography
Symmetric vs asymmetric encryption? Symmetric uses one shared key and is fast (AES); asymmetric uses a public-private key pair and solves key exchange (RSA, ECC). Real systems use both: asymmetric to exchange a symmetric session key.
What is hashing? A one-way function producing a fixed fingerprint. Used for password storage (with salting) and integrity checks — not reversible like encryption.
What is a digital signature? A hash encrypted with a private key — proves who signed and that the content was not altered.
What is TLS? The protocol that encrypts web traffic (HTTPS): certificate-based authentication, key exchange, then symmetric encryption for the session.
Section 5: Security operations
What is a SIEM? A platform that collects logs from across the environment, correlates them into alerts, and supports investigation and compliance reporting.
What is an incident response plan? A documented process: preparation, detection, containment, eradication, recovery, and lessons learned.
What is a penetration test? An authorised, scoped simulation of an attack to find exploitable weaknesses before criminals do.
What is social engineering? Manipulating people rather than systems — phishing, pretexting, tailgating. Countered with awareness training and verification procedures.
How to use this sheet
- Cover the answers and say each one out loud — exams and vivas test recall, not recognition.
- Mark the ones you stumble on; revise only those tomorrow.
- For interview-style practice where you must speak these answers, try the free AI mock interview — it asks five questions by voice and scores your spoken answers.
Want the interview versions of these questions with longer model answers? See cyber security interview questions and answers and the complete Q&A bank.
Preparation map: recall to reasoning
Concept | Explain the mechanism; distinguish related terms | learn
Example | Use a real authorised lab; identify evidence | laptop
Decision | State what you would check first and why | search
Limit | Identify missing context; avoid overstating certainty | shield
Delivery | Answer in a clear sequence; pause before details | user
Review | Record gaps; practise corrected answers; revisit later | database